A data message and a method for safe mutual access of data flow on a firewall

Abstract

A kind of data message of the present invention comprises Mac head section, IP header section, new protocol header section, TCP / UDP header section, data payload section and FCS section, and new protocol header section includes version number field and priority field. The data flow security mutual access method of the data message on the firewall comprises: establishing the data message format, and updating the forwarding protocol; the firewall decapsulates the data message, if the source IP address and the target IP address are both private Network, match the target address and interface address correspondence table with the interface policy table to confirm whether forwarding is allowed; if the source IP address and target IP address are private network addresses and public network addresses respectively, if forwarding is allowed, NAT processing is performed first, and then send. The scheme of the present invention is simple to implement and clear in principle, can more effectively solve the problem of safe access of data streams in different networks, and improves the flexibility of data mutual access configuration between different networks.

Description

technical field [0001] The invention belongs to the technical field of data communication and network security, specifically relates to a data message, and also relates to a data flow security mutual access method on a firewall based on the data message Background technique [0002] At present, the traditional firewall adopts the method of area division to distinguish the security level of the network. Although the area division of the traditional firewall reasonably divides different interfaces into different security levels, so as to realize the legal access of data packets under the permission of the security policy, but if To achieve access from different security areas, you must configure the inter-zone default packet filtering policy or the inter-zone security forwarding policy. Although the configuration of the inter-zone default packet filtering policy is simple and rarely wastes system resources, its policy conditions are extremely broad. In other words, it is very ...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is also to provide a data flow security mutual access method for data messages on the firewall, which solves the problem of wasting equipment system resources caused by traditional firewall division methods and a large number of applications of security forwarding strategies, which affects equipment performance degradation The problem

Images