Traffic safety processing method, system, device, equipment, storage medium and product

Abstract

The invention provides a traffic safety processing method, system and device, equipment, a storage medium and a product. The method comprises the following steps: acquiring network traffic sent from a user terminal to the Internet from an access network; matching the network traffic with a user-defined security policy; under the condition of successful matching, determining target traffic classification identification information corresponding to the network traffic according to the self-defined security policy; under the condition that the matching fails, matching the network traffic with a service scene security policy, and determining target traffic classification identification information corresponding to the network traffic; matching a corresponding target security policy according to the target traffic classification identification information; and performing security processing on the network traffic according to the security capability node corresponding to the target security policy.

Description

Technical Field

[0001] This application relates to the field of network engineering technology, and in particular to a method, system, device, equipment, storage medium and product for secure traffic processing. Background Technology

[0002] With the acceleration of digital transformation and the continuous development of emerging technologies such as the Internet of Things (IoT) and edge computing, network service scenarios are becoming increasingly diverse, and deployment environments are becoming more flexible, posing significant challenges to traditional network security defense solutions. Faced with ubiquitous business access boundaries and security requirements, traditional security construction approaches based on security boundaries and centralized management, along with locally deployed security products, are no longer sufficient to address these emerging needs. In recent years, an increasing number of security vendors and cloud providers have attempted to address the experience and security issues of centralized access by deploying security capabilities services in the cloud. Proximity-based security monitoring and protection combined with integrated network security scheduling is currently the main approach to network security protection.

[0003] Secure Access Service Edge (SASE) is an emerging security service that combines WAN access with network security. Throughout the network access process, it delivers services by dynamically orchestrating security based on entity identity, real-time context, and security compliance policies, continuously assessing risks. SASE offers a rich set of network and security functions, enabling security monitoring, protection, and forwarding of traffic, and facilitating threat detection and control of network access behavior at edge network nodes. However, current security orchestration solutions based on the SASE architecture can only provide inherent security policies. With the diversification of business needs, existing security solutions often fail to adapt well to different business scenarios and require users to submit their own information and certain local security capabilities; otherwise, security assurance is difficult to achieve, and the diverse security needs of users cannot be met. Summary of the Invention

[0004] This application provides a traffic security processing method, system, device, equipment, storage medium, and product, which can improve security protection capabilities and meet users' diverse security needs.

[0005] In a first aspect, this application provides a traffic security processing method applied to edge cloud nodes, the method comprising:

[0006] Obtain network traffic sent from user terminals to the Internet from the access network;

[0007] Match the network traffic with the custom security policy;

[0008] If a match is successful, the target traffic classification identifier information corresponding to the network traffic is determined according to the custom security policy.

[0009] In the event of a failed match, the network feature information is matched with the security policy of the business scenario to determine the target traffic classification identifier information corresponding to the network traffic.

[0010] Based on the target traffic classification identifier information, match the corresponding target security policy;

[0011] The network traffic is processed securely according to the security capability nodes corresponding to the target security policy.

[0012] In some possible implementations, matching the network traffic with a custom security policy includes:

[0013] Obtain user identification information from the network traffic;

[0014] The user identification information is matched with the custom security policy.

[0015] In some possible implementations, matching the network feature information with the security policy of the business scenario to determine the target traffic classification identifier information corresponding to the network traffic includes:

[0016] Obtain network feature information from the network traffic, the network feature information including network protocol information in network data packets;

[0017] The network protocol information is matched with the security policy of the business scenario to determine the traffic classification identification information corresponding to the network traffic.

[0018] In some possible implementations, after matching the network protocol information with the business scenario security policy to determine the traffic classification identifier information corresponding to the network traffic, the method further includes:

[0019] If the network feature information fails to match the security policy of the business scenario, the security policy of the business scenario shall be updated according to the security service change information.

[0020] The network feature information is matched with the updated business scenario security policy to determine the traffic classification identifier information corresponding to the network traffic.

[0021] In some possible implementations, the security policy includes security service information and processing flow information related to the business scenario, and the step of performing security processing on the network traffic according to the security capability node corresponding to the target security policy includes:

[0022] The corresponding security capability node is determined based on the security service information;

[0023] According to the order corresponding to the processing flow information, the network traffic is forwarded through the security capability node for security processing.

[0024] In some possible implementations, the step of forwarding network traffic through the security capability node in the order corresponding to the processing flow information for security processing includes:

[0025] According to the order corresponding to the processing flow information, the first security capability node in the processing flow information is taken as the target node;

[0026] The network traffic is forwarded to the target node, and the target node performs security processing on the network traffic.

[0027] Remove the target node from the processing flow information and return to the step of taking the first security capability node in the processing flow information as the target node according to the order corresponding to the processing flow information, until the network traffic has passed through all security capability nodes in the processing flow information.

[0028] In some possible implementations, the method further includes, before matching the network traffic with a custom security policy:

[0029] Receive security service requests from users;

[0030] Check whether the security service request contains corresponding traffic classification identification information and security policies;

[0031] If corresponding traffic classification identification information and security policy exist, update the traffic classification identification information and / or the security policy according to the security service request;

[0032] In the absence of corresponding traffic classification identification information and security policies, based on the security service request, corresponding user security service information, as well as traffic classification identification information and security policies corresponding to the user security service information, are constructed.

[0033] In some possible implementations, the method further includes:

[0034] Upon receiving user security service update information, the corresponding security capability node is determined according to the user security service update information;

[0035] According to the processing flow information corresponding to the user security service update information, the user security service information is updated based on the security capability node;

[0036] The updated user security service information is broken down into multiple security capability service units;

[0037] According to the forwarding logic corresponding to each of the security capability service units, the network traffic is forwarded through the security capability nodes.

[0038] Secondly, this application provides a traffic security processing system, which includes a traffic diversion device, a traffic classification module, a security control module, a traffic forwarding module, and a security capability pool, wherein the security capability pool includes multiple security capability nodes:

[0039] The diversion device is used to obtain network traffic sent from user terminals to the Internet from the access network;

[0040] The traffic classification module is used to match the network traffic with a custom security policy;

[0041] The traffic classification module is also used to determine the target traffic classification identifier information corresponding to the network traffic according to the custom security policy when a match is successful.

[0042] The traffic classification module is also used to match the network feature information with the business scenario security policy in the event of a matching failure, and determine the target traffic classification identifier information corresponding to the network traffic.

[0043] The security control module is used to match the corresponding target security policy based on the target traffic classification identification information;

[0044] The traffic forwarding module is used to perform security processing on the network traffic according to the security capability nodes corresponding to the target security policy.

[0045] In some possible implementations, the security policy includes security service information and processing flow information related to the business scenario, and the security control module is further used to determine the corresponding security capability node based on the security service information;

[0046] The traffic forwarding module is also used to forward the network traffic through the security capability node in the order corresponding to the processing flow information, and to perform security processing.

[0047] Thirdly, this application provides a traffic security processing device, the device comprising:

[0048] The acquisition module is used to acquire network traffic sent from user terminals to the Internet from the access network;

[0049] A matching module is used to match the network traffic with a custom security policy;

[0050] The determination module is used to determine the target traffic classification identifier information corresponding to the network traffic according to the custom security policy when a match is successful.

[0051] The matching module is also used to match the network feature information with the business scenario security policy in the event of a matching failure, and to determine the target traffic classification identifier information corresponding to the network traffic.

[0052] The matching module is also used to match the corresponding target security policy based on the target traffic classification identification information;

[0053] The processing module is used to perform security processing on the network traffic according to the security capability nodes corresponding to the target security policy.

[0054] Fourthly, this application provides a traffic security processing device, the device comprising: a processor, and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the traffic security processing method described above.

[0055] Fifthly, this application provides a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the traffic security processing method described above.

[0056] Sixthly, this application provides a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform the traffic security processing method described above.

[0057] The traffic security processing method, apparatus, device, storage medium, and product provided in this application embodiment obtain network traffic sent from user terminals to the Internet from the access network. Based on predefined user security service information, the network traffic is identified by user identity to obtain traffic classification identification information, and then matched with corresponding security policies. According to the security policies, the network traffic is forwarded through the security capability nodes for security processing. Corresponding security policies are obtained for different business scenarios, and different security measures are taken for different network traffic, thus achieving refined security management of network traffic, improving security protection capabilities, and meeting the differentiated security needs of users. Attached Figure Description

[0058] This application can be better understood from the following description of specific embodiments in conjunction with the accompanying drawings, wherein:

[0059] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings, wherein the same or similar reference numerals denote the same or similar features.

[0060] Figure 1 This is a schematic flowchart of a traffic security processing method provided in one embodiment of this application;

[0061] Figure 2 This is a schematic diagram of the architecture of a traffic security processing system provided in one embodiment of this application;

[0062] Figure 3 This is a schematic diagram of the specific architecture of a traffic security processing system provided in another embodiment of this application;

[0063] Figure 4 This is a schematic diagram of the structure of a traffic security processing device provided in one embodiment of this application;

[0064] Figure 5 This is a schematic diagram of the hardware structure of the traffic security processing device provided in the embodiments of this application. Detailed Implementation

[0065] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0066] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0067] Virtual network switch (Open vSwitch, OVS): Implements the network functions of a physical switch through software. It can perform multiple switching functions on the same physical device or perform single-function switching on multiple physical devices in the network.

[0068] With the accelerating pace of digital transformation in society and enterprises, and the continuous development of emerging technologies such as the Internet of Things (IoT) and edge computing, business scenarios are becoming increasingly diverse, and deployment environments are becoming more flexible, posing significant challenges to traditional security defense solutions. Faced with ubiquitous business access boundaries and security requirements, traditional security construction approaches based on security boundaries and centralized management, along with locally deployed security products, are no longer sufficient to address the current network environment. In recent years, an increasing number of security vendors and cloud providers have explored cloud-deployed security capabilities to effectively solve the experience and security issues of centralized access. Near-source security monitoring and protection combined with network security scheduling has become a new application direction. SASE is an emerging security service that combines WAN access with network security. Throughout the entire network access process, it delivers services in a continuously risk-assessed, dynamically orchestrated security manner, based on entity identity, real-time context, and security compliance policies. SASE provides a rich set of network and security functions, enabling security monitoring, protection, and forwarding of traffic, and achieving threat detection and control of network access behavior at edge network nodes.

[0069] Existing technologies place excessively high demands on user-side security capabilities. If the user side cannot meet the execution conditions of the security service chain, it cannot provide security guarantees, making it difficult to meet users' diverse security needs and solve the problem of adapting to business scenarios.

[0070] The inventors' research revealed that if security capabilities are not deployed locally on the edge, and the edge is not required to actively report its own information, then the construction and execution of the security service chain are achieved through the edge cloud node security capability resource pool, without requiring edge-side capabilities. This allows for open access to various terminal users and serves various business scenarios. Through cloud-based security capability delivery and intelligent orchestration, atomic decoupling of security capabilities is achieved, solving the shortcomings of local security hardware and software product deployment, such as heavy deployment, high cost, difficult expansion, and poor coordination. Cloud-based security atomic capabilities, based on traffic orchestration and forwarding, realize dynamic service chains oriented towards business scenarios. By customizing and subscribing to security requirements according to different users, different dynamic security service chains are realized based on security atomic capabilities, solving the problem of a single security service capability for each user in existing solutions. At the same time, on-demand orchestration of security services improves the utilization rate of security capability resources and reduces usage costs.

[0071] To address the problems of the prior art, embodiments of this application provide a traffic security processing method, system, apparatus, device, storage medium, and product. The traffic security processing method provided in this application embodiment will be described first below.

[0072] Figure 1 A schematic flowchart of a traffic security processing method according to an embodiment of this application is shown. Figure 1 As shown, the method is applied to edge cloud nodes and includes the following steps: S101 to S106.

[0073] S101: Obtain network traffic sent from user terminals to the Internet from the access network.

[0074] In practice, network traffic sent from user terminals to the Internet is captured from the access network. Network monitoring tools or traffic acquisition devices can be used to analyze and record all data packets passing through edge cloud nodes in real time using Deep Packet Inspection (DPI) technology. The captured data packets may include network information such as source IP address, destination IP address, protocol type, and port number.

[0075] S102: Match the above network traffic with the custom security policy.

[0076] In practice, after obtaining network traffic data, this data is matched against predefined custom security policies. The matching process typically relies on pattern recognition algorithms, which compare traffic characteristics (such as packet size, traffic frequency, etc.) with the rules in the security policy to determine whether they conform to those rules.

[0077] As another implementation method, custom security policies can be set based on the user's specific needs, such as rules for allowing or denying specific types of traffic, rate limiting, monitoring, etc.

[0078] S103: If the match is successful, determine the target traffic classification identifier information corresponding to the network traffic according to the above-mentioned custom security policy.

[0079] In practice, if network traffic matches a custom security policy, the target classification information of the network traffic can be determined based on that policy. This classification information helps subsequent security processing steps to identify which category the traffic belongs to (e.g., normal traffic, suspicious traffic, malicious traffic, etc.).

[0080] As another approach, during the matching process, data can be mapped and tagged, and traffic information can be stored in a database for subsequent querying and management.

[0081] S104: In the event of a failed match, the above network feature information is matched with the security policy of the business scenario to determine the target traffic classification identifier information corresponding to the above network traffic.

[0082] In practice, if network traffic fails to pass the matching of the custom security policy, the process will then proceed to match traffic characteristic information with the security policy of the business scenario. Business scenario security policies typically consider the actual operational needs of the business, such as additional protection measures for high-risk businesses. At this stage, traffic characteristics can be analyzed and compared with the security requirements of the business scenario to find appropriate classification and identification information.

[0083] S105: Match the corresponding target security policy based on the target traffic classification and identification information mentioned above.

[0084] In practice, custom security policies or business scenario-based security policies are used to match appropriate target security policies based on the obtained target traffic classification and identification information. Target security policies may include firewall rules, intrusion detection system (IDS) settings, traffic filters, etc. This process ensures that appropriate security measures are taken for different types of traffic to reduce potential risks.

[0085] S106: Perform security processing on the network traffic according to the security capability nodes corresponding to the above target security policy.

[0086] In practice, network traffic is processed according to the matched target security policy. This includes isolating suspicious traffic, blocking malicious traffic, and monitoring and logging normal traffic. To achieve these operations, edge cloud nodes invoke relevant security capability nodes, which may include virtual firewalls, load balancers, intrusion prevention systems, and other security components. These multiple security components work together to ensure the security of network traffic.

[0087] The traffic security processing method provided in this application embodiment obtains network traffic sent from user terminals to the Internet from the access network, identifies the user identity of the network traffic according to predefined user security service information, obtains traffic classification identification information, and then matches the corresponding security policy. According to the security policy, the network traffic is forwarded through the aforementioned security capability nodes for security processing. By obtaining the corresponding security policy for the business scenario, different security measures are taken for different network traffic, and different security processing is performed, which realizes refined security management of network traffic, improves security protection capabilities, and meets the differentiated security needs of users.

[0088] In order to accurately match the custom security policy, in some implementations, the above S102 may include the following steps: S1021 to S1022.

[0089] S1021: Obtain user identification information from the above network traffic.

[0090] In practice, network traffic is captured in real time using network monitoring tools. The captured data packets include source IP addresses, destination IP addresses, and port numbers—information that identifies the user. Deep Packet Inspection (DPI) technology is used to parse the packet content and extract user identification information. This information may include login credentials, session identifiers, or other identity-related data.

[0091] As another approach, during traffic parsing, attention can be paid to identity information carried in session certificates or other application layer protocols. For example, in a Hypertext Transfer Protocol (HTTP) request, user information stored in the (authorization) Authorization header or a small text file (cookie) can be looked for.

[0092] As another implementation method, the extracted user identification information is stored in a structured database or memory, including additional information such as the user's unique identifier, source IP address, and timestamp, for subsequent processing.

[0093] S1022: Match the above user identification information with the custom security policy.

[0094] In the actual implementation, predefined custom security policies are loaded from configuration files or security policy databases at runtime. These policies are typically set by users according to their needs and may include role-based access control, specific IP whitelists, blacklist rules, etc. The extracted user identification information is fed into the matching algorithm, which compares each policy with the custom security policy. After the matching is completed, a matching result is generated, including whether it conforms to the custom security policy, the applicable policy type, and possible security measures.

[0095] As another approach, the matching results can be logged to a log system for subsequent auditing and analysis.

[0096] The above-described embodiments of this application obtain user identification information from the network traffic and match it with custom security policies, thereby enabling more accurate matching of custom security policies.

[0097] In order to accurately determine the traffic classification identification information, in some embodiments, the above-mentioned S104 may include the following steps: S1041 to S1042.

[0098] S1041: Obtain network characteristic information from the above network traffic, including network protocol information in network data packets.

[0099] In practice, network packet capture tools or built-in network monitoring modules are used to capture data packets transmitted through the network interface in real time. These data packets contain information from different network layers, from the physical layer to the application layer. The data packets are parsed layer by layer, and the protocol information of each layer is extracted through a protocol decoder to obtain network characteristic information.

[0100] S1042: Match the above network protocol information with the security policy of the business scenario to determine the traffic classification identification information corresponding to the above network traffic.

[0101] In the implementation, security policies corresponding to the current business scenario are loaded from the security policy database. These policies can be predefined by the security administrator and vary according to different business needs. Network feature information is compared one by one with the security policies of the business scenario, and traffic classification identification information is generated based on the matching results.

[0102] As an alternative approach, the loaded security policies can be parsed and standardized before matching to ensure they are consistent with the format of the extracted network feature information. This step converts the policies into a comparable standard format.

[0103] The embodiments described above in this application obtain network feature information and network protocol information from the network traffic, match the network protocol information with the security policy of the business scenario, and determine the traffic classification identification information corresponding to the network traffic, thereby more accurately determining the traffic classification identification information.

[0104] In order to match the latest business scenario security policies, in some implementations, after S1042, the above method may also include the following steps: S1043 to S1044.

[0105] S1043: If the above network characteristic information fails to match the security policy of the business scenario, update the above business scenario security policy according to the security service change information.

[0106] In the specific implementation, if the network feature information fails to match the existing business scenario security policy, the detailed information of the failure is recorded. Then, the suggested change information is obtained, the obtained security service change information is parsed, and it is determined which policies need to be updated, thereby updating the above-mentioned business scenario security policy.

[0107] As an alternative approach, after the update is complete, the new business scenario security policy can be persistently stored in the database to ensure that the updated policy can be used for the next matching.

[0108] As another approach, after the update is completed, an update log can be generated to record the content and reasons for the update, which will facilitate subsequent review and retrospection.

[0109] S1044: Match the above network feature information with the updated business scenario security policy to determine the traffic classification identification information corresponding to the above network traffic.

[0110] In the specific implementation, the newly updated business scenario security policy is loaded. This ensures that the latest information is used in the next matching step. The previously extracted network feature information is used as input, and the matching algorithm is called again. This time, the matching algorithm should consider the new security policy, reassess the network traffic, compare the network feature vectors with the updated business scenario security policy one by one, and check whether each feature conforms to the new rules. This process is similar to S1042, but now the updated policy is used. Based on the rematch results, new traffic classification identification information is generated.

[0111] The above implementation method of this application, when the above network feature information fails to match the business scenario security policy, updates the above business scenario security policy according to the security service change information, and then matches the network feature information according to the updated business scenario security policy to determine the traffic classification identification information corresponding to the above network traffic, so as to ensure that it can match the latest business scenario security policy.

[0112] In order to accurately complete the security process, in some implementations, the security strategy mentioned above includes security service information and processing flow information related to the business scenario. S106 may also include the following steps: S1061 to S1063.

[0113] S1061: Determine the corresponding security capability nodes based on the above security service information.

[0114] In the implementation, security service information is extracted from the security policy. This information includes available security capability nodes (such as firewalls, intrusion detection systems, data loss prevention, etc.) along with their functional descriptions and configuration parameters. The parsed security service information is then matched against a predefined library of security capability nodes. Based on the matching results, a list of capability nodes is generated. This list contains all the security capability nodes required for processing current network traffic.

[0115] As an alternative implementation, security capability nodes can be arranged in processing order to facilitate subsequent traffic forwarding and security processing.

[0116] S1062: Following the order of the above processing flow information, the above network traffic is forwarded through the above security capability nodes for security processing.

[0117] In practical implementation, processing flow information is extracted from the security policy. This information describes how network traffic should be processed through various security capability nodes. The processing flow may include multiple steps, such as detection, filtering, and forwarding. Based on the obtained processing flow information, network traffic is forwarded step by step to the capability nodes, where it undergoes security processing.

[0118] As another implementation method, the process of progressively forwarding network traffic to capability nodes can be as follows: receiving real-time network traffic data packets from the network interface, and sending the traffic data packets one by one to the designated security capability nodes for processing according to the order of the capability node list. Afterwards, each capability node will perform security checks and processing on the received traffic according to its own security rules and algorithms.

[0119] As another implementation method, based on the processing result of the capability node, if the traffic is allowed to pass, the system sends it to the target address; if it is blocked, the event is recorded and corresponding response measures are taken (e.g., notifying the administrator, triggering an alarm, etc.).

[0120] The above-described implementation method of this application determines the corresponding security capability node based on the security service information, and then forwards the network traffic through the security capability node in the order corresponding to the processing flow information to perform security processing, thereby accurately completing the security processing.

[0121] In order to complete the security process in sequence, in some embodiments, the above-mentioned S1062 may also include the following steps: S10621 to S10623.

[0122] S10621: According to the order of the above processing flow information, the first security capability node in the above processing flow information is taken as the target node.

[0123] In the specific implementation, the current processing flow information is first extracted from the security policy. This information includes all the security capability nodes that need to be traversed and their order. From the processing flow information, the system identifies the first security capability node in the current queue as the current target node.

[0124] S10622: Forward the aforementioned network traffic to the aforementioned target node, and perform secure processing on the aforementioned network traffic through the aforementioned target node.

[0125] In the specific implementation, data packets to be processed are extracted from the received network traffic buffer. These data packets can be real-time traffic captured in previous steps. Using the network protocol stack, the system forwards the traffic packets to the target node. Once the packets arrive at the target node, the target node performs predefined security processing operations.

[0126] S10623: Remove the target node from the above processing flow information and return to the step of taking the first security capability node in the above processing flow information as the target node according to the order corresponding to the above processing flow information, until the above network traffic has passed through all security capability nodes in the above processing flow information.

[0127] In the actual implementation, after obtaining the processing result of the target node, the processed target node is removed from the processing flow information, and then it is checked whether the updated processing flow is empty. If there are still nodes, it returns to S10621, continues to select a new target node, and repeats S10622 to forward network traffic to the new target node for security processing; if there are no nodes, the processing flow ends.

[0128] The above implementation method of this application, by following the order corresponding to the above processing flow information, takes the first security capability node in the above processing flow information as the target node, forwards network traffic to this target node, and the target node performs security processing of the network traffic. Then, the target node is removed from the above processing flow information, and forwarding starts again. This cycle continues until the above network traffic has passed through all the security capability nodes in the above processing flow information, thereby enabling the security processing to be completed completely in sequence.

[0129] In order to respond quickly to users' security service requests and execute the corresponding security policies, in some implementations, the following steps may be included before S102: S1021 to S1024.

[0130] S1021: Receive security service requests from users.

[0131] In the actual implementation, once a request is received, it undergoes initial verification. If the request does not meet the standards, an error response will be returned, prompting the user to correct the request. Valid security service requests will then be logged.

[0132] S1022: Check whether there is corresponding traffic classification identification information and security policy in the security service request.

[0133] In the specific implementation, key parameters are extracted from the user's security service request, and traffic classification identifier information corresponding to the current request parameters is retrieved. Similarly, the security policy associated with the traffic classification identifier is found.

[0134] S1023: If corresponding traffic classification identification information and security policy exist, update the traffic classification identification information and / or the security policy according to the security service request.

[0135] In the implementation, given the existence of corresponding traffic classification identification information and security policies, the system will determine how to update these based on the new parameters in the user's request. Based on the request, the existing traffic classification identification will be adjusted. Similarly, the security policy may be updated based on the user's request. After all update operations are completed, the modified traffic classification identification information and security policies will be persisted to the database to ensure information persistence and consistency.

[0136] S1024: In the absence of corresponding traffic classification identification information and security policy, construct corresponding user security service information, as well as traffic classification identification information and security policy corresponding to the aforementioned user security service information, based on the aforementioned security service request.

[0137] In the specific implementation, if no corresponding traffic classification identifier and security policy exist, new user security service information will be constructed based on the user's request. Specifically, new traffic classification identifier information will be generated based on the parameters of the user's request, and for the newly created traffic classification identifier, the system will generate a corresponding security policy. The newly constructed user security service information, along with its corresponding traffic classification identifier and security policy, will be stored in the database to ensure quick access and reference in the future.

[0138] The above implementation method of this application, after receiving a user's security service request, checks whether the security service request has traffic classification identification information and security policy corresponding to the security service request. If they exist, they are updated according to the security service request; if they do not exist, they construct the corresponding user security service information and the traffic classification identification information and security policy corresponding to the user security service information according to the security service request, so as to quickly respond to the user's security service request and execute the corresponding security policy.

[0139] In order to enable changes to the safety processing procedures during the process, in some embodiments, the above method may further include the following steps: S107 to S110.

[0140] S107: Upon receiving user security service update information, determine the corresponding security capability node according to the aforementioned user security service update information.

[0141] In the implementation, security service update information sent by users is received via a message queue. This information may include new configurations, change requests, or policy adjustments. The received data is parsed to extract key information, including the update type and the identifier of the target security capability node. The database or configuration management system is accessed to find records related to the security capability node specified in the user's update information, thus determining the corresponding security capability node. The security capability node can be a firewall, intrusion detection system, or other security components.

[0142] S108: Update the user security service information according to the processing flow information corresponding to the above-mentioned user security service update information based on the above-mentioned security capability nodes.

[0143] In the specific implementation, based on the received user security service update information, the corresponding processing flow information is queried. This flow information defines the execution order at different security capability nodes. Based on this information, the security capability nodes and user security service information are updated.

[0144] S109: Decompose the updated user security service information into multiple security capability service units.

[0145] In the implementation, the updated user security service information is logically analyzed and broken down to identify independently operable security capability service units. Each security capability service unit is identified and its attributes are defined, including service type, priority, and dependencies. These attributes will be used for subsequent forwarding and management.

[0146] S110: According to the forwarding logic corresponding to each of the above-mentioned security capability service units, the above-mentioned network traffic is forwarded through the above-mentioned security capability nodes.

[0147] In the specific implementation, corresponding traffic forwarding logic is formulated based on the attributes and policies of each security capability service unit. Utilizing the previously determined security capability nodes, network traffic is processed according to the forwarding logic, and the aforementioned network traffic is forwarded through these security capability nodes.

[0148] The embodiments of this application, upon receiving user security service update information, determine the corresponding security capability node according to the user security service update information, update the user security service information based on the security capability node according to the processing flow information corresponding to the user security service update information, decompose the updated user security service information into multiple security capability service units, and forward the network traffic through the security capability node according to the forwarding logic corresponding to each of the aforementioned security capability service units, thereby enabling changes to the security processing flow during the processing.

[0149] Figure 2 A schematic diagram of the architecture of a traffic security processing system provided in one embodiment of this application is shown. Figure 2 As shown, the aforementioned traffic security processing system includes a traffic redirection device 201, a traffic classification module 202, a security control module 203, a traffic forwarding module 204, and a security capability pool 205. The security capability pool includes multiple security capability nodes. The traffic redirection device 201 is used to obtain network traffic sent from user terminals to the Internet from the access network. The traffic classification module 202 is used to match the network traffic with a custom security policy. If the match is successful, the traffic classification module 202 is also used to determine the target traffic classification identifier information corresponding to the network traffic according to the custom security policy. If the match fails, the traffic classification module 202 is also used to match the network feature information with a business scenario security policy to determine the target traffic classification identifier information corresponding to the network traffic. The security control module 203 is used to match the corresponding target security policy based on the target traffic classification identifier information. The traffic forwarding module 204 is used to perform security processing on the network traffic according to the security capability nodes corresponding to the target security policy.

[0150] Specifically, home gateways, enterprise gateways and their plugins from telecom operators, as well as third-party access gateways based on operator networks, can all serve as traffic redirection devices. These devices establish an authenticated connection with the connector in the traffic classification module via a VirtualeXtensible Local Area Network (VXLAN) and upload network traffic. The connector receives all traffic and forwards it to the traffic classifier. The connector's main functions include VXLAN connection with the redirection device, authentication, traffic caching, and forwarding. Considering the classifier's processing performance, the connector supports five-tuple-based traffic load balancing, enabling load balancing of network traffic originating from and destined for the same classifier across multiple classifiers.

[0151] The classifier comprises two functional layers: user identity recognition for user-defined security service chain scenarios and user business identity recognition for business scenario intelligent perception and matching of dynamic security service chains. In the user identity recognition stage, user-defined security service chain subscription service information predefined in the security control module is requested to identify the user's IP address and user identity. In the system implementation, user-defined security service chains have higher priority than business intelligent perception security service chains; therefore, business traffic that matches the security policy of the identity recognition classifier is directly sent to the security forwarding module after being labeled with traffic classification information. Business traffic that does not match the security policy of the identity recognition classifier enters the feature recognition classifier. In the traffic feature identification stage, the layer 7 protocol packet header is analyzed to obtain traffic packet characteristics and business characteristic packets. Business traffic that matches the feature recognition classifier is labeled with a traffic classification identifier before being sent to the security forwarding module. Business traffic that does not match the traffic classifier is labeled with a "security policy not matched" classification identifier before also being sent to the security forwarding module. The traffic classification module is a functional device used to connect traffic redirection devices to access business traffic, enabling the identification of business traffic based on user identity or business characteristics. After classifying the business traffic, the business traffic is forwarded to the appropriate forwarding node in the traffic forwarding module according to the classification strategy of the security control module.

[0152] Traffic classification is implemented based on the security services subscribed to by end-user businesses. User-subscribed security service information is managed centrally by the security control module, including user-defined security policies and business-scenario-based security policies. User-defined security policies are more flexible and can meet the diverse security service needs of different users. Business-scenario-based security policies provide scenario-based security services at the business scenario level; different business scenarios can use different security services, but the same business scenario uses a scenario-based service. Compared to traditional security solutions, this approach offers greater flexibility, while compared to user-defined security policies, it provides a simpler and lower-cost option.

[0153] Each registered security atomic capability in the security capability pool corresponds to a forwarding node. The forwarding node controls the traffic connection between itself and the security capability according to the security policy issued by the system. There are two connection methods between the security atomic capabilities in the security capability pool and the forwarding nodes in the security forwarding module: traffic bypass mirroring and traffic serial forwarding. Generally speaking, atomic capabilities such as risk identification and security detection, which aim to achieve threat and risk identification and analysis, do not require traffic injection back; in this case, the forwarding node only needs to mirror a copy of the traffic to the security capability. Conversely, atomic capabilities such as security protection and security response, which require the control and handling of network and business traffic, need to inject the processed traffic back into the forwarding node. Based on the same security capability pool, different business scenarios or user-defined subscribed security services will form different security policies, and the security forwarding module will dynamically orchestrate different security service chains, which contain different security capabilities or capability execution sequences.

[0154] The traffic forwarding module can construct virtual forwarding nodes, which are implemented by OVS in engineering and are a key component for performing secure traffic forwarding. Before service traffic enters the forwarding module, the forwarding nodes have already generated forwarding routing tables for their respective network elements based on predefined security control policies, and defined the security service chains corresponding to user identities or network service scenarios.

[0155] Each forwarding node has a corresponding security atomic capability, and the two are connected via network ports. Each OVS, after its generation, needs to register with the security control module, filling in information such as its bound security capabilities and the number of its network ports. The security control module decomposes the constructed security service logic chain and publishes it to the traffic forwarding module based on the user identifier or business scenario's subscription to security services. If the execution policy units of multiple security service logic chains fall on the same security atomic capability (e.g., after the two security service logic chains in the diagram above are decomposed, both need to execute network attack protection security capabilities), the security control module will issue a policy to inform the two next-hop network elements of the OVS. At this time, on the forwarding route of this OVS, two different network traffic forwarding paths are formed corresponding to the two different business scenarios. After the actual business traffic enters the current OVS, the actual network link path to be executed is determined based on the classifier business identifier in the traffic.

[0156] After business traffic enters the traffic forwarding module, the forwarding nodes first guide the traffic to the security capabilities for processing. When the security capabilities inject the processed traffic back to the forwarding nodes, the forwarding nodes select the next-hop network element for forwarding based on the business traffic classification identifier. Since the forwarding nodes forward traffic based on the traffic classification identifier, no further parsing or processing is required, resulting in high real-time processing performance for the traffic forwarding module. Once each forwarding node generates its own network link forwarding path bound to the security capabilities and the next-hop network, the group of forwarding nodes in the overall security forwarding module forms a dynamic forwarding node network. After business traffic enters this network, it is forwarded step-by-step according to the forwarding routing table of each forwarding node. When the security logic service chain of the security control module changes, it will affect the forwarding link paths of the forwarding nodes, further updating the entire dynamic forwarding node network diagram.

[0157] To achieve module boundary decoupling, two connectors (upper connector and lower connector) can be built in the secure forwarding module. The upper connector connects to the traffic classification module and receives the traffic forwarded by the traffic classification module. The lower connector aggregates the outgoing traffic of all forwarding nodes and connects to the Internet, realizing the collection of outgoing traffic from the secure forwarding module.

[0158] The security control module supports both user-defined security policies and business-scenario-based security policies. User-defined security policies use user identity as the identifier and construct a dynamic security service chain at the user level based on the user's subscribed security service requirements. This security service chain changes as the content of the user's subscribed security services changes. Business-scenario-based security policies use business scenarios as the identifier and construct a dynamic security service chain at the business level based on scenario-preset security service requirements. This security service chain changes as the content of the subscribed security services changes according to the business scenario.

[0159] In the implementation of the security control module, the first step is to register the security capability pool and security forwarding nodes, enabling the security control module to perceive orchestratable and schedulable forwarding and security capability resources. Then, when a user actively subscribes to a security service, the user and their subscribed security service information are synchronized to the security control module. Based on the user's subscription request, the security control module first checks if a dynamic security service chain already exists for that user / service. If it does, a security service chain update process is triggered. If it does not exist, a new dynamic security service chain is constructed. Additionally, the system configuration administrator can adjust security services for specific business scenarios according to business needs and trigger the security service chain update process. Using classification identifiers and security capabilities as logical service units, the dynamic security service chain is further decomposed into several service units, and several security capability logical service units are reconstructed based on security capabilities. Then, the user / service identifier information that has subscribed to security services in the security control module is updated and synchronized to the traffic classification module, and each security capability logical service unit is synchronized to the corresponding forwarding node in the security forwarding module in the form of a security policy. The specific system in this embodiment is as follows: Figure 3 As shown.

[0160] The system in this embodiment is specifically as follows: Figure 3 As shown. In another implementation, the aforementioned security strategy includes security service information and processing flow information related to the business scenario. The security control module 203 is further configured to determine the corresponding security capability node based on the aforementioned security service information. The traffic forwarding module 204 is further configured to forward the network traffic through the aforementioned security capability nodes in the order corresponding to the aforementioned processing flow information, thereby performing security processing.

[0161] The traffic security processing system provided in this application embodiment obtains network traffic sent from user terminals to the Internet from the access network, identifies the user identity of the network traffic according to predefined user security service information, obtains traffic classification identification information, and then matches the corresponding security policy. According to the security policy, the network traffic is forwarded through the aforementioned security capability nodes for security processing. By obtaining corresponding security policies for business scenarios and taking different security measures for different network traffic, different security processing is performed, thereby realizing refined security management of network traffic, improving security protection capabilities, and meeting the differentiated security needs of users.

[0162] Based on the traffic security processing method provided in the above embodiments, this application also provides specific implementations of the traffic security processing device. Please refer to the following embodiments.

[0163] First see Figure 4 The traffic security processing device 400 provided in this application embodiment includes the following modules:

[0164] The acquisition module 401 is used to acquire network traffic sent from user terminals to the Internet from the access network.

[0165] Matching module 402 is used to match the aforementioned network traffic with a custom security policy.

[0166] The determination module 403 is used to determine the target traffic classification identifier information corresponding to the network traffic according to the above-mentioned custom security policy when a match is successful.

[0167] The matching module 402 is also used to match the above network feature information with the business scenario security policy in the event of a matching failure, and to determine the target traffic classification identification information corresponding to the above network traffic.

[0168] The matching module 402 is also used to match the corresponding target security policy based on the target traffic classification identification information mentioned above.

[0169] The processing module 404 is used to perform security processing on the network traffic according to the security capability nodes corresponding to the above-mentioned target security policy.

[0170] The traffic security processing device provided in this application embodiment obtains network traffic sent from user terminals to the Internet from the access network, identifies the user identity of the network traffic according to predefined user security service information, obtains traffic classification identification information, and then matches the corresponding security policy. According to the security policy, the network traffic is forwarded through the aforementioned security capability nodes for security processing. By obtaining the corresponding security policy for the business scenario, different security measures are taken for different network traffic, and different security processing is performed, which realizes refined security management of network traffic, improves security protection capabilities, and meets the differentiated security needs of users.

[0171] As one implementation of this application, the matching module 402 may further include:

[0172] The acquisition unit is used to acquire user identification information from the aforementioned network traffic.

[0173] The matching unit is used to match the aforementioned user identification information with the custom security policy.

[0174] The above-described embodiments of this application obtain user identification information from the network traffic and match it with custom security policies, thereby enabling more accurate matching of custom security policies.

[0175] As one implementation of this application, the matching module 402 may further include:

[0176] The acquisition unit is used to acquire network characteristic information from the aforementioned network traffic, including network protocol information in network data packets.

[0177] The matching unit is used to match the aforementioned network protocol information with the security policies of the business scenario to determine the traffic classification identification information corresponding to the aforementioned network traffic.

[0178] The embodiments described above in this application obtain network feature information and network protocol information from the network traffic, match the network protocol information with the security policy of the business scenario, and determine the traffic classification identification information corresponding to the network traffic, thereby more accurately determining the traffic classification identification information.

[0179] As one implementation of this application, the traffic security processing device 400 may further include:

[0180] The update module is used to update the security policy of the above-mentioned business scenario according to the security service change information when the above-mentioned network feature information fails to match the security policy of the business scenario.

[0181] The determination module is used to match the above network feature information with the updated business scenario security policy to determine the traffic classification identification information corresponding to the above network traffic.

[0182] The above implementation method of this application, when the above network feature information fails to match the business scenario security policy, updates the above business scenario security policy according to the security service change information, and then matches the network feature information according to the updated business scenario security policy to determine the traffic classification identification information corresponding to the above network traffic, so as to ensure that it can match the latest business scenario security policy.

[0183] As one implementation of this application, the processing module 404 may further include:

[0184] The determination unit is used to determine the corresponding security capability node based on the aforementioned security service information.

[0185] The forwarding unit is used to forward the network traffic through the security capability nodes in the order corresponding to the above processing flow information, and to perform security processing.

[0186] The above-described implementation method of this application determines the corresponding security capability node based on the security service information, and then forwards the network traffic through the security capability node in the order corresponding to the processing flow information to perform security processing, thereby accurately completing the security processing.

[0187] As one implementation of this application, the forwarding unit may further include:

[0188] The sub-unit is determined to select the first security capability node in the above processing flow information as the target node, according to the order corresponding to the above processing flow information.

[0189] The processing subunit is used to forward the network traffic to the target node and perform secure processing on the network traffic through the target node.

[0190] The removal sub-unit is used to remove the target node from the above processing flow information and return to the step of taking the first security capability node in the above processing flow information as the target node according to the order corresponding to the above processing flow information, until the above network traffic has passed through all security capability nodes in the above processing flow information.

[0191] The above implementation method of this application, by following the order corresponding to the above processing flow information, takes the first security capability node in the above processing flow information as the target node, forwards network traffic to this target node, and the target node performs security processing of the network traffic. Then, the target node is removed from the above processing flow information, and forwarding starts again. This cycle continues until the above network traffic has passed through all the security capability nodes in the above processing flow information, thereby enabling the security processing to be completed completely in sequence.

[0192] As one implementation of this application, the traffic security processing device 400 may further include:

[0193] The receiving module is used to receive security service requests from users.

[0194] The inspection module is used to check whether the security service request has corresponding traffic classification identification information and security policies.

[0195] The update module is used to update the traffic classification identification information and / or the security policy according to the security service request, provided that the corresponding traffic classification identification information and security policy exist.

[0196] The construction module is used to construct the corresponding user security service information, as well as the traffic classification identification information and security policy corresponding to the aforementioned user security service information, based on the aforementioned security service request, in the absence of corresponding traffic classification identification information and security policy.

[0197] The above implementation method of this application, after receiving a user's security service request, checks whether the security service request has traffic classification identification information and security policy corresponding to the security service request. If they exist, they are updated according to the security service request; if they do not exist, they construct the corresponding user security service information and the traffic classification identification information and security policy corresponding to the user security service information according to the security service request, so as to quickly respond to the user's security service request and execute the corresponding security policy.

[0198] As one implementation of this application, the traffic security processing device 400 may further include:

[0199] The determination module is used to determine the corresponding security capability node according to the user security service update information received.

[0200] The update module is used to update the user security service information based on the aforementioned security capability nodes, according to the processing flow information corresponding to the user security service update information.

[0201] The decomposition module is used to decompose the updated user security service information into multiple security capability service units.

[0202] The forwarding module is used to forward the network traffic through the aforementioned security capability nodes according to the forwarding logic corresponding to each of the aforementioned security capability service units.

[0203] The embodiments of this application, upon receiving user security service update information, determine the corresponding security capability node according to the user security service update information, update the user security service information based on the security capability node according to the processing flow information corresponding to the user security service update information, decompose the updated user security service information into multiple security capability service units, and forward the network traffic through the security capability node according to the forwarding logic corresponding to each of the aforementioned security capability service units, thereby enabling changes to the security processing flow during the processing.

[0204] Each module in the traffic security processing device provided in this application embodiment can implement each step in the above-mentioned traffic security processing method and achieve the corresponding effect. For the sake of brevity, it will not be described in detail here.

[0205] Figure 5 A schematic diagram of the traffic security processing hardware provided in an embodiment of this application is shown.

[0206] The traffic security processing device may include a processor 501 and a memory 502 storing computer program instructions.

[0207] Specifically, the processor 501 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0208] Memory 502 may include mass storage for data or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 502 may include removable or non-removable (or fixed) media. Where appropriate, memory 502 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 502 is non-volatile solid-state memory.

[0209] The memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the traffic security processing method according to any embodiment of this disclosure.

[0210] The processor 501 reads and executes computer program instructions stored in the memory 502 to implement any of the traffic security processing methods in the above embodiments.

[0211] In one example, the traffic security processing device may further include a communication interface 503 and a bus 510. Wherein, as... Figure 5 As shown, the processor 501, memory 502, and communication interface 503 are connected through bus 510 and complete communication with each other.

[0212] The communication interface 503 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0213] Bus 510 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 510 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0214] Furthermore, in conjunction with the traffic security processing methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the traffic security processing methods in the above embodiments.

[0215] This application also provides a computer program product, including a computer program, which, when executed, implements any of the traffic security processing methods described in the above embodiments.

[0216] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0217] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0218] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0219] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0220] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for secure traffic processing, characterized in that, Applied to edge cloud nodes, the method includes: Obtain network traffic sent from user terminals to the Internet from the access network; Match the network traffic with the custom security policy; If a match is successful, the target traffic classification identifier information corresponding to the network traffic is determined according to the custom security policy. If the matching fails, the network traffic is matched with the security policy of the business scenario to determine the target traffic classification identification information corresponding to the network traffic; Based on the target traffic classification identifier information, match the corresponding target security policy; The network traffic is processed securely according to the security capability nodes corresponding to the target security policy.

2. The traffic security processing method according to claim 1, characterized in that, The step of matching the network traffic with the custom security policy includes: Obtain user identification information from the network traffic; The user identification information is matched with the custom security policy.

3. The traffic security processing method according to claim 1, characterized in that, The step of matching the network traffic with the security policies of the business scenario to determine the target traffic classification identifier information corresponding to the network traffic includes: Obtain network feature information from the network traffic, the network feature information including network protocol information in network data packets; The network protocol information is matched with the security policy of the business scenario to determine the traffic classification identification information corresponding to the network traffic.

4. The traffic security processing method according to claim 3, characterized in that, After matching the network protocol information with the business scenario security policy to determine the traffic classification identifier information corresponding to the network traffic, the method further includes: If the network feature information fails to match the security policy of the business scenario, the security policy of the business scenario shall be updated according to the security service change information. The network feature information is matched with the updated business scenario security policy to determine the traffic classification identifier information corresponding to the network traffic.

5. The traffic security processing method according to claim 1, characterized in that, The security policy includes security service information and processing flow information related to the business scenario. The step of performing security processing on the network traffic according to the security capability nodes corresponding to the target security policy includes: The corresponding security capability node is determined based on the security service information; According to the order corresponding to the processing flow information, the network traffic is forwarded through the security capability node for security processing.

6. The traffic security processing method according to claim 5, characterized in that, The step of forwarding network traffic through the security capability node in the order corresponding to the processing flow information for security processing includes: According to the order corresponding to the processing flow information, the first security capability node in the processing flow information is taken as the target node; The network traffic is forwarded to the target node, and the target node performs security processing on the network traffic. Remove the target node from the processing flow information and return to the step of taking the first security capability node in the processing flow information as the target node according to the order corresponding to the processing flow information, until the network traffic has passed through all security capability nodes in the processing flow information.

7. The traffic security processing method according to claim 1, characterized in that, Before matching the network traffic with the custom security policy, the method further includes: Receive security service requests from users; Check whether the security service request contains corresponding traffic classification identification information and security policies; If corresponding traffic classification identification information and security policy exist, update the traffic classification identification information and / or the security policy according to the security service request; In the absence of corresponding traffic classification identification information and security policies, based on the security service request, corresponding user security service information, as well as traffic classification identification information and security policies corresponding to the user security service information, are constructed.

8. The traffic security processing method according to any one of claims 1 to 7, characterized in that, The method further includes: Upon receiving user security service update information, the corresponding security capability node is determined according to the user security service update information; According to the processing flow information corresponding to the user security service update information, the user security service information is updated based on the security capability node; The updated user security service information is broken down into multiple security capability service units; According to the forwarding logic corresponding to each of the security capability service units, the network traffic is forwarded through the security capability nodes.

9. A traffic flow security processing system, characterized in that, The traffic security processing system includes a traffic diversion device, a traffic classification module, a security control module, a traffic forwarding module, and a security capability pool. The security capability pool includes multiple security capability nodes. The diversion device is used to obtain network traffic sent from user terminals to the Internet from the access network; The traffic classification module is used to match the network traffic with a custom security policy; The traffic classification module is also used to determine the target traffic classification identifier information corresponding to the network traffic according to the custom security policy when a match is successful. The traffic classification module is also used to match the network traffic with the business scenario security policy in the event of a matching failure, and determine the target traffic classification identifier information corresponding to the network traffic. The security control module is used to match the corresponding target security policy based on the target traffic classification identification information; The traffic forwarding module is used to perform security processing on the network traffic according to the security capability nodes corresponding to the target security policy.

10. The traffic security processing system according to claim 9, characterized in that, The security policy includes security service information and processing flow information related to the business scenario. The security control module is also used to determine the corresponding security capability node based on the security service information. The traffic forwarding module is also used to forward the network traffic through the security capability node in the order corresponding to the processing flow information, and to perform security processing.

11. A flow safety processing device, characterized in that, The device includes: The acquisition module is used to acquire network traffic sent from user terminals to the Internet from the access network; A matching module is used to match the network traffic with a custom security policy; The determination module is used to determine the target traffic classification identifier information corresponding to the network traffic according to the custom security policy when a match is successful. The matching module is also used to match the network traffic with the business scenario security policy in the event of a matching failure, and to determine the target traffic classification identification information corresponding to the network traffic. The matching module is also used to match the corresponding target security policy based on the target traffic classification identification information; The processing module is used to perform security processing on the network traffic according to the security capability nodes corresponding to the target security policy.

12. A flow safety processing device, characterized in that, The device includes: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the traffic security processing method as described in any one of claims 1-8.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the traffic security processing method as described in any one of claims 1-8.

14. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the traffic security processing method as described in any one of claims 1-8.

Images