A bypass blocking method, device, system, and electronic device

Abstract

A bypass blocking method, device, system, and electronic equipment; the bypass blocking method includes: a bypass blocking device receives a mirrored message of a predetermined message from a distribution device; wherein, the distribution device is used to distribute A device for downlink data of the Internet service provider ISP network; the bypass blocking device judges that it needs to be blocked according to the mirror message of the predetermined message, and generates a blocking message with the same destination address as the predetermined message, sent to multiple core routers. The present application can reduce the deployment difficulty and cost of bypass blocking, and guarantee the time delay requirement of bypass blocking to a certain extent.

Description

technical field [0001] The present invention relates to the network field, in particular to a bypass blocking method, device, system and electronic equipment. Background technique [0002] Bypass blocking technology uses bypass interception to obtain all data packets passing through the firewall device, restores and analyzes the protocol content to identify illegal information in the restored content, and blocks accordingly. [0003] HTTP (HyperText Transfer Protocol, hypertext transfer protocol) bypass blocking refers to analyzing the REQUEST (request) message using HTTP, blocking the fast and accurate calculation and matching of the firewall device through the bypass, and generating a fake RESET that blocks the use The (reset) message is sent to the server to stop the HTTP session transmission that the bypass analysis thinks needs to be stopped, and do corresponding interruption and prevention processing for the access and transmission of suspicious content. However, the ...

AI Technical Summary

Problems solved by technology

[0006] like figure 2 As shown, for example, for a large-scale cloud service provider, multiple IDC computer rooms share the ISP network outlet line. Since the optical splitting equipment is usually fixedly deployed at the location of the ISP network outlet line, the transmission distance between the computer room where the firewall device is located and the actual service server room may be relatively long. As a result, the network transmission delay of the RESET message used for blocking cannot be guaranteed, resulting in a decrease in the blocking success rate.

[0007] for example figure 2 , when the mirrored traffic enters the bypass blocking firewall device (such as figure 2 dot-dash line), but accesses Server 1 on the A side of the IDC computer room, the bypass blocking firewall device will analyze the mirrored traffic on the line on the B side of the IDC computer room, and continue the triggered RESET message. Inject back into the access switch in the B-side computer room. Since Server 1 is in the IDC computer room A-side, the RESET message needs to bypass the core router, which increases the forwarding delay of multi-hop network devices. For example, figure 2 As shown by the dotted line in the middle, the RESET message sent by the bypass blocking firewall device is forwarded from the access switch on the B side of the IDC to the aggregation switch on the B side of the IDC, and then forwarded to the core router before being forwarded to Server 1. Wen Ru figure 2 As shown by the thick line in the middle, it is sent from the ISP network to the server 1 through the optical splitting device; therefore, it is very likely that the RESET message used for blocking reaches the target server (server 1) later than the normal service message, resulting in bypass blocking function failure

[0008] However, if in a large-scale cloud computer room deployment environment, a set of bypass blocking firewall equipment is independently deployed for each computer room, the maintenance cost and equipment cost will increase exponentially, so the traditional bypass blocking firewall equipment cannot provide Large cloud service providers provide comprehensive protection

Images