Open flow table security enhancement method and device

Abstract

The invention discloses an open flow table security enhancement method which can enable a security control function to be separated from a security executive function. The method includes the steps of obtaining security application corresponding to each security service, extracting security strategies, security protocols and feature libraries corresponding to the various security services from the security application, analyzing the security strategies of the security services to generate a security flow table, and creating a matching rule in the security flow table, and carrying out access control to messages and inspection for a state firewall, a security virtual private network (VPN) and deep messages according to the matching rule in the security flow table. The invention simultaneously discloses an open flow table security enhancement device. The open flow table security enhancement method and the open flow table security enhancement device can enable the security execution and the security application to be independently evolved and upgraded, and bring convenience to development of new security services, and can intensively carry out security management, resist zero-day attack, and relieve distributed denial of service attack according to the security strategies, and also support a virtualization multi-tenant security mode.

Description

technical field [0001] The invention relates to safety detection technology, in particular to an open flow table safety enhancement method and device. Background technique [0002] like figure 1 As shown, traditional security devices, such as firewalls, intrusion detection and prevention, secure virtual private networks, and unified threat management, are all integrated architectures, in which the interface board 100, security service board 102, main control board 106, and switching board 104 are Tightly coupled, usually located in a physical box; wherein, the interface board 100 provides the interface of the security device and submits the data flow to the security service board 102, and the interface board 100 is usually composed of a network processor (NP, Network Processor) or application-specific Integrated chip (ASIC, Application Specific Integrated Circuit) implementation. The security service board 102 completes functions such as access policy control, network addr...

AI Technical Summary

Problems solved by technology

This architecture has the following limitations: (1) It is difficult for enterprises to deploy new security applications on the security execution unit, and usually needs to purchase the entire device to complete the upgrade of new features; (2) The security execution units provided by different manufacturers are quite different, Inconsistent security policies make it difficult to achieve interoperability and centralized control and management; (3) Traditional security execution units are usually deployed at the edge of the enterprise, which is difficult for virtualized multi-tenant scenarios

Images