Deep packet inspection device for ipv6 security gateway
A deep packet inspection and security gateway technology, applied in the field of deep packet inspection devices, can solve problems such as difficulty in realizing real-time response and wire-speed processing, inability to adapt rule matching technology, and weak scalability.
Active Publication Date: 2017-03-22
BEIJING TOPSEC TECH
View PDF4 Cites 0 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Secondly, with the transition from IPv4 to IPv6, the length of the IP address increases from the original 32 bits to 128 bits. The mandatory application of the security mechanism based on the IPSec standard makes the message load change from plaintext to ESP ciphertext, and the existing rules match Technology is completely unable to adapt to this new change
Thirdly, the performance scalability of existing rule matching engines is generally weak. With the update and expansion of the rule set, the speed of rule preprocessing and rule matching is declining rapidly, making it difficult to achieve real-time response and line-speed processing
Finally, the existing rule matching engine cannot implement configurable rule set preprocessing and matching core structure upgrade. Since the preprocessing process and rule matching core are hard-coded, when the security requirements change or the application situation changes, for example, the rule format changes , everything can only be implemented from scratch
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0048] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0049] According to an embodiment of the present invention, a deep packet inspection device for IPv6 security gateway is provided, figure 1 It is a schematic structural diagram of an IPv6 security gateway-oriented deep packet inspection device according to an embodiment of the present invention, as figure 1 As shown, the deep packet inspection device for IPv6 security gateway according to the embodiment of the present invention inc...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
The invention discloses a deep packet detection device orienting an IPv6 security gateway. The device comprises a double-matching core unit 102, a multistage assembly line preprocessing parallel mechanism 112 which is connected with the double-matching core unit 102 and is invoked via a basic operation interface, and a multipath search matching parallel mechanism 114. The double-matching core unit 102 comprises a main matching core 1 and a shadow matching core 2. The main matching core 1 and the shadow matching core 2 respectively comprise an engine configuration parameter unit 104, a preprocessing primitive operation unit 106, a class search high-speed classification unit 108 and a class reduction high-speed classification unit 110. The basic operation interface comprises a rule parsing interface 116, a rule matching preprocessing interface 118, a rule matching classification interface 120 and a rule matching engine configuration interface 122. With the help of the technical scheme, deep packet detection orienting an IPv6 network can be realized.
Description
technical field [0001] The invention relates to the technical field of flow classification and identification, in particular to a deep packet inspection device for IPv6 security gateways. Background technique [0002] In the existing technology, the identification and classification of applications or protocols is the basis of content filtering, traffic analysis, bandwidth management, secure communication, Internet supervision and operation and maintenance, and rule matching based on protocol feature matching is the key to network packet classification technology. Correspondingly, the rule matching engine is the core component of various network security gateways such as application traffic management gateway, content filtering firewall, intrusion detection and prevention system, anti-virus gateway, spam filtering gateway, unified threat management, VPN, etc. It is the premise and foundation of packet forwarding, QoS queue scheduling, load balancing, content filtering and n...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More Patent Type & Authority Patents(China)
IPC IPC(8): H04L12/26
Inventor 高长喜
Owner BEIJING TOPSEC TECH