Realize the method for safety tactics of network safety apparatus
Technical field
The present invention relates to realize in the network security device method of security strategy.
Background technology
Along with the fast development of network technology and popularizing of internet, applications, network security receives concern more and more widely.Existing network security device generally includes safety means or functional modules such as fire compartment wall, intrusion detection device and VPN(Virtual Private Network).
Security strategy is a kind of description of handling the management strategy of safety problem, is used for the communication between the main control system, to improve the fail safe of inter-host communication.
When the configuration security strategy, source address in the security strategy and destination address use the network address usually; What described source address was described is the information of source network, and what destination address was described is the information of purpose network.When safety device is received a packet, extract the source address and the destination address of packet, and with security strategy in source address and matching destination address, according to the result of coupling, and packet is handled accordingly according to described security strategy.
According to above principle, a kind of method of existing realization security strategy is: manually resolve the network address of domain name addresses correspondence, and use the network address in the security strategy of safety device.The shortcoming of this method is: if the pairing network address, domain name address has produced variation, then need manually to resolve again domain name addresses, and use the network address that this parsing the obtains security strategy that comes into force again.
The another kind of prior art of security strategy that realizes is: directly use the domain name addresses of source network and purpose network in security strategy, when security strategy comes into force, resolve the pairing network address of domain name addresses.The defective of this method is: disposable parsing is only carried out in the pairing network address of domain name addresses when security strategy comes into force, when realizing security strategy, all use the network address of the described parsing acquisition first time and the network address in the packet to mate, therefore, if the pairing network address of the domain name addresses of using in the security strategy changes, then need to resolve again the pairing network address of domain name addresses, and then reconfigure security strategy, otherwise can't realize security strategy.
In sum, if the pairing network address of domain name addresses has produced variation, in the then existing security strategy implementation method, can not upgrade the corresponding relation of the network address and domain name addresses dynamically.Because the existing network safety device can't be tackled the dynamic change of the network address flexibly, thereby has improved the configuration management workload of network security device.
Summary of the invention
The problem to be solved in the present invention provides a kind of method that realizes safety tactics of network safety apparatus, and this method can adapt to the dynamic change of the network address, makes network security device realize security strategy fast.
In order to address the above problem, the invention provides a kind of method that realizes security strategy, comprise
1) network security device is to the pairing network address of server requests domain name addresses, server is resolved the domain name address, and to the network address of network security device feedback parsing acquisition and the corresponding relation of domain name addresses, perhaps, the network security device analysis is obtained the corresponding relation of the domain name addresses and the network address through the packet of the name server agreement of the network equipment;
2) the configuration security strategy is quoted domain name addresses in security strategy;
3) obtain the network address of carrying in the packet;
4) mate the network address of carrying in the packet is corresponding with the domain name address network address;
5) according to matching result and security strategy packet is handled.
Step 2) also comprises application network address configuration security strategy in; And,
Also comprise in the step 3): search whether defined the network address of carrying in the packet in the security strategy, if do not have, then carry out step 4), otherwise the network address that defines in the strategy safe in utilization mates, carry out step 5).
Network security device is periodically to the pairing network address of server requests domain name addresses.
Also comprise in the step 1):
In presetting duration,, then delete this corresponding relation if the corresponding relation of the described network address that obtains and domain name addresses upgrades.
The corresponding relation of setting up the domain name addresses and the network address respectively at the user's space and the kernel spacing of network security device.
The corresponding relation of the domain name addresses and the network address upgrades synchronously in described user's space and the kernel spacing.
Above technical scheme as can be seen, in the present invention, owing to when the configuration network security strategy, quoted domain name addresses, and set up the corresponding relation of the domain name addresses and the network address, thereby, during the network address that the present invention carries, can search the corresponding relation that the domain name addresses and the network address are set up in security strategy undefined data bag, the network address of carrying in the packet is mated, and then packet is handled according to described security strategy.
Further, the present invention carries out dynamic management to the domain name addresses of described foundation and the corresponding relation of the network address, can set up the corresponding relation of the domain name addresses and the dynamic network address, and in time this corresponding relation be upgraded, and needn't reconfigure security strategy; Therefore, when changing in the network address, mate the network address to carrying in the packet that the present invention can be correct, and then can carry out correct processing to packet according to security strategy.
Further, the corresponding relation that the present invention safeguards a network address and domain name addresses respectively at the user's space and the kernel spacing of safety device, and carry out synchronous renewal, therefore, when mate the network address of carrying in to packet, can search the corresponding relation of the described network address and domain name addresses more fast, improve the treatment effeciency of network security device.
In sum, the present invention has made things convenient for the management of network security device, has strengthened the adaptive capacity of Network Security Device to network environment.
Description of drawings
Fig. 1 is an embodiment of the invention flow chart;
Fig. 2 is a domain name addresses resource logical relation schematic diagram in user's space and the kernel spacing;
Fig. 3 is for carrying out the flow chart of network address coupling in the security strategy.
Embodiment
Core concept of the present invention is: quote the domain name address resource in the security strategy of network, the domain name address resource is safeguarded the corresponding relation between domain name addresses and its pairing network address, and described corresponding relation can be upgraded with the variation of network actual environment; In realizing security strategy, use the network address of resolving in the domain name addresses resource to finish the coupling of network packet, and then packet is handled accordingly according to described security strategy.
According to above-mentioned core concept, with reference to Fig. 1, the specific embodiment of the present invention is:
Step 1: set up the corresponding relation of the domain name addresses and the network address, the corresponding relation of the described network address of Dynamic Maintenance and domain name addresses;
In the present embodiment, by setting up and safeguarding that the method for domain name address resource realizes the present invention, comprising:
A) set up the domain name addresses resource:
The attribute that defines in the domain name addresses resource can comprise: the title of domain name addresses resource, the i.e. normally used title of certain domain name addresses; Domain name addresses comprises domain name addresses or Chinese domain name address that ascii character is formed, and when certain website had Chinese domain name, this Chinese domain name address was identical with the title of domain name address resource usually; Static network address, the i.e. network address of manually adding; The primary and secondary name server is used for dynamically resolving the server address of the pairing network address of domain name addresses; Dynamically resolve, i.e. the function of the pairing network address of domain name addresses is dynamically obtained in definition; Resolve at interval, dynamically obtain the time interval of the pairing network address of domain name addresses; Lose efficacy the time limit in time interval that the domain name addresses of dynamically obtaining and the corresponding relation of the network address lost efficacy; The dominant record number, the maximum number of each pairing network address of domain name addresses.
Realize before the security strategy that the user can pass through to add the domain name addresses resource, and can edit the attribute of domain name address resource, as adding static network address or selecting dynamic analytical capabilities etc., the user can delete the domain name addresses resource of having built up equally.
B) dynamically obtain the network address of domain name addresses correspondence, its method comprises:
B1) the domain name addresses resource method is to the pairing network address of name server active request domain name addresses.If opened dynamic analytical capabilities when promptly setting up the domain name addresses resource, then when adding the domain name addresses resource, the domain name addresses resource method can send the domain name addresses request to name server, and after the foundation of domain name addresses resource is finished, regularly send the pairing network address of domain name addresses of this domain name addresses resource to the name server request.The domain name server is the primary and secondary name server that defines in the domain name addresses Resource Properties, if do not define the primary and secondary domain name server address in the domain name addresses resource, then uses the domain name server address of safety device;
B2) pass the protocol package of the domain name addresses server (DNS) of the network equipment by the kernel module analysis of network security device, and therefrom obtain the corresponding relation of the domain name addresses and the network address.
C) safeguard the corresponding relation of the domain name addresses and the network address:
The domain name addresses resource method is respectively safeguarded the mapping table of a domain name addresses and the network address in user's space and kernel spacing, and the mapping table of user's space and kernel spacing keeps upgrading synchronously.As shown in Figure 2, in the user's space of network security device and kernel spacing, have a domain name addresses and network address mapping table 21 separately, functional unit 22 is quoted the domain name address resource for security strategy or other functional modules, and then obtain the network address in the described correspondence table 21 and the corresponding relation of domain name addresses, in subscriber unit, comprise domain name addresses parsing and updating block 23 automatically, this functional unit is used for safeguarding and upgrades the network address of described mapping table 21 and the corresponding relation of domain name addresses that domain name addresses in the network security device in kernel spacing and the user's space and network address mapping table 21 reach synchronous renewal by functional unit 23.
In the mapping table of the domain name address and the network address, the pairing network address of domain name addresses comprises: the manually static network address that adds and dynamically the dynamic network address of parsing.As mentioned above, owing to opened dynamic analytical capabilities when setting up the domain name addresses resource, thereby the dynamic network address of each domain name addresses correspondence all can regularly be parsed automatically, to set up the corresponding relation with domain name addresses; And, when not upgrading in the duration that the corresponding relation of described dynamic network address and domain name addresses is presetting, then in the domain name addresses resource with this dynamic network address deletion.The automatic parsing interval of each domain name addresses and the survival time limit of dynamic network address can be set to inequality.
Step 2: the configuration security strategy, and in security strategy, quote domain name addresses.Different demands according to the user are formulated the security strategy that adapts to network environments, among the present invention not the formulation to security strategy limit.In security strategy, quote the domain name address resource according to the domain name addresses resource name.Other modules in the network security device are quoted the domain name address resource according to the needs of this module.
Step 3: obtain the network address of carrying in the packet; Have source address and destination address with network address sign in the packet that transmits in the network, those skilled in the art can obtain the network address in the described packet according to prior art.
Step 4: mate the network address that the network address of carrying in the packet is corresponding with the domain name address.In security strategy or other functional modules, quote the domain name address resource, and when security strategy comes into force, domain name addresses resource name or sequence number according to the domain name addresses resource, search the corresponding network address the domain name addresses of safeguarding from the user's space of network security device or kernel spacing and the correspondence table of the network address, and then the network address of carrying in the packet is mated.
With reference to Fig. 3, in the present embodiment, step 31, network security device is received packet; Step 32 is extracted the network address in the packet; Behind the network address in obtaining packet, carry out step 33, judge whether when security strategy, to quote the domain name address resource; If need, then carry out step 34, obtain the network address in the domain name addresses resource correspondence table; And then carry out step 35, use these network addresss the network address of carrying in the packet is mated; If judging in the step 33 does not need to quote the domain name address resource, then carry out step 36, mate the network address of carrying in the packet network address in the using security strategy.
Step 5: according to matching result, packet is handled, as abandoned or packet is transmitted according to security strategy etc. with reference to security strategy.
More than the method for realization safety tactics of network safety apparatus provided by the present invention is described in detail, used specific case herein principle of the present invention and execution mode are set forth, the explanation of above embodiment just is used for helping to understand method of the present invention and core concept thereof; Simultaneously, for one of ordinary skill in the art, according to thought of the present invention, the part that all can change in specific embodiments and applications, in sum, this description should not be construed as limitation of the present invention.