CN113315765B - Network security processing system and working method thereof - Google Patents
Network security processing system and working method thereof Download PDFInfo
- Publication number
- CN113315765B CN113315765B CN202110575169.XA CN202110575169A CN113315765B CN 113315765 B CN113315765 B CN 113315765B CN 202110575169 A CN202110575169 A CN 202110575169A CN 113315765 B CN113315765 B CN 113315765B
- Authority
- CN
- China
- Prior art keywords
- message
- layer
- engine
- messages
- service
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a network security processing system and a working method thereof. The system comprises a physical network card, a data forwarding platform and a service system; the data forwarding platform comprises a virtualization layer, a message analysis engine, a message construction engine and a message forwarding engine; the physical network card is connected with the virtualization layer through a driver, and the data forwarding platform is connected with the service system through the virtual network card virtualized by the virtualization layer. By adopting the technical scheme, the data forwarding layer is used as a common forwarding layer of each service system by using the virtualization technology, each service system is abstracted and positioned above the forwarding layer to perform parallel processing on the data messages, and the data processing efficiency is improved.
Description
Technical Field
The invention relates to the technical field of communication, in particular to a network security processing system based on data forwarding and service separation and a working method thereof.
Background
In the modern society, ethernet is spread all over every corner of the world, which not only greatly facilitates the work and life of people, but also greatly improves the production efficiency of enterprises! Especially enterprise networks, intelligent manufacturing plants and national key infrastructure, the efficient operation is realized by utilizing the Ethernet, and respective service systems are constructed based on the Ethernet.
In order to keep the continuous and stable operation of the on-site production network, and also to consider the security and compliance of the existing network, an enterprise or an organization needs to perform security level control and business level audit on messages of the on-site environment. The control of the safety layer of the message needs to depend on firewall equipment; the auditing of the service layer needs to depend on professional auditing equipment, and other services need to be finished by other equipment.
It can be seen that, in the prior art, separate devices are required for different services to complete their functions, and service operations of each device require sequential processing, and data cannot be processed in parallel by a multi-service system, so that the prior art has at least the following disadvantages:
1. increase the purchase cost: different hardware devices need to be purchased to implement different services.
2. The labor cost is consumed: the management of these different hardware devices, i.e., asset management, requires a significant expenditure of labor and cost.
3. Cost of office work: the storage of hardware devices, i.e., assets, requires space costs, such as renting a machine room or occupying its own office space.
4. The electricity cost is consumed: the hardware equipment is many, that is to say the asset is many, and the power cost of consumption is many.
5. The efficiency is low: the data needs to be processed sequentially.
Disclosure of Invention
The invention provides a network security processing system, which comprises a physical network card, a data forwarding platform and a service system, wherein the physical network card is used for transmitting data to the data forwarding platform; the data forwarding platform comprises a virtualization layer, a message analysis engine, a message construction engine and a message forwarding engine; the physical network card is connected with the virtualization layer through a driver, and the data forwarding platform is connected with the service system through a virtual network card virtualized by the virtualization layer;
the physical network card receives the message and delivers the message to the virtualization layer upwards through the driving program; the virtualization layer virtualizes the hardware network card, after the virtual network card is virtualized out, a message analysis engine deeply analyzes the message, a message construction engine constructs and copies the message in batches, and a message forwarding engine corresponds the message to the virtual network card channel and delivers the message to a corresponding upper-layer service system; and each service system analyzes and processes the message according to the respective service rule.
In the network security processing system, the virtualization layer virtualizes the physical network interface card, specifically virtualizing the physical network interface card by a corresponding amount according to the number of the upper layer service systems.
The network security processing system as described above, wherein the message parsing engine performs deep parsing on the original message, specifically, parses the message according to a standard TCP/IP layered model, and the deep parsing result includes detailed information of a link layer, an IP layer, a transport layer, and an application layer, and determines the content of the original message.
In the network security processing system, the message construction engine constructs and copies the messages in batch, specifically, constructs and copies the messages in batch according to the deep analysis result of the message analysis engine, and the total number of the newly obtained messages after batch construction and copying corresponds to the number of the virtual network cards/the number of the service systems.
The invention also provides a working method of the network security processing system, which comprises the following steps:
the physical network card receives the original message, and the original message is upwards delivered to the data forwarding platform through the driving program;
the data forwarding platform virtualizes the hardware network cards, virtualizes virtual network cards with corresponding quantity according to the quantity of service systems, deeply analyzes original messages, constructs and copies the original messages in batches, corresponds newly obtained messages to virtual network card channels, and delivers the newly obtained messages to corresponding upper-layer service systems;
and each service system analyzes and processes the received message according to the respective service rule.
The working method of the network security processing system as described above, wherein the data forwarding platform includes a virtualization layer, a message parsing engine, a message construction engine, and a message forwarding engine.
The working method of the network security processing system described above, wherein the data forwarding platform specifically executes the following substeps:
the virtualization layer virtualizes the hardware network cards, and virtualizes virtual network cards with corresponding quantity according to the quantity of the service systems;
the message analysis engine carries out deep analysis on the message;
the message construction engine constructs and copies the messages in batches according to the deep analysis result of the message analysis engine;
and the message forwarding engine corresponds the newly obtained messages after batch construction and copying to the virtual network card channel and delivers the messages to the corresponding upper-layer service system.
The working method of the network security processing system as described above, wherein after each service system receives its respective message, each service system determines the processing time of the message, and the method includes: each business system analyzes and processes the received message at the same time according to the business processing rule of each business system; or each service system carries out asynchronous service processing on the received message according to the service processing rule set by the service system.
The present invention also provides a computer storage medium, comprising: at least one memory and at least one processor;
the memory is used for storing one or more program instructions;
a processor, configured to execute one or more program instructions to perform an operating method of any one of the foregoing network security processing systems.
The invention has the following beneficial effects: by adopting the technical scheme, the data forwarding layer is used as the public forwarding layer of each service system by using the virtualization technology, each service system is abstracted and is positioned on the forwarding layer to perform parallel processing on the data messages, the data processing efficiency is improved, various hardware equipment does not need to be purchased, the purchasing cost is reduced, the office cost and the electricity charge cost are saved, various hardware does not need to be managed, and the labor cost is saved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present invention, and other drawings can be obtained by those skilled in the art according to the drawings.
Fig. 1 is a schematic diagram of a network security processing system based on data forwarding and service separation according to an embodiment of the present invention;
fig. 2 is a schematic diagram illustrating deep parsing of an original packet by a packet parsing engine;
fig. 3 is a flowchart of a working method of a network security system based on data forwarding and service separation according to a second embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention are clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be obtained by a person skilled in the art without making any creative effort based on the embodiments in the present invention, belong to the protection scope of the present invention.
Example one
As shown in fig. 1, an embodiment of the present invention provides a network security processing system based on data forwarding and service separation, including: the system comprises a physical network card, a data forwarding platform and a service system; the data forwarding platform comprises a virtualization layer, a message analysis engine, a message construction engine and a message forwarding engine; the physical network card is connected with the virtualization layer through a driver, and the data forwarding platform is connected with the service system through the virtual network card virtualized by the virtualization layer.
Specifically, a physical network card (i.e. a hardware network card) receives a message, and the message is delivered upwards to the virtualization layer through a driver; the virtualization layer virtualizes the hardware network card, after the virtual network card is virtualized out, a message analysis engine deeply analyzes the message, a message construction engine constructs and copies the message in batches, and a message forwarding engine corresponds the message to the virtual network card channel and delivers the message to a corresponding upper-layer service system; and the service systems analyze and process the messages according to respective service rules.
The virtualization layer virtualizes the hardware network card, specifically virtualizes the network card by a corresponding amount according to the number of upper layer service systems, and virtualizes 3 virtual network cards (virtual network cards) if there are 3 service systems on the upper layer.
After the virtualization layer processing, the message analysis engine performs deep analysis on the original message to determine where the message comes from, where the message goes to, what services are accessed, whether the message has the right to perform specific instructions on the target device, and the like so as to execute correct expected actions, and if the message is allowed, the message is rejected;
as shown in fig. 2, the message is deeply analyzed, specifically, the message is analyzed according to a standard TCP/IP layering model, which includes a two-layer mac address, a three-layer IP address, a four-layer port number, seven-layer load information, and the like; aiming at the information of the 7-layer load, matching is carried out according to the format of a specific protocol (such as an http protocol, an FTP protocol, an industrial control protocol and the like), and the field value of the information is read from a fixed position behind a TCP/UDP head for matching so as to judge whether the information accords with the specific protocol; the detailed information including the link layer, the IP layer, the transmission layer and the application layer is obtained through specific analysis, and the content of the original message can be known.
After the message analysis engine processes the original messages, the message construction engine constructs and copies the original messages in batches, and constructs and copies the messages in batches according to the depth analysis result of the message analysis engine, wherein the total number of the newly obtained messages after batch construction and copying corresponds to the number of the virtual network cards/the number of the service systems, namely the number of the specific construction behaviors and the construction messages corresponds to the number of the virtual network cards/the number of the service systems, namely 3 service systems (A, B, C), and two messages identical to the original messages are constructed.
In the embodiment of the application, each service system (A, B, C) can analyze and process the message according to the respective service rule at the same time, and one transmission is not needed as the traditional system behavior, that is, the message is not needed to be transmitted to the service system a first, and the message is transmitted to the service system B after the service system a finishes processing, so that the service processing efficiency is improved.
Example two
As shown in fig. 3, a second embodiment of the present invention provides a working method of a network security system based on data forwarding and service separation, including:
step 310, the physical network card receives the original message, and the original message is upwards delivered to a data forwarding platform through a driving program;
specifically, the data forwarding platform comprises a virtualization layer, a message analysis engine, a message construction engine and a message forwarding engine; the physical network card delivers the message to the virtualization layer through the driver.
Step 320, virtualizing the hardware network card by the data forwarding platform, virtualizing virtual network cards with corresponding number according to the number of service systems, deeply analyzing the original message, constructing and copying the original message in batches, corresponding the newly obtained message to a virtual network card channel, and delivering the message to a corresponding upper-layer service system;
specifically, the data forwarding platform specifically executes the following sub-steps:
step 321, virtualizing the hardware network cards by the virtualization layer, and virtualizing virtual network cards with corresponding quantity according to the quantity of the service systems;
322, the message analysis engine carries out deep analysis on the message;
step 323, the message construction engine constructs and copies the message in batches according to the deep analysis result of the message analysis engine;
step 324, the message forwarding engine makes the newly obtained messages after batch construction and copying correspond to the virtual network card channel, and delivers the newly obtained messages to the corresponding upper-layer service system;
the virtual network cards correspond to the service systems one by one, and a message forwarding engine arranged in the data forwarding platform sends messages to the corresponding service systems through each virtual network card channel.
Referring back to fig. 3, in step 330, each service system analyzes and processes the received message according to its service rule;
after each service system receives the respective message, each service system determines the processing time of the message, can analyze and process the received message according to the respective service rule at the same time, and can also perform asynchronous service processing according to the service processing rule set by the service system, so that one transmission is not needed like the traditional system behavior, corresponding processing sequence association is not needed among the service systems, and the processing efficiency of the service is improved.
Corresponding to the above embodiments, an embodiment of the present invention provides a computer storage medium, including: at least one memory and at least one processor;
the memory is used for storing one or more program instructions;
the processor is used for executing one or more program instructions to execute the working method of the network security processing system.
In accordance with the embodiments described above, an embodiment of the present invention provides a computer-readable storage medium, where one or more program instructions are contained in the computer-readable storage medium, and the one or more program instructions are used by a processor to execute an operating method of a network security processing system.
The embodiment of the invention discloses a computer-readable storage medium, in which computer program instructions are stored, and when the computer program instructions are run on a computer, the computer is caused to execute the working method of the network security processing system.
In an embodiment of the invention, the processor may be an integrated circuit chip having signal processing capability. The Processor may be a general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic device, discrete Gate or transistor logic device, discrete hardware component.
The various methods, steps and logic blocks disclosed in the embodiments of the present invention may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in connection with the embodiments of the present invention may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules may be located in ram, flash, rom, prom, or eprom, registers, etc. as is well known in the art. The processor reads the information in the storage medium and completes the steps of the method in combination with the hardware.
The storage medium may be a memory, for example, which may be volatile memory or nonvolatile memory, or which may include both volatile and nonvolatile memory.
The nonvolatile Memory may be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically Erasable PROM (EEPROM), or a flash Memory.
The volatile Memory may be a Random Access Memory (RAM) which serves as an external cache. By way of example, and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double Data Rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), SLDRAM (SLDRAM), and Direct Rambus RAM (DRRAM).
The storage media described in connection with the embodiments of the invention are intended to comprise, without being limited to, these and any other suitable types of memory.
Those skilled in the art will recognize that the functionality described in this disclosure may be implemented in a combination of hardware and software in one or more of the examples described above. When software is applied, the corresponding functionality may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a general purpose or special purpose computer.
The above-mentioned embodiments, objects, technical solutions and advantages of the present invention are further described in detail, it should be understood that the above-mentioned embodiments are only exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made on the basis of the technical solutions of the present invention should be included in the scope of the present invention.
Claims (7)
1. A network security processing system is characterized by comprising a physical network card, a data forwarding platform and a service system; the data forwarding platform comprises a virtualization layer, a message analysis engine, a message construction engine and a message forwarding engine; the physical network card is connected with the virtualization layer through a driver, and the data forwarding platform is connected with the service system through a virtual network card virtualized by the virtualization layer;
the physical network card receives the message and delivers the message to the virtualization layer upwards through the driving program; the virtualization layer virtualizes the hardware network card, after the virtual network card is virtualized out, a message analysis engine deeply analyzes the message, a message construction engine constructs and copies the message in batches, and a message forwarding engine corresponds the message to the virtual network card channel and delivers the message to a corresponding upper-layer service system; each service system analyzes and processes the message according to the respective service rule;
the method comprises the steps of carrying out deep analysis on a message, specifically, analyzing the message according to a standard TCP/IP layering model, wherein the message comprises a two-layer mac address, a three-layer IP address, a four-layer port number and seven-layer load information; aiming at the information loaded on the 7 layers, matching is carried out according to the format of a specific protocol, the protocol comprises an http protocol, an FTP protocol and an industrial control protocol, and the field value of the protocol is read from a fixed position behind a TCP/UDP head to carry out matching so as to judge whether the protocol conforms to the specific protocol or not;
the message analysis engine carries out deep analysis on the original message, specifically, the message is analyzed according to a standard TCP/IP layered model, the deep analysis result comprises detailed information of a link layer, an IP layer, a transmission layer and an application layer, and the content of the original message is determined;
the message construction engine constructs and copies the messages in batches, specifically constructs and copies the messages in batches according to the deep analysis result of the message analysis engine, and the total number of the newly obtained messages after batch construction and copying corresponds to the number of the virtual network cards/the number of the service systems.
2. The network security processing system of claim 1, wherein the virtualization layer virtualizes the physical network card, specifically virtualizing the physical network card by a corresponding amount according to the number of upper layer service systems.
3. A working method of a network security processing system is characterized by comprising the following steps:
the physical network card receives the original message, and the original message is upwards delivered to the data forwarding platform through the driving program;
the data forwarding platform virtualizes the hardware network cards, virtualizes virtual network cards with corresponding quantity according to service system data, deeply analyzes original messages, constructs and copies the original messages in batches, corresponds newly obtained messages to virtual network card channels, and delivers the messages to corresponding upper-layer service systems;
each service system analyzes and processes the received message according to the respective service rule;
the method comprises the steps of carrying out deep analysis on a message, specifically, analyzing the message according to a standard TCP/IP layering model, wherein the message comprises a two-layer mac address, a three-layer IP address, a four-layer port number and seven-layer load information; aiming at the information loaded on the 7 layers, matching is carried out according to the format of a specific protocol, the protocol comprises an http protocol, an FTP protocol and an industrial control protocol, and the field value of the protocol is read from a fixed position behind a TCP/UDP head to carry out matching so as to judge whether the protocol conforms to the specific protocol or not;
the message analysis engine carries out deep analysis on the original message, specifically, the message is analyzed according to a standard TCP/IP layering model, the deep analysis result comprises detailed information of a link layer, an IP layer, a transmission layer and an application layer, and the content of the original message is determined;
the message construction engine constructs and copies the messages in batches, specifically constructs and copies the messages in batches according to the deep analysis result of the message analysis engine, and the total number of the newly obtained messages after batch construction and copying corresponds to the number of the virtual network cards/the number of the service systems.
4. The method of claim 3, wherein the data forwarding platform comprises a virtualization layer, a message parsing engine, a message construction engine, and a message forwarding engine.
5. The method of claim 4, wherein the data forwarding platform performs the following steps:
the virtualization layer virtualizes the hardware network cards, and virtualizes virtual network cards with corresponding quantity according to the service system data;
the message analysis engine carries out deep analysis on the message;
the message construction engine constructs and copies the messages in batches according to the deep analysis result of the message analysis engine;
and the message forwarding engine corresponds the newly obtained messages after batch construction and copying to the virtual network card channel and delivers the messages to the corresponding upper-layer service system.
6. The method of claim 3, wherein the determining the processing time of the message by each service system after receiving the respective message comprises: each business system analyzes and processes the received message at the same time according to the business processing rule of each business system; or each service system carries out asynchronous service processing on the received message according to the service processing rule set by the service system.
7. A computer storage medium, comprising: at least one memory and at least one processor;
the memory is used for storing one or more program instructions;
a processor for executing one or more program instructions to perform a method of operating a network security processing system as claimed in any one of claims 3 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110575169.XA CN113315765B (en) | 2021-05-26 | 2021-05-26 | Network security processing system and working method thereof |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110575169.XA CN113315765B (en) | 2021-05-26 | 2021-05-26 | Network security processing system and working method thereof |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113315765A CN113315765A (en) | 2021-08-27 |
| CN113315765B true CN113315765B (en) | 2023-01-03 |
Family
ID=77374868
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110575169.XA Active CN113315765B (en) | 2021-05-26 | 2021-05-26 | Network security processing system and working method thereof |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113315765B (en) |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101343595B1 (en) * | 2008-12-19 | 2013-12-20 | 한국전자통신연구원 | Method for forwarding path virtualization for router |
| CN104579695B (en) * | 2013-10-23 | 2018-07-20 | 新华三技术有限公司 | A kind of data forwarding device and method |
| CN108809748A (en) * | 2018-03-26 | 2018-11-13 | 北京天融信网络安全技术有限公司 | Network audit collecting method and related device, equipment and storage medium |
| CN112714073B (en) * | 2019-10-24 | 2024-04-30 | 中兴通讯股份有限公司 | Message distribution method, system and storage medium based on SR-IOV network card |
| CN111522624B (en) * | 2020-04-17 | 2023-10-20 | 成都安恒信息技术有限公司 | Message forwarding performance elastic expansion system and expansion method based on virtualization technology |
-
2021
- 2021-05-26 CN CN202110575169.XA patent/CN113315765B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN113315765A (en) | 2021-08-27 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110430288B (en) | Node access method, node access device, computer equipment and storage medium | |
| CN107464117A (en) | Data managing method and block catenary system based on block chain | |
| CN104348677A (en) | Deep packet inspection method and equipment and coprocessor | |
| CN110008226A (en) | Construction method, device, computer equipment and the storage medium of data model | |
| CN108401037A (en) | User terminal and the binding method of equipment, device and system | |
| CN110599142B (en) | Data storage method, device, computer equipment and storage medium | |
| CN111949899B (en) | Service integration method and service platform | |
| CN104660557A (en) | Operation processing method and device | |
| CN108429739A (en) | A kind of method, system and the terminal device of identification honey jar | |
| CN112311851A (en) | Network policy configuration method and device | |
| CN110187986A (en) | A kind of command management method, system, device and computer readable storage medium | |
| CN112991064B (en) | Service processing method, device, computer equipment and storage medium | |
| CN114244842A (en) | Security resource scheduling method and device, electronic equipment and storage medium | |
| CN113315765B (en) | Network security processing system and working method thereof | |
| CN110119277A (en) | Data sharing method, device, computer equipment and storage medium | |
| CN109918277A (en) | Electronic device, the evaluation method of system log cluster analysis result and storage medium | |
| CN115604103A (en) | Configuration method and device of cloud computing system, storage medium and electronic equipment | |
| CN115473695A (en) | DDOS attack identification method, terminal device and storage medium | |
| CN113596192A (en) | Communication method, device, equipment and medium based on network gate networking | |
| CN111447080B (en) | Private network decentralization control method, device and computer readable storage medium | |
| CN114172895A (en) | Routing method, routing device, computer equipment and storage medium | |
| CN115686888B (en) | Rule-based disposal behavior flow arrangement method, device and application | |
| CN114301619B (en) | Industrial control firewall without hardware management port and implementation method of simulation management port of industrial control firewall | |
| CN110365742B (en) | Multi-active load balancing application creation method and device, computer equipment and storage medium | |
| CN114258020B (en) | Proprietary cloud deployment method, platform and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |