A label-based network authorization management method and system

Abstract

The invention discloses a label-based network authorization management method and system, and aims to realize a simple and convenient network authorization management method in a dynamically changing network. According to the user identity authentication module, the user's identity information is uploaded to the management platform in real time, and the management platform generates user label data and user-defined application label data, and synchronizes them to the label synchronization module, and converts them into binary labels that can be used in the label matching module data. The label matching module of the operating system kernel module uses the interval tree (interval-tree) retrieval algorithm and matching cache to quickly match all data packets with application labels and user labels, and perform corresponding traffic operations (blocking) through different matching results or release).

Description

technical field [0001] The invention relates to the technical field of IP, in particular to a tag-based network authorization management method and system. Background technique [0002] The rapid development of IT has changed the face of the network boundary, and many enterprises adopt cloud, big data analysis and automation to accelerate the delivery of applications, thereby driving business development. As access to applications becomes easier, the network becomes more complex, and network security becomes critical, requiring a more refined approach to network authorization management. [0003] Traditional networks use firewall devices to supervise inbound and outbound north-south network traffic, and release or block specific traffic based on some custom security rules. This method is relatively complicated to manage and cannot be directly and effectively managed according to applications and devices. It is even more impossible to monitor the east-west traffic of the int...

AI Technical Summary

Problems solved by technology

[0003] Traditional networks use firewall devices to supervise inbound and outbound north-south network traffic, and release or block specific traffic based on some custom security rules. This method is relatively complicated to manage and cannot be directly and effectively managed according to applications and devices. It is even more impossible to monitor the east-west traffic of the enterprise internal network

[0004] In short, in the management of existing network security policy rules, it is difficult to achieve refined and dynamically adjustable methods

Images