CN113098895A

CN113098895A - DPDK-based network traffic isolation system

Info

Publication number: CN113098895A
Application number: CN202110452447.2A
Authority: CN
Inventors: 王洁
Original assignee: Chengdu Zhongxing Electric Technology Co ltd
Current assignee: Chengdu Zhongxing Electric Technology Co ltd
Priority date: 2021-04-26
Filing date: 2021-04-26
Publication date: 2021-07-09

Abstract

A DPDK-based network traffic isolation system comprises a tested network, a twin network, a gateway, a DPDK module, a detection and filtration module, a filtration rule submission module and a filtration rule distribution module; the DPDK module is used for inquiring and modifying the messages received and sent by the network card at the gateway according to the filtering rule, and the DPDK module is arranged on the gateway; the detection module is used for analyzing, detecting and filtering the flow packet and is arranged in the network to be detected; the filtering rule submitting module is used for receiving the filtering rules sent by the filtering and distributing module and sending the filtering rules to the driving module; the filtering rule distribution module is used for distributing filtering rules imported from other places and sending the filtering rules to the driving module. According to the invention, flexible and quick isolation strategy configuration can be effectively carried out on the flow, malicious flow is detected in real time, the isolation strategy is dynamically modified, the flow at the gateway can be quickly shunted, and the malicious flow can be quickly isolated.

Description

DPDK-based network traffic isolation system

Technical Field

The invention relates to the technical field of flow isolation, in particular to a DPDK-based network flow isolation system.

Background

With the continuous development of internet technology, the traffic scale of data center networks and national backbone networks is also continuously increased, and the traditional network traffic isolation method cannot adapt to the current high-speed network environment. Although the performance of hardware is continuously improved in terms of traffic isolation, large-scale traffic and useless malicious traffic have great influence on the traffic isolation of the multi-core processor, and a great deal of overhead problems exist in the processing of large-scale data messages in the Linux system, including data copying from an application layer to a system layer, interrupt processing and context switching of the system, and the like. Therefore, for the multi-core processor, the traffic isolation is an urgent problem to be solved. The GAP technology in the prior art is a technology for realizing secure data transmission and resource sharing under the condition that two or more networks are not communicated through special hardware, adopts unique hardware design, ensures that a link layer between the networks is disconnected at any time, blocks a TCP/IP protocol and other network protocols, and can remarkably improve the security strength of an internal user network.

Disclosure of Invention

Objects of the invention

In order to solve the technical problems in the background art, the invention provides a DPDK-based network traffic isolation system which is developed on the basis of the DPDK, is added with traffic analysis and identification functions, can identify and locate common protocols, can quickly forward traffic packets, is added with a traffic detection function, respectively detects different characteristics of common malicious traffic, and can realize malicious traffic detection of password blasting, DDOS, SQL injection and the like at present. The method can effectively and flexibly and quickly configure the isolation strategy for the flow, detect the malicious flow in real time, dynamically modify the isolation strategy, quickly shunt the flow at the gateway and quickly isolate the malicious flow.

(II) technical scheme

The invention provides a DPDK-based network traffic isolation system, which comprises a tested network, a twin network, a gateway, a DPDK module, a detection filtering module, a filtering rule submitting module and a filtering rule distributing module;

the filtering rule submitting module is in communication connection with the filtering rule distribution module, and the filtering rule submitting module is in communication connection with the driving module in a named pipeline mode; the filtering rule distribution module is in network connection with the driving module;

the DPDK module is used for inquiring and modifying the messages received and sent by the network card at the gateway according to the filtering rule, and the DPDK module is arranged on the gateway;

the detection module is used for analyzing, detecting and filtering the flow packet and is arranged in the network to be detected;

the filtering rule submitting module is used for receiving the filtering rules sent by the filtering and distributing module and sending the filtering rules to the driving module;

the filtering rule distribution module is used for distributing filtering rules imported from other places and sending the filtering rules to the driving module.

Preferably, the driver module is kni module in DPDK.

Preferably, the detection filtering module analyzes the traffic packet by using a traffic packet analysis library of the DPDK itself to obtain a network layer protocol, the traffic packet is filtered by using a cache filtering rule, then malicious traffic is filtered by using the filtering rule, and a packet header of the malicious traffic packet, including an IP destination address and a check code, is modified to be led into a preset twin network, and the packet header of the packet sent back from the twin network is also modified by using the IP source address and the check code.

Preferably, the importing mode of the filtering rule distribution module includes two modes of local importing and importing after traffic analysis.

The technical scheme of the invention has the following beneficial technical effects: the method is developed on the basis of DPDK, the functions of flow analysis and identification are added, common protocols can be identified and positioned, flow packets can be rapidly forwarded, the function of flow detection is added, different feature detections are respectively carried out on common malicious flows, and malicious flow detection such as password blasting, DDOS (distributed denial of service) and SQL (structured query language) injection can be realized at present. The method can effectively and flexibly and quickly configure the isolation strategy for the flow, detect the malicious flow in real time, dynamically modify the isolation strategy, quickly shunt the flow at the gateway and quickly isolate the malicious flow.

Drawings

Fig. 1 is a schematic structural diagram of a DPDK-based network traffic isolation system according to the present invention.

Fig. 2 is a schematic structural diagram of an kni module in the DPDK-based network traffic isolation system according to the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail with reference to the accompanying drawings in conjunction with the following detailed description. It should be understood that the description is intended to be exemplary only, and is not intended to limit the scope of the present invention. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present invention.

As shown in fig. 1-2, a DPDK-based network traffic isolation system provided in the present invention includes a tested network, a twin network, a gateway, a DPDK module, a detection filtering module, a filtering rule submitting module, and a filtering rule distributing module;

the filtering rule submitting module is used for receiving the filtering rules sent by the filtering and distributing module and sending the filtering rules to the driving module; for the submitting mode of the filtering rules, a filtering rule obtaining process is independently started on the machine, the filtering rule obtaining process is communicated with a DPDK module in a named pipeline mode, the filtering rules are sent to the DPDK module, the DPDK module independently starts a thread polling mode to be communicated with the filtering rule obtaining process, the filtering rules are obtained in real time and cached in a memory of the DPDK module in real time for malicious flow detection, the filtering rule submitting module is communicated with the DPDK module and is also communicated with an external filtering rule distribution module to receive the filtering rules sent by the external filtering rule distribution module, and the whole filtering rule is coded by base64 and output in a standardized mode;

In the invention, the flow analysis and identification functions are added on the basis of DPDK, common protocols can be identified and positioned, flow packets can be rapidly forwarded, the flow detection function is added, different feature detections are respectively carried out on common malicious flows, and the malicious flow detection of password blasting, DDOS, SQL injection and the like can be realized at present. The method can effectively and flexibly and quickly configure the isolation strategy for the flow, detect the malicious flow in real time, dynamically modify the isolation strategy, quickly shunt the flow at the gateway and quickly isolate the malicious flow.

In an alternative embodiment, the driver module employs kni module in DPDK; an kni module is a DPDK module which allows application messages of a user plane to access a kernel protocol stack interface library, in a kni module, mbuf is converted into skb, only one memory copy is needed, the middle mbuf is transmitted from a user mode to a kernel mode, all that is needed is memory zero copy, and system call and copy _ to _ user ()/copy _ from _ user () operation do not exist in the middle; allowing a user to check the message of the dpdk through standard linux net tools; the message enters a normal kernel protocol stack; by utilizing the kni module, messages received and sent by the network card can be inquired and modified at the gateway, so that the purpose of detecting and shunting malicious traffic is achieved.

In an optional embodiment, the detection filtering module analyzes the traffic packet by using a traffic packet analysis library of a DPDK itself to obtain a network layer protocol, the traffic packet is filtered by using a cache filtering rule, then malicious traffic is filtered by using the filtering rule, and a packet header of the malicious traffic packet, including an IP destination address and a check code, is modified to be led into a preset twin network, and the packet header of the packet sent back from the twin network is also modified by using the IP source address and the check code; the attacker is mistakenly regarded as a data packet sent back by the real network, and the purpose of deceiving the attacker is achieved.

In an optional embodiment, the import mode of the filter rule distribution module includes two modes, namely local import and import after traffic analysis; dynamic modification of the filtering rules is facilitated.

It is to be understood that the above-described embodiments of the present invention are merely illustrative of or explaining the principles of the invention and are not to be construed as limiting the invention. Therefore, any modification, equivalent replacement, improvement and the like made without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention. Further, it is intended that the appended claims cover all such variations and modifications as fall within the scope and boundaries of the appended claims or the equivalents of such scope and boundaries.

Claims

1. A DPDK-based network traffic isolation system is characterized by comprising a tested network, a twin network, a gateway, a DPDK module, a detection filtering module, a filtering rule submitting module and a filtering rule distributing module;

2. The DPDK-based network traffic isolation system of claim 1, wherein the driver module uses kni module in DPDK.

3. The DPDK-based network traffic isolation system of claim 1, wherein the detection filtering module analyzes the traffic packet using a traffic packet analysis library of the DPDK itself, and analyzes the traffic packet to a network layer protocol, the traffic packet is filtered using a caching filtering rule, and then filters malicious traffic using the filtering rule, and modifies a packet header of a malicious traffic packet, including an IP destination address and a check code, so as to be led into a preset twin network, and a packet sent back from the twin network is also modified by the packet header, including an IP source address and a check code.

4. The DPDK-based network traffic isolation system of claim 1, wherein the import mode of the filter rule distribution module includes two modes, namely local import and import after traffic analysis.