WO2022083207A1 - 一种基于OpenStack框架的虚拟防火墙构建方法 - Google Patents

一种基于OpenStack框架的虚拟防火墙构建方法 Download PDF

Info

Publication number
WO2022083207A1
WO2022083207A1 PCT/CN2021/109224 CN2021109224W WO2022083207A1 WO 2022083207 A1 WO2022083207 A1 WO 2022083207A1 CN 2021109224 W CN2021109224 W CN 2021109224W WO 2022083207 A1 WO2022083207 A1 WO 2022083207A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
firewall
service
virtual
forwarding
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/109224
Other languages
English (en)
French (fr)
Inventor
张同剑
秦海中
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Suzhou Wave Intelligent Technology Co Ltd
Original Assignee
Suzhou Wave Intelligent Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Suzhou Wave Intelligent Technology Co Ltd filed Critical Suzhou Wave Intelligent Technology Co Ltd
Priority to US18/029,072 priority Critical patent/US12432179B2/en
Publication of WO2022083207A1 publication Critical patent/WO2022083207A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/56—Routing software
    • H04L45/566—Routing instructions carried by the data packet, e.g. active networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/58—Association of routers
    • H04L45/586—Association of routers of virtual routers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management

Definitions

  • the invention relates to the technical field of firewalls, in particular to a method and storage medium for constructing a virtual firewall based on an OpenStack framework.
  • OpenStack was originally an open source cloud computing management platform project, which is a combination of a series of software open source projects. OpenStack provides scalable and elastic cloud computing services for private and public clouds. It provides an operating platform or toolset for deploying clouds, and becomes the main framework for node control in the process of building clouds. At the same time, the boundary of data based on cloud computing is gradually disappearing. Cloud computing faces more threats, larger attack surfaces, and security issues that have become a bottleneck restricting the development of cloud computing. Once malicious network attack traffic enters the virtual Inside the cloud platform, it will bring fatal network paralysis, which makes people rely more and more on the use of virtual firewall technology.
  • the introduced virtual firewall technology generally includes the following two methods: The first is to add a packet rule table to the OpenStack-based native routing service. The second is to introduce the VPP vector packet processing service to replace the OpenStack packet processing mechanism.
  • the VPP full name is Vector Packet Processing, which is a vector data provided by Cisco.
  • the packet processing tool has data packet processing rules (ie, access control rules) set in the VPP vector data packet processing service, and the VPP vector data packet processing service implements control over the data packets in the virtual network based on this method.
  • the first method has a good processing effect
  • the native routing service of the OpenStack framework performs packet control based on the packet rule table
  • its forwarding process will be limited by the bandwidth of the set virtual route. limit, thus forming a bottleneck limit, which affects the forwarding efficiency in the process of controlling data packets
  • the corresponding second method uses the VPP vector data packet processing service to solve the problem of forwarding efficiency, but based on its existing
  • the packet processing rules (that is, access control rules) are the same under the same network.
  • different packet processing rules cannot be set, and it is difficult to meet the needs of different users. The need for processing rules. Therefore, the existing virtual firewall under the OpenStack framework cannot meet the needs of both forwarding efficiency and differentiated settings.
  • the purpose of the present invention is to provide a method for constructing a virtual firewall based on the OpenStack framework and a computer-readable storage medium, which solves the problem that the prior art is difficult to satisfy both forwarding efficiency and differentiated settings.
  • the present invention provides a method for constructing a virtual firewall based on the OpenStack framework, including:
  • the firewall rules of the target packet service are modified by the preset rules, and the modified target packet service is obtained.
  • the modified target packet service performs packet control through the modified firewall rules.
  • the modified target packet service The data packet service is provided with a forwarding stack whose forwarding performance is higher than that of the routing service of the OpenStack framework, and the firewall rules in the modified target data packet service are provided with a firewall configuration interface, and the firewall configuration interface is used according to different Users can set packet processing rules that meet their own requirements under different virtual networks;
  • the routing service of the OpenStack framework is replaced according to the modified target packet service.
  • the target data packet service is a VPP vector data packet processing service; the modified VPP vector data packet processing service is provided with a forwarding stack constructed based on the data plane development framework DPDK.
  • the modification of the firewall rules of the target data packet service by the preset rules specifically includes:
  • the firewall configuration interface of the VPP vector data packet processing service is set to bind the corresponding virtual route forwarding index, and the firewall configuration interface is used to configure the firewall rules of each virtual route forwarding index.
  • the firewall configuration interface Contains the judgment conditions and processing methods when processing data packets.
  • the judgment condition includes a judgment parameter and a parameter judgment rule, wherein the judgment parameter includes protocol information, port information and address information, and the parameter judgment rule is determined according to the operation command input by the user based on the firewall configuration interface.
  • the processing method includes forwarding and ignoring the forwarding request.
  • the method further includes:
  • the modified target data packet service is enabled to perform access control on the data packet corresponding to the Layer 3 forwarding request.
  • the Layer 3 forwarding request when the Layer 3 forwarding request is detected, enabling the modified target data packet service to perform access control on the data packet corresponding to the Layer 3 forwarding request, specifically including:
  • the data packet corresponding to the Layer 3 forwarding request is ignored.
  • the present invention also provides a computer-readable storage medium, where the computer-readable storage medium stores machine-executable instructions, and when the computer-executable instructions are invoked and executed by a processor, the computer can execute The instructions cause the processor to perform the method described above.
  • the method for constructing a virtual firewall based on the OpenStack framework provided by the present invention modifies the firewall rules of the target data packet service through preset rules to obtain the modified target data packet service, and then replaces the target data packet service according to the modified target data packet service.
  • the routing service of the OpenStack framework is described, thereby realizing the construction of the virtual firewall based on the OpenStack framework, because the modified target packet service carries out packet control by the modified firewall rule, and in the modified target packet service
  • a forwarding stack with a forwarding performance higher than the routing service of the OpenStack framework is provided, so it can be ensured that the virtual firewall after the routing service of the OpenStack framework is replaced can be higher than the forwarding of the OpenStack framework in the process of performing packet control. efficiency.
  • the firewall rules in the modified target data packet service are provided with a firewall configuration interface, and the firewall configuration interface is used to set data packet processing rules that meet their own requirements under different virtual networks according to different users. It ensures that the modified service can set different packet control rules for their own virtual machines in the configuration interface based on different users in the subsequent packet control process, which satisfies the differentiation of different users setting different packet control rules. requirements, thus ensuring that the constructed virtual firewall based on the OpenStack framework achieves both forwarding efficiency and differentiated settings.
  • the apparatus, electronic device, and computer-readable storage medium provided by the embodiments of the present invention also have the above technical effects.
  • FIG. 1 is a flowchart of a method for constructing a virtual firewall based on an OpenStack framework provided by an embodiment of the present invention
  • FIG. 2 is a flowchart of specific execution steps of a method for constructing a virtual firewall based on an OpenStack framework provided by an embodiment of the present invention
  • FIG. 3 is a flowchart of data packet control based on a virtual firewall in a method for constructing a virtual firewall based on an OpenStack framework according to an embodiment of the present invention.
  • a method for constructing a virtual firewall based on an OpenStack framework provided by an embodiment of the present invention includes the following steps:
  • the modified target data packet service performs data packet control through the modified firewall rules, and the modified target data packet service is provided with a route whose forwarding performance is higher than that of the OpenStack framework The forwarding stack for the service.
  • the firewall rules in the modified target data packet service are provided with a firewall configuration interface, and the firewall configuration interface is used to set data packet processing rules that meet their own requirements under different virtual networks according to different users.
  • the modified target service By replacing the original routing service under the OpenStack framework with the modified target service with higher forwarding performance, it can ensure that in the process of using the virtual firewall to control data packets, the problem that the forwarding performance of the original routing service is affected by the bandwidth can be solved.
  • the forwarding stack realizes the function of higher forwarding efficiency.
  • the modified target service is provided with different data packet control rules that can be set for their own virtual machines in the configuration interface based on different users, which satisfies the differentiated requirements of different users for setting different data packet control rules.
  • the target data packet service is a VPP vector data packet processing service; the modified VPP vector data packet processing service is provided with a data plane-based development framework (Data Plane Development Kit, DPDK) Constructed forwarding stack.
  • DPDK Data Plane Development Kit
  • the firewall rules of the target data packet service are modified through preset rules, which can be shown in FIG. 2 during execution, and specifically includes:
  • the firewall configuration interface is used to configure the firewall rules of each virtual route forwarding index, and the firewall configuration interface includes judgment conditions and processing methods when processing data packets.
  • the modified virtualizers are newly created in the original VPP vector packet processing service, and each virtualizer and the modified virtualizer are created.
  • the subsequent delivery rules are bound by indexes, which ensures that when users configure firewall rules that meet their own needs in the firewall rule configuration interface, they can correspond to the corresponding virtual machines, and use the delivery rules in subsequent packet control.
  • the corresponding firewall rules are called, thereby realizing the effect that each user can set the corresponding virtual machine and the corresponding firewall rules according to their own needs.
  • the judgment condition includes a judgment parameter and a parameter judgment rule, wherein the judgment parameter includes protocol information, port information and address information, and the parameter judgment rule is based on the user based on the firewall configuration interface The input operation command is determined.
  • the user can select any one or more of the above judgment parameters during the setting process.
  • the subsequent virtual firewall can control the data packet in the process of controlling the data packet.
  • the port is checked to determine whether it conforms to the parameter judgment rules set by the user.
  • the processing method includes forwarding and ignoring the forwarding request. In this way, by setting different processing methods, it can be ensured that the firewall can control and process the data packets by itself based on the processing methods, so as to avoid the influence of inquiring to the user when there is a problem.
  • the access data packets across the network can also be controlled through the virtual firewall based on the OpenStack framework, that is, when a need is detected
  • the firewall for packet control it also includes the following steps, including:
  • the modified target data packet service is enabled to perform access control on the data packet corresponding to the Layer 3 forwarding request.
  • the three-layer forwarding is the data interaction between different nodes across the network, and the firewall controls the data packets in the network
  • the focus of its prevention is also the data interaction between the nodes across the network. Therefore, when it is detected that there are data packets between networks (including between virtual networks), the access control mechanism of the firewall is triggered, and the modified target data packet service (that is, the virtual firewall function) can be started at this time. Start), and use the previously set firewall rules to queue packets for access control.
  • the execution method when a Layer 3 forwarding request is detected, enable the modified target data packet service to perform access control on the data packet corresponding to the Layer 3 forwarding request, and the execution method may be as follows As shown in Figure 3, it includes:
  • the subsequent steps may be performed 304 or 305 respectively according to the determination results.
  • forwarding If forwarding is required, forward the data packet corresponding to the Layer 3 forwarding request to the access target.
  • the firewall rules bound by the virtual router based on the virtual router forwarding index can be used, and the corresponding firewall control function can be triggered according to the issued rules, so as to determine whether the current Layer 3
  • the data packets of the forwarding request are forwarded, which realizes the control function of the data packets when different users are accessed by nodes of different networks under the networks of different virtual routing frameworks, and realizes the detection function of the firewall.
  • the judgment parameters in the judgment can include protocol information, port information, address information (it can be IP address), and the processing methods include forwarding and throw away;
  • the user can select the required firewall rules from the created firewall security policy rules and bind them with the index of their own virtual machine;
  • the virtual firewall of the OpenStack framework When there is an access operation from the virtual machine VM1 to the virtual machine VM2, the virtual firewall of the OpenStack framework will detect the data packets corresponding to the three-layer forwarding request. At this time, the virtual firewall of the OpenStack framework will enable the modified VPP vector data packet service, detects that the access target of the data packet is VM2, and at the same time obtains the firewall rules issued by VM2 according to the corresponding rules issued by the index, and assigns the Internet Protocol (IP) address of the data packet according to its rules. The judgment parameters of information, port information, and protocol information are extracted and matched with the issued firewall rules;
  • IP Internet Protocol
  • an embodiment of the present invention further provides a computer-readable storage medium, where the computer-readable storage medium stores machine-executable instructions, and when the computer-executable instructions are called and run by a processor, the The computer-executable instructions cause the processor to perform the steps of the above-described method.
  • the firewall rules of the target data packet service are modified through preset rules to obtain the modified target data packet service, and then according to the modified target data packet service
  • the packet service replaces the routing service of the OpenStack framework, thereby realizing the construction of a virtual firewall based on the OpenStack framework, because the modified target packet service performs packet control through the modified firewall rules, and the modified target packet service
  • the target packet service is provided with a forwarding stack whose forwarding performance is higher than that of the routing service of the OpenStack framework. Therefore, it can be ensured that the virtual firewall after replacing the routing service of the OpenStack framework can perform high-speed packet control in the process of performing packet control.
  • the firewall rules in the modified target data packet service are provided with a firewall configuration interface, and the firewall configuration interface is used to set data packet processing rules that meet their own requirements under different virtual networks according to different users. It ensures that the modified service can set different packet control rules for their own virtual machines in the configuration interface based on different users in the subsequent packet control process, which satisfies the differentiation of different users setting different packet control rules. requirements, thus ensuring that the constructed virtual firewall based on the OpenStack framework achieves both forwarding efficiency and differentiated settings.
  • each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more functions for implementing the specified logical function(s) executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures.
  • each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations can be implemented in dedicated hardware-based systems that perform the specified functions or actions , or can be implemented in a combination of dedicated hardware and computer instructions.
  • the division of the units is only a logical function division, and there may be other division methods in actual implementation.
  • multiple units or components may be combined or integrated into another system, or some features may be ignored. , or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces, indirect coupling or communication connection of devices or units, which may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in the embodiments provided by the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM for short), Random Access Memory (RAM for short), magnetic disk or CD, etc. that can store program codes medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种基于OpenStack框架的虚拟防火墙构建方法及存储介质，属于防火墙技术领域，解决了现有技术难以满足转发效率和差异化设置兼顾的问题。包括：通过预设规则对目标数据包服务的防火墙规则进行修改，得到修改后的目标数据包服务，所述修改后的目标数据包服务通过修改后的防火墙规则进行数据包控制，所述修改后的目标数据包服务中设置有转发性能高于所述OpenStack框架的路由服务的转发栈，所述修改后的目标数据包服务中的防火墙规则设置有防火墙配置界面，所述防火墙配置界面用于根据不同的用户在不同的虚拟网络下设置符合自身要求的数据包处理规则；根据所述修改后的目标数据包服务替换所述OpenStack框架的路由服务。

Description

一种基于OpenStack框架的虚拟防火墙构建方法
本申请要求于2020年10月20日提交至中国专利局、申请号为202011125136.7、发明名称为“一种基于OpenStack框架的虚拟防火墙构建方法及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及防火墙技术领域，尤其是涉及一种基于OpenStack框架的虚拟防火墙构建的方法及存储介质。
背景技术
随着云计算服务的高速发展，以OpenStack框架为基础的云计算平台也越来越受到瞩目。其中，OpenStack原本是一个开源的云计算管理平台项目，是一系列软件开源项目的组合。OpenStack为私有云和公有云提供可扩展的弹性的云计算服务，它提供了一个部署云的操作平台或工具集，成为了构建云过程中作为节点控制的主要框架。同时，基于云计算的方式导致数据的边界化正在逐步消失，云计算中面临的威胁更多、攻击面更大、面临的安全问题已经成为制约云计算发展的瓶颈，网络恶意攻击流量一旦进入虚拟云平台内部，将带来致命性的网络瘫痪，这使得人们愈加依赖虚拟防火墙技术的使用。
目前，在基于OpenStack框架部署私有云平台的应用场景中，引入的虚拟防火墙技术一般包括以下两种方式：第一种是在基于OpenStack原生的路由服务中添加数据包规则表，通过该表中的规则来实现对进出虚拟网络数据包的控制；第二种是引入VPP矢量数据包处理服务来替代OpenStack的数据包处理机制，其中，VPP全称Vector Packet Processing，是一种由思科公司提供的矢量数据包处理工具，在VPP矢量数据包处理服务中设置有数据包处理规则(即访问控制规则)，VPP矢量数据包处理服务基于该方式实现对虚拟网络中的数据包进行控制。然而，在实际应用中， 第一种方式虽然具有较好的处理效果，但由于OpenStack框架原生的路由服务在基于数据包规则表进行数据包控制时，其转发过程会受到设置的虚拟路由的带宽限制，从而形成瓶颈限制，使得在控制数据包的过程中转发效率受到影响；而与之对应的第二种方式虽然利用VPP矢量数据包处理服务解决了转发效率的问题，但基于其现有的数据包处理规则(即访问控制规则)在同一个网络下是相同的，当同一网络下的不同用户构建了两个不同的虚拟机时无法设置不同的数据包处理规则，难以满足不同用户使用不同处理规则的需要。因此，现有的OpenStack框架下的虚拟防火墙难以满足转发效率和差异化设置兼顾的需要。
发明内容
本发明的目的在于提供一种基于OpenStack框架的虚拟防火墙构建方法及计算机可读存储介质，解决了现有技术难以满足转发效率和差异化设置兼顾的问题。
第一方面，本发明提供一种基于OpenStack框架的虚拟防火墙构建的方法，其中包括：
通过预设规则对目标数据包服务的防火墙规则进行修改，得到修改后的目标数据包服务，所述修改后的目标数据包服务通过修改后的防火墙规则进行数据包控制，所述修改后的目标数据包服务中设置有转发性能高于所述OpenStack框架的路由服务的转发栈，所述修改后的目标数据包服务中的防火墙规则设置有防火墙配置界面，所述防火墙配置界面用于根据不同的用户在不同的虚拟网络下设置符合自身要求的数据包处理规则；
根据所述修改后的目标数据包服务替换所述OpenStack框架的路由服务。
进一步的，所述目标数据包服务为VPP矢量数据包处理服务；所述修改后的VPP矢量数据包处理服务中设置有基于数据平面开发框架DPDK构建的转发栈。
进一步的，所述通过预设规则对目标数据包服务的防火墙规则进行修改，具体包括：
对所述VPP矢量数据包处理服务中虚拟路由器的实现代码进行修改， 得到修改后的虚拟器，并为所述修改后的虚拟器创建虚拟路由转发表索引；
对所述VPP矢量数据包处理服务中数据包控制的下发规则流程代码进行修改，并将修改后的下发规则与所述虚拟路由转发索引绑定；
设置所述VPP矢量数据包处理服务的防火墙配置界面，用以绑定对应的虚拟路由转发索引，所述防火墙配置界面用于对每个虚拟路由转发索引的防火墙规则进行配置，所述防火墙配置界面中包含有处理数据包时的判断条件及处理方式。
进一步的，所述判断条件包括判断参数以及参数判断规则，其中所述判断参数包括协议信息、端口信息以及地址信息，所述参数判断规则是根据用户基于所述防火墙配置界面输入的操作命令确定的。
进一步的，所述处理方式包括予以转发及忽略转发请求。
进一步的，在根据所述修改后的目标数据包服务替换所述OpenStack框架的路由服务之后，所述方法还包括：
当检测到三层转发请求时，启用所述修改后的目标数据包服务对所述三层转发请求对应的数据包进行访问控制。
进一步的，所述当检测到三层转发请求时，启用所述修改后的目标数据包服务对所述三层转发请求对应的数据包进行访问控制，具体包括：
通过所述修改后的目标数据包服务判断所述三层转发请求确定访问目标；
根据所述访问目标对应的虚拟路由器转发索引确定防火墙规则；
根据所述防火墙配置规则确定所述三层转发请求对应的数据包是否应予转发；
若应转发，则将所述三层转发请求对应的数据包转发至所述访问目标；
若不应转发，则忽略所述三层转发请求对应的数据包。
第二方面，本发明还提供一种计算机可读存储介质，所述计算机可读存储介质存储有机器可运行指令，所述计算机可运行指令在被处理器调用和运行时，所述计算机可运行指令促使所述处理器运行上述的方法。
本发明提供的基于OpenStack框架的虚拟防火墙构建方法，通过预设规则对目标数据包服务的防火墙规则进行修改，得到修改后的目标数据包服务，然后根据所述修改后的目标数据包服务替换所述OpenStack框架的 路由服务，从而实现了基于OpenStack框架的虚拟防火墙构建，由于所述修改后的目标数据包服务通过修改后的防火墙规则进行数据包控制，且所述修改后的目标数据包服务中设置有转发性能高于所述OpenStack框架的路由服务的转发栈，因此可以确保在替换了所述OpenStack框架的路由服务后的虚拟防火墙在进行数据包控制的过程中，能够高于OpenStack框架的转发效率。同时，所述修改后的目标数据包服务中的防火墙规则设置有防火墙配置界面，所述防火墙配置界面用于根据不同的用户在不同的虚拟网络下设置符合自身要求的数据包处理规则，这就确保了修改后的服务在后续数据包控制的过程中，能够基于不同的用户在配置界面中为自己的虚拟机设置不用的数据包控制规则，满足了不同用户设置不同数据包控制规则的差异化需求，从而确保了构建后的基于OpenStack框架的虚拟防火墙实现了转发效率和差异化设置两者兼顾的效果。
相应地，本发明实施例提供的装置、电子设备以及计算机可读存储介质，也同样具有上述技术效果。
附图说明
为了更清楚地说明本发明具体实施方式或现有技术中的技术方案，下面将对具体实施方式或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施方式，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种基于OpenStack框架的虚拟防火墙构建的方法流程图；
图2为本发明实施例提供的一种基于OpenStack框架的虚拟防火墙构建方法具体执行步骤的流程图；
图3为本发明实施例提供的一种基于OpenStack框架的虚拟防火墙构建方法基于虚拟防火墙的数据包控制的流程图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合附图对本发明的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例中所提到的术语“包括”和“具有”以及它们的任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括其他没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
本发明实施例提供的一种基于OpenStack框架的虚拟防火墙构建方法，如图1所示，包括以下步骤：
101、通过预设规则对目标数据包服务的防火墙规则进行修改，得到修改后的目标数据包服务。
102、根据所述修改后的目标数据包服务替换所述OpenStack框架的路由服务。
其中，在上述步骤中，所述修改后的目标数据包服务通过修改后的防火墙规则进行数据包控制，并且所述修改后的目标数据包服务中设置有转发性能高于所述OpenStack框架的路由服务的转发栈。另外，所述修改后的目标数据包服务中的防火墙规则设置有防火墙配置界面，所述防火墙配置界面用于根据不同的用户在不同的虚拟网络下设置符合自身要求的数据包处理规则。
通过转发性能的更高的修改后的目标服务来代替OpenStack框架下原有的路由服务，可以确保在利用虚拟防火墙控制数据包的过程中，解决原有路由服务转发性能受到带宽影响的问题，利用转发栈实现了更加高速转发效率的功能。而且，在修改后的目标服务中设置有可基于不同的用户在配置界面中为自己的虚拟机设置不用的数据包控制规则，满足了不同用户设置不同数据包控制规则的差异化需求。
在一种可能的实施方式中，所述目标数据包服务为VPP矢量数据包处理服务；所述修改后的VPP矢量数据包处理服务中设置有基于数据平面开 发框架(Data Plane Development Kit，DPDK)构建的转发栈。
在一种可能的实施方式中，前述实施例中步骤101、通过预设规则对目标数据包服务的防火墙规则进行修改，在执行时可以如图2所示，具体包括：
201、对VPP矢量数据包处理服务中虚拟路由器的实现代码进行修改，得到修改后的虚拟器，并为所述修改后的虚拟器创建虚拟路由转发表索引。
202、对所述VPP矢量数据包处理服务中数据包控制的下发规则流程代码进行修改，并将修改后的下发规则与所述虚拟路由转发索引绑定。
203、设置所述VPP矢量数据包处理服务的防火墙配置界面，用以绑定对应的虚拟路由转发索引。
其中，所述防火墙配置界面用于对每个虚拟路由转发索引的防火墙规则进行配置，所述防火墙配置界面中包含有处理数据包时的判断条件及处理方式。
这样，通过将VPP矢量数据包处理服务中的路由器的实现代码进行修改，可以确保在原VPP矢量数据包处理服务中新建不同的虚拟器，即修改后的虚拟器，并为每个虚拟器和修改后的下发规则通过索引进行绑定，确保了在用户后续利用防火墙规则配置界面配置符合自己需要的防火墙规则时能够与对应的虚拟器相对应，并在后续进行数据包控制时利用下发规则调用与之对应的防火墙规则，从而实现了每个用户可根据自己需要设置与其对应的虚拟器以及对应的防火墙规则的效果。
在一种可能的实施方式中，所述判断条件包括判断参数以及参数判断规则，其中所述判断参数包括协议信息、端口信息以及地址信息，所述参数判断规则是根据用户基于所述防火墙配置界面输入的操作命令确定的。
需要说明的是，用户在设置过程中可以选择上述判断参数中的任意一种或多种，例如当仅选取端口信息时，则在后续的虚拟防火墙对数据包进行控制过程中可对数据包的端口进行检测，以确定是否符合用户设置的参数判断规则。
在一种可能的实施方式中，所述处理方式包括予以转发及忽略转发请求。这样，通过设置不同的处理方式可以确保防火墙能够基于处理方式自行对数据包进行控制和处理，避免在存在问题时向用户询问带来的影响。
在一种可能的实施方式中，在按照上述步骤所述方式构建了基于OpenStack框架的虚拟防火墙之后，还可以通过于OpenStack框架的虚拟防火墙对跨网络间访问数据包进行控制，即当检测到需要利用防火墙进行数据包控制时，还包括按照下述步骤执行，其中包括：
当检测到三层转发请求时，启用所述修改后的目标数据包服务对所述三层转发请求对应的数据包进行访问控制。
其中，由于三层转发是跨越网络间的不同节点之间的数据交互，而在防火墙对网络中的数据包进行控制的过程中，其防范的重点也是跨网络间的节点之间的数据交互，因此，在检测到存在跨网之间(其中包括虚拟网络之间)的数据包时，则触发防火墙的访问控制机制，这时则可以启动修改后的目标数据包服务(也就是虚拟防火墙功能的启动)，并利用之前设置好的防火墙规则队数据包进行访问控制。
在一种可能的实施方式中，所述当检测到三层转发请求时，启用所述修改后的目标数据包服务对所述三层转发请求对应的数据包进行访问控制，其执行方式可如图3所示，具体包括：
301、通过所述修改后的目标数据包服务确定所述三层转发请求对应的访问目标。
302、根据所述访问目标对应的虚拟路由器转发索引确定防火墙规则。
303、根据所述防火墙规则确定所述三层转发请求对应的数据包是否应予转发。其中，根据不同的确定结果，其后续执行的步骤可依据确定结果分别执行304或305。
304、若应转发，则将所述三层转发请求对应的数据包转发至所述访问目标。
305、若不应转发，则忽略所述三层转发请求对应的数据包。
通过利用访问目标确定目标所对应的虚拟路由器，可以按照该虚拟路由器基于虚拟路由器转发索引所绑定的防火墙规则，并按照下发规则触发对应的防火墙控制功能，从而判断是否应该对当前的三层转发请求的数据包进行转发，实现了不同用户在不同虚拟路由构架的网络下被不同网络的节点访问时的数据包的控制功能，实现了防火墙的检测功能。
另外，在基于前述方法所构建了基于OpenStack框架的虚拟防火墙后， 其利用修改后的VPP矢量数据包处理服务执行数据包控制时的具体实施方案可如下述示例所示：
1：根据用户需求，可以分别创建两个虚拟机网络，如Net1 192.168.10.1/24以及Net2 192.168.20.1/24；
2：网络创建成功后，用户可以基于上述两个网络粉笔创建的对应的网络虚拟器VM1以及VM2，同时建立对应的索引；
3：创建一个虚拟路由器，并连接上述网络；
4：根据用户需求，在防火墙配置界面中设置每个用户所需的防火墙规则，其判断时的判断参数可以包括协议信息，端口信息，地址信息(可以为IP地址)，同时处理方式包括转发以及丢弃；
5：在路由器界面，用户可从已创建的防火墙安全策略规则中选择所需的防火墙规则并与自身的虚拟器的索引进行绑定；
6：当存在从虚拟机VM1访问虚拟机VM2的访问操作，这个时候OpenStack框架的虚拟防火墙会检测到三层转发请求对应的数据包上，此时该OpenStack框架的虚拟防火墙会启用基于修改后的VPP矢量数据包服务，检测数据包的访问目标为VM2，同时获取按照索引对应下发规则所下发VM2的防火墙规则，并按其规则对数据包的网际互连协议(Internet Protocol，IP)地址信息、端口信息、协议信息的判断参数进行提取，并与下发的防火墙规则进行匹配；
7：如果基于防火墙规则确定允许转发，则直接转发该三层转发请求的数据包至VM2，反之，如果基于防火墙规则确定不允许转发，则丢弃该三层转发请求的数据包。
对应于上述方法，本发明实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有机器可运行指令，所述计算机可运行指令在被处理器调用和运行时，所述计算机可运行指令促使所述处理器运行上述方法的步骤。
本发明实施例提供的基于OpenStack框架的虚拟防火墙构建方法及存储介质，通过预设规则对目标数据包服务的防火墙规则进行修改，得到修改后的目标数据包服务，然后根据所述修改后的目标数据包服务替换所述OpenStack框架的路由服务，从而实现了基于OpenStack框架的虚拟防火墙 构建，由于所述修改后的目标数据包服务通过修改后的防火墙规则进行数据包控制，且所述修改后的目标数据包服务中设置有转发性能高于所述OpenStack框架的路由服务的转发栈，因此可以确保在替换了所述OpenStack框架的路由服务后的虚拟防火墙在进行数据包控制的过程中，能够高于OpenStack框架的转发效率。同时，所述修改后的目标数据包服务中的防火墙规则设置有防火墙配置界面，所述防火墙配置界面用于根据不同的用户在不同的虚拟网络下设置符合自身要求的数据包处理规则，这就确保了修改后的服务在后续数据包控制的过程中，能够基于不同的用户在配置界面中为自己的虚拟机设置不用的数据包控制规则，满足了不同用户设置不同数据包控制规则的差异化需求，从而确保了构建后的基于OpenStack框架的虚拟防火墙实现了转发效率和差异化设置两者兼顾的效果。
在本发明所提供的几个实施例中，应该理解到，所揭露的装置和方法，也可以通过其它的方式实现。以上所描述的装置实施例仅仅是示意性的，例如，附图中的流程图和框图显示了根据本发明的多个实施例的装置、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或代码的一部分，所述模块、程序段或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现方式中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或动作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
又例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，再例如，多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些通信接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的， 作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明提供的实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，简称ROM)、随机存取存储器(Random Access Memory，简称RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步定义和解释，此外，术语“第一”、“第二”、“第三”等仅用于区分描述，而不能理解为指示或暗示相对重要性。
最后应说明的是：以上所述实施例，仅为本发明的具体实施方式，用以说明本发明的技术方案，而非对其限制，本发明的保护范围并不局限于此，尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，其依然可以对前述实施例所记载的技术方案进行修改或可轻易想到变化，或者对其中部分技术特征进行等同替换；而这些修改、变化或者替换，并不使相应技术方案的本质脱离本发明实施例技术方案的范围。都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求的保护范围为准。

Claims (8)

  1. 一种基于OpenStack框架的虚拟防火墙构建方法，其特征在于，包括：
    通过预设规则对目标数据包服务的防火墙规则进行修改，得到修改后的目标数据包服务，所述修改后的目标数据包服务通过修改后的防火墙规则进行数据包控制，所述修改后的目标数据包服务中设置有转发性能高于所述OpenStack框架的路由服务的转发栈，所述修改后的目标数据包服务中的防火墙规则设置有防火墙配置界面，所述防火墙配置界面用于根据不同的用户在不同的虚拟网络下设置符合自身要求的数据包处理规则；
    根据所述修改后的目标数据包服务替换所述OpenStack框架的路由服务。
  2. 根据权利要求1所述的一种基于OpenStack框架的虚拟防火墙构建方法，其特征在于，所述目标数据包服务为VPP矢量数据包处理服务；所述修改后的VPP矢量数据包处理服务中设置有基于数据平面开发框架DPDK构建的转发栈。
  3. 根据权利要求2所述的一种基于OpenStack框架的虚拟防火墙构建方法，其特征在于，所述通过预设规则对目标数据包服务的防火墙规则进行修改，具体包括：
    对所述VPP矢量数据包处理服务中虚拟路由器的实现代码进行修改，得到修改后的虚拟器，并为所述修改后的虚拟器创建虚拟路由转发表索引；
    对所述VPP矢量数据包处理服务中数据包控制的下发规则流程代码进行修改，并将修改后的下发规则与所述虚拟路由转发索引绑定；
    设置所述VPP矢量数据包处理服务的防火墙配置界面，用以绑定对应的虚拟路由转发索引，所述防火墙配置界面用于对每个虚拟路由转发索引的防火墙规则进行配置，所述防火墙配置界面中包含有处理数据包时的判断条件及处理方式。
  4. 根据权利要求3所述的一种基于OpenStack框架的虚拟防火墙构建方法，其特征在于，所述判断条件包括判断参数以及参数判断规则，其中所述判断参数包括协议信息、端口信息以及地址信息，所述参数判断规则是根据用户基于所述防火墙配置界面输入的操作命令确定的。
  5. 根据权利要求4所述的一种基于OpenStack框架的虚拟防火墙构建方法，其特征在于，所述处理方式包括予以转发及忽略转发请求。
  6. 根据权利要求1-5中任一项所述的一种基于OpenStack框架的虚拟防火墙构建方法，其特征在于，在根据所述修改后的目标数据包服务替换所述OpenStack框架的路由服务之后，所述方法还包括：
    当检测到三层转发请求时，启用所述修改后的目标数据包服务对所述三层转发请求对应的数据包进行访问控制。
  7. 根据权利要求6所述的一种基于OpenStack框架的虚拟防火墙构建方法，其特征在于，所述当检测到三层转发请求时，启用所述修改后的目标数据包服务对所述三层转发请求对应的数据包进行访问控制，具体包括：
    通过所述修改后的目标数据包服务确定所述三层转发请求对应的访问目标；
    根据所述访问目标对应的虚拟路由器转发索引确定防火墙规则；
    根据所述防火墙规则确定所述三层转发请求对应的数据包是否应予转发；
    若应转发，则将所述三层转发请求对应的数据包转发至所述访问目标；
    若不应转发，则忽略所述三层转发请求对应的数据包。
  8. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有机器可运行指令，所述计算机可运行指令在被处理器调用和运行时，所述计算机可运行指令促使所述处理器运行所述权利要求1至7任一项所述的方法。
PCT/CN2021/109224 2020-10-20 2021-07-29 一种基于OpenStack框架的虚拟防火墙构建方法 Ceased WO2022083207A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/029,072 US12432179B2 (en) 2020-10-20 2021-07-29 Virtual firewall construction method based on openstack framework

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011125136.7A CN112491789B (zh) 2020-10-20 2020-10-20 一种基于OpenStack框架的虚拟防火墙构建方法及存储介质
CN202011125136.7 2020-10-20

Publications (1)

Publication Number Publication Date
WO2022083207A1 true WO2022083207A1 (zh) 2022-04-28

Family

ID=74926186

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/109224 Ceased WO2022083207A1 (zh) 2020-10-20 2021-07-29 一种基于OpenStack框架的虚拟防火墙构建方法

Country Status (3)

Country Link
US (1) US12432179B2 (zh)
CN (1) CN112491789B (zh)
WO (1) WO2022083207A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491789B (zh) * 2020-10-20 2022-12-27 苏州浪潮智能科技有限公司 一种基于OpenStack框架的虚拟防火墙构建方法及存储介质
CN113438183B (zh) * 2021-06-29 2022-12-02 软通动力信息技术(集团)股份有限公司 一种网络框架的出向流控方法、装置、设备及存储介质
CN113612807B (zh) * 2021-10-09 2021-12-03 苏州浪潮智能科技有限公司 一种分布式防火墙定义方法及系统
TWI834078B (zh) * 2021-11-16 2024-03-01 中華電信股份有限公司 應用於虛實防火牆的一站式設定系統及其方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1389377A2 (en) * 2001-04-11 2004-02-18 Firebridge Systems PTY Ltd Network security system
CN103763310A (zh) * 2013-12-31 2014-04-30 曙光云计算技术有限公司 基于虚拟网络的防火墙服务系统及方法
CN107196952A (zh) * 2017-06-12 2017-09-22 深圳市永达电子信息股份有限公司 基于Opensatck实现个人虚拟应用防火墙方法
CN112491789A (zh) * 2020-10-20 2021-03-12 苏州浪潮智能科技有限公司 一种基于OpenStack框架的虚拟防火墙构建方法及存储介质

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10484334B1 (en) * 2013-02-26 2019-11-19 Zentera Systems, Inc. Distributed firewall security system that extends across different cloud computing networks
US9130901B2 (en) * 2013-02-26 2015-09-08 Zentera Systems, Inc. Peripheral firewall system for application protection in cloud computing environments
US9215213B2 (en) * 2014-02-20 2015-12-15 Nicira, Inc. Method and apparatus for distributing firewall rules
US10257089B2 (en) * 2014-10-30 2019-04-09 At&T Intellectual Property I, L.P. Distributed customer premises equipment
CN107872443A (zh) * 2016-09-28 2018-04-03 深圳市深信服电子科技有限公司 虚拟网络安全防护系统、流量牵引方法及装置
US11336572B2 (en) * 2017-05-12 2022-05-17 Nicira, Inc. Dynamic chain of service functions for processing network traffic in a virtual computing environment
US10554483B2 (en) * 2017-05-31 2020-02-04 Cisco Technology, Inc. Network policy analysis for networks
US10673698B2 (en) * 2017-07-21 2020-06-02 Cisco Technology, Inc. Service function chain optimization using live testing
CN107517129B (zh) * 2017-08-25 2020-04-03 杭州迪普科技股份有限公司 一种基于OpenStack配置设备上行接口的方法和装置
US10666497B2 (en) * 2018-06-22 2020-05-26 Intel Corporation Localized service resiliency
US11252040B2 (en) * 2018-07-31 2022-02-15 Cisco Technology, Inc. Advanced network tracing in the data plane
US20190207853A1 (en) * 2019-03-07 2019-07-04 Intel Corporation Selection of inputs for lookup operations
US11336696B2 (en) * 2020-02-27 2022-05-17 At&T Intellectual Property I, L.P. Control access to domains, servers, and content

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1389377A2 (en) * 2001-04-11 2004-02-18 Firebridge Systems PTY Ltd Network security system
CN103763310A (zh) * 2013-12-31 2014-04-30 曙光云计算技术有限公司 基于虚拟网络的防火墙服务系统及方法
CN107196952A (zh) * 2017-06-12 2017-09-22 深圳市永达电子信息股份有限公司 基于Opensatck实现个人虚拟应用防火墙方法
CN112491789A (zh) * 2020-10-20 2021-03-12 苏州浪潮智能科技有限公司 一种基于OpenStack框架的虚拟防火墙构建方法及存储介质

Also Published As

Publication number Publication date
US12432179B2 (en) 2025-09-30
US20230379303A1 (en) 2023-11-23
CN112491789A (zh) 2021-03-12
CN112491789B (zh) 2022-12-27

Similar Documents

Publication Publication Date Title
US12218956B2 (en) Providing a virtual security appliance architecture to a virtual cloud infrastructure
WO2022083207A1 (zh) 一种基于OpenStack框架的虚拟防火墙构建方法
US9692696B2 (en) Managing data flows in overlay networks
US20210036990A1 (en) Distributed identity-based firewalls
US9800502B2 (en) Quantized congestion notification for computing environments
CN104813611B (zh) 针对网络服务的虚拟设备描述表(vdc)集成
US20160323245A1 (en) Security session forwarding following virtual machine migration
US10333827B2 (en) Adaptive session forwarding following virtual machine migration detection
KR101862274B1 (ko) 클라우드 컴퓨팅 환경에서의 작업공간으로의 낮은 레이턴시 커넥션
CN103650430B (zh) 报文处理方法、装置、主机和网络系统
CN104205051B (zh) 用于虚拟机的移动处理的方法和装置
CN106850459B (zh) 一种实现虚拟网络负载均衡的方法及装置
CN114338606B (zh) 一种公有云的网络配置方法及相关设备
CN103581062B (zh) 用于处理未知单播数据包的方法和系统
US20220210005A1 (en) Synchronizing communication channel state information for high flow availability
US9590855B2 (en) Configuration of transparent interconnection of lots of links (TRILL) protocol enabled device ports in edge virtual bridging (EVB) networks
US9225631B2 (en) Implementation of protocol in virtual link aggregate group
WO2017167028A1 (zh) 一种路由控制方法、网络设备及控制器
US20240422179A1 (en) Autonomous network security scaling
US20160254958A1 (en) Method, apparatus and system for virtualizing a policy and charging rules function
CN112887330B (zh) 一种网络acl隔离浮动ip的实现装置及方法
CN111010340A (zh) 数据报文转发控制方法、装置及计算装置
Saxena et al. A recent trends in software defined networking (SDN) security
WO2019063028A1 (zh) 一种信息处理方法以及相关设备
CN111371608A (zh) 一种部署sfc业务链的方法、装置和介质

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21881627

Country of ref document: EP

Kind code of ref document: A1

WWG Wipo information: grant in national office

Ref document number: 18029072

Country of ref document: US