WO2016074502A1

WO2016074502A1 - Method and device for implementing virtual firewall

Info

Publication number: WO2016074502A1
Application number: PCT/CN2015/085627
Authority: WO
Inventors: 王煜
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-11
Filing date: 2015-07-30
Publication date: 2016-05-19
Also published as: CN105577628B; CN105577628A

Abstract

Disclosed is a method for implementing a virtual firewall. The method comprises: acquiring an identifier of a virtual firewall instance according to received first information of a data traffic; searching for a configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and searching for an ACL rule set according to packet information of the data traffic; and generating a session entry according to the data traffic, the configuration parameter of the virtual firewall and the ACL rule set, and storing a related security service parameter of a session in the data traffic into the session entry. Also disclosed is a device for implementing a virtual firewall. In this way, a physical firewall can be divided into multiple logical firewalls for use, each logical firewall can separately apply for separate resources; in addition, defects of deployment of a conventional firewall are overcome, and separate security service policies can be provided to different users at the same time on the premise that maintenance and management costs are greatly reduced.

Description

Method and device for realizing virtual firewall

Technical field

The present invention relates to the field of network security, and in particular, to a method and apparatus for implementing a virtual firewall.

Background technique

In a traditional solution, when the system requires multiple sets of firewall protection, it is common to deploy multiple firewalls for protection. The traditional method is to deploy a firewall in front of the CE device for management and configuration. For example, in the MPLS VPN network, security protection needs to be performed between VPNs. The traditional solution has obvious shortcomings:

Enterprises need to deploy and manage multiple independent firewalls, resulting in higher cost of ownership and maintenance, and greater complexity of network management. Multiple independent firewalls placed in a centralized manner will occupy more rack space and bring additional wiring to the integrated wiring. Complexity; due to the development of services, MPLS VPN or VLAN division may undergo new changes. MPLS VPN or VLAN is a logical implementation. It is convenient to meet this requirement only by changing the configuration. However, traditional firewalls need to undergo physical changes, which poses great difficulties for users' spare parts and management.

Summary of the invention

The embodiments of the present invention provide a method and an apparatus for implementing a virtual firewall. The main purpose of the present invention is to solve the technical problem of implementing multiple virtual firewall instances on a single hardware platform.

To achieve the above object, a method for implementing a virtual firewall is provided by an embodiment of the present invention, where the method includes:

Obtaining an identifier of the virtual firewall instance according to the first information of the received data traffic;

In the case that the session entry matching the data traffic cannot be found according to the second information of the data traffic, the configuration parameter of the virtual firewall is searched according to the identifier of the virtual firewall instance, and according to the data traffic. Packet information to find an ACL rule group;

Generating a session entry according to the data traffic, the configuration parameter of the virtual firewall, and the ACL rule group, and saving related security service parameters of the session in the data traffic in the session entry.

Preferably, the first information includes at least a quintuple, VLAN information, or IP information in the packet of the data traffic; and the second information includes at least a quintuple in the packet of the data traffic.

Preferably, the obtaining the identifier of the virtual firewall instance according to the first information of the received data traffic includes:

Determining whether the identifier of the virtual firewall instance is obtained according to the interface information of the data traffic and the pre-stored interface mapping table, where the interface mapping table includes interface information of the data traffic and an identifier of the virtual firewall instance. If the configuration is performed, the configuration parameter of the virtual firewall is searched according to the identifier of the virtual firewall instance, and the ACL rule group is searched according to the packet information of the data traffic.

Preferably, if the configuration is performed, the configuration parameter of the virtual firewall is searched according to the identifier of the virtual firewall instance, and after the ACL rule group is searched according to the packet information of the data traffic, the method further includes:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic and the pre-stored VLAN mapping table, where the first packet information includes at least VLAN information, the VLAN The mapping table includes a mapping between the VLAN information of the data traffic and the identifier of the virtual firewall instance; if yes, performing configuration to search for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and according to the data The packet information of the traffic is searched for the ACL rule group.

If not, determining whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic, the first VPN mapping table that is pre-stored, and the second VPN mapping table that is stored in advance. The message information includes at least the VLAN information, the first VPN mapping table includes a correspondence between the VLAN information and the VPN information, and the second VPN mapping table includes the information between the VPN information and the identifier of the virtual firewall instance. Corresponding relationship; if yes, performing a search for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and searching for an ACL rule group according to the packet information of the data traffic;

Preferably, if the configuration is performed, the configuration parameter of the virtual firewall is searched according to the identifier of the virtual firewall instance, and after the ACL rule group is searched according to the packet information of the data traffic, Also includes:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the second packet information of the data traffic and the pre-stored IP mapping table, where the second packet information includes at least an IP address. The IP mapping table includes a correspondence between the IP address and the identifier of the virtual firewall instance obtained by the HASH operation of the IP address; if yes, performing a search for the virtual firewall according to the identifier of the virtual firewall instance. Configure the parameters and find the ACL rule group based on the packet information of the data traffic.

Preferably, after obtaining the identifier of the virtual firewall instance according to the first information of the received data traffic, the method includes:

Searching, according to the second information, a session entry that matches the data traffic;

And searching, according to the second information, a session entry that matches the data traffic, including:

Performing a HASH operation on the second information to obtain a value H, where a low N bit of the value H is used to search an index of a CAM table, and a high N bit of the value H is used to search for an identifier of the CAM table;

If the CAM table is matched with the pre-stored CAM table, the content of the matched CAM table is obtained, and the content is matched with the second information according to the content, and if they are the same, it is determined that the second information can be searched according to the second information. The session entry that matches the data traffic; if not, determining that the session entry matching the data traffic cannot be found according to the second information;

If it is unable to match the pre-stored CAM table, it is determined that the session entry matching the data traffic cannot be found according to the second information.

Preferably, the method further includes:

When the virtual firewall instance VFWv is created, the resource object in the total resource queue QA in the total resource pool PA is first dequeued, and then the queue operation is performed to the resource queue Qv.

When the virtual firewall instance VFWv is deleted, the resource object in the resource queue Qv in the resource pool Pv is first dequeued, and then the queue operation is performed to the resource total queue QA;

The Qv is a queue or a stack of each type of the resource pool of the virtual firewall instance; the QA is a resource corresponding to each type of the resource pool of the virtual firewall instance; The total resource pool of the virtual firewall instance; the Pv is a resource in a resource pool corresponding to the virtual firewall instance VFWv.

In addition, in order to achieve the above object, an embodiment of the present invention further provides an apparatus for implementing a virtual firewall, where the apparatus includes:

An obtaining unit, configured to obtain an identifier of the virtual firewall instance according to the first information of the received data traffic;

The first searching unit is configured to search for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, if the session entry that matches the data traffic cannot be found according to the second information of the data traffic. And searching for an ACL rule group according to the packet information of the data traffic;

a generating unit, configured to generate a session entry according to the data traffic, the configuration parameter of the virtual firewall, and the ACL rule group, and save related security service parameters of the session in the data traffic in the session entry in.

Preferably, the obtaining unit is configured to:

Preferably, the obtaining unit is further configured to:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic, the first VPN mapping table that is pre-stored, and the second VPN mapping table that is stored in advance. The message information includes at least the VLAN information, the first VPN mapping table includes a correspondence between the VLAN information and the VPN information, and the second VPN mapping table includes the information between the VPN information and the identifier of the virtual firewall instance. Correspondence relationship; if yes, execute according to the The identifier of the virtual firewall instance is used to find the configuration parameter of the virtual firewall, and the ACL rule group is searched according to the packet information of the data traffic.

Preferably, the obtaining unit is further configured to:

Preferably, the device further comprises a second searching unit, which is configured to:

The second search unit is configured to:

Preferably, the device further comprises:

Create a unit, and set the resource object in the total resource queue QA of the total resource pool PA to perform the dequeue operation first, and then enter the queue operation to the resource queue Qv.

The deleting unit is configured to perform the dequeuing operation on the resource object in the resource queue Qv in the resource pool Pv before deleting the virtual firewall instance VFWv, and then re-enter the operation to the resource total queue QA;

In this embodiment, the virtual firewall instance is obtained by using the first information of the received data traffic. And determining, in the case that the session entry that matches the data traffic is not found, according to the second information of the data traffic, searching for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and according to the The packet information of the data traffic is searched for the ACL rule group; the session entry is generated according to the data traffic, the configuration parameter of the virtual firewall, and the ACL rule group, and the related security service parameters of the session in the data traffic are saved. In the session entry, the physical firewall can be divided into multiple logical firewalls, and each logical firewall can independently apply for resources and configure different security policies to meet different security requirements of users. At the same time, the embodiment of the invention provides a method for implementing multiple virtual firewall instances on a single hardware platform, which solves the defects of the traditional firewall deployment. It can provide independent security service policies for different users while greatly reducing maintenance and management costs.

DRAWINGS

1 is a schematic flowchart of a first embodiment of a method for implementing a virtual firewall according to the present invention;

2 is a schematic flowchart of a second embodiment of a method for implementing a virtual firewall according to the present invention;

3 is a schematic flowchart of a third embodiment of a method for implementing a virtual firewall according to the present invention;

4 is a schematic flowchart of a fourth embodiment of a method for implementing a virtual firewall according to the present invention;

5 is a schematic diagram of functional modules of a first embodiment of an apparatus for implementing a virtual firewall according to the present invention;

6 is a schematic diagram of functional modules of a second embodiment of an apparatus for implementing a virtual firewall according to the present invention;

7 is a schematic diagram of functional modules of a third embodiment of an apparatus for implementing a virtual firewall according to the present invention;

FIG. 8 is a schematic diagram of functional modules of a fourth embodiment of an apparatus for implementing a virtual firewall according to the present invention.

The implementation, functional features, and advantages of the present invention will be further described in conjunction with the embodiments.

detailed description

It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

Embodiments of the present invention provide a method for implementing a virtual firewall.

Referring to FIG. 1, FIG. 1 is a schematic flowchart of a first embodiment of a method for implementing a virtual firewall according to the present invention.

In the first embodiment, the method for implementing a virtual firewall includes:

Step 101: Acquire an identifier of the virtual firewall instance according to the first information of the received data traffic.

The first information includes at least a quintuple, a virtual local area network (VLAN) information, or an Internet Protocol (IP) information in the packet of the data traffic.

Preferably, the identifier of the virtual firewall instance is obtained according to the first information of the received data traffic, including:

And determining, according to the interface information of the data traffic and the pre-stored interface mapping table, the identifier of the virtual firewall instance, where the interface mapping table includes the correspondence between the interface information of the data traffic and the identifier of the virtual firewall instance; if yes, performing the The ID of the virtual firewall instance is used to find the configuration parameters of the virtual firewall, and the access control list (ACL) rule group is searched according to the packet information of the data traffic.

If not, it is determined whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic and the pre-stored VLAN mapping table. The first packet information includes at least VLAN information, and the VLAN mapping table includes VLAN information of the data traffic. The mapping between the virtual firewall instance and the identifier of the virtual firewall instance; if yes, the configuration of the virtual firewall is performed according to the identifier of the virtual firewall instance, and the ACL rule group is searched according to the packet information of the data traffic;

If yes, it is determined whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic, the first VPN mapping table that is pre-stored, and the second VPN mapping table that is pre-stored. The first packet information includes at least a VLAN. Information, the first virtual private network (Virtual Private Network, the VPN mapping table includes the correspondence between the VLAN information and the VPN information, and the second VPN mapping table includes the correspondence between the VPN information and the identifier of the virtual firewall instance; if yes, the execution basis The ID of the virtual firewall instance is used to find the configuration parameters of the virtual firewall, and the ACL rule group is searched according to the packet information of the data traffic.

If not, it is determined whether the identifier of the virtual firewall instance is obtained according to the second packet information of the data traffic and the pre-stored IP mapping table, where the second packet information includes at least an IP address, and the IP mapping table includes an IP address and an IP address. The mapping between the identifiers of the virtual firewall instances obtained by the HASH operation; if yes, the configuration parameters of the virtual firewall are searched according to the identifier of the virtual firewall instance, and the ACL rule group is searched according to the packet information of the data traffic.

Optionally, after the system is powered on, first, the shunt module is started, that is, the mapping table is initialized; then, the session management module is started, that is, the session table is initialized; then, the resource pool module is started, that is, the system resource queue is initialized; finally, the grading is started. Management module, which initializes the virtual firewall table.

Initialization of the mapping table: refers to the interface mapping table, VPN mapping table, VLAN mapping table, IP The mapping table applies for the corresponding address space and clears the requested space. The linear table, such as the interface mapping table, the VPN mapping table, and the VLAN mapping table, can calculate the size of the address space to be applied according to the number of interfaces actually supported by the system, the number of VPNs, and the number of VLANs; and the IP mapping table is The HASH table applies for the corresponding address space according to the configuration specifications supported by the system. If the IP mapping table requires CAM table support, the corresponding address space is also requested for the CAM table.

Initialization of the session table: refers to requesting the corresponding address space for the session HASH+CAM table, and clearing the requested space.

System resource pool initialization: All resources of the system are respectively enqueued according to the resource type T to the corresponding resource queue QT. That is, the system resource pool PA={QA, QB···QT}.

Virtual firewall instance table initialization: Apply the corresponding address space according to the number of virtual virtual firewall instances supported by the system, and clear the requested space.

The traffic distribution mechanism is to send the data traffic received by the system to the corresponding virtual firewall instance. That is, the interface information of the received data traffic or the packet information of the data traffic (such as the VPN, VLAN, or IP information in the packet) is matched with the configuration information of the virtual firewall instance, and the data traffic is sent to the corresponding virtual firewall instance. The corresponding security service is provided by the virtual firewall instance.

The traffic distribution mechanism is implemented by maintaining an interface mapping table, a VLAN mapping table, a VPN mapping table, and an IP mapping table.

The interface mapping table uses a linear table to store the correspondence between the interface and the virtual firewall instance. The keyword of the table is the interface index (IF-ID), and the result is the index (VFW-ID) of the virtual firewall instance to which the interface belongs.

The VLAN mapping table uses a linear table to store which VPN or virtual firewall instance the VLAN belongs to. The key of the table is the VLAN index (VLAN-ID), and the result is the VPN index (VPN-ID) to which the VLAN belongs or the index (VFW-ID) of the virtual firewall instance.

The VPN mapping table uses a linear table to store the correspondence between the VPN and the virtual firewall instance. The keyword of the table is the VPN index (VPN-ID), and the result is the index (VFW-ID) of the virtual firewall instance to which the VPN belongs.

The IP mapping table uses a HASH table to store the correspondence between the IP address and the virtual firewall. The key of the table is the IP mapping table index (IP-ID) obtained by the HASH operation of the IP address, and the result is the index (VFW-ID) of the virtual firewall instance to which the IP address belongs. Here, when the allowed IP address is configured as a mask address, all IP addresses covered by the mask address are saved to the HASH table. This way There may be insufficient HASH table space due to too many IP addresses. Therefore, in this case, you can consider using the CAM table to save the IP mask address, thus avoiding table space problems and improving the efficiency of IP retrieval.

When the super administrator configures the virtual firewall instance to handle which data traffic, you only need to specify the VFW-ID field in the corresponding interface mapping table, VLAN mapping table, VPN mapping table, and IP mapping table. For example, if the data traffic received by a specific interface IFa (corresponding to IF-ID is a) is sent to the specified virtual firewall instance VFWx (corresponding to VFW-ID is x), the table a of the interface mapping table is processed. The VFW-ID field in the item is set to x. For another example, the data traffic whose destination IP address is a specific IPb is sent to the specified virtual firewall instance VFWy (corresponding to VFW-ID is y) for processing. First, the IPb is HASH-operated to obtain the HASH value b, and then the VFW-ID field in the item b of the IP mapping table is set to y.

When the system is running, the interface mapping table, the VLAN mapping table, the VPN mapping table, and the IP mapping table are respectively searched according to the interface information of the received data traffic or the packet information of the data traffic, and the virtual firewall instance index corresponding to the data traffic is obtained, and then The data traffic is sent to the virtual firewall for subsequent processing. When a certain data traffic matches multiple entries in the interface mapping table, the VLAN mapping table, the VPN mapping table, and the IP mapping table, it is determined according to the priority of the mapping table to determine which virtual firewall instance the data traffic should be sent to. Generally, the interface mapping table has the highest priority, the VLAN mapping table is the second, the VPN mapping table is again, and the IP mapping table has the lowest priority.

Step 102: If the session entry matching the data traffic cannot be found according to the second information of the data traffic, the configuration parameter of the virtual firewall is searched according to the identifier of the virtual firewall instance, and the ACL rule is searched according to the packet information of the data traffic. group;

The second information includes at least a quintuple in the packet of the data traffic.

Optionally, the session management mechanism is that after the virtual firewall instance receives the data traffic, the data traffic is matched with the ACL rule group to generate a corresponding session entry. The virtual firewall instance can provide the security services related to the session state, such as the ASPF and the NAT ALG, according to the related state changes in the session table. It can also provide address binding, blacklist, address translation, statistics, attack defense, etc. according to the statistics of the session table. Security service.

Step 103: Generate a session entry according to the data traffic, the configuration parameters of the virtual firewall, and the ACL rule group, and save the related security service parameters of the session in the data traffic in the session entry.

Optionally, the session management mechanism has the following advantages: after the virtual firewall instance receives the first packet of the session, the configuration parameters in the virtual firewall instance table and the ACL matching the packet are obtained. The rule group automatically generates a session entry and saves the session-related security service parameters in the session table entry. Then, when the virtual firewall instance receives subsequent packets of the session, it does not need to repeatedly search for the virtual firewall instance table or ACL rule group, and directly read the information of the session entry. In this way, the processing efficiency of the subsequent messages of the session can be greatly improved.

Here a "session", also called a "stream", contains the two-direction message that is uniquely determined by the quintuple. For example, the forward packet sent by A to B, that is, the source IP of the packet is IPA, the destination IP is IPB, the source port is PORTA, the destination port is PORTB, the protocol is PROX, and the reverse packet returned by B to A. That is, the source IP of the packet is IPB, the destination IP is IPA, the source port is PORTB, the destination port is PORTA, and the protocol is PROX. The quintuple of the two directions messages is only reversed, and they belong to a session here.

The virtual firewall instance manages its own session resources independently. That is, each virtual firewall instance logically maintains a separate session table (FT). Each entry in the FT table corresponds to a session, and all the information related to the session is saved:

The status information, such as the TCP connection status and the FTP status, can be used to provide an ASPF status tracking service for the session based on the status information, or provide related anti-attack services based on the statistics of the relevant status of all sessions.

The aging information, such as the session creation timestamp and update timestamp, can be used to calculate the remaining aging time of the session based on the timestamp and determine when the session is aged.

Security policy information, such as the session's NAT policy, ACL policy, ASPF policy, and ALG policy, can be used to forward, drop, send, modify, and forward the corresponding protocol fields based on these policy information.

Statistics, such as the number of packets sent and received by the session, can provide session monitoring services for these statistics.

Forwarding information, such as Layer 3 routing information and Layer 2 forwarding information, can provide data traffic forwarding services based on these forwarding information.

When creating a virtual firewall instance, the maximum number of sessions CFT saved in the FT table is specified. Generally, the value of CFT is relatively large, such as 128K. Therefore, the FT table can adopt the secondary search structure of HASH+CAM to improve the search efficiency. The HASH table can store C _HS = 2 ^N entries, each HASH entry corresponds to a CAM table, and each CAM table can store C _CAM strip entries, and each CAM entry corresponds to one session, then

C _FT =C _HS ×C _CAM

After the virtual firewall instance receives the message, it first retrieves the FT table. If the retrieval fails, the virtual firewall instance table and the ACL rule group are searched, and the flow table is established according to the matched security service parameters. If the search is successful, the flow table is taken directly. Then, according to the information in the flow table, the corresponding security policy is executed on the packet.

In this embodiment, the identifier of the virtual firewall instance is obtained according to the first information of the received data traffic; and the session entry matching the data traffic cannot be found according to the second information of the data traffic, according to the identifier of the virtual firewall instance. Find the configuration parameters of the virtual firewall, and find the ACL rule group based on the packet information of the data traffic. Generate the session entry based on the data traffic, the configuration parameters of the virtual firewall, and the ACL rule group, and set the security service parameters of the session in the data traffic. It is stored in the session table, so that it can be used to divide a physical firewall into multiple logical firewalls. Each logical firewall can independently apply for resources and configure different security policies to meet different security requirements of users. At the same time, the present invention provides a method for implementing multiple virtual firewall instances on a single hardware platform, which solves the defects of traditional firewall deployment. It can provide independent security service policies for different users while greatly reducing maintenance and management costs.

Referring to FIG. 2, FIG. 2 is a schematic flowchart diagram of a second embodiment of a method for implementing a virtual firewall according to the present invention.

In the second embodiment, after step 101, the method further includes:

Step 104: Search for a session entry that matches the data traffic according to the second information.

Find a session entry that matches the data traffic according to the second information, including:

Performing a HASH operation on the second information to obtain a value H, a low N bit of the value H is used to search an index of the CAM table, and a high N bit of the value H is used to search for an identifier of the CAM table;

If the CAM table is matched with the pre-stored CAM table, the content of the matched CAM table is obtained, and the content is matched with the second information according to the content. If the content is the same, it is determined that the session entry matching the data traffic can be searched according to the second information; If it is different, it is determined that the session entry matching the data traffic cannot be found according to the second information;

Optionally, first, the quintuple (source IP, destination IP, source port, destination port, protocol) and the VPN index VPN-ID in the packet are subjected to a 128-bit HASH operation to obtain a HASH value H. Then, the 0 to N-1 bits of the value H are taken as the CAM table index IDX _CAM corresponding to the FT entry, and the remaining bits of the value H are searched for the CAM table corresponding to the IDX _CAM . If there is no matching CAM entry, the search fails and the session does not exist in the FT table. If there is a matching CAM entry IDXENTRY, the corresponding session index S-ID is calculated.

S-ID=IDX _CAM ×C _CAM +IDX _ENTRY

Here, because there may be a HASH conflict, after the session entry is fetched, the keyword is also searched for an exact match to confirm whether it is the actual required entry.

Referring to FIG. 3, FIG. 3 is a schematic flowchart diagram of a third embodiment of a method for implementing a virtual firewall according to the present invention.

In the third embodiment, after the step 103 is taken as an example, but not limited to the step 103, the method further includes:

In step 105, when the virtual firewall instance VFWv is created, the resource object in the total resource queue QA in the total resource pool PA is first performed in a dequeuing operation, and then the enqueue operation is performed to the resource queue Qv.

Qv is a queue or stack in each type of the resource pool of the virtual firewall instance; QA is the resource corresponding to each type of the resource pool of the virtual firewall instance; PA is the total resource pool of the virtual firewall instance; Pv is virtual The resource in the resource pool corresponding to the firewall instance VFWv.

Optionally, the resource pool mechanism means that each virtual firewall instance corresponds to a separate resource pool, and the virtual firewall instance only allows operation of resource objects in its own resource pool. That is, the virtual firewall instance is independently responsible for the application, collection, and aging of resource objects in the resource pool. The resource objects herein include, but are not limited to, address resources, security domain resources, service resources, session resources, and the like.

The advantage of using the resource pool is that it can fully utilize the resources of the system and flexibly control the resources occupied by each virtual firewall instance. At the same time, the independent resource pool management also greatly reduces the coupling between the virtual firewall instances and reduces the virtual firewall instance. The interaction between them is easier to use.

Since the total number of resources in the system is limited, the resources allocated to the resource pool of each virtual firewall instance are also limited. For example, the system supports up to 32M sessions and supports up to 256 virtual firewall instances. Each virtual firewall instance can support up to 128K sessions on average.

The resource objects in the resource pool Pv corresponding to the virtual firewall instance VFWv can be separated by type. Management, each type is managed by a queue (or stack) Qv, that is, each resource object of the type corresponds to a member of the Qv. The system resource can be regarded as the largest total resource pool PA, where each type of resource corresponds to a total queue QA.

When the super administrator creates a virtual firewall instance VFWv, it specifies the number of resource objects included in each resource queue Qv in the resource pool Pv, that is, the resources in the total resource queue QA in the total resource pool PA. The object performs the dequeue operation first, and then enters the queue operation to the resource queue Qv. When the super administrator deletes the virtual firewall instance VFWv, the resource objects included in the resource queue Qv in the resource pool Pv are reclaimed, that is, the resource objects in the resource queue Qv in the resource pool Pv are first executed. Perform the enqueue operation to the resource total queue QA.

The virtual firewall administrator requests, recycles, and aging the resource objects in the resource pool Pv, that is, the dequeue, enqueue, and enqueue operations of the resource objects in the corresponding resource queue Qv.

Referring to FIG. 4, FIG. 4 is a schematic flowchart diagram of a fourth embodiment of a method for implementing a virtual firewall according to the present invention.

In the fourth embodiment, after the step 105 is taken as an example, but not limited to after step 105, the method further includes:

Step 106: Configure a first administrator for each virtual firewall instance and a second administrator for the first administrator.

Optionally, the hierarchical management mechanism implements the independent configuration management of the virtual firewall instance by using the secondary management mode, that is, the super administrator creates or deletes the virtual firewall instance and specifies the corresponding virtual firewall administrator; The administrator manages the virtual firewall instance independently.

When a super administrator creates or deletes a virtual firewall instance, the corresponding resource pool is allocated or reclaimed for the virtual firewall instance, that is, the previous Resource Pool module. At the same time, the super administrator also specifies which data traffic is sent or not sent. Into this virtual firewall instance processing. That is, the previous "split" module.

The virtual firewall administrator manages the virtual firewall instance, that is, configures private ACL security rules to manage resource objects in the resource pool according to user security requirements. Here, we maintain a virtual firewall instance table to store configuration information about the virtual firewall instance. The virtual firewall instance table uses a linear table. The keyword of the virtual firewall instance is the index VFW-ID of the virtual firewall instance. The result is the configuration parameters of the virtual firewall instance. For example, the attack defense type and related threshold parameters are enabled in the virtual firewall instance. , or configured blacklist parameters, etc. When the virtual firewall administrator configures the relevant security services, the corresponding fields are updated.

The advantage of hierarchical management is that the super administrator only pays attention to which system resources need to be allocated for the virtual firewall instance, and the management of the virtual firewall instance can be independently responsible by the virtual firewall administrator, making the management of the virtual firewall more flexible and convenient.

The embodiment of the invention further provides an apparatus for implementing a virtual firewall.

Referring to FIG. 5, FIG. 5 is a schematic diagram of functional modules of a first embodiment of an apparatus for implementing a virtual firewall according to the present invention.

In the first embodiment, the device for implementing a virtual firewall includes:

The obtaining unit 501 is configured to obtain an identifier of the virtual firewall instance according to the first information of the received data traffic;

The first information includes at least a quintuple, VLAN information, or IP information in the packet of the data traffic.

Preferably, the obtaining unit 501 is configured to:

And determining, according to the interface information of the data traffic and the pre-stored interface mapping table, the identifier of the virtual firewall instance, where the interface mapping table includes the correspondence between the interface information of the data traffic and the identifier of the virtual firewall instance; if yes, performing the The ID of the virtual firewall instance is used to find the configuration parameters of the virtual firewall, and the ACL rule group is searched according to the packet information of the data traffic.

If yes, it is determined whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic, the first VPN mapping table that is pre-stored, and the second VPN mapping table that is pre-stored. The first packet information includes at least a VLAN. The first VPN mapping table includes a correspondence between the VLAN information and the VPN information, and the second VPN mapping table includes a correspondence between the VPN information and the identifier of the virtual firewall instance; if yes, performing a virtual firewall according to the identifier of the virtual firewall instance Configuration parameters, and find an ACL rule group according to the packet information of the data traffic;

If not, it is determined whether the identifier of the virtual firewall instance is obtained according to the second packet information of the data traffic and the pre-stored IP mapping table, where the second packet information includes at least an IP address, and the IP mapping table includes an IP address and an IP address. The pair between the identifiers of the virtual firewall instances obtained through the HASH operation If yes, the configuration parameters of the virtual firewall are searched based on the identifier of the virtual firewall instance, and the ACL rule group is searched based on the packet information of the data traffic.

The initialization of the mapping table refers to requesting the corresponding address space for the interface mapping table, the VPN mapping table, the VLAN mapping table, and the IP mapping table, and clearing the requested space. The linear table, such as the interface mapping table, the VPN mapping table, and the VLAN mapping table, can calculate the size of the address space to be applied according to the number of interfaces actually supported by the system, the number of VPNs, and the number of VLANs; and the IP mapping table is The HASH table applies for the corresponding address space according to the configuration specifications supported by the system. If the IP mapping table requires CAM table support, the corresponding address space is also requested for the CAM table.

The IP mapping table uses a HASH table to store the correspondence between the IP address and the virtual firewall. The key of the table is the IP mapping table index (IP-ID) obtained by the HASH operation of the IP address, and the result is the index (VFW-ID) of the virtual firewall instance to which the IP address belongs. Here, when the allowed IP address is configured as a mask address, all IP addresses covered by the mask address are saved to the HASH table. This may result in insufficient HASH table space due to too many IP addresses. Therefore, in this case, you can consider using the CAM table to save the IP mask address, thus avoiding table space problems and improving the efficiency of IP retrieval.

The first searching unit 502 is configured to: if the session entry matching the data traffic cannot be found according to the second information of the data traffic, find the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and report the data according to the data traffic The text information is used to find an ACL rule group.

Optionally, the session management mechanism is that after the virtual firewall instance receives the data traffic, the data traffic is matched with the ACL rule group to generate a corresponding session entry. The virtual firewall instance can provide session state-related security services such as ASPF and NAT ALG according to related state changes in the session table. You can also provide security services such as address binding, blacklist, address translation, statistics, and attack defense based on the statistics of the session table.

The generating unit 503 is configured to generate a session entry according to the data traffic, the configuration parameter of the virtual firewall, and the ACL rule group, and save the related security service parameter of the session in the data traffic in the session entry.

Optionally, the session management mechanism has the advantage that after the virtual firewall instance receives the first packet of the session, the session can be automatically generated according to the configuration parameters in the virtual firewall instance table and the ACL rule group matched by the packet. An entry and save the session-related security service parameters in the session table entry. Then, when the virtual firewall instance receives subsequent packets of the session, it does not need to repeatedly search for the virtual firewall instance table or ACL rule group, and directly read the information of the session entry. In this way, the processing efficiency of the subsequent messages of the session can be greatly improved.

When creating a virtual firewall instance, the maximum number of sessions CFT saved in the FT table is specified. Generally, the value of CFT is relatively large, such as 128K. Therefore, the FT table can adopt the secondary search structure of HASH+CAM to improve the search efficiency. The HASH table can store C _HS = 2 ^N entries, and each HASH entry corresponds to a CAM table. Each CAM table can store C _CAM strip entries, and each CAM entry corresponds to one session.

C _FT =C _HS ×C _CAM

FIG. 6 is a schematic diagram of functional modules of a second embodiment of an apparatus for implementing a virtual firewall according to the present invention.

In the second embodiment, the device for implementing the virtual firewall further includes:

The second searching unit 504 is configured to:

Find a session entry that matches the data traffic according to the second information;

The second searching unit 504 is configured to:

FIG. 7 is a schematic diagram of functional modules of a third embodiment of an apparatus for implementing a virtual firewall according to the present invention.

In the third embodiment, the device for implementing the virtual firewall further includes:

The creating unit 505 is configured to perform a dequeuing operation on the resource object in the total resource queue QA in the total resource pool PA, and then enter the resource queue Qv;

The deleting unit 506 is configured to perform the dequeuing operation on the resource object in the resource queue Qv in the resource pool Pv before deleting the virtual firewall instance VFWv, and then re-enter the operation to the resource total queue QA;

The resource objects in the resource pool Pv corresponding to the virtual firewall instance VFWv can be managed separately according to the type. Each type is managed by a queue (or stack) Qv, that is, each resource object of the type corresponds to one member of the Qv. And system resources can be seen as one of the largest total resource pool PA, Each type of resource corresponds to a total queue QA.

In the fourth embodiment, the device for implementing the virtual firewall further includes:

The configuration unit 507 is configured to configure a first administrator for each virtual firewall instance and a second administrator for the first administrator.

The above are only the preferred embodiments of the present invention, and are not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the embodiments of the present invention and the contents of the drawings, or directly or indirectly applied to other related The technical field is equally included in the scope of patent protection of the present invention.

Industrial applicability

As described above, the drawbacks of the conventional firewall deployment are solved by the above embodiments and preferred embodiments. It can provide independent security service policies for different users while greatly reducing maintenance and management costs.

Claims

A method of implementing a virtual firewall, the method comprising:

Obtaining an identifier of the virtual firewall instance according to the first information of the received data traffic;

In the case that the session entry matching the data traffic cannot be found according to the second information of the data traffic, the configuration parameter of the virtual firewall is searched according to the identifier of the virtual firewall instance, and according to the data traffic. The packet information is searched for an access control list ACL rule group;

Generating a session entry according to the data traffic, the configuration parameter of the virtual firewall, and the ACL rule group, and saving related security service parameters of the session in the data traffic in the session entry.
The method according to claim 1, wherein the first information comprises at least a quintuple in the packet of the data traffic, virtual local area network VLAN information or internet protocol IP information; the second information comprises at least the The quintuple in the message of the data traffic.
The method of claim 1, wherein the obtaining the identifier of the virtual firewall instance according to the first information of the received data traffic comprises:

Determining whether the identifier of the virtual firewall instance is obtained according to the interface information of the data traffic and the pre-stored interface mapping table, where the interface mapping table includes interface information of the data traffic and an identifier of the virtual firewall instance. If the configuration is performed, the configuration parameter of the virtual firewall is searched according to the identifier of the virtual firewall instance, and the ACL rule group is searched according to the packet information of the data traffic.
The method of claim 3, wherein, if yes, performing a search for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and after searching the ACL rule group according to the packet information of the data traffic, Also includes:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic and the pre-stored VLAN mapping table, where the first packet information includes at least VLAN information, the VLAN The mapping table includes a correspondence between VLAN information of the data traffic and an identifier of the virtual firewall instance; if yes, performing according to the virtual firewall The identifier of the instance is used to find the configuration parameter of the virtual firewall, and the ACL rule group is searched according to the packet information of the data traffic.
The method of claim 4, wherein if yes, performing a search for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and searching for an ACL rule group according to the packet information of the data traffic, Also includes:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic, the first virtual private network VPN mapping table stored in advance, and the second VPN mapping table stored in advance. The first message mapping table includes at least the VLAN information, the first VPN mapping table includes a correspondence between the VLAN information and the VPN information, and the second VPN mapping table includes the VPN information and an identifier of the virtual firewall instance. The mapping between the virtual firewalls is performed according to the identifier of the virtual firewall instance, and the ACL rule group is searched according to the packet information of the data traffic.
The method of claim 5, wherein, if yes, performing a search for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and after searching the ACL rule group according to the packet information of the data traffic, Also includes:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the second packet information of the data traffic and the pre-stored IP mapping table, where the second packet information includes at least an IP address. The IP mapping table includes a correspondence between the IP address and the identifier of the virtual firewall instance obtained by the HASH operation of the IP address; if yes, performing a search for the virtual firewall according to the identifier of the virtual firewall instance. Configure the parameters and find the ACL rule group based on the packet information of the data traffic.
The method of claim 1, wherein the obtaining the identifier of the virtual firewall instance according to the first information of the received data traffic comprises:

Searching, according to the second information, a session entry that matches the data traffic;

And searching, according to the second information, a session entry that matches the data traffic, including:

Performing a HASH operation on the second information to obtain a value H, where a low N bit of the value H is used to search an index of a CAM table, and a high N bit of the value H is used to search for an identifier of the CAM table;

If the CAM table is matched with the pre-stored CAM table, the content of the matched CAM table is obtained, and the content is matched with the second information according to the content, and if they are the same, it is determined that the second information can be searched according to the second information. The session entry that matches the data traffic; if not, determining that the session entry matching the data traffic cannot be found according to the second information;

If it is unable to match the pre-stored CAM table, it is determined that the session entry matching the data traffic cannot be found according to the second information.
The method according to any one of claims 1 to 7, wherein the method further comprises:

When the virtual firewall instance VFWv is created, the resource object in the total resource queue QA in the total resource pool PA is first dequeued, and then the queue operation is performed to the resource queue Qv.

When the virtual firewall instance VFWv is deleted, the resource object in the resource queue Qv in the resource pool Pv is first dequeued, and then the queue operation is performed to the resource total queue QA;

The Qv is a queue or a stack of each type of the resource pool of the virtual firewall instance; the QA is a resource corresponding to each type of the resource pool of the virtual firewall instance; The total resource pool of the virtual firewall instance; the Pv is a resource in a resource pool corresponding to the virtual firewall instance VFWv.
An apparatus for implementing a virtual firewall, the apparatus comprising:

An obtaining unit, configured to obtain an identifier of the virtual firewall instance according to the first information of the received data traffic;

The first searching unit is configured to search for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, if the session entry that matches the data traffic cannot be found according to the second information of the data traffic. And searching for an ACL rule group according to the packet information of the data traffic;

a generating unit, configured to generate a session entry according to the data traffic, the configuration parameter of the virtual firewall, and the ACL rule group, and save related security service parameters of the session in the data traffic in the session entry in.
The apparatus according to claim 9, wherein the first information comprises at least a quintuple, VLAN information or IP information in a message of the data traffic; the second information comprises at least The quintuple in the message of the data traffic.
The apparatus according to claim 9, wherein said obtaining unit is configured to:

Determining whether the identifier of the virtual firewall instance is obtained according to the interface information of the data traffic and the pre-stored interface mapping table, where the interface mapping table includes interface information of the data traffic and an identifier of the virtual firewall instance. If the configuration is performed, the configuration parameter of the virtual firewall is searched according to the identifier of the virtual firewall instance, and the ACL rule group is searched according to the packet information of the data traffic.
The apparatus according to claim 11, wherein the obtaining unit is further configured to:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic and the pre-stored VLAN mapping table, where the first packet information includes at least VLAN information, the VLAN The mapping table includes a mapping between the VLAN information of the data traffic and the identifier of the virtual firewall instance; if yes, performing configuration to search for the configuration parameter of the virtual firewall according to the identifier of the virtual firewall instance, and according to the data The packet information of the traffic is searched for the ACL rule group.
The device according to claim 12, wherein the obtaining unit is further configured to:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the first packet information of the data traffic, the first VPN mapping table that is pre-stored, and the second VPN mapping table that is stored in advance. The message information includes at least the VLAN information, the first VPN mapping table includes a correspondence between the VLAN information and the VPN information, and the second VPN mapping table includes the information between the VPN information and the identifier of the virtual firewall instance. Corresponding relationship; if yes, performing configuration on the virtual firewall according to the identifier of the virtual firewall instance, and searching for an ACL rule group according to the packet information of the data traffic.
The device according to claim 13, wherein the obtaining unit is further configured to:

If not, determining whether the identifier of the virtual firewall instance is obtained according to the second packet information of the data traffic and the pre-stored IP mapping table, where the second packet information includes at least an IP address. The IP mapping table includes the IP address and the IP address obtained by HASH operation The mapping between the identifiers of the virtual firewall instances is performed; if yes, the configuration parameters of the virtual firewall are searched according to the identifier of the virtual firewall instance, and the ACL rule group is searched according to the packet information of the data traffic.
The apparatus of claim 14, wherein the apparatus further comprises a second lookup unit configured to:

Searching, according to the second information, a session entry that matches the data traffic;

The second search unit is configured to:

Performing a HASH operation on the second information to obtain a value H, where a low N bit of the value H is used to search an index of a CAM table, and a high N bit of the value H is used to search for an identifier of the CAM table;

If the CAM table is matched with the pre-stored CAM table, the content of the matched CAM table is obtained, and the content is matched with the second information according to the content, and if they are the same, it is determined that the second information can be searched according to the second information. The session entry that matches the data traffic; if not, determining that the session entry matching the data traffic cannot be found according to the second information;

If it is unable to match the pre-stored CAM table, it is determined that the session entry matching the data traffic cannot be found according to the second information.
The device according to any one of claims 9 to 15, wherein the device further comprises:

Create a unit, and set the resource object in the total resource queue QA of the total resource pool PA to perform the dequeue operation first, and then enter the queue operation to the resource queue Qv.

The deleting unit is configured to perform the dequeuing operation on the resource object in the resource queue Qv in the resource pool Pv before deleting the virtual firewall instance VFWv, and then re-enter the operation to the resource total queue QA;

The Qv is a queue or a stack of each type of the resource pool of the virtual firewall instance; the QA is a resource corresponding to each type of the resource pool of the virtual firewall instance; The total resource pool of the virtual firewall instance; the Pv is a resource in a resource pool corresponding to the virtual firewall instance VFWv.