Method and device for realizing high-performance state firewall

Abstract

The invention provides a method and a device for realizing a high-performance state firewall. The device comprises a data packet processing module VPP, a routing module, a firewall policy module and a flow state module. The data packet processing module (VPP) is configured to receive transmission data from a network interface. And the routing module queries routing information and forwards data. And the firewall policy module is used for matching a firewall policy issued by a user, and performing security policy matching on the data flow of the session established for the first time according to an IP address, a protocol and a port number. And the flow state module is used for creating a flow session for the data flow successfully passing through the firewall policy, carrying out flow state detection on the flow in which the session is established, refreshing the flow table when the firewall policy is changed and the route is changed, periodically checking the flow table, and deleting the flow of which the state is not updated in a life cycle from the flow table. By reducing the repeated query matching of the firewall security policy table and the query of the routing table, the data packet processing capability of the VPP is improved, the throughput rate of the firewall is improved, and the data forwarding performance of the firewall is effectively improved.

Description

technical field [0001] The invention relates to firewall technology in the field of information security, in particular to a high-performance state firewall based on flow state control. Background technique [0002] With the rapid development of computer networks, the complexity of network attacks continues to increase, and the proliferation of mixed threats such as viruses, Trojan horses, and backdoors poses greater security threats to the network layer and application layer. A firewall is a device that can protect network information security. , which is composed of software and hardware devices, and is a protective barrier constructed on the interface between the internal network and the external network, between the private network and the public network, is a combination of computer hardware and software, and makes the connection between the Internet and the Intranet A security gateway (Security Gateway) is established to protect the internal network from the intrusion ...

AI Technical Summary

Problems solved by technology

[0005] The invention provides a method and device for realizing a high-performance stateful firewall to solve the technical problems of low network throughput and insufficient ability of general software to process data packets

Images