CN116614318A - Network security protection method and system based on firewall - Google Patents

Network security protection method and system based on firewall Download PDF

Info

Publication number
CN116614318A
CN116614318A CN202310891561.4A CN202310891561A CN116614318A CN 116614318 A CN116614318 A CN 116614318A CN 202310891561 A CN202310891561 A CN 202310891561A CN 116614318 A CN116614318 A CN 116614318A
Authority
CN
China
Prior art keywords
firewall
slave
network
master
access policy
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202310891561.4A
Other languages
Chinese (zh)
Other versions
CN116614318B (en
Inventor
吴远新
罗雄兰
吴远辉
吴天圣
吴心圣
吴蕊圣
吴思圣
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen City Branch Cloud Technology Development Co ltd
Original Assignee
Shenzhen City Branch Cloud Technology Development Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen City Branch Cloud Technology Development Co ltd filed Critical Shenzhen City Branch Cloud Technology Development Co ltd
Priority to CN202310891561.4A priority Critical patent/CN116614318B/en
Publication of CN116614318A publication Critical patent/CN116614318A/en
Application granted granted Critical
Publication of CN116614318B publication Critical patent/CN116614318B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227Filtering policies
    • H04L63/0236Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00Data switching networks
    • H04L12/28Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46Interconnection of networks
    • H04L12/4641Virtual LANs, VLANs, e.g. virtual private networks [VPN]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

The application discloses a network security protection method and system based on a firewall, wherein the method comprises the following steps: receiving configuration information from a firewall; the secondary firewall configures a preset network interface of the secondary firewall into the virtual local area network according to the configuration information; the slave firewall sends a request message to the master firewall through the virtual local area network, wherein the request message carries the MAC address of a preset network interface; the master firewall judges whether the MAC address is in a preconfigured list, and if so, the master firewall responds to the request message to send a network access strategy to the slave firewall; the slave firewall runs the network access policy on the slave firewall after receiving the network access policy. The application solves the problem of lower configuration efficiency caused by manual configuration of the firewall of the branch unit, thereby improving the configuration efficiency of a plurality of firewalls on the basis of ensuring the security configuration of the firewall.

Description

Network security protection method and system based on firewall
Technical Field
The application relates to the field of network security, in particular to a network security protection method and system based on a firewall.
Background
The firewall technology is a technology for helping computer networks to construct a relatively isolated protection barrier between the internal network and the external network by organically combining various software and hardware devices for safety management and screening so as to protect user data and information safety.
The firewall technology mainly aims at timely finding and processing the possible problems of security risk, data transmission and the like when the computer network runs, wherein the processing measures comprise isolation and protection, and meanwhile, recording and detection can be implemented on each operation in the security of the computer network so as to ensure the running security of the computer network, ensure the integrity of user data and information and provide better and safer computer network use experience for users.
The firewall needs to be properly configured when in use so that the firewall can function properly. With the gradual expansion of the enterprise scale, enterprises have a plurality of branch units, the branch units are generally located in different areas, the branch units also need to use firewalls for protecting network security, currently, the branch unit firewalls generally need to be manually configured, and with the increase of the number of the branch units, the configuration becomes time-consuming and labor-consuming.
Disclosure of Invention
The embodiment of the application provides a network security protection method and system based on a firewall, which are used for at least solving the problem of low configuration efficiency caused by manual configuration of the firewall of a branch unit.
According to one aspect of the present application, there is provided a firewall-based network security protection method, including: receiving configuration information from a firewall, wherein the configuration information is used for configuring the firewall; the secondary firewall configures a preset network interface of the secondary firewall into a virtual local area network according to the configuration information, wherein one network interface of a primary firewall is also configured into the virtual local area network; the slave firewall sends a request message to the master firewall through the virtual local area network, wherein the request message carries the MAC address of the preset network interface; the master firewall judges whether the MAC address is in a preconfigured list, and if so, the master firewall responds to the request message to send a network access policy to the slave firewall; the slave firewall runs the network access policy on the slave firewall after receiving the network access policy.
Further, after the master firewall sends the network access policy to the slave firewall, the method further comprises: the master firewall receives a configuration update request, wherein the configuration update request is used for updating the network access policy; the main firewall responds to the configuration update request to update the network access policy; and the master firewall sends the updated network access policy to the slave firewall.
Further, the receiving configuration information from the firewall includes: the slave firewall sends authentication information to a preconfigured network address of the master firewall, wherein the authentication information carries a preconfigured verification code; the master firewall checks the verification code, and sends the configuration information to the slave firewall under the condition that the verification is successful; the secondary firewall receives the configuration information from the primary firewall.
Further, the configuring, by the slave firewall, the predetermined network interface of the slave firewall into the virtual local area network according to the configuration information includes: the slave firewall selecting an interface from a plurality of WAN interfaces, wherein the selected interface is already connected to the public network; the slave firewall sends a Ping command to the network address of the master firewall through the selected interface; and after receiving the response of the Ping command, the slave firewall configures the selected interface into the virtual local area network as the preset network interface.
Further, the number of the master firewalls is one, and the number of the slave firewalls is a plurality.
According to another aspect of the present application, there is also provided a firewall-based network security protection system, including: the system comprises a master firewall and a slave firewall, wherein the slave firewall is used for receiving configuration information, and the configuration information is used for configuring the slave firewall; the secondary firewall is used for configuring a preset network interface of the secondary firewall into a virtual local area network according to the configuration information, wherein one network interface of the primary firewall is also configured into the virtual local area network; the slave firewall is used for sending a request message to the master firewall through the virtual local area network, wherein the request message carries the MAC address of the preset network interface; the master firewall is used for judging whether the MAC address is in a preconfigured list, and if so, the master firewall responds to the request message to send a network access policy to the slave firewall; the slave firewall is configured to run the network access policy on the slave firewall after receiving the network access policy.
Further, the primary firewall is configured to receive a configuration update request, where the configuration update request is configured to update the network access policy; the main firewall is used for responding to the configuration update request and updating the network access policy; the master firewall is used for sending the updated network access policy to the slave firewall.
Further, the slave firewall is configured to send authentication information to a preconfigured network address of the master firewall, where the authentication information carries a preconfigured verification code; the master firewall is used for checking the verification code, and sending the configuration information to the slave firewall under the condition that the verification is successful; the secondary firewall is configured to receive the configuration information from the primary firewall.
Further, the slave firewall is configured to select an interface from a plurality of WAN interfaces, where the selected interface is already connected to the public network; the slave firewall is used for sending a Ping command to the network address of the master firewall through the selected interface; the slave firewall is used for configuring the selected interface into the virtual local area network as the preset network interface after receiving the response of the Ping command.
Further, the number of the master firewalls is one, and the number of the slave firewalls is a plurality.
In the embodiment of the application, the configuration information is received from the firewall, wherein the configuration information is used for configuring the firewall; the secondary firewall configures a preset network interface of the secondary firewall into a virtual local area network according to the configuration information, wherein one network interface of a primary firewall is also configured into the virtual local area network; the slave firewall sends a request message to the master firewall through the virtual local area network, wherein the request message carries the MAC address of the preset network interface; the master firewall judges whether the MAC address is in a preconfigured list, and if so, the master firewall responds to the request message to send a network access policy to the slave firewall; the slave firewall runs the network access policy on the slave firewall after receiving the network access policy. The application solves the problem of lower configuration efficiency caused by manual configuration of the firewall of the branch unit, thereby improving the configuration efficiency of a plurality of firewalls on the basis of ensuring the security configuration of the firewall.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:
fig. 1 is a flow chart of a firewall-based network security protection method in accordance with an embodiment of the application.
Detailed Description
It should be noted that, without conflict, the embodiments of the present application and features of the embodiments may be combined with each other. The application will be described in detail below with reference to the drawings in connection with embodiments.
It should be noted that the steps illustrated in the flowcharts of the figures may be performed in a computer system such as a set of computer executable instructions, and that although a logical order is illustrated in the flowcharts, in some cases the steps illustrated or described may be performed in an order other than that illustrated herein.
In this embodiment, a firewall-based network security protection method is provided, and fig. 1 is a flowchart of the firewall-based network security protection method according to an embodiment of the present application, as shown in fig. 1, where the flowchart includes the following steps:
step S102, receiving configuration information from a firewall, wherein the configuration information is used for configuring the firewall;
step S104, the secondary firewall configures the preset network interface of the secondary firewall into a virtual local area network according to the configuration information, wherein one network interface of the primary firewall is also configured into the virtual local area network;
step S106, the slave firewall sends a request message to the master firewall through the virtual local area network, wherein the request message carries the MAC address of the preset network interface;
step S108, the master firewall judges whether the MAC address is in a preconfigured list, if so, the master firewall responds to the request message to send a network access policy to the slave firewall;
as another optional implementation manner, the slave firewall may further carry topology information of the network where the slave firewall is located in the request message, and if the master firewall determines that the MAC address is in the preconfigured list, the master firewall searches for a network access policy corresponding to the topology information, and sends the found network access policy to the slave firewall.
Step S110, the slave firewall runs the network access policy on the slave firewall after receiving the network access policy.
The method solves the problem of lower configuration efficiency caused by manual configuration of the firewall of the branch unit, thereby improving the configuration efficiency of a plurality of firewalls on the basis of ensuring the security configuration of the firewall.
After the master firewall sends the network access policy to the slave firewall, the method further comprises: the master firewall receives a configuration update request, wherein the configuration update request is used for updating the network access policy; the main firewall responds to the configuration update request to update the network access policy; and the master firewall sends the updated network access policy to the slave firewall.
In an alternative embodiment, the primary firewall may update the network access policy for a variety of reasons. For example, the primary firewall passes a first interception rate of a data packet for a predetermined period of time after running the network access policy, wherein the data packet is intercepted if the interception policy in the network access policy is met while passing through the primary firewall; the master firewall obtains a second interception rate of the data packet in the same preset time period after the slave firewall runs the network access policy; the primary firewall determines whether the difference between the first interception rate and the second interception rate is greater than a threshold (the threshold may be a pre-configured value, such as 10% or 20%), and if the difference is greater than the threshold, the primary firewall confirms that the network access policy needs to be updated.
The receiving configuration information from the firewall includes: the slave firewall sends authentication information to a preconfigured network address of the master firewall, wherein the authentication information carries a preconfigured verification code; the master firewall checks the verification code, and sends the configuration information to the slave firewall under the condition that the verification is successful; the secondary firewall receives the configuration information from the primary firewall.
Optionally, the configuring, by the slave firewall, the predetermined network interface of the slave firewall into the virtual local area network according to the configuration information includes: the slave firewall selects an interface (referred to as a first interface for descriptive convenience) from a plurality of WAN interfaces, wherein the selected interface is already connected to the public network; the slave firewall sends a Ping command to the network address of the master firewall through the selected interface; and after receiving the response of the Ping command, the slave firewall configures the selected interface into the virtual local area network as the preset network interface.
As another alternative embodiment, for further security assurance, the secondary firewall may also select a second interface after selecting one interface (referred to as a first interface for convenience of description) from the plurality of WAN interfaces, where the second interface is already connected to the public network, the secondary firewall encrypts the MAC address of the first interface using an encryption mode agreed in advance with the primary firewall, the secondary firewall sends the encrypted MAC address to the primary firewall, the primary firewall decrypts the MAC address, and allows sending Ping command from the MAC address interface, and the primary firewall configures the MAC address into the list.
In the above embodiment, the number of the master firewalls is one, and the number of the slave firewalls is plural.
As another optional implementation manner, the slave firewall may further have an independent network access policy, the slave firewall receives a network access policy newly configured by an administrator, the slave firewall encrypts the network access policy newly configured by using the MAC address of the predetermined network interface as a key, the slave firewall sends the encrypted network access policy newly configured to the master firewall, the master firewall decrypts the network access policy newly configured and audits the network access policy newly configured after decryption, and after the audit passes, acknowledgement information is sent to the slave firewall, and the slave firewall applies the network access policy newly configured after receiving the acknowledgement information.
The method comprises the steps of opening up two parts of storage areas in a slave firewall, wherein the two parts of storage areas comprise a first storage area and a second storage area, the first storage area is used for storing network access policies from a master firewall, and the second storage area is used for storing network access policies which are managed and newly added and configured by the slave firewall.
In this embodiment, there is provided an electronic device including a memory in which a computer program is stored, and a processor configured to run the computer program to perform the method in the above embodiment.
The above-described programs may be run on a processor or may also be stored in memory (or referred to as computer-readable media), including both permanent and non-permanent, removable and non-removable media, and information storage may be implemented by any method or technique. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.
These computer programs may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks and/or block diagram block or blocks, and corresponding steps may be implemented in different modules. Such an apparatus or system is provided in this embodiment. The system or the device is used for realizing the functions of the method in the above embodiment, and each module in the system or the device corresponds to each step in the method, which has been described in the method, and will not be described herein.
The foregoing is merely exemplary of the present application and is not intended to limit the present application. Various modifications and variations of the present application will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. which come within the spirit and principles of the application are to be included in the scope of the claims of the present application.

Claims (10)

1. A firewall-based network security method, comprising:
receiving configuration information from a firewall, wherein the configuration information is used for configuring the firewall;
the secondary firewall configures a preset network interface of the secondary firewall into a virtual local area network according to the configuration information, wherein one network interface of a primary firewall is also configured into the virtual local area network;
the slave firewall sends a request message to the master firewall through the virtual local area network, wherein the request message carries the MAC address of the preset network interface;
the master firewall judges whether the MAC address is in a preconfigured list, and if so, the master firewall responds to the request message to send a network access policy to the slave firewall;
the slave firewall runs the network access policy on the slave firewall after receiving the network access policy.
2. The method of claim 1, wherein after the master firewall sends the network access policy to the slave firewall, the method further comprises:
the master firewall receives a configuration update request, wherein the configuration update request is used for updating the network access policy;
the main firewall responds to the configuration update request to update the network access policy;
and the master firewall sends the updated network access policy to the slave firewall.
3. The method of claim 1, wherein receiving configuration information from a firewall comprises:
the slave firewall sends authentication information to a preconfigured network address of the master firewall, wherein the authentication information carries a preconfigured verification code;
the master firewall checks the verification code, and sends the configuration information to the slave firewall under the condition that the verification is successful;
the secondary firewall receives the configuration information from the primary firewall.
4. A method according to claim 3, wherein the configuring of the predetermined network interface of the slave firewall into the virtual local area network by the slave firewall according to the configuration information comprises:
the slave firewall selecting an interface from a plurality of WAN interfaces, wherein the selected interface is already connected to the public network;
the slave firewall sends a Ping command to the network address of the master firewall through the selected interface;
and after receiving the response of the Ping command, the slave firewall configures the selected interface into the virtual local area network as the preset network interface.
5. The method of any one of claims 1 to 4, wherein the master firewall is one and the slave firewalls are a plurality.
6. A firewall-based network security protection system, comprising: a master firewall and a slave firewall, wherein,
the slave firewall is used for receiving configuration information, wherein the configuration information is used for configuring the slave firewall;
the secondary firewall is used for configuring a preset network interface of the secondary firewall into a virtual local area network according to the configuration information, wherein one network interface of the primary firewall is also configured into the virtual local area network;
the slave firewall is used for sending a request message to the master firewall through the virtual local area network, wherein the request message carries the MAC address of the preset network interface;
the master firewall is used for judging whether the MAC address is in a preconfigured list, and if so, the master firewall responds to the request message to send a network access policy to the slave firewall;
the slave firewall is configured to run the network access policy on the slave firewall after receiving the network access policy.
7. The system of claim 6, wherein the system further comprises a controller configured to control the controller,
the main firewall is used for receiving a configuration update request, wherein the configuration update request is used for updating the network access policy;
the main firewall is used for responding to the configuration update request and updating the network access policy;
the master firewall is used for sending the updated network access policy to the slave firewall.
8. The system of claim 6, wherein the system further comprises a controller configured to control the controller,
the secondary firewall is used for sending authentication information to the pre-configured network address of the primary firewall, wherein the authentication information carries a pre-configured verification code;
the master firewall is used for checking the verification code, and sending the configuration information to the slave firewall under the condition that the verification is successful;
the secondary firewall is configured to receive the configuration information from the primary firewall.
9. The system of claim 8, wherein the system further comprises a controller configured to control the controller,
the secondary firewall is configured to select an interface from a plurality of WAN interfaces, wherein the selected interface is already connected to a public network;
the slave firewall is used for sending a Ping command to the network address of the master firewall through the selected interface;
the slave firewall is used for configuring the selected interface into the virtual local area network as the preset network interface after receiving the response of the Ping command.
10. The system of any one of claims 6 to 9, wherein the master firewall is one and the slave firewalls are a plurality.
CN202310891561.4A 2023-07-20 2023-07-20 Network security protection method and system based on firewall Active CN116614318B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310891561.4A CN116614318B (en) 2023-07-20 2023-07-20 Network security protection method and system based on firewall

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310891561.4A CN116614318B (en) 2023-07-20 2023-07-20 Network security protection method and system based on firewall

Publications (2)

Publication Number Publication Date
CN116614318A true CN116614318A (en) 2023-08-18
CN116614318B CN116614318B (en) 2023-10-03

Family

ID=87680448

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310891561.4A Active CN116614318B (en) 2023-07-20 2023-07-20 Network security protection method and system based on firewall

Country Status (1)

Country Link
CN (1) CN116614318B (en)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101977187A (en) * 2010-10-20 2011-02-16 中兴通讯股份有限公司 Firewall policy distribution method, client, access server and system
CN105827623A (en) * 2016-04-26 2016-08-03 山石网科通信技术有限公司 Data center system
CN106027569A (en) * 2016-07-19 2016-10-12 浪潮电子信息产业股份有限公司 Firewall management methods, master node, slave node, and cluster
US20200366648A1 (en) * 2019-05-14 2020-11-19 ColorTokens, Inc. Configuring hostname based firewall policies
CN112637105A (en) * 2019-09-24 2021-04-09 中国电信股份有限公司 Method, system, device and computer readable storage medium for switching firewall
CN116015977A (en) * 2023-01-28 2023-04-25 武汉大学 Network access control method and system for Internet of things equipment

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101977187A (en) * 2010-10-20 2011-02-16 中兴通讯股份有限公司 Firewall policy distribution method, client, access server and system
CN105827623A (en) * 2016-04-26 2016-08-03 山石网科通信技术有限公司 Data center system
CN106027569A (en) * 2016-07-19 2016-10-12 浪潮电子信息产业股份有限公司 Firewall management methods, master node, slave node, and cluster
US20200366648A1 (en) * 2019-05-14 2020-11-19 ColorTokens, Inc. Configuring hostname based firewall policies
CN112637105A (en) * 2019-09-24 2021-04-09 中国电信股份有限公司 Method, system, device and computer readable storage medium for switching firewall
CN116015977A (en) * 2023-01-28 2023-04-25 武汉大学 Network access control method and system for Internet of things equipment

Also Published As

Publication number Publication date
CN116614318B (en) 2023-10-03

Similar Documents

Publication Publication Date Title
EP3937424B1 (en) Blockchain data processing methods and apparatuses based on cloud computing
EP3937046A1 (en) Trusted startup methods and apparatuses of dedicated blockchain node device
EP3937041B1 (en) Trusted startup methods and apparatuses of dedicated blockchain node device
EP1860590B1 (en) Posture-based data protection
US20170161489A1 (en) Permission Management Method, Apparatus, and Terminal
EP3937458A1 (en) Blockchain integrated stations and automatic node adding methods and apparatuses
EP3937045A1 (en) Hash updating methods and apparatuses of dedicated blockchain node device
US20120005724A1 (en) Method and system for protecting private enterprise resources in a cloud computing environment
EP3937459A1 (en) Blockchain integrated stations and automatic node adding methods and apparatuses
EP3860036B1 (en) Key management method, security chip, service server and information system
US10887085B2 (en) System and method for controlling usage of cryptographic keys
CN104170348A (en) System and method for supporting state synchronization in a network environment
CN114553540B (en) Zero trust-based Internet of things system, data access method, device and medium
US20150310220A1 (en) Clipboard management
US20190260587A1 (en) Security authentication method and system, and integrated circuit
CN114528603B (en) Isolation dynamic protection method, device, equipment and storage medium of embedded system
CN102065003A (en) Method, system and equipment for realizing trusted secure routing of vehicular information system
CN114338153B (en) IPSec negotiation method and device
KR102442169B1 (en) A method and apparatus for log verification between heterogeneous operators in edge cloud system
CN116614318B (en) Network security protection method and system based on firewall
WO2023197529A1 (en) Online monitoring system, method and apparatus for power transmission line, and master station
CN112769849B (en) Method, system, equipment and storage medium for virus diagnosis and blocking
CN114598724A (en) Safety protection method, device, equipment and storage medium for power internet of things
CN101557397A (en) Entry management method and device
CN111814154A (en) High-compatibility safety protection system for network software development

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant