[go: up one dir, main page]

CN107205007A - Web fire walls transparent mode data spreads transmission method under a kind of cloud environment - Google Patents

Web fire walls transparent mode data spreads transmission method under a kind of cloud environment Download PDF

Info

Publication number
CN107205007A
CN107205007A CN201610154750.3A CN201610154750A CN107205007A CN 107205007 A CN107205007 A CN 107205007A CN 201610154750 A CN201610154750 A CN 201610154750A CN 107205007 A CN107205007 A CN 107205007A
Authority
CN
China
Prior art keywords
waf
web
server
sent
web server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201610154750.3A
Other languages
Chinese (zh)
Inventor
江均勇
朱国文
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Cloud Information Technology Co Ltd
Original Assignee
Shanghai Cloud Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Cloud Information Technology Co Ltd filed Critical Shanghai Cloud Information Technology Co Ltd
Priority to CN201610154750.3A priority Critical patent/CN107205007A/en
Publication of CN107205007A publication Critical patent/CN107205007A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00Data switching networks
    • H04L12/28Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46Interconnection of networks
    • H04L12/4633Interconnection of networks using encapsulation techniques, e.g. tunneling
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/02Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Spreading transmission method the invention discloses Web fire wall transparent mode datas under a kind of cloud environment includes:Web application firewalls are disposed to virtualize form in generic server by cloud mode;When user initiates access request, request message can first pass through web application firewalls and be detected;Request message is transmitted to the Web server of rear end by detection no problem again;Response message is sent to web application firewalls after web server response;Response message is sent to client after the processing of web application firewalls, using harmonized programme, that is Internet user's request accesses Web server, or data center's internal user request access web server all arrives first the physical server where Web server, packet rs destination IP and MAC based on request, by L2/L3 layers of forwarding capability of conventional switch, physical server where being directly sent to Web server simplifies the configuration of transparent flow rule.

Description

Web fire walls transparent mode data spreads transmission method under a kind of cloud environment
Technical field
It is anti-the present invention relates to Web under technical field of internet application, more particularly to a kind of cloud environment Wall with flues transparent mode data spreads transmission method.
Background technology
With internet development, ecommerce, E-Government, prevailing, the Web clothes of Web bank The business value more and more higher that business device is carried, the security threat that Web server is faced is also therewith Increase.Inexorable trend, Web application firewall products are turned into for the defence that Web is applied based on this Come into vogue.Web application firewalls are the fire walls applied for Web, and its function is main A series of attack for the Web application aspects initiated for hacker is on the defensive.It is anti-in Web Under wall with flues transparent mode, by Web fire walls any change will not occur for flow, in deployment, Any change will not be sent to existing network environment, can quickly be realized " plug and play ".
Traditional Web fire walls are main to be realized in the form of software and hardware all-in-one, carries out unit pipe Reason, performance depends on the configuration of hardware;Reliability depends on software architecture, relies on again In the stability of hardware platform.
With the fast development of cloud computing, cloud computing with the pond of its resource, the management concentrated, The excellent characteristics such as high reliability, automatically dispose O&M, increasingly by the pro-gaze in each field. Either data center public cloud deployment, or enterprise private clound and the layout of mixed cloud, All have become irresistible trend, cloud computing also really bring to Capex and Opex reduction.In NFV (Network Function Virtualization, network Virtualization of function) the new technological revolution trend of a ripple under, legacy equipment manufacturer is with " special to set Standby hardware is by king " situation overturned by NFV patterns, network function virtualization and virtually The upper new arena of history will be stepped by changing value-added service.
WAF (Web Application Firewall, Web application firewall) is entered by cloud mode Row deployment, to virtualize form deployment in generic server, generic server is connected to exchange On machine.Need request message being first sent to WAF for protection business, then WAF and Web service Device communicate, as shown in figure 1, message will from interchanger 1 mouthful enter, entered by flowing rule Be connected with interchanger 2 mouthfuls of Host where WAF, WAF to Web server message needs are matched somebody with somebody Put 2 mouthfuls to 3 mouthfuls from interchanger of stream rule.
Conventional switch can be by configuring ACL (access control rule, Access Control List it is) regular, but conventional switch is defective.Interchanger is forwarded and MAC by acl rule Address learning is two independent processes, that is to say, that interchanger carries out the same of acl rule forwarding When can also carry out MAC address learning, this feature just encounters problem in cloud environment transparent mode. It is identical with the packet five-tuple for entering interchanger from 2 mouthfuls to enter the packet of interchanger from 1 mouthful, The result so caused is that Web server floats on interchanger 1 a little while in the mac list items of interchanger Mouthful, 2 mouthfuls are floated on a little while.WAF is to protect seven layers of service, to seven layers of ping, ssh etc. with Under service do not protect, that is to say, that for ping or ssh etc. service it is direct without WAF The drift for accessing Web server mac list items on Web server, interchanger causes to take Web Service access below seven layers of device of business is obstructed.
The content of the invention
In view of current technical field of internet application above shortcomings, the present invention provides a kind of Web fire walls transparent mode data spreads transmission method under cloud environment, and uniform transmission scheme simplifies The configuration of transparent flow rule.
To reach above-mentioned purpose, embodiments of the invention are adopted the following technical scheme that:
Web fire walls transparent mode data spreads transmission method, the cloud environment under a kind of cloud environment Lower Web fire wall transparent mode datas spread transmission method and comprised the following steps:
By cloud mode in generic server with virtualize form dispose Web application firewalls (with Lower abbreviation WAF);
When user initiates access request, request message can first pass through WAF and be detected;
Request message is transmitted to the Web server of rear end by detection no problem again;
Response message is sent to WAF after web server response;
Response message is sent to client after WAF processing.
According to one aspect of the present invention, the handling process of the request includes:Outside access stream Physical server where into Web;, will because Web server is configured with security protection demand Request stream guides WAF into;If WAF is deployed in same physical server with Web server, please Ask and be directly sent to WAF and be then sent through Web server;If WAF and across the physics clothes of Web server Business device, sets up tunnel, between the two between physical server where WAF and Web server Communicated by tunnel.
It is described to work as WAF with Web server across physical server according to one aspect of the present invention When, request processing flow is specially:Physical server where request first is sent into Web server, Then physical server where request message being sent into WAF by tunnel;Physics clothes where WAF Business device is received after channel message, encapsulated message, and sends the requests to WAF progress safety detections; After WAF safety detections, message is sent to the physical server where Web server by tunnel; Physical server where Web is received after channel message, is decapsulated, and is then sent to Web clothes Business device.
According to one aspect of the present invention, if WAF and Web server are in same physical service Device, the handling process of the response is:Response message is sent at WAF, WAF by Web server Response message is sent out into physical server after reason, sent to client.
According to one aspect of the present invention, if WAF and Web server are across physical server, The handling process of the response is:Web server response message, is sent response message by tunnel Physical server where to WAF;Physical server where WAF is received after channel message, encapsulation report Text, and response message is sent to WAF processing;After WAF processing response messages, by message Physical server where being sent to Web server by tunnel;Physical server where Web is received After channel message, decapsulated, then send out physical server, sent to client.
According to one aspect of the present invention, described when user initiates access request, request is arrived first Physical server where Web server.
According to one aspect of the present invention, the packet of the request and response after WAF not Change IP, MAC information.
The advantage that the present invention is implemented:Web fire walls transparent mode under cloud environment of the present invention Data flow transmission method includes:Disposed by cloud mode in generic server with virtualizing form WAF;When user initiates access request, request message can first pass through WAF and be detected;Detection Request message is transmitted to the Web server of rear end by no problem again;It will be rung after web server response Message is answered to be sent to WAF;Response message is sent to client after WAF processing, using unified side The request of case, i.e. Internet user accesses Web server, or data center's internal user please Access web server is asked all to arrive first the physical server where Web server, based on request Packet rs destination IP and MAC, by L2/L3 layers of forwarding capability of conventional switch, are directly sent to Physical server where Web server, simplifies the configuration of transparent flow rule;Further, when WAF when physical server communicates away tunnel, solves packet and enters exchange with Web server Machine protects caused interchanger mac addresses confusion identical into Web server five-tuple with WAF, So as to cause to communicate between WAF and Web server.So that transparent deployment mode is to exchanging Machine is not relied on, and supports the interchanger of L2/L3 forwarding capabilitys to be all suitable for.
Brief description of the drawings
Technical scheme in order to illustrate the embodiments of the present invention more clearly, below will be to embodiment In required for the accompanying drawing that uses be briefly described, it should be apparent that, drawings in the following description Only some embodiments of the present invention, for those of ordinary skill in the art, are not paying On the premise of going out creative work, other accompanying drawings can also be obtained according to these accompanying drawings.
Fig. 1 is the protection business datum streaming schematic diagram described in background of invention;
Fig. 2 spreads for Web fire wall transparent mode datas under a kind of cloud environment of the present invention Transmission method schematic diagram;
Fig. 3 spreads for Web fire wall transparent mode datas under a kind of cloud environment of the present invention Defeated schematic diagram.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, to the technical side in the embodiment of the present invention Case is clearly and completely described, it is clear that described embodiment is only the present invention one Divide embodiment, rather than whole embodiments.Based on the embodiment in the present invention, this area is general The every other embodiment that logical technical staff is obtained under the premise of creative work is not made, Belong to the scope of protection of the invention.
As shown in Figure 1, Figure 2 and Figure 3, Web fire wall transparent mode datas under a kind of cloud environment Spreading Web fire wall transparent mode datas under transmission method, the cloud environment and spreading transmission method includes Following steps:
Step S1:WAF is disposed to virtualize form in generic server by cloud mode;
Step S2:When user initiates access request, request message can first pass through WAF and be examined Survey;
The step S2 is when user initiates access request, and request message can first pass through WAF progress The embodiment of detection can be:When user initiates access request, the destination address of access For Web server, pacified to realize security protection, it is necessary to which request is initially directed into WAF Full inspection is surveyed.
Step S3:Request message is transmitted to the Web server of rear end by detection no problem again;
In actual applications, will if WAF is deployed in same physical server with Web server Request after detection is directly sent to Web server by WAF.
If WAF and Web server are across physical server, where WAF and Web server Being communicated by tunnel between tunnel, two, idiographic flow are set up between physical server It is as follows:After WAF safety detections, message is sent to the physics where Web server by tunnel Physical server where server, Web is received after channel message, is sent to Web server.
Step S4:Response message is sent to WAF after web server response;
If WAF is deployed in same physical server with Web server, Web server will be responded and reported Text is directly sent to WAF.
If WAF, across physical server, is needed by tunnel communication with Web server Reason.
Step S5:Response message is sent to client after WAF processing.
In actual applications, the handling process of the user access request includes:
Outside access stream enters physical server where Web, because Web server is configured with peace Full protection demand, guides request stream into WAF;
If WAF is deployed in same physical server with Web server, request is directly sent to WAF is then sent through Web server;
If WAF and Web server are across physical server, where WAF and Web server Tunnel is set up between physical server, is communicated between the two by tunnel.
It is described when WAF and Web server it is across physical server when, its request processing flow is specific For:
Physical server where request first is sent into Web server, then will be asked by tunnel Message is sent to physical server where WAF;
Physical server where WAF is received after channel message, encapsulated message, and is sent the requests to WAF carries out safety detection;
After WAF safety detections, message is sent to the physics clothes where Web server by tunnel Business device;
Physical server where Web is received after channel message, is decapsulated, is then sent to Web server.
In actual applications, the handling process of the web server response is as follows:
If WAF is with Web server in same physical physical server, the processing of the response Flow is specially:Response message is directly sent to the WAF, WAF of same physical server by Web server Response message is sent out into physical server after processing, then sent to client.
If WAF and across the physical server of Web server, the handling process of the response Specially:Web server response message, physics where response message is sent into WAF by tunnel Server;Physical server where WAF is received after channel message, encapsulated message, and response is reported Text is sent to WAF processing;After WAF processing response messages, message is sent to by tunnel Physical server where Web server;Physical server where Web is received after channel message, is entered Row decapsulation, then sends out physical server, is sent to client.
In actual applications, it is described request and response packet do not change after WAF IP, MAC information.
The advantage that the present invention is implemented:Web fire walls transparent mode under cloud environment of the present invention Data flow transmission method includes:Disposed by cloud mode in generic server with virtualizing form WAF;When user initiates access request, request message can first pass through WAF and be detected;Detection Request message is transmitted to the Web server of rear end by no problem again;It will be rung after web server response Message is answered to be sent to WAF;Response message is sent to client after WAF processing, using unified side The request of case, i.e. Internet user accesses Web server, or data center's internal user please Access web server is asked all to arrive first the physical server where Web server, based on request Packet rs destination IP and MAC, by L2/L3 layers of forwarding capability of conventional switch, are directly sent to Physical server where Web server, simplifies the configuration of transparent flow rule;Further, when WAF when physical server communicates away tunnel, solves packet and enters exchange with Web server Machine protects caused interchanger mac addresses confusion identical into Web server five-tuple with WAF, So as to cause to communicate between WAF and Web server.So that transparent deployment mode is to exchanging Machine is not relied on, and supports the interchanger of L2/L3 forwarding capabilitys to be all suitable for.
The foregoing is only a specific embodiment of the invention, but protection scope of the present invention is simultaneously This is not limited to, any those skilled in the art is in technology model disclosed by the invention In enclosing, the change or replacement that can be readily occurred in should be all included within the scope of the present invention. Therefore, protection scope of the present invention should be based on the protection scope of the described claims.

Claims (7)

1. Web fire walls transparent mode data spreads transmission method under a kind of cloud environment, its feature exists In Web fire walls transparent mode data spreads transmission method and comprised the following steps under the cloud environment:
WAF is disposed to virtualize form in generic server by cloud mode;
When user initiates access request, request message can first pass through WAF and be detected;
Request message is transmitted to the Web server of rear end by detection no problem again;
Response message is sent to WAF after web server response;
Response message is sent to client after WAF processing.
2. Web fire walls transparent mode data spreads under cloud environment according to claim 1 Transmission method, it is characterised in that the handling process of the request includes:Outside access stream enters Web Physical server where server;, please because Web server is configured with security protection demand Stream is asked to guide WAF into;If WAF is deployed in same physical server with Web server, it will ask It is directly sent to WAF and is then sent through Web server;If WAF is with Web server across physical services Device, tunnel is set up between physical server where WAF and Web server, is led between the two Tunnel is crossed to be communicated.
3. Web fire walls transparent mode data spreads under cloud environment according to claim 2 Transmission method, it is characterised in that described when WAF and Web server are across physical server, please The handling process is asked to be specially:Physical server where request first is sent into Web server, then Physical server where request message is sent into WAF by tunnel;Physical server where WAF Receive after channel message, encapsulated message, and send the requests to WAF and carry out safety detection;WAF After safety detection, message is sent to the physical server where Web server by tunnel; Physical server where Web is received after channel message, is decapsulated, and is then sent to Web clothes Business device.
4. Web fire walls transparent mode data spreads under cloud environment according to claim 1 Transmission method, it is characterised in that if WAF and Web server are in same physical server, institute The handling process for stating response is:Response message is sent to WAF by Web server, will after WAF processing Response message sends out physical server, is sent to client.
5. Web fire walls transparent mode data spreads under cloud environment according to claim 1 Transmission method, it is characterised in that if WAF and Web server are across physical server, the sound The handling process answered is:Web server response message, WAF is sent to by tunnel by response message Place physical server;Physical server where WAF is received after channel message, encapsulated message, and Response message is sent to WAF processing;After WAF processing response messages, message is passed through into tunnel Road is sent to physical server where Web server;Physical server where Web receives tunnel report Wen Hou, is decapsulated, and then sends out physical server, is sent to client.
6. Web fire walls transparent mode under the cloud environment according to one of claim 1 to 5 Data flow transmission method, it is characterised in that described when user initiates access request, request is arrived first Physical server where Web server.
7. Web fire walls transparent mode data spreads under cloud environment according to claim 6 Transmission method, it is characterised in that the packet of the request and response do not change after WAF IP, MAC information.
CN201610154750.3A 2016-03-18 2016-03-18 Web fire walls transparent mode data spreads transmission method under a kind of cloud environment Pending CN107205007A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610154750.3A CN107205007A (en) 2016-03-18 2016-03-18 Web fire walls transparent mode data spreads transmission method under a kind of cloud environment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610154750.3A CN107205007A (en) 2016-03-18 2016-03-18 Web fire walls transparent mode data spreads transmission method under a kind of cloud environment

Publications (1)

Publication Number Publication Date
CN107205007A true CN107205007A (en) 2017-09-26

Family

ID=59904069

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610154750.3A Pending CN107205007A (en) 2016-03-18 2016-03-18 Web fire walls transparent mode data spreads transmission method under a kind of cloud environment

Country Status (1)

Country Link
CN (1) CN107205007A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108156079A (en) * 2017-12-29 2018-06-12 深信服网络科技(深圳)有限公司 A kind of data packet forwarding system and method based on cloud service platform

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104113527A (en) * 2014-06-19 2014-10-22 上海地面通信息网络有限公司 Waf firewall configuration applied to cloud computing network
CN104615934A (en) * 2015-02-03 2015-05-13 腾讯科技(深圳)有限公司 SQL injection attack safety protection method and system
US9088544B1 (en) * 2014-09-11 2015-07-21 Fortinet, Inc. Interface groups for rule-based network security
CN104917653A (en) * 2015-06-26 2015-09-16 北京奇虎科技有限公司 Virtual flow monitoring method based on cloud platform and device thereof

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104113527A (en) * 2014-06-19 2014-10-22 上海地面通信息网络有限公司 Waf firewall configuration applied to cloud computing network
US9088544B1 (en) * 2014-09-11 2015-07-21 Fortinet, Inc. Interface groups for rule-based network security
CN104615934A (en) * 2015-02-03 2015-05-13 腾讯科技(深圳)有限公司 SQL injection attack safety protection method and system
CN104917653A (en) * 2015-06-26 2015-09-16 北京奇虎科技有限公司 Virtual flow monitoring method based on cloud platform and device thereof

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108156079A (en) * 2017-12-29 2018-06-12 深信服网络科技(深圳)有限公司 A kind of data packet forwarding system and method based on cloud service platform
CN108156079B (en) * 2017-12-29 2021-08-13 深信服科技股份有限公司 Data packet forwarding system and method based on cloud service platform

Similar Documents

Publication Publication Date Title
US11770408B2 (en) Method and system of mitigating network attacks
US12212476B2 (en) System and method for network policy simulation
US11729059B2 (en) Dynamic service device integration
US10944691B1 (en) Container-based network policy configuration in software-defined networking (SDN) environments
US20210243276A1 (en) Systems and methods for protecting an identity in network communications
US11343229B2 (en) Managed forwarding element detecting invalid packet addresses
US11252183B1 (en) System and method for ransomware lateral movement protection in on-prem and cloud data center environments
US10341185B2 (en) Dynamic service insertion
CN105591978B (en) Network-based service function link
CN105099779B (en) Multi-tenant cloud platform framework
CN104301321B (en) A kind of method and system for realizing distributed network security protection
CN104954367B (en) A kind of cross-domain ddos attack means of defence of internet omnidirectional
US10778465B1 (en) Scalable cloud switch for integration of on premises networking infrastructure with networking services in the cloud
CN108449314B (en) Flow traction method and device
CN105100026A (en) Safe message forwarding method and safe message forwarding device
US20260032135A1 (en) Dns recursive ptr signals analysis
US20240214416A1 (en) Virtual network distributed denial-of-service scrubber
CN105939267B (en) Outband management method and device
Khan et al. FML: A novel forensics management layer for software defined networks
CN120153359A (en) Routing in GPU Superclusters
CN107205007A (en) Web fire walls transparent mode data spreads transmission method under a kind of cloud environment
CN105959248B (en) The method and device of message access control
CN109728926A (en) Communication means and the network equipment
CN106357446B (en) A kind of acquisition methods and device of flow forward-path
US20210226869A1 (en) Offline connectivity checks

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
AD01 Patent right deemed abandoned
AD01 Patent right deemed abandoned

Effective date of abandoning: 20210312