Network traffic isolation system based on DPDK

Abstract

A network flow isolation system based on DPDK comprises a detected network, a twin network, a gateway, a DPDK module, a detection filtering module, a filtering rule submission module and a filtering rule distribution module; wherein the DPDK module is used for querying and modifying messages received and sent by the network card at the gateway according to a filtering rule, and the DPDK module is arranged on the gateway; the detection module is used for analyzing, detecting and filtering the flow packet, and the detection module is arranged in a detected network; the filtering rule submitting module is used for receiving the filtering rule sent by the filtering distribution module and sending the filtering rule to the driving module; and the filtering rule distribution module is used for distributing filtering rules imported from other places and sending the filtering rules to the driving module. According to the invention, flexible and rapid isolation strategy configuration can be effectively carried out on the traffic, and malicious traffic can be detected in real time, so that the isolation strategy can be dynamically modified, the traffic at the gateway can be rapidly shunted, and the malicious traffic can also be rapidly isolated.

Description

technical field [0001] The invention relates to the technical field of traffic isolation, in particular to a DPDK-based network traffic isolation system. Background technique [0002] With the continuous development of Internet technology, the traffic scale of data center network and national backbone network is also increasing, and the traditional network traffic isolation method can no longer adapt to the current high-speed network environment. Although the performance of hardware is constantly improving in terms of traffic isolation, large-scale traffic and useless malicious traffic have a great impact on the traffic isolation of multi-core processors, and in the Linux system, the large-scale data packet Processing also has a lot of overhead problems, including data copying from the application layer to the system layer, system interrupt processing, context switching, and so on. So for multi-core processors, traffic isolation is an urgent problem to be solved. GAP in th...

AI Technical Summary

Problems solved by technology

GAP in the prior art is a technology that uses dedicated hardware to enable two or more networks to realize secure data transmission and resource sharing when they are not connected. Disconnecting the link layer and blocking TCP / IP protocol and other network protocols can significantly improve the security strength of the internal user network. However, although GAP technology isolates traffic from the source, its traffic isolation rate for large traffic It will inevitably cause a sharp drop and cannot meet its normal business needs. At the same time, the GAP technology cannot flexibly configure the isolation strategy. When the isolation strategy needs to be adjusted, it cannot be adjusted immediately, and the flexibility is not enough.

Images