WO2023040303A1 - 网络流量控制方法以及相关系统 - Google Patents

网络流量控制方法以及相关系统 Download PDF

Info

Publication number
WO2023040303A1
WO2023040303A1 PCT/CN2022/092099 CN2022092099W WO2023040303A1 WO 2023040303 A1 WO2023040303 A1 WO 2023040303A1 CN 2022092099 W CN2022092099 W CN 2022092099W WO 2023040303 A1 WO2023040303 A1 WO 2023040303A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
control
firewall
packet
control module
Prior art date
Application number
PCT/CN2022/092099
Other languages
English (en)
French (fr)
Inventor
罗照宇
郭冕
李剑彪
邓炜
Original Assignee
华为云计算技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为云计算技术有限公司 filed Critical 华为云计算技术有限公司
Priority to EP22868681.2A priority Critical patent/EP4391476A1/en
Publication of WO2023040303A1 publication Critical patent/WO2023040303A1/zh
Priority to US18/606,777 priority patent/US20240223535A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0254—Stateful filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/06—Generation of reports
    • H04L43/062—Generation of reports related to network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/12—Network monitoring probes

Definitions

  • the present application relates to the field of computer technology, and in particular to a network flow control method, system, firewall, firewall control module, computer-readable storage medium, and computer program product.
  • the network traffic refers to the data traffic generated on the network by devices connected to the network.
  • firewalls can usually be deployed in series in the network to analyze and control network traffic in real time.
  • the above-mentioned deployment manner easily affects the normal forwarding of network traffic. For example, when the firewall stops forwarding, all network traffic is interrupted, which has a great impact on the normal operation of services.
  • This application provides a network traffic control method, which analyzes data in parallel through a firewall deployed in a bypass, and the firewall control module does not need to parse any data, thereby simplifying the logic of the firewall control module and improving the stability of the firewall control module , reducing the impact of the firewall control module on the normal forwarding of network traffic, and ensuring the normal operation of services.
  • the present application also provides devices, devices, computer-readable storage media, and computer program products corresponding to the above methods.
  • the present application provides a network flow control method.
  • the method can be performed by a control system.
  • the control system includes a firewall and a firewall control module.
  • the firewall may be hardware or software with an access control function.
  • the firewall control module can be a hardware module or a software module. When the firewall control module is a software module, the firewall control module can also be integrated in the firewall.
  • the firewall control module receives network traffic, caches a plurality of messages in the network traffic, and at the same time, the firewall receives bypass traffic obtained by performing a copy operation on the network traffic, and processes the packets in the bypass traffic Detect and obtain packet control messages.
  • the firewall control module executes the target operation on the target packets in the plurality of packets.
  • the target action may include forwarding, discarding or caching.
  • the protective wall adopts a bypass deployment mode and is parallel to the firewall control module.
  • the firewall control module does not need to analyze any data, but bypasses the firewall for parallel analysis. This makes the logic of the firewall control module extremely simple and stable, reducing the The impact of the firewall control module on the normal forwarding of network traffic ensures the normal operation of services.
  • the firewall control module controls corresponding packet forwarding based on the packet control message, and implements packet-level access control. This kind of fine-grained access control improves the effect of access control.
  • the packet control message includes packet identification information and packet control information.
  • the message identification information is used to uniquely identify the message, and the message identification information may be, for example, a quadruple of the message.
  • the message control information is used to indicate the operation on the message. Based on this, the firewall control module can determine the target message from the plurality of messages according to the message identification information, and then perform a target operation on the target message according to the message control information.
  • the firewall generates a message control message with message identification information in real time, and sends it to the firewall control module.
  • the firewall control module can quickly locate the target message according to the message identification information, and realize message-level access control to ensure network security.
  • the multiple packets include a first packet and a second packet that are associated with each other.
  • the first packet and the second packet may be multiple packets of the same data flow, for example.
  • the message control message includes message identification information and message control information of the second message, and when the message control information of the second message indicates that the second message is discarded, the firewall control module may Discarding the first packet and the second packet. In this way, messages related to messages containing harmful content can be blocked to ensure network security.
  • the packet control message includes a first packet control message and a second packet control message
  • the first packet control message includes packet identification information and First message control information
  • the first message control information of the first message indicates that the first message is cached
  • the second message control message includes message identification information of the first message and The second message control information and the message identification information and message control information of the second message, the second message control information of the first message and the message control information indication of the second message The message is discarded.
  • firewall control module When the firewall control module receives the first packet control message, it prolongs the cache time of the first packet to wait for subsequent packets; when the firewall control module receives the second packet control message, it discards the the first packet and the second packet.
  • the combined detection of the content of the interrelated messages can be realized, avoiding the leakage of messages including harmful content caused by the independent detection of the content of a single message, and ensuring network security.
  • the firewall control module when it does not receive a packet control message sent by the firewall within a preset time, it may further control the multiple packets based on a preset control strategy. In this way, the fault tolerance rate of network flow control can be improved, thereby improving the robustness of the control system.
  • the preset control strategy includes multiple control strategies.
  • the plurality of control policies may include strict control policies or relatively loose control policies.
  • Strict control strategy means that no forwarding or discarding operation is performed when the packet control message is not received.
  • a timeout mechanism can also be set, and when the cache time of the message or the cache timeout time reaches a preset threshold, the message is discarded.
  • a loose control strategy means that when the set conditions are met, for example, the number of packets in the cache queue reaches the preset number, or the cache time or cache timeout of the packets reaches the preset threshold, the cached packets are forwarded.
  • the firewall control module can obtain the service identifier from the network traffic, and the firewall control module determines from the plurality of control strategies according to the corresponding relationship between the service and the control strategy target control policy, and then the firewall control module controls the multiple packets based on the target control policy.
  • the firewall control module can select a corresponding control policy for control according to business requirements. For example, when the business scenario is a scenario that requires high security, you can choose a strict control strategy; for another example, when the business scenario is a scenario that requires high stability (such as some cloud service scenarios), you can choose a relatively loose control policy. Control Strategy.
  • the bypass traffic is obtained by splitting through an optical splitter, or obtained by mirroring through a switch.
  • the optical splitter or the switch replicates the network traffic in real time to obtain the bypass traffic, which provides a basis for parallel processing of the bypass firewall and the firewall control module.
  • the present application provides a control system.
  • the system includes:
  • a firewall control module configured to receive network traffic, and cache multiple packets in the network traffic
  • a firewall configured to receive bypass traffic obtained by performing a copy operation on the network traffic, detect packets in the bypass traffic, and obtain packet control messages;
  • the firewall control module is further configured to receive a message control message sent by the firewall, and perform a target operation on a target message in the plurality of messages, and the target operation includes forwarding, discarding or caching.
  • the packet control message includes packet identification information and packet control information
  • the firewall control module is specifically used for:
  • the plurality of messages include a first message and a second message that are associated with each other;
  • the message control message includes message identification information and message control information of the second message information, and the message control information of the second message indicates discarding the second message;
  • the firewall control module is specifically used for:
  • the packet control message includes a first packet control message and a second packet control message
  • the first packet control message includes packet identification information and First message control information
  • the first message control information of the first message indicates that the first message is cached
  • the second message control message includes message identification information of the first message and The second message control information and the message identification information and message control information of the second message, the second message control information of the first message and the message control information indication of the second message discard the message;
  • the firewall control module is specifically used for:
  • the firewall control module is also used for:
  • the multiple packets are controlled based on a preset control policy.
  • the preset control strategy includes multiple control strategies
  • the firewall control module is specifically configured to:
  • the multiple packets are controlled based on the target control strategy.
  • the bypass traffic is obtained by splitting through an optical splitter, or obtained by mirroring through a switch.
  • the present application provides a firewall, where the firewall includes a processor and a memory.
  • the processor and the memory communicate with each other.
  • Computer-readable instructions are stored in the memory, and the processor executes the computer-readable instructions, so that the firewall executes the method executed by the firewall in the first aspect or any implementation manner of the first aspect. Method steps.
  • the firewall is further integrated with a firewall control module.
  • the processor executes the computer-readable instructions, so that the firewall further executes the method steps performed by the firewall control module in the first aspect or any implementation manner of the first aspect.
  • the present application provides a firewall control module, where the firewall control module includes a processor and a memory.
  • the processor and the memory communicate with each other.
  • Computer-readable instructions are stored in the memory, and the processor executes the computer-readable instructions, so that the firewall control module executes the firewall control module as described in the first aspect or any implementation manner of the first aspect. The method steps performed by the control module.
  • the present application provides a computer-readable storage medium, where computer-readable instructions are stored in the computer-readable storage medium, and when the computer-readable instructions are run on a firewall, the firewall is made to execute the above-mentioned Method steps performed by the firewall in one aspect or any implementation of the first aspect.
  • the present application provides a computer-readable storage medium, where computer-readable instructions are stored in the computer-readable storage medium, and when the computer-readable instructions are run on the firewall control module, the firewall control The module executes the method steps performed by the firewall control module in the first aspect or any implementation of the first aspect.
  • the present application provides a computer program product including instructions, where the computer program product includes computer-readable instructions.
  • the firewall is made to execute the method steps performed by the firewall in the first aspect or any implementation manner of the first aspect.
  • the present application provides a computer program product comprising instructions, where the computer program product includes computer readable instructions.
  • the firewall control module is made to execute the method steps performed by the firewall control module in the first aspect or any implementation manner of the first aspect.
  • FIG. 1 is a system architecture diagram of a network flow control method provided in an embodiment of the present application
  • FIG. 2 is a flow chart of a network traffic control method provided in an embodiment of the present application
  • FIG. 3 is a schematic flow diagram of message access control provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a firewall provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a firewall control module provided by an embodiment of the present application.
  • first and second in the embodiments of the present application are used for description purposes only, and cannot be understood as indicating or implying relative importance or implicitly indicating the quantity of indicated technical features. Thus, a feature defined as “first” and “second” may explicitly or implicitly include one or more of these features.
  • Network traffic refers to the data traffic generated on the network by devices that can connect to the network.
  • the devices capable of connecting to the network include network devices such as servers and terminals.
  • the server includes a cloud server, an edge server or a local server.
  • a cloud server is a computing device in a cloud environment.
  • the cloud environment indicates a central computing device cluster owned by a cloud service provider for providing computing, storage, and communication resources.
  • the edge server is a computing device in the edge environment.
  • the edge environment indicates an edge computing device cluster that is geographically close to the terminal (that is, the end-side device) and is used to provide computing, storage, and communication resources.
  • the local server is a server in a local data center. Terminals include but are not limited to user terminals such as desktop computers, laptop computers, and smart phones.
  • Network traffic control also known as traffic control, refers to analyzing network traffic and performing operations such as forwarding or discarding network traffic according to the analysis results to ensure network security.
  • the analysis result of the network traffic indicates that the network traffic is malicious traffic, such as traffic generated by illegal elements launching a network attack, and the network traffic can be discarded to ensure the security of devices in the network.
  • a firewall is hardware or software that is located between multiple networks (for example, two networks) and implements network access control.
  • a firewall can be a dedicated network device dedicated to network access control.
  • the protection wall may be software running on the host, and the host runs the software to check network transmissions on various network interfaces.
  • Firewalls can be used to isolate networks. Specifically, the firewall divides the network into different zones (ZONE), and formulates access control policies between different zones to control the data flow transmitted between zones with different trust levels. Among them, areas with different levels of trust include the Internet and internal networks. The Internet is an untrusted zone, and the internal network is a highly trusted zone.
  • firewalls can usually be deployed in series in a network to analyze and control network traffic in real time.
  • the above-mentioned deployment manner easily affects the normal forwarding of network traffic. For example, when the firewall stops forwarding, all network traffic is interrupted, which has a great impact on the normal operation of services.
  • an embodiment of the present application provides a network traffic control method.
  • the method can be performed by a control system.
  • the control system includes a firewall and a firewall control module.
  • the firewall may be hardware or software with an access control function.
  • the firewall control module can be a hardware module or a software module.
  • the firewall control module can also be integrated in the firewall.
  • the firewall control module receives network traffic, caches a plurality of messages in the network traffic, and the firewall receives the bypass traffic obtained by performing a copy operation on the network traffic, detects the packets in the bypass traffic, and obtains the text control messages. Then, the protection wall control module receives the message control message sent by the firewall, and performs a target operation on the target message in the multiple messages, and the target operation includes forwarding, discarding or caching.
  • the protective wall adopts a bypass deployment mode and is parallel to the firewall control module.
  • the firewall control module does not need to analyze any data, but bypasses the firewall for parallel analysis. This makes the logic of the firewall control module extremely simple and stable, reducing the The impact of the firewall control module on the normal forwarding of network traffic ensures the normal operation of services.
  • the firewall control module controls corresponding packet forwarding based on the packet control message, and implements packet-level access control. This kind of fine-grained access control improves the effect of access control.
  • the network traffic control method of the present application is applicable to the scene of real-time security detection of network traffic that requires high stability, especially the scene of real-time security detection of network traffic in a cloud environment.
  • the system architecture of the network traffic control method according to the embodiment of the present application will be introduced below with reference to the accompanying drawings.
  • the network device 10 is connected to the network device 20 , and the network device 20 is connected to the control system 30 .
  • the network device 10 and the network device 20 may be connected through wired communication, for example, may be connected through optical fiber communication.
  • the network device 10 and the network device 20 can also be connected through wireless communication, for example, the network device 10 and the network device 20 can be connected through a wireless local area network (wireless local area network, WLAN), the fifth generation (the fifth generation, 5G) mobile communication network or Bluetooth, ZigBee (ZigBee) and other ways to connect.
  • the network device 20 and the control system 30 can also be connected through the above wired or wireless communication.
  • the network device 10 is a device that generates network traffic.
  • the network device 10 may be, for example, a server, or a terminal such as a smart phone, a notebook computer, or a desktop computer.
  • the terminal sends a data access request to the server, thereby generating network traffic, where the network traffic may be multiple packets included in the data access request.
  • the server may return a data access response to the terminal, thereby generating network traffic, where the network traffic may be multiple packets included in the data access response.
  • Network device 20 is a device that replicates network traffic.
  • FIG. 1 uses a network device 20 as an example for illustration.
  • a switch with port mirroring (port mirroring) function can forward the data traffic of one or more source ports to a certain designated port to monitor the network. This designated port is also called a mirrored port.
  • the network traffic forwarded by the switch to the designated port is called bypass traffic.
  • copying network traffic is not limited to port mirroring, and in other possible implementations of this embodiment of the present application, the network device 20 may also copy network traffic in other ways.
  • the network device 20 may also be an optical splitter.
  • the optical splitter can obtain a copy of the original network traffic through bypass splitting, and the copy is called bypass traffic.
  • the optical splitter is a passive optical device, which can redistribute the power intensity of the optical signal according to the required ratio, so as to realize the replication of network traffic.
  • the control system 30 is used for access control of network traffic.
  • the control system 30 includes a firewall 31 and a firewall control module 32 .
  • FIG. 1 uses a firewall control module as a hardware module, such as an independent firewall controller, for illustration.
  • the firewall control module 32 receives network traffic, and caches multiple packets in the network traffic.
  • the firewall 31 receives bypass traffic obtained by performing a copy operation on the network traffic, detects packets in the bypass traffic, and obtains a packet control message.
  • the firewall control module 32 receives the packet control message sent by the firewall, and executes the target operation on the target packets in the plurality of packets.
  • the target action includes forwarding, discarding, or caching.
  • target manipulation may also include modification.
  • the message control message indicates to modify the message
  • the message control message may also include a modification prompt, so that the firewall control module 32 can modify the target message according to the modification prompt.
  • firewall control module 32 Compared with firewalls deployed in series, this application puts the complex detection logic of firewalls into bypass deployment.
  • the protective wall 31 of bypass deployment generates the message control message that has message identification information in real time with the result of detection, and sends to firewall control module 32, and firewall control module 32 carries out rapid location to each message, according to control message to Each packet performs access control, such as performing actions such as forwarding, caching, or discarding.
  • the method includes:
  • the firewall control module 32 receives network traffic, and caches multiple packets in the network traffic.
  • the firewall control module 32 receives network traffic generated by devices such as terminals or servers accessing the network.
  • the network traffic includes multiple packets.
  • the packet may be an Internet Protocol (Internet Protocol, IP) packet.
  • IP Internet Protocol
  • the firewall control module 32 maintains a cache queue, and when multiple packets are received, the multiple packets can be added to the cache queue, so as to cache multiple packets in the network traffic.
  • the protection wall 31 receives bypass traffic obtained by performing a copy operation on network traffic, detects packets in the bypass traffic, and obtains a packet control message.
  • the firewall 31 deployed by the bypass receives the bypass traffic obtained by performing operations such as port mirroring or optical splitting on the network traffic.
  • the bypass traffic includes the same message as the above-mentioned network traffic.
  • the message is checked. Then the firewall 31 can generate a packet control message according to the detection result.
  • the firewall 31 may generate a packet control data block according to the detection result of each packet and the packet identification information of the packet, and then generate a packet control message according to the packet control data block.
  • the message identification information is used to uniquely identify the message.
  • the packet identification information includes a source IP, a destination IP, and a packet identifier (identifer, ID) such as the IP ID of the IP packet.
  • ID packet identifier
  • the packet identification information may also include a fragmentation offset.
  • the packet identification information may include a quaternion formed by the above four types of information.
  • the packet identification information may further include a port number, such as at least one of a source port number and a destination port number.
  • the firewall 31 may determine the message control information according to the detection result, and the message control information is used to indicate the control operation on the message. For example, the detection result indicates that the packet is a malicious packet, and the packet control information may be discard, which is used to indicate discarding of the packet. For another example, if the detection result indicates that the packet is a non-malicious packet, the packet control information may be forwarding, which is used to indicate forwarding of the packet. Then the firewall 31 generates a packet control data block according to the packet identification information and the packet control information.
  • the firewall 31 can add the message control data block to the message queue, and then the firewall 31 can pack multiple message control data blocks in the message queue to generate a message control message. In this way, multiple message control data blocks can be transmitted at one time, reducing transmission overhead.
  • bypass traffic is obtained by duplicating network traffic in real time, for example, by mirroring a switch, or by splitting light through an optical splitter, the above S202 and S204 can be executed in parallel.
  • the firewall control module 32 receives the packet control message sent by the firewall 31.
  • the firewall control module 32 determines the target packet from the multiple packets according to the packet identification information in the packet control message.
  • the packet identification information can be a quadruple, and the firewall control module 32 can quickly locate the packet from multiple packets in the cache queue according to the source IP, destination IP, IP ID or fragment offset in the quadruple. A target packet corresponding to the packet identification information.
  • the firewall control module 32 performs a target operation on the target packet according to the packet control information in the packet control message.
  • the firewall control module 32 When the message control information indicates discarding the message, the firewall control module 32 performs the discarding operation on the target message; when the message control information indicates the forwarding message, the firewall control module 32 performs the forwarding operation on the target message; When the information indicates to cache the message, the firewall control module 32 performs a cache operation on the target message, for example, the cache time of the target message can be extended.
  • the above steps from S208 to S210 are an implementation method for the firewall control module 32 to perform target operations on the target messages among the plurality of messages.
  • the firewall control module 32 may also determine the target message in other ways , and perform the target operation on the target message.
  • the protective wall 31 adopts a bypass deployment mode, and is parallel to the firewall control module 32.
  • the firewall control module 32 does not need to analyze any data, but bypasses the firewall for parallel analysis, so that the logic of the firewall control module 32 is extremely simple and Stable, reducing the impact of the firewall control module 32 on the normal forwarding of network traffic, so that the business can run normally.
  • the firewall control module controls corresponding packet forwarding based on the packet control message, and implements packet-level access control. This kind of fine-grained access control improves the effect of access control.
  • the multiple packets include a first packet and a second packet that are associated with each other. Interrelated messages can be combined and inspected to determine whether they contain harmful content.
  • the firewall 31 detects that the combination of the first packet and the second packet includes harmful content, it may determine that the packet control information of the first packet and the second packet is discarded.
  • the firewall 31 may generate a packet control message according to the packet control information of the first packet and the second packet.
  • the firewall control module 32 receives the message control message, and the message control message includes the message identifier and message control information of the first message and the message identifier and message control information of the second message, and the protective wall
  • the control module 32 may discard the first packet and the second packet according to the foregoing packet control information.
  • the firewall 31 may first detect the content of the first packet, and when no harmful content is detected, since the first packet and the second packet are related, the firewall 31 may determine The first packet control information of the first packet is buffered to wait for subsequent packets.
  • the firewall 31 may generate the message control data block of the first message according to the message identification information and the first message control information of the first message, and then generate the first message according to the message control data block of the first message Control messages.
  • the firewall control module 32 caches the first packet according to the first packet control information of the first packet in the first packet control message, for example, prolongs the buffering time of the first packet.
  • the firewall 31 detects the content of the second packet. During detection, the firewall 31 may combine the content of the second packet with the content of the first packet for detection, so as to determine whether harmful content is included. If so, then according to the result of detection, determine that the second message control information of the first message and the message control information of the second message are discarded; if not, then according to the result of detection, determine the second message control information of the first message.
  • the message control information and the message control information of the second message are forwarding.
  • Firewall 31 can generate the message control data block of the first message according to the message identification information of the first message and the second message control information, and generate the second message block according to the message identification information and message control information of the second message. The message control data block of the second message.
  • the firewall 31 generates a second packet control message according to the packet control data block of the first packet and the packet control data block of the second packet.
  • the firewall control module 32 performs corresponding operations according to the second packet control information of the first packet and the packet control information of the second packet in the second packet control message. For example, when the second packet control information of the first packet and the packet control information of the second packet are forwarding, the first packet and the second packet may be forwarded. For another example, when the second packet control information of the first packet and the packet control information of the second packet are discarded, the first packet and the second packet may be discarded.
  • the present application also provides an example to illustrate packet-level access control in network traffic.
  • message 1 Transmission Control Protocol
  • message 2 message 3 and message 4 are messages related to each other, for example, messages in the same data stream.
  • packet 1, packet 2, packet 3 and packet 4 arrive at the protective wall 31 (ie, bypass firewall) and firewall control module 32 (eg, firewall controller) in sequence.
  • the firewall 31 first detects the packet 1, and when the detection result indicates that no harmful content is detected, the packet control information of the packet 1 can be determined to be forwarded according to the detection result, that is, the packet 1 is released.
  • the firewall 31 generates a message control data block according to the message identification information and message control information of the message 1, and carries the message control data block in a message control message, such as message 1 shown in FIG. To the firewall control module 32.
  • the firewall control module 32 forwards the message 1 according to the message control information of the message 1 in the message 1.
  • the firewall 31 detects the message 2 and the message 3. When the detection result indicates that no harmful content is detected, since the message 2, the message 3 and the message 4 are interrelated, the message can be determined according to the detection result.
  • the message control information of message 2 and message 3 is cached to wait for subsequent messages.
  • Firewall 31 generates the message control data block of message 2 according to the message identification information and message control information of message 2, and generates the message control data of message 3 according to the message identification information and message control information of message 3 piece.
  • the firewall 31 carries the message control data blocks of the message 2 and the message 3 in a message control message, such as message 2 shown in FIG. 3 , and sends it to the firewall control module 32 .
  • the firewall control module 32 caches the message 2 and the message 3 according to the message control information of the message 2 and the message 3 in the message 2, for example, prolonging the cache time of the message 2 and the message 3 .
  • the extended time may be greater than the default cache time, for example, it may be extended by 1 second.
  • the firewall 31 then detects the packet 4 . Since the message 4 is correlated with the messages 2 and 3, the firewall 31 can combine the contents of the message 2, the message 3 and the message 4, and then perform detection. In this example, the detection result indicates that harmful content is detected, and the packet control information of packet 2, packet 3, and packet 4 can be determined to be discarded according to the detection result, that is, packet 2 and packet 3 are blocked. , Forwarding of message 4.
  • Firewall 31 generates the message control data block of message 2 according to the message identification information and message control information of message 2, and generates the message control data of message 3 according to the message identification information and message control information of message 3 block, generating a message control data block of message 4 according to the message identification information and message control information of message 4.
  • Firewall 31 carries the message control data blocks of message 2, message 3 and message 4 in a message control message, such as message 3 shown in FIG. 3, and sends it to firewall control module 32.
  • the firewall control module 32 discards the packet 2, the packet 3, and the packet 4 according to the packet control information of the packet 2, the packet 3, and the packet 4 in the message 3.
  • the firewall 31 may also send a reset (RST) message to terminate the TCP connection, thereby blocking the message 2, the message 3, and the message 4.
  • RST reset
  • the foregoing embodiment has described the situation that the firewall control module 32 receives a packet control message.
  • the firewall control module 32 may Multiple messages are controlled based on a preset control policy.
  • the preset message control strategy includes multiple control strategies, and the different control strategies will be described respectively below.
  • the first control strategy is to strictly wait for the packet control message from the firewall 31 . If the packet control message is not received, the operation of forwarding or discarding the packet will not be performed. Moreover, a timeout mechanism is set, and when the cache time (or cache timeout time) reaches a preset threshold, the cached packets are discarded.
  • the second control strategy is, when the number of messages in the buffer queue reaches the preset number, forward the messages in first-in first-out order, and keep the number of messages in the buffer queue not exceeding the preset number.
  • the third control strategy is to send the cached message when the cache time (or cache timeout) reaches a preset threshold.
  • the preset threshold can be set according to the processing delay of the firewall 31 .
  • the above-mentioned first control strategy is suitable for business scenarios with high security requirements, for example, it can be applied to internal network services;
  • the above-mentioned second and third control strategies are suitable for businesses with high stability requirements Scenarios, for example, can be applied to public network services.
  • the firewall control module 32 can obtain the service identifier from the network traffic when the content of the preset time does not receive the message control message, and then the firewall control module 32 can select from multiple control strategies according to the corresponding relationship between the service and the control strategy. Determine the target control policy corresponding to the service identified by the service identifier, and then the firewall control module 32 can control the multiple packets based on the target control policy.
  • control system 30 includes:
  • a firewall control module 32 configured to receive network traffic, and cache multiple messages in the network traffic
  • the firewall 31 is configured to receive bypass traffic obtained by performing a copy operation on the network traffic, detect packets in the bypass traffic, and obtain packet control messages;
  • the firewall control module 32 is further configured to receive a message control message sent by the firewall, and perform a target operation on a target message in the plurality of messages, and the target operation includes forwarding, discarding or caching.
  • the packet control message includes packet identification information and packet control information
  • the firewall control module 32 is specifically used for:
  • the plurality of messages include a first message and a second message that are associated with each other;
  • the message control message includes message identification information and message control information of the second message information, and the message control information of the second message indicates discarding the second message;
  • the firewall control module 32 is specifically used for:
  • the packet control message includes a first packet control message and a second packet control message
  • the packet control message includes a first packet control message and a second packet control message
  • the first packet control message includes packet identification information of the first packet and first packet control information
  • the first packet control information of the first packet indicates to cache the first packet
  • the second message control message includes message identification information and second message control information of the first message and message identification information and message control information of the second message, and the first message
  • the second message control information of the message and the message control information of the second message indicate to discard the message;
  • the firewall control module 32 is specifically used for:
  • the firewall control module is also used for:
  • the multiple messages are controlled based on a preset control policy.
  • the preset control strategy includes multiple control strategies
  • the firewall control module is specifically configured to:
  • the multiple packets are controlled based on the target control strategy.
  • the bypass traffic is obtained by splitting through an optical splitter, or obtained by mirroring through a switch.
  • control system 30 may correspond to the implementation of the method described in the embodiment of the present application, and the above-mentioned and other operations and/or functions of the various components of the control system 30 are respectively in order to realize the implementation shown in Fig. 2 and Fig. 3
  • the corresponding flow of each method in the example is not repeated here.
  • the embodiment of the present application also provides a firewall 31 .
  • the firewall may be dedicated hardware, or general hardware deployed with corresponding software, such as hosts and other devices.
  • the hardware structure of the protective wall 31 will be described in detail below with reference to the accompanying drawings.
  • FIG. 4 provides a schematic structural diagram of a protective wall 31 .
  • the protective wall 31 includes a bus 311 , a processor 312 , a communication interface 313 and a memory 314 .
  • the processor 312 , the memory 314 and the communication interface 313 communicate through the bus 311 .
  • the bus 311 may be a peripheral component interconnect standard (peripheral component interconnect, PCI) bus or an extended industry standard architecture (extended industry standard architecture, EISA) bus or the like.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 4 , but it does not mean that there is only one bus or one type of bus.
  • the processor 312 may be a central processing unit (central processing unit, CPU), a graphics processing unit (graphics processing unit, GPU), a microprocessor (micro processor, MP) or a digital signal processor (digital signal processor, DSP). Any one or more of them.
  • CPU central processing unit
  • GPU graphics processing unit
  • MP microprocessor
  • DSP digital signal processor
  • the communication interface 313 is used for communicating with the outside. For example, receiving the bypass traffic obtained by mirroring the network traffic by the switch, and sending a packet control message to the firewall control module 32 and so on.
  • the memory 314 may include a volatile memory (volatile memory), such as a random access memory (random access memory, RAM).
  • volatile memory such as a random access memory (random access memory, RAM).
  • Memory 314 can also include non-volatile memory (non-volatile memory), such as read-only memory (read-only memory, ROM), flash memory, hard disk drive (hard disk drive, HDD) or solid state drive (solid state drive) , SSD).
  • the memory 314 stores computer-readable instructions, and the processor 312 executes the computer-readable instructions, so that the firewall 31 executes the method steps performed by the firewall 31 in the aforementioned network traffic control method.
  • the protective wall 31 can integrate the firewall control module 32, and the processor 312 executes computer-readable instructions, so that the firewall 31 also performs the method steps performed by the firewall control module 32 in the aforementioned network traffic control method.
  • the embodiment of the present application also provides a firewall control module 32 .
  • the firewall control module 32 may be hardware independent of the firewall 31.
  • the hardware structure of the protective wall control module 32 will be described in detail below with reference to the accompanying drawings.
  • FIG. 5 provides a schematic structural diagram of a protective wall control module 32 .
  • the protective wall control module 32 includes a bus 321 , a processor 322 , a communication interface 323 and a memory 324 .
  • the processor 322 , the memory 324 and the communication interface 323 communicate through the bus 321 .
  • the bus 321 , the processor 322 , the communication interface 323 and the memory 324 refer to the related content description in FIG. 4 .
  • the memory 324 stores computer-readable instructions
  • the processor 322 executes the computer-readable instructions, so that the firewall control module 32 executes the method steps performed by the firewall control module 32 in the aforementioned network traffic control method.
  • the embodiment of the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium may be any available medium that a computing device can store, or a data storage device such as a data center that includes one or more available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media (eg, solid state hard disk), etc.
  • the computer-readable storage medium includes instructions, and when the instructions are run on the firewall 31, the firewall 31 also executes the method steps executed by the firewall 31 in the foregoing network traffic control method.
  • the embodiment of the present application also provides another computer-readable storage medium.
  • the computer-readable storage medium includes instructions, and when the instructions are run on the firewall control module 32, the firewall control module 32 also executes the method steps performed by the firewall control module 32 in the aforementioned network traffic control method.
  • the embodiment of the present application also provides a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the firewall 31 or the firewall control module 32, the processes or functions according to the embodiments of the present application will be produced in whole or in part.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, e.g. (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wirelessly (such as infrared, wireless, microwave, etc.) to another website site, computer or data center.
  • another computer-readable storage medium e.g. (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wirelessly (such as infrared, wireless, microwave, etc.) to another website site, computer or data center.
  • the computer program product may be a software installation package, which may be downloaded and executed on a computing device if any of the foregoing network traffic control methods needs to be used.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种网络流量控制方法，包括：防火墙控制模块接收网络流量，缓存网络流量中的多个报文，防火墙接收对网络流量执行复制操作所得的旁路流量，对旁路流量中的报文进行检测，获得报文控制消息。防火墙控制模块接收到防火墙发送的报文控制消息，对多个报文中的目标报文执行转发、丢弃或缓存等目标操作。该方法通过旁路部署的防火墙并行地解析数据，防火墙控制模块不需要解析任何数据，由此可以简化防火墙控制模块的逻辑，提高防火墙控制模块的稳定性，降低了防火墙控制模块对网络流量正常转发的影响，保障业务能够正常运行。

Description

网络流量控制方法以及相关系统
本申请要求于2021年9月16日提交中国国家知识产权局、申请号为202111088857.X、发明名称为“网络流量控制方法以及相关系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，尤其涉及一种网络流量控制方法、系统以及防火墙、防火墙控制模块、计算机可读存储介质、计算机程序产品。
背景技术
随着计算设备尤其是智能终端设备的普及，越来越多的计算设备接入互联网，并在互联网中产生了海量的网络流量。其中，网络流量是指接入网络的设备在网络上产生的数据流量。
考虑到非法分子利用计算设备接入网络以发起网络攻击不时发生，例如是阻断服务攻击(denial-of-service attack，DoS)、勒索攻击等不时发生，业界提出了基于防火墙(firewall)对网络流量进行控制，保障网络安全的方案。
为了阻断有害信息的传输，防火墙通常可以以串联方式部署在网络中，对网络流量进行实时分析及控制。然而，上述部署方式容易影响网络流量的正常转发。例如，防火墙停止转发时，所有网络流量均被中断，如此对业务正常运行产生较大的影响。
发明内容
本申请提供了一种网络流量控制方法，该方法通过旁路部署的防火墙并行地解析数据，防火墙控制模块不需要解析任何数据，由此可以简化防火墙控制模块的逻辑，提高防火墙控制模块的稳定性，降低了防火墙控制模块对网络流量正常转发的影响，保障业务能够正常运行。本申请还提供了上述方法对应的装置、设备、计算机可读存储介质以及计算机程序产品。
第一方面，本申请提供了一种网络流量控制方法。该方法可以由控制系统执行。其中，控制系统包括防火墙和防火墙控制模块。其中，防火墙可以是具有访问控制功能的硬件或软件。防火墙控制模块可以是硬件模块，也可以是软件模块。当防火墙控制模块为软件模块时，防火墙控制模块还可以集成在防火墙中。
具体地，防火墙控制模块接收网络流量，缓存所述网络流量中的多个报文，同时防火墙接收对所述网络流量执行复制操作所得的旁路流量，对所述旁路流量中的报文进行检测，获得报文控制消息。当防火墙控制模块接收到所述防火墙发送的报文控制消息，对所述多个报文中的目标报文执行目标操作。该目标操作可以包括转发、丢弃或缓存。
在该方法中，防护墙采用旁路部署方式，并且与防火墙控制模块并行，防火墙控制模块不需要解析任何数据，而是旁路防火墙并行解析，如此使得防火墙控制模块逻辑极其简单和稳定，降低了防火墙控制模块对网络流量正常转发的影响，保障业务能够正常运行。 并且，防火墙控制模块基于报文控制消息控制对应的报文转发，实现报文级别的访问控制，这种细粒度的访问控制提升了访问控制的效果。
在一些可能的实现方式中，报文控制消息包括报文标识信息和报文控制信息。报文标识信息用于唯一标识报文，该报文标识信息例如可以是报文的四元组等。报文控制信息用于指示对报文的操作。基于此，防火墙控制模块可以根据所述报文标识信息，从所述多个报文中确定目标报文，然后根据所述报文控制信息，对所述目标报文执行目标操作。
在该方法中，防火墙实时生成带有报文标识信息的报文控制消息，并发送给防火墙控制模块，如此，防火墙控制模块可以根据报文标识信息快速定位目标报文，实现报文级别的访问控制，保障了网络安全。
在一些可能的实现方式中，多个报文包括相互关联的第一报文和第二报文。该第一报文和第二报文例如可以是同一数据流的多个报文。报文控制消息包括所述第二报文的报文标识信息和报文控制信息，且所述第二报文的报文控制信息指示丢弃所述第二报文时，所述防火墙控制模块可以丢弃所述第一报文和所述第二报文。如此，可以阻断与包括有害内容的报文相互关联的报文，保障网络安全。
在一些可能的实现方式中，所述报文控制消息包括第一报文控制消息和第二报文控制消息，所述第一报文控制消息包括所述第一报文的报文标识信息和第一报文控制信息，所述第一报文的第一报文控制信息指示缓存所述第一报文，所述第二报文控制消息包括所述第一报文的报文标识信息和第二报文控制信息以及所述第二报文的报文标识信息和报文控制信息，所述第一报文的第二报文控制信息和所述第二报文的报文控制信息指示丢弃所述报文。
当防火墙控制模块接收到所述第一报文控制消息，延长所述第一报文的缓存时间，以等待后续报文，当防火墙控制模块接收到所述第二报文控制消息，丢弃所述第一报文和所述第二报文。
如此，可以实现对相互关联的报文的内容进行组合检测，避免了对单个报文的内容独立检测导致包括有害内容的报文漏发，保障了网络安全。
在一些可能的实现方式中，所述防火墙控制模块预设时间内未接收到所述防火墙发送的报文控制消息时，还可以基于预设的控制策略对所述多个报文进行控制。由此可以提升网络流量控制的容错率，从而提升控制系统的健壮性。
在一些可能的实现方式中，所述预设的控制策略包括多个控制策略。例如，多个控制策略可以包括严格的控制策略或者相对宽松的控制策略。严格的控制策略是指未接收到报文控制消息时，不执行转发或丢弃操作。进一步地，还可以设置超时机制，当报文的缓存时间或者缓存超时时间达到预设阈值，则丢弃报文。宽松的控制策略是指当设定的条件被满足时，例如缓存队列中报文数量达到预设数量，或者报文的缓存时间或者缓存超时时间达到预设阈值时，转发缓存的报文。
基于此，防火墙控制模块可以从所述网络流量中获取业务标识，所述防火墙控制模块根据业务与控制策略的对应关系，从所述多个控制策略中确定所述业务标识所标识的业务对应的目标控制策略，然后防火墙控制模块基于所述目标控制策略对所述多个报文进行控制。
由此，防火墙控制模块可以实现根据业务需求，选择相应的控制策略进行控制。例如，业务场景为对安全性要求较高的场景时，可以选择严格的控制策略；又例如，业务场景为对稳定性要求较高的场景(例如一些云服务场景)时，可以选择相对宽松的控制策略。
在一些可能的实现方式中，所述旁路流量通过分光器分光得到，或者通过交换机镜像得到。其中，分光器或者交换机实时复制网络流量获得旁路流量，为旁路防火墙和防火墙控制模块并行处理提供了基础。
第二方面，本申请提供了一种控制系统。所述系统包括：
防火墙控制模块，用于接收网络流量，缓存所述网络流量中的多个报文；
防火墙，用于接收对所述网络流量执行复制操作所得的旁路流量，对所述旁路流量中的报文进行检测，获得报文控制消息；
所述防火墙控制模块，还用于接收到所述防火墙发送的报文控制消息，对所述多个报文中的目标报文执行目标操作，所述目标操作包括转发、丢弃或缓存。
在一些可能的实现方式中，所述报文控制消息包括报文标识信息和报文控制信息；
所述防火墙控制模块具体用于：
根据所述报文标识信息，从所述多个报文中确定目标报文；
根据所述报文控制信息，对所述目标报文执行目标操作。
在一些可能的实现方式中，所述多个报文包括相互关联的第一报文和第二报文；所述报文控制消息包括所述第二报文的报文标识信息和报文控制信息，且所述第二报文的报文控制信息指示丢弃所述第二报文；
所述防火墙控制模块具体用于：
丢弃所述第一报文和所述第二报文。
在一些可能的实现方式中，所述报文控制消息包括第一报文控制消息和第二报文控制消息，所述第一报文控制消息包括所述第一报文的报文标识信息和第一报文控制信息，所述第一报文的第一报文控制信息指示缓存所述第一报文，所述第二报文控制消息包括所述第一报文的报文标识信息和第二报文控制信息以及所述第二报文的报文标识信息和报文控制信息，所述第一报文的第二报文控制信息和所述第二报文的报文控制信息指示丢弃所述报文；
所述防火墙控制模块具体用于：
接收到所述第一报文控制消息，延长所述第一报文的缓存时间；
接收到所述第二报文控制消息，丢弃所述第一报文和所述第二报文。
在一些可能的实现方式中，所述防火墙控制模块还用于：
预设时间内未接收到所述防火墙发送的报文控制消息时，基于预设的控制策略对所述多个报文进行控制。
在一些可能的实现方式中，所述预设的控制策略包括多个控制策略，所述防火墙控制模块具体用于：
从所述网络流量中获取业务标识；
根据业务与控制策略的对应关系，从所述多个控制策略中确定所述业务标识所标识的业务对应的目标控制策略；
基于所述目标控制策略对所述多个报文进行控制。
在一些可能的实现方式中，所述旁路流量通过分光器分光得到，或者通过交换机镜像得到。
第三方面，本申请提供一种防火墙，所述防火墙包括处理器和存储器。所述处理器、所述存储器进行相互的通信。所述存储器中存储有计算机可读指令，所述处理器执行所述计算机可读指令，以使得所述防火墙执行如第一方面或第一方面的任一种实现方式中由所述防火墙执行的方法步骤。
在一些可能的实现方式中，所述防火墙还集成有防火墙控制模块。相应地，所述处理器执行所述计算机可读指令，以使得所述防火墙还执行如第一方面或第一方面的任一种实现方式中由所述防火墙控制模块执行的方法步骤。
第四方面，本申请提供一种防火墙控制模块，所述防火墙控制模块包括处理器和存储器。所述处理器、所述存储器进行相互的通信。所述存储器中存储有计算机可读指令，所述处理器执行所述计算机可读指令，以使得所述防火墙控制模块执行如第一方面或第一方面的任一种实现方式中由所述防火墙控制模块执行的方法步骤。
第五方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机可读指令，当所述计算机可读指令在防火墙上运行时，使得所述防火墙执行上述第一方面或第一方面的任一种实现中由所述防火墙执行的方法步骤。
第六方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机可读指令，当所述计算机可读指令在防火墙控制模块上运行时，使得所述防火墙控制模块执行上述第一方面或第一方面的任一种实现中由所述防火墙控制模块执行的方法步骤。
第七方面，本申请提供了一种包含指令的计算机程序产品，该计算机程序产品包括计算机可读指令。当所述计算机可读指令在防火墙上运行时，使得所述防火墙执行上述第一方面或第一方面的任一种实现方式中由所述防火墙执行的方法步骤。
第八方面，本申请提供了一种包含指令的计算机程序产品，该计算机程序产品包括计算机可读指令。当所述计算机可读指令在防火墙控制模块上运行时，使得所述防火墙控制模块执行上述第一方面或第一方面的任一种实现方式中由所述防火墙控制模块执行的方法步骤。
本申请在上述各方面提供的实现方式的基础上，还可以进行进一步组合以提供更多实现方式。
附图说明
为了更清楚地说明本申请实施例的技术方法，下面将对实施例中所需使用的附图作以简单地介绍。
图1为本申请实施例提供的一种网络流量控制方法的系统架构图；
图2为本申请实施例提供的一种网络流量控制方法的流程图；
图3为本申请实施例提供的一种报文访问控制的流程示意图；
图4为本申请实施例提供的一种防火墙的结构示意图；
图5为本申请实施例提供的一种防火墙控制模块的结构示意图。
具体实施方式
本申请实施例中的术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征。
为了便于理解本申请实施例，首先，对本申请涉及的部分术语进行解释说明。
网络流量是指能够连接网络的设备在网络上所产生的数据流量。其中，能够连接网络的设备包括服务器和终端等网络设备。服务器包括云服务器、边缘服务器或者本地服务器。云服务器为云环境中的计算设备。所述云环境指示云服务提供商拥有的，用于提供计算、存储、通信资源的中心计算设备集群。边缘服务器为边缘环境中的计算设备。边缘环境指示在地理位置上距离终端(即端侧设备)较近的，用于提供计算、存储、通信资源的边缘计算设备集群。本地服务器为本地数据中心中的服务器。终端包括但不限于台式机、笔记本电脑、智能手机等用户终端。
网络流量控制，也称作流量控制，是指通过对网络流量进行分析，并根据分析结果对网络流量进行转发或丢弃等操作，以保障网络安全。例如，对网络流量的分析结果表征该网络流量为恶意流量，例如是非法分子发起网络攻击产生的流量时，可以对网络流量执行丢弃操作，以保障网络中的设备安全。
防火墙，是位于多个网络(例如是两个网络)间，实现网络访问控制的硬件或软件。例如，防火墙可以是一台专属的网络设备，专用于网络访问控制。又例如，防护墙可以是运行于主机上的软件，主机运行该软件检查各个网络接口上的网络传输。防火墙可以用于隔离网络。具体地，防火墙将网络划分成不同的区域(ZONE)，制定出不同区域之间的访问控制策略来控制不同信任程度区域间传送的数据流。其中，不同信任程度区域包括互联网和内部网络。互联网是不可信任的区域，内部网络是高度信任的区域。
目前，防火墙通常可以以串联方式部署在网络中，对网络流量进行实时分析及控制。然而，上述部署方式容易影响网络流量的正常转发。例如，防火墙停止转发时，所有网络流量均被中断，如此对业务正常运行产生较大的影响。
有鉴于此，本申请实施例提供了一种网络流量控制方法。该方法可以由控制系统执行。控制系统包括防火墙和防火墙控制模块。其中，防火墙可以是具有访问控制功能的硬件或软件。防火墙控制模块可以是硬件模块，也可以是软件模块。当防火墙控制模块为软件模块时，防火墙控制模块还可以集成在防火墙中。
具体地，防火墙控制模块接收网络流量，缓存所述网络流量中的多个报文，防火墙接收对网络流量执行复制操作所得的旁路流量，对该旁路流量中的报文进行检测，获得报文控制消息。然后，防护墙控制模块接收到防火墙发送的报文控制消息，对多个报文中的目标报文执行目标操作，该目标操作包括转发、丢弃或缓存。
在该方法中，防护墙采用旁路部署方式，并且与防火墙控制模块并行，防火墙控制模块不需要解析任何数据，而是旁路防火墙并行解析，如此使得防火墙控制模块逻辑极其简单和稳定，降低了防火墙控制模块对网络流量正常转发的影响，保障业务能够正常运行。 并且，防火墙控制模块基于报文控制消息控制对应的报文转发，实现报文级别的访问控制，这种细粒度的访问控制提升了访问控制的效果。
本申请的网络流量控制方法可适用于对稳定性要求极高的网络流量实时安全检测的场景，尤其是对云环境中的网络流量实时安全检测的场景。为了使得本申请的技术方案更加清楚、易于理解，下面结合附图对本申请实施例的网络流量控制方法的系统架构进行介绍。
参见图1所示的网络访问控制方法的系统架构图，网络设备10和网络设备20连接，网络设备20和控制系统30连接。其中，网络设备10、网络设备20可以通过有线通信方式连接，例如可以通过光纤通信等方式进行连接。网络设备10、网络设备20也可以通过无线通信方式连接，例如网络设备10、网络设备20可以通过无线局域网(wireless local area network，WLAN)、第5代(the fifth generation，5G)移动通信网络或者蓝牙、紫蜂(ZigBee)等方式进行连接。类似地，网络设备20和控制系统30也可以通过上述有线或无线通信方式连接。
网络设备10为产生网络流量的设备。该网络设备10例如可以是服务器，也可以是智能手机、笔记本电脑、台式机等终端。终端向服务器发送数据访问请求，从而产生网络流量，该网络流量可以是数据访问请求包括的多个报文。服务器可以向终端返回数据访问响应，从而产生网络流量，该网络流量可以是数据访问响应包括的多个报文。
网络设备20为复制网络流量的设备。图1以网络设备20为交换机示例说明。具体地，具有端口镜像(port mirroring)功能的交换机可以将或多个源端口的数据流量转发到某一个指定端口来实现对网络的监听。该指定端口也称作镜像端口。交换机转发到指定端口的网络流量称作旁路流量。
需要说明的是，复制网络流量不限于通过端口镜像的方式，在本申请实施例其他可能的实现方式中，网络设备20也可以通过其他方式对网络流量进行复制。例如，网络设备20还可以是分光器。分光器可以通过旁路分光，获得原始的网络流量的拷贝，该拷贝称作旁路流量。其中，分光器为无源光器件，可对光信号的功率强度按照需要的比例进行再分配，从而实现网络流量复制。
控制系统30用于对网络流量进行访问控制。其中，控制系统30包括防火墙31和防火墙控制模块32。图1以防火墙控制模块为硬件模块，例如是独立的防火墙控制器进行示例说明。具体地，防火墙控制模块32接收网络流量，缓存所述网络流量中的多个报文。防火墙31接收对所述网络流量执行复制操作所得的旁路流量，对所述旁路流量中的报文进行检测，获得报文控制消息。然后防火墙控制模块32接收到所述防火墙发送的报文控制消息，对所述多个报文中的目标报文执行目标操作。该目标操作包括转发、丢弃或缓存。在一些实施例中，目标操作还可以包括修改。当报文控制消息指示修改报文时，报文控制消息还可以包括修改提示，以便于防火墙控制模块32按照该修改提示对目标报文进行修改。
相较于串联部署的防火墙，本申请将防火墙复杂的检测逻辑放到旁路部署。旁路部署的防护墙31将检测的结果实时生成带有报文标识信息的报文控制消息，并发送给防火墙控制模块32，防火墙控制模块32对每一个报文进行快速定位，根据控制消息对每一个报文进行访问控制，例如执行转发、缓存或丢弃等动作。
接下来，从控制系统30的角度，结合附图对本申请实施例的网络流量控制方法进行详细说明。
参见图2所示的网络流量控制方法的流程图，该方法包括：
S202：防火墙控制模块32接收网络流量，缓存网络流量中的多个报文。
具体地，防火墙控制模块32接收终端或服务器等设备接入网络产生的网络流量。该网络流量中包括多个报文。该报文可以是网际协议(Internet Protocol，IP)报文。防火墙控制模块32维护有缓存队列，当接收到多个报文时，可以将多个报文加入缓存队列，以实现缓存网络流量中的多个报文。
S204：防护墙31接收对网络流量执行复制操作所得的旁路流量，对旁路流量中的报文进行检测，获得报文控制消息。
旁路部署的防火墙31接收对网络流量执行端口镜像或者分光等操作所得的旁路流量，该旁路流量包括与上述网络流量相同的报文，防火墙31可以通过检测逻辑，对旁路流量中的报文进行检测。然后防火墙31可以根据检测的结果生成报文控制消息。
具体地，防火墙31可以根据对每个报文检测的结果以及该报文的报文标识信息生成报文控制数据块，然后根据该报文控制数据块生成报文控制消息。其中，报文标识信息用于唯一标识报文。在一些实施例中，报文标识信息包括源IP、目的IP和报文标识符(identifer，ID)如IP报文的IP ID。考虑到一些报文会进行分片，报文标识信息还可以包括分片偏移。基于此，报文标识信息可以包括上述四种信息形成的四元组。为了能够准确、高效地识别报文，报文标识信息还可以包括端口号，例如是源端口号、目的端口号中的至少一种。
在生成报文控制数据块时，防火墙31可以根据检测的结果确定报文控制信息，该报文控制信息用于指示对报文的控制操作。例如，检测的结果表征该报文为恶意报文，则报文控制信息可以是丢弃，用于指示丢弃报文。又例如，检测的结果表征该报文为非恶意报文，则报文控制信息可以是转发，用于指示转发报文。然后防火墙31根据报文标识信息和报文控制信息生成报文控制数据块。
考虑到传输开销，防火墙31可以将报文控制数据块加入消息队列，然后防火墙31可以将消息队列中的多个报文控制数据块打包生成报文控制消息。如此，可以实现一次传输多个报文控制数据块，减少传输开销。
需要说明的是，由于旁路流量为对网络流量实时复制获得，例如是通过交换机镜像得到，或者是通过分光器分光得到，因此上述S202和S204可以并行执行。
S206：防火墙控制模块32接收防火墙31发送的报文控制消息。
S208：防火墙控制模块32根据报文控制消息中的报文标识信息，从多个报文中确定目标报文。
具体地，报文标识信息可以为四元组，防火墙控制模块32可以根据四元组中的源IP、目的IP、IP ID或者分片偏移，从缓存队列的多个报文中快速定位出与该报文标识信息对应的目标报文。
S210：防火墙控制模块32根据报文控制消息中的报文控制信息，对目标报文执行目标操作。
当报文控制信息指示丢弃报文时，防火墙控制模块32对目标报文执行丢弃操作；当报文控制信息指示转发报文时，防火墙控制模块32对目标报文执行转发操作；当报文控制信息指示缓存报文时，防火墙控制模块32对目标报文执行缓存操作，例如可以延长目标报文的缓存时间。
上述S208至S210为防火墙控制模块32对所述多个报文中的目标报文执行目标操作的一种实现方式，在本申请实施例中，防火墙控制模块32也可以通过其他方式确定目标报文，并对目标报文执行目标操作。
基于上述内容描述，防护墙31采用旁路部署方式，并且与防火墙控制模块32并行，防火墙控制模块32不需要解析任何数据，而是旁路防火墙并行解析，如此使得防火墙控制模块32逻辑极其简单和稳定，降低了防火墙控制模块32对网络流量正常转发的影响，使得业务能够正常运行。并且，防火墙控制模块基于报文控制消息控制对应的报文转发，实现报文级别的访问控制，这种细粒度的访问控制提升了访问控制的效果。
在一些可能的实现方式中，多个报文包括相互关联的第一报文和第二报文。相互关联的报文可以组合进行检测，以确定是否包括有害内容。当防火墙31检测到第一报文和第二报文的组合包括有害内容时，可以确定第一报文和第二报文的报文控制信息为丢弃。防火墙31可以根据第一报文和第二报文的报文控制信息生成报文控制消息。相应地，防火墙控制模块32接收到报文控制消息，该报文控制消息包括第一报文的报文标识和报文控制信息以及第二报文的报文标识和报文控制信息，防护墙控制模块32可以根据上述报文控制信息丢弃第一报文和第二报文。
具体地，防火墙31可以先对第一报文的内容进行检测，当未检测到有害内容时，由于第一报文和第二报文具有关联性，因此，防火墙31可以根据检测的结果，确定第一报文的第一报文控制信息为缓存，以等待后续报文。防火墙31可以根据第一报文的报文标识信息和第一报文控制信息生成第一报文的报文控制数据块，进而根据该第一报文的报文控制数据块生成第一报文控制消息。防火墙控制模块32根据第一报文控制消息中第一报文的第一报文控制信息，缓存第一报文，例如是延长第一报文的缓存时间。
防火墙31对第二报文的内容进行检测。在检测时，防火墙31可以将第二报文的内容与第一报文的内容组合进行检测，以确定是否包括有害内容。若是，则根据检测的结果，确定第一报文的第二报文控制信息和第二报文的报文控制信息为丢弃；若否，则根据检测的结果，确定第一报文的第二报文控制信息和第二报文的报文控制信息为转发。防火墙31可以根据第一报文的报文标识信息和第二报文控制信息，生成第一报文的报文控制数据块，根据第二报文的报文标识信息和报文控制信息生成第二报文的报文控制数据块。然后防火墙31根据上述第一报文的报文控制数据块和第二报文的报文控制数据块生成第二报文控制消息。防火墙控制模块32根据第二报文控制消息中第一报文的第二报文控制信息和第二报文的报文控制信息，执行相应的操作。例如，第一报文的第二报文控制信息和第二报文的报文控制信息为转发时，则可以转发第一报文和第二报文。又例如，第一报文的第二报文控制信息和第二报文的报文控制信息为丢弃时，则可以丢弃第一报文和第二报文。
为了便于理解，本申请还提供一个示例，对网络流量中报文级别的访问控制进行说明。
参见图3所示的报文控制的流程示意图，该示例中包括4个报文，具体是4个传输控制协议(Transmission Control Protocol，TCP)报文，记作报文1、报文2、报文3和报文4。其中，报文2、报文3和报文4为相互关联的报文，例如是同一个数据流中的报文。假设报文1、报文2、报文3和报文4顺序到达防护墙31(即旁路防火墙)和防火墙控制模块32(例如防火墙控制器)。
防火墙31先对报文1进行检测，当检测的结果表征未检测到有害内容时，可以根据检测的结果确定报文1的报文控制信息为转发，也即对报文1放行。防火墙31根据报文1的报文标识信息和报文控制信息生成报文控制数据块，将该报文控制数据块携带在报文控制消息中，例如是图3所示的消息1中，发送至防火墙控制模块32。防火墙控制模块32根据该消息1中报文1的报文控制信息，转发报文1。
防火墙31接着对报文2、报文3进行检测，检测的结果表征未检测到有害内容时，由于报文2、报文3和报文4相互关联，因此，可以根据检测的结果，确定报文2、报文3的报文控制信息为缓存，以等待后续报文。防火墙31根据报文2的报文标识信息和报文控制信息生成报文2的报文控制数据块，根据报文3的报文标识信息和报文控制信息生成报文3的报文控制数据块。防火墙31将报文2和报文3的报文控制数据块携带在报文控制消息中，例如是图3所示的消息2中，发送至防火墙控制模块32。防火墙控制模块32根据该消息2中报文2、报文3的报文控制信息，缓存报文2和报文3，例如是延长报文2、报文3的缓存时间。需要说明，延长的时间可以大于默认的缓存时间，例如可以延长1秒。
防火墙31接着对报文4进行检测。由于报文4和报文2、3相互关联，防火墙31可以将报文2、报文3和报文4的内容进行组合，然后再进行检测。在该示例中，检测的结果表征检测到有害内容，则可以根据检测的结果确定报文2、报文3、报文4的报文控制信息为丢弃，即阻断报文2、报文3、报文4的转发。防火墙31根据报文2的报文标识信息和报文控制信息生成报文2的报文控制数据块，根据报文3的报文标识信息和报文控制信息生成报文3的报文控制数据块，根据报文4的报文标识信息和报文控制信息生成报文4的报文控制数据块。防火墙31将报文2、报文3和报文4的报文控制数据块携带在报文控制消息中，例如是图3所示的消息3中，发送至防火墙控制模块32。防火墙控制模块32根据该消息3中报文2、报文3、报文4的报文控制信息，丢弃报文2、报文3、报文4。
其中，上述网络流量来源于TCP连接，防火墙31也可以发送通过复位(reset，RST)报文来终结TCP连接，从而阻断报文2、报文3、报文4。
上述实施例描述了防火墙控制模块32接收到报文控制消息的情况，在一些可能的实现方式中，防火墙控制模块32在预设时间内容未接收到防火墙31发送的报文控制消息时，还可以基于预设的控制策略对多个报文进行控制。
其中，预设的报文控制策略包括多个控制策略，下面分别对不同控制策略进行说明。
第一种控制策略为，严格等待防火墙31的报文控制消息。未收到报文控制消息，则不执行转发或丢弃报文的操作。并且，设置一个超时机制，当缓存时间(或者缓存超时时间)达到预设阈值，则丢弃缓存的报文。
第二种控制策略为，当缓存队列中报文数量达到预设数量时，按先进先出顺序转发报文，保持缓存队列中报文数量不超过预设数量。
第三种控制策略为，当缓存时间(或者缓存超时时间)达到预设阈值，发送缓存的报文。其中，预设阈值可以根据防火墙31的处理时延设置。
其中，上述第一种控制策略适用于对安全性要求较高的业务场景，例如可以应用于内部网络业务；上述第二种控制策略、第三种控制策略适用于对稳定性要求较高的业务场景，例如可以应用于公共网络业务。
基于此，防火墙控制模块32可以在预设时间内容未接收到报文控制消息时，可以从网络流量中获取业务标识，然后防火墙控制模块32根据业务与控制策略的对应关系，从多个控制策略中确定所述业务标识所标识的业务对应的目标控制策略，接着防火墙控制模块32可以基于所述目标控制策略对所述多个报文进行控制。
上文结合附图对本申请实施例的网络流量控制方法进行了详细说明，接下来，结合附图，对本申请实施例的控制系统30进行介绍。
参见图1所示的控制系统30的结构示意图，该控制系统30包括：
防火墙控制模块32，用于接收网络流量，缓存所述网络流量中的多个报文；
防火墙31，用于接收对所述网络流量执行复制操作所得的旁路流量，对所述旁路流量中的报文进行检测，获得报文控制消息；
所述防火墙控制模块32，还用于接收到所述防火墙发送的报文控制消息，对所述多个报文中的目标报文执行目标操作，所述目标操作包括转发、丢弃或缓存。
在一些可能的实现方式中，所述报文控制消息包括报文标识信息和报文控制信息；
所述防火墙控制模块32具体用于：
根据所述报文标识信息，从所述多个报文中确定目标报文；
根据所述报文控制信息，对所述目标报文执行目标操作。
在一些可能的实现方式中，所述多个报文包括相互关联的第一报文和第二报文；所述报文控制消息包括所述第二报文的报文标识信息和报文控制信息，且所述第二报文的报文控制信息指示丢弃所述第二报文；
所述防火墙控制模块32具体用于：
丢弃所述第一报文和所述第二报文。
在一些可能的实现方式中，所述报文控制消息包括第一报文控制消息和第二报文控制消息，所述报文控制消息包括第一报文控制消息和第二报文控制消息，所述第一报文控制消息包括所述第一报文的报文标识信息和第一报文控制信息，所述第一报文的第一报文控制信息指示缓存所述第一报文，所述第二报文控制消息包括所述第一报文的报文标识信息和第二报文控制信息以及所述第二报文的报文标识信息和报文控制信息，所述第一报文的第二报文控制信息和所述第二报文的报文控制信息指示丢弃所述报文；
所述防火墙控制模块32具体用于：
接收到所述第一报文控制消息，延长所述第一报文的缓存时间；
接收到所述第二报文控制消息，丢弃所述第一报文和所述第二报文。
在一些可能的实现方式中，所述防火墙控制模块还用于：
预设时间内未接收到所述防火墙发送的报文控制消息时，基于预设的控制策略对所述 多个报文进行控制。
在一些可能的实现方式中，所述预设的控制策略包括多个控制策略，所述防火墙控制模块具体用于：
从所述网络流量中获取业务标识；
根据业务与控制策略的对应关系，从所述多个控制策略中确定所述业务标识所标识的业务对应的目标控制策略；
基于所述目标控制策略对所述多个报文进行控制。
在一些可能的实现方式中，所述旁路流量通过分光器分光得到，或者通过交换机镜像得到。
根据本申请实施例的控制系统30可对应于执行本申请实施例中描述的方法，并且控制系统30的各个组成部分的上述和其它操作和/或功能分别为了实现图2、图3所示实施例中的各个方法的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种防火墙31。该防火墙可以专用硬件，也可以是部署有相应软件的通用硬件，例如是主机等设备。下面结合附图，对防护墙31的硬件结构进行详细的说明。
图4提供了一种防护墙31的结构示意图，如图4所示，防护墙31包括总线311、处理器312、通信接口313和存储器314。处理器312、存储器314和通信接口313之间通过总线311通信。
总线311可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图4中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器312可以为中央处理器(central processing unit，CPU)、图形处理器(graphics processing unit，GPU)、微处理器(micro processor，MP)或者数字信号处理器(digital signal processor，DSP)等处理器中的任意一种或多种。
通信接口313用于与外部通信。例如，接收交换机对网络流量进行镜像所得的旁路流量，以及向防火墙控制模块32发送报文控制消息等等。
存储器314可以包括易失性存储器(volatile memory)，例如随机存取存储器(random access memory，RAM)。存储器314还可以包括非易失性存储器(non-volatile memory)，例如只读存储器(read-only memory，ROM)，快闪存储器，硬盘驱动器(hard disk drive，HDD)或固态驱动器(solid state drive，SSD)。
存储器314中存储有计算机可读指令，处理器312执行该计算机可读指令，以使防火墙31执行前述网络流量控制方法中由防火墙31执行的方法步骤。
在一些可能的实现方式中，防护墙31可以集成防火墙控制模块32，处理器312执行计算机可读指令，以使防火墙31还执行前述网络流量控制方法中由防火墙控制模块32执行的方法步骤。
本申请实施例还提供了一种防火墙控制模块32。该防火墙控制模块32可以是独立于 防火墙31的硬件。下面结合附图，对防护墙控制模块32的硬件结构进行详细的说明。
图5提供了一种防护墙控制模块32的结构示意图，如图5所示，防护墙控制模块32包括总线321、处理器322、通信接口323和存储器324。处理器322、存储器324和通信接口323之间通过总线321通信。总线321、处理器322、通信接口323和存储器324的具体实现可以参见图4相关内容描述。
在该实施例中，存储器324中存储有计算机可读指令，处理器322执行该计算机可读指令，以使防火墙控制模块32执行前述网络流量控制方法中由防火墙控制模块32执行的方法步骤。
本申请实施例还提供了一种计算机可读存储介质。所述计算机可读存储介质可以是计算设备能够存储的任何可用介质或者是包含一个或多个可用介质的数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘)等。该计算机可读存储介质包括指令，所述指令在防火墙31上运行时，使得防火墙31还执行前述网络流量控制方法中由防火墙31执行的方法步骤。
本申请实施例还提供了另一种计算机可读存储介质。该计算机可读存储介质包括指令，所述指令在防火墙控制模块32上运行时，使得防火墙控制模块32还执行前述网络流量控制方法中由防火墙控制模块32执行的方法步骤。
本申请实施例还提供了一种计算机程序产品。所述计算机程序产品包括一个或多个计算机指令。在防火墙31或防火墙控制模块32上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。
所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机或数据中心进行传输。
所述计算机程序产品可以为一个软件安装包，在需要使用前述网络流量控制方法的任一方法的情况下，可以下载该计算机程序产品并在计算设备上执行该计算机程序产品。
上述各个附图对应的流程或结构的描述各有侧重，某个流程或结构中没有详述的部分，可以参见其他流程或结构的相关描述。

Claims (21)

  1. 一种网络流量控制方法，其特征在于，应用于控制系统，所述控制系统包括防火墙和防火墙控制模块，所述方法包括：
    所述防火墙控制模块接收网络流量，缓存所述网络流量中的多个报文，所述防火墙接收对所述网络流量执行复制操作所得的旁路流量，对所述旁路流量中的报文进行检测，获得报文控制消息；
    所述防火墙控制模块接收到所述防火墙发送的报文控制消息，对所述多个报文中的目标报文执行目标操作，所述目标操作包括转发、丢弃或缓存。
  2. 根据权利要求1所述的方法，其特征在于，所述报文控制消息包括报文标识信息和报文控制信息；
    所述对所述多个报文中的目标报文执行目标操作，包括：
    根据所述报文标识信息，从所述多个报文中确定目标报文；
    根据所述报文控制信息，对所述目标报文执行目标操作。
  3. 根据权利要求1所述的方法，其特征在于，所述多个报文包括相互关联的第一报文和第二报文；
    所述报文控制消息包括所述第二报文的报文标识信息和报文控制信息，且所述第二报文的报文控制信息指示丢弃所述第二报文时，所述防火墙控制模块对所述多个报文中的目标报文执行目标操作，包括：
    所述防火墙控制模块丢弃所述第一报文和所述第二报文。
  4. 根据权利要求3所述的方法，其特征在于，所述报文控制消息包括第一报文控制消息和第二报文控制消息，所述第一报文控制消息包括所述第一报文的报文标识信息和第一报文控制信息，所述第一报文的第一报文控制信息指示缓存所述第一报文，所述第二报文控制消息包括所述第一报文的报文标识信息和第二报文控制信息以及所述第二报文的报文标识信息和报文控制信息，所述第一报文的第二报文控制信息和所述第二报文的报文控制信息指示丢弃所述报文；
    所述防火墙控制模块接收到所述防火墙发送的报文控制消息，对所述多个报文中的目标报文执行目标操作，包括：
    所述防火墙控制模块接收到所述第一报文控制消息，延长所述第一报文的缓存时间；
    所述防火墙控制模块接收到所述第二报文控制消息，丢弃所述第一报文和所述第二报文。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述方法还包括：
    所述防火墙控制模块预设时间内未接收到所述防火墙发送的报文控制消息时，基于预设的控制策略对所述多个报文进行控制。
  6. 根据权利要求5所述的方法，其特征在于，所述预设的控制策略包括多个控制策略，所述防火墙控制模块基于预设的控制策略对所述多个报文进行控制，包括：
    所述防火墙控制模块从所述网络流量中获取业务标识；
    所述防火墙控制模块根据业务与控制策略的对应关系，从所述多个控制策略中确定所述业务标识所标识的业务对应的目标控制策略；
    所述防火墙控制模块基于所述目标控制策略对所述多个报文进行控制。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述旁路流量通过分光器分光得到，或者通过交换机镜像得到。
  8. 一种控制系统，其特征在于，所述系统包括：
    防火墙控制模块，用于接收网络流量，缓存所述网络流量中的多个报文；
    防火墙，用于接收对所述网络流量执行复制操作所得的旁路流量，对所述旁路流量中的报文进行检测，获得报文控制消息；
    所述防火墙控制模块，还用于接收到所述防火墙发送的报文控制消息，对所述多个报文中的目标报文执行目标操作，所述目标操作包括转发、丢弃或缓存。
  9. 根据权利要求8所述的系统，其特征在于，所述报文控制消息包括报文标识信息和报文控制信息；
    所述防火墙控制模块具体用于：
    根据所述报文标识信息，从所述多个报文中确定目标报文；
    根据所述报文控制信息，对所述目标报文执行目标操作。
  10. 根据权利要求8所述的系统，其特征在于，所述多个报文包括相互关联的第一报文和第二报文；所述报文控制消息包括所述第二报文的报文标识信息和报文控制信息，且所述第二报文的报文控制信息指示丢弃所述第二报文；
    所述防火墙控制模块具体用于：
    丢弃所述第一报文和所述第二报文。
  11. 根据权利要求10所述的系统，其特征在于，所述报文控制消息包括第一报文控制消息和第二报文控制消息，所述第一报文控制消息包括所述第一报文的报文标识信息和第一报文控制信息，所述第一报文的第一报文控制信息指示缓存所述第一报文，所述第二报文控制消息包括所述第一报文的报文标识信息和第二报文控制信息以及所述第二报文的报文标识信息和报文控制信息，所述第一报文的第二报文控制信息和所述第二报文的报文控制信息指示丢弃所述报文；
    所述防火墙控制模块具体用于：
    接收到所述第一报文控制消息，延长所述第一报文的缓存时间；
    接收到所述第二报文控制消息，丢弃所述第一报文和所述第二报文。
  12. 根据权利要求8至11任一项所述的系统，其特征在于，所述防火墙控制模块还用于：
    预设时间内未接收到所述防火墙发送的报文控制消息时，基于预设的控制策略对所述多个报文进行控制。
  13. 根据权利要求12所述的系统，其特征在于，所述预设的控制策略包括多个控制策略，所述防火墙控制模块具体用于：
    从所述网络流量中获取业务标识；
    根据业务与控制策略的对应关系，从所述多个控制策略中确定所述业务标识所标识的业务对应的目标控制策略；
    基于所述目标控制策略对所述多个报文进行控制。
  14. 根据权利要求8至13任一项所述的系统，其特征在于，所述旁路流量通过分光器分光得到，或者通过交换机镜像得到。
  15. 一种防火墙，其特征在于，所述防火墙包括处理器和存储器，所述存储器中存储有计算机可读指令，所述处理器执行所述计算机可读指令，使得所述防火墙执行如权利要求1至7任一项所述的由所述防火墙执行的方法步骤。
  16. 根据权利要求15所述的防火墙，其特征在于，所述防火墙还集成有防火墙控制模块，所述处理器还执行所述计算机可读指令，使得所述防火墙还执行如权利要求1至7任一项所述的由所述防火墙控制模块执行的方法步骤。
  17. 一种防火墙控制模块，其特征在于，所述防火墙控制模块包括处理器和存储器，所述存储器中存储有计算机可读指令，所述处理器执行所述计算机可读指令，使得所述防火墙控制模块执行如权利要求1至7任一项所述的由防火墙控制模块的方法步骤。
  18. 一种计算机可读存储介质，其特征在于，包括计算机可读指令，当所述计算机可读指令在防火墙上运行时，使得所述防火墙执行如权利要求1至7任一项所述的由所述防火墙执行的方法步骤。
  19. 一种计算机可读存储介质，其特征在于，包括计算机可读指令，当所述计算机可读指令在防火墙控制模块上运行时，使得所述防火墙控制模块执行如权利要求1至7任一项所述的由防火墙控制模块执行的方法步骤。
  20. 一种计算机程序产品，其特征在于，包括计算机可读指令，当所述计算机可读指令在防火墙上运行时，使得所述防火墙执行如权利要求1至7任一项所述的由所述防火墙执行的方法步骤。
  21. 一种计算机程序产品，其特征在于，包括计算机可读指令，当所述计算机可读指令在防火墙控制模块上运行时，使得所述防火墙控制模块执行如权利要求1至7任一项所述的由防火墙控制模块执行的方法步骤。
PCT/CN2022/092099 2021-09-16 2022-05-11 网络流量控制方法以及相关系统 WO2023040303A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22868681.2A EP4391476A1 (en) 2021-09-16 2022-05-11 Network traffic control method and related system
US18/606,777 US20240223535A1 (en) 2021-09-16 2024-03-15 Network Traffic Control Method and Related System

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111088857.XA CN115834091A (zh) 2021-09-16 2021-09-16 网络流量控制方法以及相关系统
CN202111088857.X 2021-09-16

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/606,777 Continuation US20240223535A1 (en) 2021-09-16 2024-03-15 Network Traffic Control Method and Related System

Publications (1)

Publication Number Publication Date
WO2023040303A1 true WO2023040303A1 (zh) 2023-03-23

Family

ID=85515778

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/092099 WO2023040303A1 (zh) 2021-09-16 2022-05-11 网络流量控制方法以及相关系统

Country Status (4)

Country Link
US (1) US20240223535A1 (zh)
EP (1) EP4391476A1 (zh)
CN (1) CN115834091A (zh)
WO (1) WO2023040303A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116566682A (zh) * 2023-05-16 2023-08-08 赛姆科技(广东)有限公司 一种分布式信息网络安全防护方法、系统及其可读存储介质
CN116633656A (zh) * 2023-06-09 2023-08-22 北京源堡科技有限公司 应用的网络流量阻断方法、装置、计算机设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20240256243A1 (en) * 2023-01-31 2024-08-01 Hitachi, Ltd. Information processing system and information processing method

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101014048A (zh) * 2007-02-12 2007-08-08 杭州华为三康技术有限公司 分布式防火墙系统及实现防火墙内容检测的方法
WO2013165764A1 (en) * 2012-05-01 2013-11-07 Harris Corporation Firewalls for filtering communications in a dynamic computer network
CN106453299A (zh) * 2016-09-30 2017-02-22 北京奇虎科技有限公司 网络安全监控方法、装置及云端web应用防火墙
CN106506513A (zh) * 2016-11-21 2017-03-15 国网四川省电力公司信息通信公司 基于网络流量的防火墙策略数据分析装置及方法
CN109495508A (zh) * 2018-12-26 2019-03-19 成都科来软件有限公司 基于服务访问数据的防火墙配置方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101014048A (zh) * 2007-02-12 2007-08-08 杭州华为三康技术有限公司 分布式防火墙系统及实现防火墙内容检测的方法
WO2013165764A1 (en) * 2012-05-01 2013-11-07 Harris Corporation Firewalls for filtering communications in a dynamic computer network
CN106453299A (zh) * 2016-09-30 2017-02-22 北京奇虎科技有限公司 网络安全监控方法、装置及云端web应用防火墙
CN106506513A (zh) * 2016-11-21 2017-03-15 国网四川省电力公司信息通信公司 基于网络流量的防火墙策略数据分析装置及方法
CN109495508A (zh) * 2018-12-26 2019-03-19 成都科来软件有限公司 基于服务访问数据的防火墙配置方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116566682A (zh) * 2023-05-16 2023-08-08 赛姆科技(广东)有限公司 一种分布式信息网络安全防护方法、系统及其可读存储介质
CN116566682B (zh) * 2023-05-16 2023-12-08 赛姆科技(广东)有限公司 一种分布式信息网络安全防护方法、系统及其可读存储介质
CN116633656A (zh) * 2023-06-09 2023-08-22 北京源堡科技有限公司 应用的网络流量阻断方法、装置、计算机设备及存储介质

Also Published As

Publication number Publication date
US20240223535A1 (en) 2024-07-04
CN115834091A (zh) 2023-03-21
EP4391476A1 (en) 2024-06-26

Similar Documents

Publication Publication Date Title
US8677473B2 (en) Network intrusion protection
WO2023040303A1 (zh) 网络流量控制方法以及相关系统
EP3178216B1 (en) Data center architecture that supports attack detection and mitigation
US9578055B1 (en) Thwarting drone-waged denial of service attacks on a network
US11831420B2 (en) Network application firewall
KR101010465B1 (ko) 엔드포인트 리소스를 사용하는 네트워크 보안 요소
Ambrosin et al. Lineswitch: Efficiently managing switch flow in software-defined networking while effectively tackling dos attacks
US8856913B2 (en) Method and protection system for mitigating slow HTTP attacks using rate and time monitoring
US8661522B2 (en) Method and apparatus for probabilistic matching to authenticate hosts during distributed denial of service attack
US20070245417A1 (en) Malicious Attack Detection System and An Associated Method of Use
US7472418B1 (en) Detection and blocking of malicious code
RU2653241C1 (ru) Обнаружение угрозы нулевого дня с использованием сопоставления ведущего приложения/программы с пользовательским агентом
US20140304817A1 (en) APPARATUS AND METHOD FOR DETECTING SLOW READ DoS ATTACK
US8533834B1 (en) Antivirus intelligent flow framework
JP7388613B2 (ja) パケット処理方法及び装置、デバイス、並びに、コンピュータ可読ストレージ媒体
US20140259140A1 (en) Using learned flow reputation as a heuristic to control deep packet inspection under load
US8006303B1 (en) System, method and program product for intrusion protection of a network
US11757912B2 (en) Deep packet analysis
Boppana et al. Analyzing the vulnerabilities introduced by ddos mitigation techniques for software-defined networks
KR20120121668A (ko) 네트워크 기반 고성능 유해사이트 차단 시스템 및 방법
JP2007179523A (ja) 悪意データを検出する端末装置及び関連方法
US20230367875A1 (en) Method for processing traffic in protection device, and protection device
JP6563872B2 (ja) 通信システム、および、通信方法
WO2023060881A1 (zh) 报文源地址识别方法及装置
FI126032B (en) Detection of threats in communication networks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22868681

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022868681

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022868681

Country of ref document: EP

Effective date: 20240319

NENP Non-entry into the national phase

Ref country code: DE