Message processing method, device and network security equipment

Abstract

The invention provides a message processing method, device and network security equipment, wherein the method comprises the steps of: when a first message of a session flow is received, establishing a session flow table entry for the session flow and adding the index of the session flow table entry to a universal flow hash table; performing policy matching and verification on the session flow in order to judge whether the session flow is legal or illegal; and when the session flow is illegal, adding the index of the session flow table entry to a recovery auxiliary table and updating the policy matching and verification results of the illegal session flow to the session flow table entry. The device comprises an establishment module, a verification module and an addition module. The network security equipment comprises the message processing device above. According to the method and the device, the depletion of the resource of flow table entry when the number of attack flows is larger is avoided, and simultaneously, high system performances are maintained.

Description

technical field [0001] The present invention relates to communication technology, in particular to a message processing method, device and network security equipment. Background technique [0002] In network security equipment, the session flow state tracking technology is generally used to monitor and manage the communication flow passing through the equipment, so as to identify and block specific untrusted communication flow. Under the framework of this session flow state tracking technology, the processing process of a message is as follows: for the first message of the session flow, create a new session flow entry and add it to the flow table; Match and audit, and update the processing policy to the session flow entry. For the non-first packet, if the session flow information is already stored in the flow table, the flow table is directly searched to obtain and execute the processing policy of the session flow. In the above message processing process, there may be many...

AI Technical Summary

Problems solved by technology

[0004] However, in the prior art, a complete policy matching and review process is required for the packets of the attack flow. When the number of attack flows is large, the system performance will decrease, thereby affecting the overall system throughput.

Images