Method and system for distributed firewall security policy configuration based on overlay network

Abstract

The invention provides a method and system for distributed firewall security policy configuration based on an overlay network. The method for distributed firewall security policy configuration based on the overlay network comprises the following steps that firstly, an intelligent node deployed in a certain region collects first reference information reflecting service flow information carried by the network in the region corresponding to the intelligent node, and security policies are generated according to the first reference information; secondly, the intelligent node in the first step simultaneously distributes the security policies generated by the intelligent node to a firewall in the region corresponding to the intelligent node and intelligent nodes in other regions; thirdly, the security policies received by the intelligent nodes in other regions from other nodes are used as second reference information by the intelligent nodes in other regions, security polices corresponding to the intelligent nodes in other regions are adjusted dynamically, the security polices generated by the intelligent nodes in other regions are distributed to the firewalls in the regions, and therefore security policy configuration between the regions is completed. The intelligent node in the first step generates the security policies according to the first reference information and firewall performance state information.

Description

technical field [0001] The present invention relates to the technical field of network security, more specifically to an overlay network-based distributed firewall security policy configuration method and system. Background technique [0002] Firewall (Firewall) is a device composed of software and hardware devices, which can construct a protective barrier between internal network and external network, between private network and public network. The firewall device can allow or restrict the passage of transmitted data according to the set rules. Firewalls are still an indispensable means of ensuring network security. In the case of a small network, traditional border firewalls are very effective. However, with the explosive growth of network scale, the defects of traditional firewall technology began to be revealed. Problems such as network single-point bottlenecks, limited new service support capabilities, and single security management model make traditional border fire...

AI Technical Summary

Problems solved by technology

However, most of this information is related to user identity, IP flow, and network static structure, and lacks awareness of the bearer status of network equipment. As a result, the system cannot quickly generate appropriate security policies for emergencies in the network.

[0014] 2. Centralized architecture generates security policies, often causing single-point bottlenecks

Therefore, the scope of each security policy configuration is limited to the controlled host, so one configuration can only realize the control of one computer

[0016] 4. The existing firewall system generally only considers the deployment in one domain, and only cares about the management of the network status in the domain; lack of linkage between multiple logical domains, it is impossible to implement the policy configuration of the firewall in the global network

Images