Distributed firewall system and method for realizing content diction of firewall

A distributed firewall and content technology, applied in the field of network security, can solve problems such as poor system stability, low throughput, network congestion, etc., and achieve the effect of improving performance, throughput and stability

CN101014048AInactive Publication Date: 2007-08-08NEW H3C TECH CO LTD
0 Cites 20 Cited by

Patent Information

Authority / Receiving Office
CN · China
Current Assignee / Owner
Publication Date
2007-08-08
Estimated Expiration
Not applicable · inactive patent

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses one distribution firewall system, which comprises dialogue transfer system and connected content monitor filter module, wherein, the content monitor filter module is to monitor filter condition according to preset content and to filter on the message content and to send the filter result to the dialogue transfer system; the content monitor filter module and dialogue transfer system are operated in first and second processors. The invention also discloses one method to realize firewall content test.
Need to check novelty before this filing date? Find Prior Art

Description

Technical field

[0001] The invention relates to the field of network security, in particular to a distributed firewall system and a method for realizing firewall content detection. Background technique

[0002] With the development of network technology, the requirements for firewalls are also increasing. The hardware logic diagram of the existing firewall is shown in Figure 1. The detection and forwarding of the received message content is completed by a single-core CPU processor. That is, all the software of the firewall runs on a single-core CPU processor to form a session forwarding system. As shown in Figure 2, the process of firewall detection is: the message receiving module receives the message and caches it, and sends it at the same time. Interrupt notification packet filtering module; the packet filtering module filters the packets according to the filtering rules configured by the management control module, such as checking each incoming packet and viewing the basic in...

Examples

Embodiment Construction

[0034] With the development of chip technology and network technology, multi-core CPU processors and multi-CPU processors have been increasingly used in network equipment to process more services and improve the performance of network equipment. Based on the multi-core CPU processor and the multi-CPU processor, the present invention proposes a distributed firewall system and a method for realizing firewall content detection. Described separately below.

[0035] In order to meet the requirements of firewalls for content detection, the present invention provides a distributed firewall system that separates content monitoring and filtering and firewall session forwarding functions. See Figure 3, which is a block diagram of Embodiment 1 of the distributed firewall system provided by the present invention, including The session forwarding system 1 and the content monitoring and filtering module 2 are connected to each other. The session forwarding system 1 runs in the first CPU process...