Rapid fine-grained multi-domain network interconnection security control method

Abstract

The invention discloses a rapid fine-grained multi-domain network interconnection security control method, and belongs to the field of network space security. The method comprises: firstly, security policy language grammar specifications are established, each security policy is converted into a normal form script, a corresponding grammar parser is achieved, and the scripts without errors are stored; designing each strategy in a white list into a tree for scripts in which domains and semantics of services exist in the network, and merging the trees; designing each strategy in the blacklist intoa tree, and merging the trees into a white list; and designing each strategy in the range default action into a tree, and merging the tree with the black and white list merging tree to obtain a security strategy tree; and finally, converting the script describing inter-domain service communication into a seven-tuple security rule describing fine granularity, distributing / transmitting the seven-tuple security rule to a security Internet gateway at a high speed, and updating security control information of an execution unit according to the security rule. The method has the advantages of simplicity, convenience, flexibility and higher efficiency.

Description

technical field [0001] The invention belongs to the field of network space security, relates to a space-ground integrated network information security guarantee system, and specifically relates to a fast fine-grained multi-domain network interconnection security control method. Background technique [0002] The space-ground integrated network is a shared and interoperable infrastructure network provided for multi-domain network users. However, there are differences in the security requirements of multi-domain bearing services. From the perspective of application services, there is a need for mutual communication between domains, which forms the characteristics of time and space change. On the network, service types / characteristics / security levels vary with multiple domains. The space-time characteristics of multi-users in the domain change, and it cannot adapt to the dynamic needs of various users in the space-ground integrated network. [0003] The space-ground integrated ...

AI Technical Summary

Problems solved by technology

[0006] Aiming at the problem that the security policy language cannot be directly applied to the high-throughput secure Internet gateway, the present invention proposes a fast and fine-grained multi-domain network interconnection security control method; Domains, security levels, and ground-based network characteristics perform differentiated security control in inter-domain communication; it can support multi-domain network interconnection security control based on domains, services, and characteristics, and realize automatic mapping from security policies to security rules and deployment of security rules. implement

Images