Fast HTTP redirection method

Abstract

The invention discloses a fast HTTP redirection method. The method comprises the following steps: step one, a terminal sends a first message of TCP three-way handshake to a server; step two, the server responds a second message of the TCP three-way handshake to the terminal, and a switch mirrors the message to an admission control server; step three, the admission control server sends a HTTP redirection message to the terminal when receiving the message mirrored in the step two; step four, the terminal receives the second message of the TCP three-way handshake responded by the server, and sends a third message of the TCP three-way handshake to the server; step five, the terminal receives the HTTP redirection message sent by the step three, and stores the same in the TCP cache; step six: the terminal sends a HTTP request to the server and waits the HTTP response; step seven, the terminal takes out the HTTP redirection message received in the step five, and then executes the HTTP redirection. By use of the fast HTTP redirection method disclosed by the invention, the defect that the existing HTTP redirection method is invalid under a specific condition is effectively solved, and the fast blocking is realized.

Description

technical field [0001] The invention relates to network security defense technology, in particular to a fast HTTP redirection method. Background technique [0002] Network access control technology is currently the mainstream network security defense technology. It effectively solves the security threats caused by non-secure terminal access to the network by implementing security protection for terminals, and keeps viruses, loopholes, and network attacks out of the door. , thus comprehensively guaranteeing the security of devices connected to the network. [0003] Common technologies for network access control include policy-based routing access, VLAN isolation access, dot1x access, ARP access, and mirroring access. Among them, the mirror admission technology refers to the switch in the network sending a copy of the data traffic image (that is, copying) to the admission control server. The admission control server monitors and examines these traffic, and then executes the t...

AI Technical Summary

Problems solved by technology

[0013] The existing HTTP redirection method has the following major defects: the HTTP response message sent by the server and the HTTP redirection message sent by the admission control server will arrive at the terminal successively. If the HTTP response message arrives first, the terminal will not be blocked. redirect

When the terminal, server, and admission control server are all in the same high-speed LAN, and the network performance of the server is higher than that of the admission control server, the HTTP response message sent by the server will arrive at the terminal first, usually within 8-9 microseconds At this time, the image access HTTP redirection blocking technology will fail, and the security protection of the network cannot be implemented.