Method and system for achieving DDoS defense based on technology of dynamic tunnels

Abstract

The invention provides a method for achieving DDoS defense based on the technology of dynamic tunnels, and the method comprises the steps: an access terminal transmits a tunnel candidate request message to a service controller; the service controller feeds back a plurality of candidate tunnel gateways, which are arranged according to a preset priority rule, to the access terminal according to the property of the access terminal after the service controller receives the tunnel candidate request message; the access terminal selects one tunnel gateway from the plurality of received candidate tunnel gateways according to the sequence of the plurality of candidate tunnel gateways, and is connected with an access object through the tunnel gateway. The invention also provides a system for achieving DDoS defense based on the technology of dynamic tunnels, and the system comprises the access terminal, the service controller, a source controller, and a plurality of tunnel gateways. The method and system achieves the security defense against attack, can reduce the link redundancy, and guarantee the reliability of core business.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to a method and system for realizing DDoS defense based on dynamic tunnel technology. Background technique [0002] Distributed Denial of Service (Distributed Denial of Service, referred to as DDoS), is a common attack behavior in the network, specifically refers to the use of client / server technology to combine multiple computers as an attack platform to launch attacks on one or more targets DDoS attacks, thus doubling the power of denial of service attacks. However, due to the uncertainty of the source of the attack, the traffic is too large when the attack occurs, which will cause the service of the business to be unreachable. [0003] In the existing technology, common DDoS defense has the following two methods: (1) equipment cleaning: cleaning through traffic cleaning equipment, generally deployed at the entry point of the data center or business system; (2) DNS ta...

AI Technical Summary

Problems solved by technology

[0004] The above-mentioned DDoS defense methods have been widely used, but there are also the following defects: (1) Equipment cleaning: professional security equipment is required, and sufficient bandwidth resources are available

For data centers or business systems that have invested a lot of resources, they cannot resist attacks with large traffic; (2) DNS takeover and cleaning: This method has less investment cost, but the services that can be cleaned are generally http, and because the traffic passes through the first Three parties, not suitable for sensitive business

Images