Data message and method for securely accessing data streams on a firewall

Abstract

The invention discloses a data message, comprising a Mac header section, an IP header section, a new protocol header section, a TCP / UDP header section, a data payload section and an FCS section, wherein the new protocol header section comprises a version number field and a priority field. The method comprises the following steps: establishing a data message format and renewing a forwarding protocol; renewing a forwarding protocol; renewing a forwarding protocol; renewing a forwarding protocol; decapsulating the data packet by a firewall, if the source IP address and the destination IP addressare both private networks, match the correspondence table of the destination address and the interface address with the interface policy table to confirm whether forwarding is allowed or not. If the source IP address and the destination IP address are private network address and public network address respectively, if forwarding is allowed, NAT processing is performed first, and then the forwarding is sent. The scheme of the invention is simple in realization and clear in principle, can more effectively solve the safe access of data streams in different networks, and improves the flexibility of data mutual access configuration between different networks.

Description

technical field [0001] The invention belongs to the technical field of data communication and network security, specifically relates to a data message, and also relates to a data flow security mutual access method on a firewall based on the data message. Background technique [0002] At present, the traditional firewall adopts the method of area division to distinguish the security level of the network. Although the area division of the traditional firewall reasonably divides different interfaces into different security levels, so as to realize the legal access of data packets under the permission of the security policy, but if To achieve access from different security areas, you must configure the inter-zone default packet filtering policy or the inter-zone security forwarding policy. Although the configuration of the inter-zone default packet filtering policy is simple and rarely wastes system resources, its policy conditions are extremely broad. In other words, it is very...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is also to provide a data flow security mutual access method for data messages on the firewall, which solves the problem of wasting equipment system resources caused by traditional firewall division methods and a large number of applications of security forwarding strategies, which affects equipment performance degradation The problem

Images