Bypass blocking method, device, system, and electronic device

Abstract

The invention provides a bypass blocking method, device, system, and electronic device. The bypass blocking method comprises the steps that a bypass blocking device receives a mirror image report of predetermined message from a distributing device, wherein the distributing device is used for distributing the downstream data of an Internet service provider (ISP network); the bypass blocking devicedetermines whether blocking is required or not based on the mirror image report of the predetermined message, and generates a blocking report having the same destination address as the predetermined message, and sends the blocking report to a plurality of core routers. The invention is advantageous in that the disposition difficulty and cost of bypass blocking can be reduced, and the time-delay demand of the bypass blocking can be guaranteed to a certain degree.

Description

technical field [0001] The present invention relates to the network field, in particular to a bypass blocking method, device, system and electronic equipment. Background technique [0002] Bypass blocking technology uses bypass interception to obtain all data packets passing through the firewall device, restores and analyzes the protocol content to identify illegal information in the restored content, and blocks accordingly. [0003] HTTP (HyperText Transfer Protocol, hypertext transfer protocol) bypass blocking refers to analyzing the REQUEST (request) message using HTTP, blocking the fast and accurate calculation and matching of the firewall device through the bypass, and generating a fake RESET that blocks the use The (reset) message is sent to the server to stop the HTTP session transmission that the bypass analysis thinks needs to be stopped, and do corresponding interruption and prevention processing for the access and transmission of suspicious content. However, the ...

AI Technical Summary

Problems solved by technology

[0006] like figure 2 As shown, for example, for a large-scale cloud service provider, multiple IDC computer rooms share the ISP network outlet line. Since the optical splitting equipment is usually fixedly deployed at the location of the ISP network outlet line, the transmission distance between the computer room where the firewall device is located and the actual service server room may be relatively long. As a result, the network transmission delay of the RESET message used for blocking cannot be guaranteed, resulting in a decrease in the blocking success rate.

[0007] for example figure 2 , when the mirrored traffic enters the bypass blocking firewall device (such as figure 2 dot-dash line), but accesses Server 1 on the A side of the IDC computer room, the bypass blocking firewall device will analyze the mirrored traffic on the line on the B side of the IDC computer room, and continue the triggered RESET message. Inject back into the access switch in the B-side computer room. Since Server 1 is in the IDC computer room A-side, the RESET message needs to bypass the core router, which increases the forwarding delay of multi-hop network devices. For example, figure 2 As shown by the dotted line in the middle, the RESET message sent by the bypass blocking firewall device is forwarded from the access switch on the B side of the IDC to the aggregation switch on the B side of the IDC, and then forwarded to the core router before being forwarded to Server 1. Wen Ru figure 2 As shown by the thick line in the middle, it is sent from the ISP network to the server 1 through the optical splitting device; therefore, it is very likely that the RESET message used for blocking reaches the target server (server 1) later than the normal service message, resulting in bypass blocking function failure

[0008] However, if in a large-scale cloud computer room deployment environment, a set of bypass blocking firewall equipment is independently deployed for each computer room, the maintenance cost and equipment cost will increase exponentially, so the traditional bypass blocking firewall equipment cannot provide Large cloud service providers provide comprehensive protection

Images