CN111181985B - Data transmission method, data transmission system, firewall device and storage medium - Google Patents

Abstract

The present disclosure provides a data transmission method, applied to a first firewall, the method including: under the condition that a request data packet from a client is sent to a server through a second firewall, a response data packet from the server is received, wherein the first firewall is a backup firewall of the second firewall; analyzing the response data packet to obtain analysis data; searching whether session data matched with the response data packet exists according to the analysis data so as to determine whether the response data packet is sent to the second firewall; and sending the response data packet to the second firewall under the condition that the session data matched with the response data packet does not exist, so that the response data packet is processed through the second firewall. The present disclosure also provides a data transmission method applied to the second firewall, a data transmission system and a firewall device, a readable storage medium and a computer program product.

Description

Data transmission method, data transmission system, firewall device and storage medium

technical field

The present disclosure relates to the field of computer technology, and more specifically, to a data transmission method, a data transmission system, a firewall device, a readable storage medium, and a computer program product.

Background technique

When deploying multiple firewall devices (hereinafter referred to as firewalls), due to the complex network environment of customers, there are generally some special requirements, such as: not changing the current network networking, not causing the purchase of other network devices due to firewall deployment, independent firewalls Work and backup each other, support path redundancy under asymmetric routing structure.

At present, firewalls of mainstream manufacturers, based on link-level multiple redundancy capabilities, can provide flexible networking in various environments. When deploying, you can choose the active/standby and active/main structure or Full Mesh according to the specific customer network environment. The networking mode supports session synchronization when multiple firewalls work independently. When multiple firewalls support session synchronization, the firewalls need to transmit the session data created by each, and then forward the data packets based on the created session data.

In the process of implementing the disclosed concept, the inventor found that there are at least the following problems in the related technology: if the firewall receives the data packet returned by the server without session data, the packet that should have been forwarded to the client may be lost In this case, the client needs to re-initiate the connection establishment process, thus affecting the data transmission efficiency.

Contents of the invention

In view of this, the present disclosure provides a data transmission method, a data transmission system and a firewall device.

One aspect of the present disclosure provides a data transmission method applied to a first firewall, the method comprising: receiving a response from the server when a request data packet from the client is sent to the server through the second firewall A data packet, wherein the first firewall is a backup firewall of the second firewall; analyze the response data packet to obtain analysis data; find whether there is a session matching the response data packet according to the analysis data data to determine whether to send the response data packet to the second firewall; and if there is no session data matching the response data packet, send the response data packet to the second firewall to The response data packet is processed through the second firewall.

According to an embodiment of the present disclosure, the method further includes: if there is no session data matching the response data packet, before sending the response data packet to the second firewall, determining the response The protocol type of the data packet; judging whether the protocol type of the response data packet is configured with a forwarding strategy; and in the case of the protocol type of the response data packet configured with a forwarding strategy, sending the response data to the second firewall Bag.

According to an embodiment of the present disclosure, the method further includes: when the protocol type of the response data packet is not configured with a forwarding policy, performing a check operation on the response data packet; case, create a session corresponding to the response data packet, and send the response data packet to the client; and when the response data packet fails to check, discard the response data packet deal with.

According to an embodiment of the present disclosure, the method further includes: if there is session data matching the response data packet, sending the response data packet to the client.

According to an embodiment of the present disclosure, processing the response data packet through the second firewall includes: judging whether there is session data matching the response data packet in the second firewall; If there is session data matching the response data packet, packet loss processing is performed on the response data packet.

According to an embodiment of the present disclosure, the method further includes: when there is session data matching the response data packet in the second firewall, sending the response data packet to the client; and sending the response data packet to the client; The first firewall sends the session data, so that the first firewall saves the session data.

Another aspect of the present disclosure provides a data transmission method applied to the second firewall, the method comprising: sending a request packet from the client to the server; receiving a response packet from the first firewall, and responding to the response Packets are processed. Wherein, the first firewall is a backup firewall of the second firewall, and the response data packet is sent after the first firewall performs the following operations: receiving the response data packet from the server; Analyzing the data packet to obtain analysis data; searching whether there is session data matching the response data packet according to the analysis data, so as to determine whether to send the response data packet to the second firewall; and according to the analysis data Finding that there is no session data matching the response data packet, and sending the response data packet to the second firewall.

According to an embodiment of the present disclosure, processing the response data packet includes: judging whether there is session data matching the response data packet in the second firewall; In the case of matching session data, packet loss processing is performed on the response data packet; when there is session data matching the response data packet in the second firewall, sending the response data to the client packet; and sending the session data to the first firewall, so that the first firewall saves the session data.

Another aspect of the present disclosure provides a data transmission system, including a first firewall and a second firewall, wherein the first firewall is a backup firewall of the second firewall, wherein:

The first firewall is used to execute: when sending a request packet from the client to the server through the second firewall, receiving a response packet from the server; parsing the response packet to obtain Analyzing the data; searching whether there is session data matching the response data packet according to the analysis data, so as to determine whether to send the response data packet to the second firewall; and if there is no session data matching the response data packet In the case of session data, sending the response data packet to the second firewall;

The second firewall is used for: sending the request data packet from the client to the server; receiving the response data packet from the first firewall; and processing the response data packet.

Another aspect of the present disclosure provides a firewall device, including: one or more processors; memory for storing one or more programs, wherein, when the one or more programs are used by the one or more When the processors are executed, the one or more processors are made to implement the method as described above.

Another aspect of the present disclosure provides a readable storage medium storing computer-executable instructions, which are used to implement the above-mentioned method when executed.

Another aspect of the present disclosure provides a computer program product including executable instructions, which when executed by a processor cause the processor to implement the method as described above.

According to an embodiment of the present disclosure, when the first firewall receives a response data packet from the server, it parses the response data packet, finds whether there is session data matching the response data packet according to the parsed data, and checks if there is no session data matching the response data packet. If the response data packet matches the session data, the response data packet is sent to the second firewall, so that the response data packet is processed by the second firewall. Since the second firewall can determine whether to forward the response data packet to the client according to the session data created by itself, it at least partially overcomes the possible occurrence of this problem if the first firewall receives the data packet returned by the server without a session. The situation of forwarding to the client but losing the packet leads to the technical problem that the client needs to re-initiate the connection establishment process, thereby achieving the technical effect of improving the data transmission efficiency.

Description of drawings

The above and other objects, features and advantages of the present disclosure will be more clearly described through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

FIG. 1 schematically shows an exemplary system architecture in which a data transmission method and a data transmission system can be applied according to an embodiment of the present disclosure;

FIG. 2 schematically shows an exemplary system architecture in which a data transmission method and a data transmission system can be applied according to another embodiment of the present disclosure;

FIG. 3 schematically shows a flowchart of a data transmission method applied to a first firewall according to an embodiment of the present disclosure;

FIG. 4 schematically shows a flowchart of a data transmission method applied to a first firewall according to another embodiment of the present disclosure;

FIG. 5 schematically shows a flowchart of a data transmission method applied to a first firewall according to another embodiment of the present disclosure;

FIG. 6 schematically shows a flowchart of a data transmission method applied to a data transmission system according to another embodiment of the present disclosure;

FIG. 7 schematically shows a block diagram of a data transmission device applied to a first firewall according to an embodiment of the present disclosure;

FIG. 8 schematically shows a block diagram of a data transmission device applied to a second firewall according to an embodiment of the present disclosure; and

Fig. 9 schematically shows a block diagram of a firewall device suitable for implementing the data transmission method described above according to an embodiment of the present disclosure.

Detailed ways

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. It should be understood, however, that these descriptions are exemplary only, and are not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Also, in the following description, descriptions of well-known structures and techniques are omitted to avoid unnecessarily obscuring the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only, and is not intended to be limiting of the present disclosure. The terms "comprising", "comprising", etc. used herein indicate the presence of stated features, steps, operations and/or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

All terms (including technical and scientific terms) used herein have the meaning commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted to have a meaning consistent with the context of this specification, and not be interpreted in an idealized or overly rigid manner.

Where expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted as those skilled in the art would normally understand the expression (for example, "having A, B, and C A system of at least one of "shall include, but not be limited to, systems with A alone, B alone, C alone, A and B, A and C, B and C, and/or A, B, C, etc. ). Where expressions such as "at least one of A, B, or C, etc." are used, they should generally be interpreted as those skilled in the art would normally understand the expression (for example, "having A, B, or C A system of at least one of "shall include, but not be limited to, systems with A alone, B alone, C alone, A and B, A and C, B and C, and/or A, B, C, etc. ).

Fig. 1 schematically shows an exemplary system architecture in which a data transmission method and a data transmission system can be applied according to an embodiment of the present disclosure.

As shown in FIG. 1 , the data transmission system 100 includes a first firewall 101 and a second firewall 102 , wherein the first firewall 101 is a backup firewall of the second firewall 102 .

According to an embodiment of the present disclosure, the data transmission system 100 may belong to an asymmetric routing network, and its routing strategy is: the second firewall 102 receives the request data packet Syn(req) from the client 104, and sends the request packet Syn(req) to the server 103 through the second firewall 102 Send the request packet Syn(req) from the client 104, and the response packet Syn(req, Ack) sent by the server 103 may be returned to the client 104 through the first firewall 101. This routing strategy is referred to as different path return .

In terms of data transmission, for data packets passing through the second firewall 102, the second firewall 102 will establish a session (Session) according to the policy, and match the subsequent data packets through the session, and if they can match, the data packets will be quickly forwarded. If the data packet returned by the server 102 passes through the first firewall 101, the first firewall 101 also needs to perform session matching according to the returned data packet.

According to the embodiment of the present disclosure, in order to ensure that the data packets returned by different paths are not discarded by the first firewall 101, the first firewall 101 and the second firewall 102, which are mutually backup, can be connected by a heartbeat line, and the second firewall 102 can complete the session in real time The data Session sync is synchronized to the first firewall 101, so that the same session also exists in the first firewall 101 to achieve normal matching response data packets. When there is a session, it can be quickly forwarded, and operations such as status checks and security policy checks are no longer performed. Normal Forward the response packet.

However, if the first firewall 101 receives the data packet without a session, it will perform operations such as state check and security policy check according to the configuration. If the check is passed, a new session will be created and subcontracted; if the check is not passed, the packet may be discarded directly, and the firewall will not be able to establish a new session for the response packet.

In the process of implementing the present disclosure, the inventor found that if the second firewall 102 synchronizes the session data Sessionsync to the first firewall 101, the session data may arrive after the first firewall 101 receives the response data packet, which may cause the response data The first packet or the first few packets are discarded by the first firewall 101 because the packet fails to pass through operations such as state check and security policy check.

In addition, if the UDP protocol is used to transmit session data synchronously, it is difficult to ensure that the other firewall can receive it. If the session data is not received, the session data synchronization packet will not be retransmitted, that is, the session data synchronization packet may be lost It will cause the response packet to be discarded by the firewall because other checks fail. Seriously reduces the success rate of network connections in an asymmetric network environment, especially for TCP connections, because TCP connections generally account for more than 90% of the network usage, thus affecting the normal use of the network.

Through the embodiment of the present disclosure, when the second firewall 102 sends the request packet from the client 104 to the server 103, the first firewall 101 receives the response packet from the server 103, and performs Analyze to obtain the analysis data; find whether there is session data matching the response packet according to the analysis data, to determine whether to send the response packet to the second firewall 102; in the case of no session data matching the response packet, the first A firewall 101 sends a response data packet to the second firewall 102 . The second firewall 102 receives the response data packet from the first firewall 101 and processes the response data packet.

Since the second firewall can determine whether to forward the response data packet to the client according to the session data created by itself, it at least partially overcomes the possible occurrence of this problem if the first firewall receives the data packet returned by the server without a session. The situation of forwarding to the client but losing the packet leads to the technical problem that the client needs to re-initiate the connection establishment process, thereby achieving the technical effect of improving the data transmission efficiency.

In the present disclosure, the first firewall 101 sends a response data packet to the second firewall 102, which effectively improves the success rate of establishing a TCP connection, ensures the stability of an asymmetric network, and effectively improves user experience.

The present disclosure proposes a special processing method for firewalls to return packets from different paths in an asymmetric network environment, and realizes zero packet loss of packets returned from different paths by the firewall under an asymmetric network. Solved the problem of the firewall discarding the return packet, and improved the reliability of the firewall.

According to an embodiment of the present disclosure, a router 105 may be included between the server 103 and the first firewall 101 and the second firewall 102 for implementing data transmission between the server 103 and the first firewall 101 and the second firewall 102 .

According to an embodiment of the present disclosure, a router 106 may be included between the client 104 and the first firewall 101 and the second firewall 102 for implementing data transmission between the client 104 and the first firewall 101 and the second firewall 102 .

It should be noted that, what is shown in FIG. 1 is only an example of the system architecture to which the embodiments of the present disclosure can be applied, so as to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other device, system, environment or scenario.

For example, FIG. 2 schematically shows an exemplary system architecture in which a data transmission method and a data transmission system can be applied according to another embodiment of the present disclosure.

As shown in FIG. 2 , in the local area network Lan, one or more clients may be included, and one or more clients may send request data packets, routed and forwarded via router 201 or router 202, and pass through the firewall 203 in the data transmission system 200 Or the firewall 204 establishes a session, detects, etc., and routes and forwards the request data packet to the WAN Internet via the router 205 or router 206 . Wherein, regarding the execution flow of the firewall 203 or the firewall 204, reference may be made to the description in FIG. 1 , which will not be repeated here.

It should be understood that the numbers of firewalls, clients and servers in Fig. 1 and Fig. 2 are only illustrative. According to the implementation needs, there can be any number of firewalls, clients and servers.

Fig. 3 schematically shows a flowchart of a data transmission method applied to a first firewall according to an embodiment of the present disclosure.

As shown in FIG. 3 , the data transmission method applied to the first firewall includes operations S301-S304.

In operation S301, when a request data packet from the client is sent to the server through the second firewall, a response data packet is received from the server, wherein the first firewall is a backup firewall of the second firewall.

According to an embodiment of the present disclosure, the second firewall may first send the request packet from the client to the server, and then the first firewall receives the response packet from the server. In other words, the data transmission method applied to the first firewall is applicable to the scenario of packet return through different paths. Wherein, the first firewall is the backup firewall of the second firewall means that after the second firewall receives the request data packet and establishes the session data corresponding to the request data packet, under normal circumstances, the second firewall will associate with the The session data corresponding to the request data packet is sent to the first firewall synchronously, so that the first firewall can save the session data corresponding to the request data packet.

In operation S302, the response data packet is parsed to obtain parsed data.

According to an embodiment of the present disclosure, the analysis data may include the IP address of the client, the IP address of the server, the port address of the client, the port address of the server, the transmission protocol type and other data.

In operation S303, it is searched according to the parsed data whether there is session data matching the response data packet, so as to determine whether to send the response data packet to the second firewall.

According to an embodiment of the present disclosure, the session data may include identification information used to identify the client sending the request data packet, for example, the IP address of the client, and the port address of the client. Of course, the session data may also include data such as the IP address of the server, the port address of the server, the type of transmission protocol, and the like.

According to an embodiment of the present disclosure, the IP address of the client included in the analysis data may be matched with the IP address of the client stored in the first firewall. If the IP address of the client stored in the first firewall includes the IP address of the client included in the analysis data, the match is successful; if the IP address of the client stored in the first firewall does not include the IP address of the client included in the analysis data , the match is unsuccessful.

According to an embodiment of the present disclosure, if it is determined that there is session data matching the response data packet after the first firewall search, the response data packet may be directly sent to the client.

In operation S304, if there is no session data matching the response data packet, the response data packet is sent to the second firewall, so that the response data packet is processed by the second firewall.

According to the embodiment of the present disclosure, the number of the second firewall is not limited, for example, it may include 1 firewall, or may include 2 firewalls, and so on. In other words, if there is no session data matching the response data packet, the first firewall may send the response data packet to multiple second firewalls.

According to an embodiment of the present disclosure, the processing of the response data packet by the second firewall includes: judging whether there is session data matching the response data packet in the second firewall, and if there is no session data matching the response data packet in the second firewall , and perform packet loss processing on the response data packet.

According to an embodiment of the present disclosure, when there is session data matching the response data packet in the second firewall, the response data packet is sent to the client, and the session data is sent to the first firewall, so that the first firewall saves the session data.

Through the embodiments of the present disclosure, when the second firewall has session data matching the response data packet, the session data is sent to the first firewall, so that when the first firewall receives the response data packet again, it can directly The data is matched, and there is no need to send the response data packet to the second firewall for processing again. This disclosure optimizes the firewall session synchronization mechanism in an asymmetric network environment, and improves the session synchronization success rate of the firewall.

According to an embodiment of the present disclosure, when the first firewall receives a response data packet from the server, it parses the response data packet, finds whether there is session data matching the response data packet according to the parsed data, and checks if there is no session data matching the response data packet. If the response data packet matches the session data, the response data packet is sent to the second firewall, so that the response data packet is processed by the second firewall. Since the second firewall can determine whether to forward the response data packet to the client according to the session data created by itself, it at least partially overcomes the possible occurrence of this problem if the first firewall receives the data packet returned by the server without a session. The situation of forwarding to the client but losing the packet leads to the technical problem that the client needs to re-initiate the connection establishment process, thereby achieving the technical effect of improving the data transmission efficiency.

The response data packet is sent to the second firewall through the first firewall, so that the response data packet can be processed through the second firewall, and the zero packet loss of the asymmetric network of the firewall is realized, and it is applied to the asymmetric group of the firewall Network environment, improve the reliability and practicability of the firewall in the asymmetric network. It can solve the technical problem that the session synchronization packet sent by the second firewall to the first firewall is lost or the synchronization packet arrives late, resulting in the loss of the response data packet. effective supplement.

Referring to FIGS. 4 to 6 , the method shown in FIG. 3 will be further described in conjunction with specific embodiments.

Fig. 4 schematically shows a flowchart of a data transmission method applied to a first firewall according to another embodiment of the present disclosure.

As shown in FIG. 4 , the data transmission method applied to the first firewall includes operations S401 to S403 in addition to operations S301 to S304 .

In operation S401, in case there is no session data matching the response data packet, before sending the response data packet to the second firewall, the protocol type of the response data packet is determined.

According to the embodiments of the present disclosure, in the process of data transmission, the protocol type of data packet processing is mainly TCP protocol, and other protocols (not limited to transport layer protocols) can also refer to this method for processing.

In operation S402, it is determined whether the protocol type of the response data packet is configured with a forwarding policy.

According to the embodiments of the present disclosure, a forwarding policy may be configured for one or more of protocols such as the TCP protocol and the UDP protocol. Due to the high proportion of TCP in network data transmission, only the forwarding of TCP type data packets can be enabled by default, and the data packets of other protocol types can be enabled according to the actual application scenario.

In operation S403, if the protocol type of the response data packet is configured with a forwarding policy, send the response data packet to the second firewall.

Fig. 5 schematically shows a flowchart of a data transmission method applied to a first firewall according to another embodiment of the present disclosure.

As shown in FIG. 5, the data transmission method applied to the first firewall further includes operations S501-S503 in addition to operations S301-S304 and S401-S403.

In operation S501, if the protocol type of the response data packet is not configured with a forwarding policy, a check operation is performed on the response data packet.

According to an embodiment of the present disclosure, for example, the checking operation may include performing status checking, security policy checking, and other operations.

In operation S502, if the response data packet passes the inspection, create a session corresponding to the response data packet, and send the response data packet to the client.

In operation S503, in the case that the response data packet fails to pass the inspection, the response data packet is discarded.

According to an embodiment of the present disclosure, therefore, the above method of sending a response data packet to the second firewall is described by using a TCP connection establishment process.

a) the first firewall receives the Tcp response packet, and performs the following processing:

i. Detect that the Session session matches, and if it matches, send the Tcp response packet directly to the client.

ii If there is no session session matching, it is judged whether the Tcp response packet type is configured with a forwarding switch, and if so, the next step is performed: b) the first firewall forwards the response packet sync (req, ack) to the second firewall.

iii. If the forwarding switch is not configured for the Tcp response packet type, it will be processed according to the original packet processing method of the first firewall, for example, perform various inspection operations, if the inspection operation passes, create a new Session and forward it, if the inspection fails , the packet is discarded directly.

b) The first firewall forwards the response data packet sync(req, ack) to the second firewall.

c) The second firewall receives the response packet forwarded by the first firewall, and performs the following processing:

i. Detect Session match, if not match, directly drop the packet.

ii If it matches, forward the response packet to the client, ensuring the establishment of the Tcp connection, and execute the next step iii.

iii. Since the response packet from the first firewall is received, it indicates that the session synchronization may fail, and the second firewall initiates the process of session synchronization to the first firewall again. The first firewall has a Tcp connection session, and other Tcp response data packets sent by the server can be normally and quickly forwarded by the first firewall to the client.

Fig. 6 schematically shows a flowchart of a data transmission method applied to a data transmission system according to another embodiment of the present disclosure.

Referring to FIG. 1 , in this embodiment, the process of processing the response data packet returned from the server 103 by the first firewall 101 is described. The first firewall 101 and the second firewall 102 can be mutually active and standby firewalls, and the Session synchronization packet that can be applicable to the second firewall 102 may be lost or arrive too late, that is, the Session synchronization packet of the second firewall 102 in step0 is sent to the first firewall At 101, the Session synchronization packet was lost or arrived too late.

As shown in FIG. 6, the method includes operations S601-S616.

In operation S601, the standby firewall (at this time, the first firewall 101 is the standby firewall, referred to as the standby firewall) receives a data packet (ie, a response data packet) returned by the server 103 .

In operation S602, the standby firewall parses the quintuple of the data message to find a matching session Session. Wherein, the five-tuple may include the IP address of the client, the IP address of the server, the port address of the client, the port address of the server, and the transmission protocol type.

In operation S603, the standby firewall judges whether there is a matching session, and if there is a matching session, perform operation S612; if not, perform operation S604.

In operation S604, the packet type of the message is obtained, and special processing configuration is searched.

In operation S605, it is determined whether data packet forwarding needs to be performed. If the data packet of this type is configured with a processing switch, perform operation S607, and if not configured, perform operation S613

In operation S606, the standby firewall forwards the data packet to the primary firewall (that is, the second firewall 102, referred to as the primary firewall).

In operation S607, the main firewall analyzes the 5-tuple of the message to find a matching Session.

In operation S608, the main firewall judges whether the Session exists, if there is a match, perform operation S609, and if not exist, perform operation S614.

In operation S609, the main firewall forwards the packet to the client.

In operation S610, the active firewall synchronizes the session to the standby firewall again.

In operation S611, the standby firewall saves the synchronized Session.

In operation S612, the standby firewall has a session matching the message, and directly forwards the message to the client.

In operation S613, if there is no special processing switch for this type of data packet in the standby firewall, various checks are performed according to normal data packets to determine whether the check is passed.

In operation S614, the standby firewall fails to pass the check, and discards the packet.

In operation S615, the standby firewall passes the check, creates a new session, and forwards the message.

In operation S616, the main firewall discards the message if there is no session matching the message.

According to an embodiment of the present disclosure, when the first firewall receives a response data packet from the server, it parses the response data packet, finds whether there is session data matching the response data packet according to the parsed data, and checks if there is no session data matching the response data packet. If the response data packet matches the session data, the response data packet is sent to the second firewall, so that the response data packet is processed by the second firewall. Since the second firewall can determine whether to forward the response data packet to the client according to the session data created by itself, it at least partially overcomes the possible occurrence of this problem if the first firewall receives the data packet returned by the server without a session. The situation of forwarding to the client but losing the packet leads to the technical problem that the client needs to re-initiate the connection establishment process, thereby achieving the technical effect of improving the data transmission efficiency.

The response data packet is sent to the second firewall through the first firewall, so that the response data packet can be processed through the second firewall, and the zero packet loss of the asymmetric network of the firewall is realized, and it is applied to the asymmetric group of the firewall Network environment, improve the reliability and practicability of the firewall in the asymmetric network. It can solve the technical problem that the session synchronization packet sent by the second firewall to the first firewall is lost or the synchronization packet arrives late, resulting in the loss of the response data packet. effective supplement.

Fig. 7 schematically shows a block diagram of a data transmission device applied to a first firewall according to an embodiment of the present disclosure.

As shown in FIG. 7 , the data transmission device 700 applied to the first firewall includes a first receiving module 701 , an analyzing module 702 , a searching module 703 and a first sending module 704 .

The first receiving module 701 is configured to receive a response data packet from the server when the request data packet from the client is sent to the server through the second firewall, wherein the first firewall is the second firewall Backup your firewall.

The parsing module 702 is configured to parse the response data packet to obtain parsed data.

The searching module 703 is configured to search whether there is session data matching the response data packet according to the parsed data, so as to determine whether to send the response data packet to the second firewall.

The first sending module 704 is configured to send the response data packet to the second firewall when there is no session data matching the response data packet, so that the response data is processed by the second firewall The package is processed.

Fig. 8 schematically shows a block diagram of a data transmission device applied to a second firewall according to an embodiment of the present disclosure.

As shown in FIG. 8 , the data transmission device 800 applied to the second firewall includes a second sending module 801 , a second receiving module 802 and a processing module 803 .

The second sending module 801 is configured to send the request packet from the client to the server.

The second receiving module 802 is configured to receive a response data packet from the first firewall, wherein the first firewall is a backup firewall of the second firewall, and the response data packet is sent after the first firewall performs the following operations; receiving a response from the server data packet; analyze the response data packet to obtain analysis data; find whether there is session data matching the response data packet according to the analysis data, so as to determine whether to send the response data packet to the second firewall; search for the non-existence and response data according to the analysis data Package matching session data.

The processing module 803 is used to process the response data packet.

Through the embodiments of the present disclosure, when the second firewall has session data matching the response data packet, the session data is sent to the first firewall, so that when the first firewall receives the response data packet again, it can directly The data is matched, and there is no need to send the response data packet to the second firewall for processing again. This disclosure optimizes the firewall session synchronization mechanism in an asymmetric network environment, and improves the session synchronization success rate of the firewall.

According to an embodiment of the present disclosure, when the first firewall receives a response data packet from the server, it parses the response data packet, finds whether there is session data matching the response data packet according to the parsed data, and checks if there is no session data matching the response data packet. If the response data packet matches the session data, the response data packet is sent to the second firewall, so that the response data packet is processed by the second firewall. Since the second firewall can determine whether to forward the response data packet to the client according to the session data created by itself, it at least partially overcomes the possible occurrence of this problem if the first firewall receives the data packet returned by the server without a session. The situation of forwarding to the client but losing the packet leads to the technical problem that the client needs to re-initiate the connection establishment process, thereby achieving the technical effect of improving the data transmission efficiency.

The response data packet is sent to the second firewall through the first firewall, so that the response data packet can be processed through the second firewall, and the zero packet loss of the asymmetric network of the firewall is realized, and it is applied to the asymmetric group of the firewall Network environment, improve the reliability and practicability of the firewall in the asymmetric network. It can solve the technical problem that the session synchronization packet sent by the second firewall to the first firewall is lost or the synchronization packet arrives late, resulting in the loss of the response data packet. effective supplement.

Any number of modules according to the embodiments of the present disclosure, or at least part of the functions of any number of them, may be implemented in one module. Any one or more of the modules according to the embodiments of the present disclosure may be implemented by being divided into multiple modules. Any one or more of modules according to embodiments of the present disclosure may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, A system on a package, an application-specific integrated circuit (ASIC), or hardware or firmware that can be implemented in any other reasonable manner that integrates or packages circuits, or in any of the three implementations of software, hardware, and firmware, or It can be realized by any suitable combination of any of them. Alternatively, one or more of the modules according to the embodiments of the present disclosure may be at least partially implemented as a computer program module, and when the computer program module is executed, corresponding functions may be performed.

For example, any number of the first receiving module 701, the parsing module 702, the searching module 703 and the first sending module 704 can be combined and implemented in one module/unit/subunit, or any one of the modules/units/subunits Can be split into multiple modules/units/subunits. Alternatively, at least part of the functions of one or more modules/units/subunits of these modules/units/subunits can be combined with at least part of the functions of other modules/units/subunits, and combined in one module/unit/subunit realized in. According to an embodiment of the present disclosure, at least one of the first receiving module 701, the analyzing module 702, the searching module 703 and the first sending module 704 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), programmable logic array (PLA), system-on-chip, system-on-substrate, system-on-package, application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuits, such as hardware or firmware, may be implemented, Or it may be realized by any one of software, hardware and firmware, or by an appropriate combination of any of them. Alternatively, at least one of the first receiving module 701, the parsing module 702, the searching module 703 and the first sending module 704 may be at least partially implemented as a computer program module, and when the computer program module is executed, corresponding functions may be performed .

It should be noted that the data transmission device applied to the first firewall in the embodiment of the present disclosure corresponds to the part of the data transmission method applied to the first firewall in the embodiment of the present disclosure, and the data transmission device applied to the first firewall For the description of the device part, refer specifically to the part of the data transmission method applied to the first firewall. The data transmission device applied to the first firewall can implement all the operations in the data transmission method applied to the first firewall, and will not be repeated here.

It should be noted that the data transmission device applied to the second firewall in the embodiment of the present disclosure corresponds to the part of the data transmission method applied to the second firewall in the embodiment of the present disclosure, and the data transmission device applied to the second firewall For the description of the device part, refer specifically to the part of the data transmission method applied to the second firewall. The data transmission device applied to the second firewall can implement all operations in the data transmission method applied to the second firewall, and details are not repeated here.

According to an embodiment of the present disclosure, there is also provided a firewall device, including: one or more processors; a memory for storing one or more programs, wherein, when the one or more programs are executed by the one or more When executed by multiple processors, the one or more processors are made to implement the method as described above.

Fig. 9 schematically shows a block diagram of a firewall device suitable for implementing the method described above according to an embodiment of the present disclosure. The firewall device shown in FIG. 9 is only an example, and should not limit the functions and scope of use of the embodiments of the present disclosure.

As shown in FIG. 9, a firewall device 900 according to an embodiment of the present disclosure includes a processor 901, which can be loaded into a random access memory (RAM) 903 according to a program stored in a read-only memory (ROM) 902 or from a storage section 908. Various appropriate actions and processing are performed by the program. Processor 901 may include, for example, a general-purpose microprocessor (eg, a CPU), an instruction set processor and/or related chipsets and/or a special-purpose microprocessor (eg, an application-specific integrated circuit (ASIC)), and the like. Processor 901 may also include on-board memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for executing different actions of the method flow according to the embodiments of the present disclosure.

In the RAM 903, various programs and data necessary for the operation of the firewall device 900 are stored. The processor 901 , ROM 902 , and RAM 903 are connected to each other via a bus 904 . The processor 901 executes various operations according to the method flow of the embodiment of the present disclosure by executing programs in the ROM 902 and/or RAM 903 . It should be noted that the program may also be stored in one or more memories other than the ROM 902 and the RAM 903 . The processor 901 may also perform various operations according to the method flow of the embodiments of the present disclosure by executing programs stored in the one or more memories.

According to an embodiment of the present disclosure, the firewall device 900 may further include an input/output (I/O) interface 905 which is also connected to the bus 904 . The firewall device 900 may also include one or more of the following components connected to the I/O interface 905: an input section 906 including a keyboard, a mouse, etc.; including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. An output section 907 of a speaker or the like; a storage section 908 including a hard disk or the like; and a communication section 909 including a network interface card such as a LAN card, a modem, or the like. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I/O interface 905 as needed. A removable medium 911 such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc. is mounted on the drive 910 as necessary so that a computer program read therefrom is installed into the storage section 908 as necessary.

According to the embodiments of the present disclosure, the method flow according to the embodiments of the present disclosure can be implemented as a computer software program. For example, the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a readable storage medium, where the computer program includes program codes for executing the methods shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from a network via communication portion 909 and/or installed from removable media 911 . When the computer program is executed by the processor 901, the above-mentioned functions defined in the firewall device of the embodiment of the present disclosure are executed. According to the embodiments of the present disclosure, the above-described devices, devices, modules, units, etc. may be implemented by computer program modules.

The present disclosure also provides a readable storage medium. The readable storage medium may be included in the device/device/system described in the above embodiments; it may also exist independently without being assembled into the device/device/system system. The above-mentioned readable storage medium carries one or more programs, and when the above-mentioned one or more programs are executed, the method according to the embodiment of the present disclosure is realized.

According to an embodiment of the present disclosure, the readable storage medium may be a non-volatile readable storage medium. Examples may include, but are not limited to: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD- ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present disclosure, a readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

For example, according to an embodiment of the present disclosure, the readable storage medium may include ROM 902 and/or RAM 903 and/or one or more memories other than ROM 902 and RAM 903 described above.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code that includes one or more logical functions for implementing specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block in the block diagrams or flowchart illustrations, and combinations of blocks in the block diagrams or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a A combination of dedicated hardware and computer instructions. Those skilled in the art can understand that various combinations and/or combinations can be made in the various embodiments of the present disclosure and/or the features described in the claims, even if such combinations or combinations are not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the various embodiments of the present disclosure and/or the features described in the claims can be combined and/or combined in various ways. All such combinations and/or combinations fall within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the various embodiments have been described separately above, this does not mean that the measures in the various embodiments cannot be advantageously used in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims (10)

1. A data transmission method applied to the first firewall, said method comprising: In the case of sending a request packet from the client to the server through the second firewall, receiving a response packet from the server, wherein the first firewall is a backup firewall of the second firewall; Analyzing the response data packet to obtain analysis data; Finding whether there is session data matching the response data packet according to the parsed data, so as to determine whether to send the response data packet to the second firewall; and In the case that there is no session data matching the response data packet, sending the response data packet to the second firewall, so that the response data packet is processed by the second firewall; wherein, by The processing of the response data packet by the second firewall includes: If there is session data matching the response data packet in the second firewall, sending the response data packet to the client; and sending the session data to the first firewall, so that the first firewall saves the session data. 2. The method of claim 1, further comprising: If there is no session data matching the response data packet, before sending the response data packet to the second firewall, determine the protocol type of the response data packet; judging whether the protocol type of the response data packet is configured with a forwarding policy; and If the protocol type of the response data packet is configured with a forwarding policy, the response data packet is sent to the second firewall. 3. The method of claim 2, further comprising: In the case that the protocol type of the response data packet is not configured with a forwarding policy, perform a check operation on the response data packet; If the response data packet passes the check, create a session corresponding to the response data packet, and send the response data packet to the client; and In the case that the response data packet fails to pass the check, packet loss processing is performed on the response data packet. 4. The method of claim 1, further comprising: If there is session data matching the response data packet, the response data packet is sent to the client. 5. The method according to claim 1, wherein processing the response data packet through the second firewall comprises: judging whether there is session data matching the response data packet in the second firewall; and When there is no session data matching the response data packet in the second firewall, packet loss processing is performed on the response data packet. 6. A data transmission method applied to a second firewall, said method comprising: Send the request packet from the client to the server; receiving a response data packet from the first firewall, wherein the first firewall is a backup firewall of the second firewall, and the response data packet is sent after the first firewall performs the following operations; receiving a response packet from the server; Analyzing the response data packet to obtain analysis data; Finding whether there is session data matching the response data packet according to the parsed data, so as to determine whether to send the response data packet to the second firewall; and Finding no session data matching the response data packet according to the parsed data, and sending the response data packet to the second firewall; Processing the response data packet; wherein, processing the response data packet includes: If there is session data matching the response data packet in the second firewall, sending the response data packet to the client; and sending the session data to the first firewall, so that the first firewall saves the session data. 7. The method according to claim 6, wherein processing the response packet comprises: judging whether there is session data matching the response data packet in the second firewall; When there is no session data matching the response data packet in the second firewall, packet loss processing is performed on the response data packet. 8. A data transmission system, comprising a first firewall and a second firewall, wherein the first firewall is a backup firewall of the second firewall, wherein: The first firewall is used to perform: receiving a response packet from the server when the request packet from the client is sent to the server through the second firewall; Analyzing the response data packet to obtain analysis data; Finding whether there is session data matching the response data packet according to the parsed data, so as to determine whether to send the response data packet to the second firewall; and If there is no session data matching the response data packet, sending the response data packet to the second firewall; The second firewall is used to perform: Send the request packet from the client to the server; receiving a response packet from the first firewall; and Processing the response data packet, wherein processing the response data packet includes: when the second firewall has session data matching the response data packet, sending the client the Responding to a data packet; and sending the session data to the first firewall, so that the first firewall saves the session data. 9. A firewall device, comprising: one or more processors; memory for storing one or more programs, Wherein, when the one or more programs are executed by the one or more processors, the one or more processors are made to implement the method described in any one of claims 1 to 5 or claim 6 or The method described in 7. 10. A readable storage medium, on which executable instructions are stored, and when the instructions are executed by a processor, the processor implements the method according to any one of claims 1 to 5 or the method described in claim 6 or 7 Methods.

Images