Packet transmission equipment and packet transmission system

Abstract

Traffic flowing through packet transmission equipment comes in countless variations ranging from traffic from harmless general users, to PC virus-infected users, and users with harmful intent. Transferring all of this traffic together through a module for monitoring causes a great loss in throughput and is an extremely inefficient way to handle general user traffic. After checking the module processing results, the system administrator can resolve this situation by changing each user's transfer module but making this setting manually is unwieldy and lacks flexibility. A security level can be set on table in the platform module linking each user to the destination application module. By dynamically changing this security level according to processing results in each module, each user's destination application module can be changed smoothly and flexibly.

Description

technical field [0001] The present invention relates to a packet relay device that dynamically changes the security level of each user and changes a transfer destination application module according to the type of traffic sent by each user. Background technique [0002] FW (Firewall: Firewall) function and IDS (Intrusion Detection System: Intrusion Detection System) function have been set in each user or each enterprise. However, as the number and layers of users using the Internet increase day by day, it becomes more and more difficult for each user and each company to realize these functions. Currently, there is a structure in which these functions are provided by the packet relay device, and users and enterprises are not aware of the existence of FW and IDS functions. When the FW function and IDS function are realized by the packet relay device used in the IP network, there are two methods, one is to incorporate modules into the packet relay device, and the other is to c...

AI Technical Summary

Problems solved by technology

Therefore, if FW and IDS processing are performed on all traffic processed by the packet relay device, the overall throughput will be quickly limited by the throughput of FW or IDS.

[0006] Furthermore, if the process of transferring packets to the module is performed, only the corresponding transfer and processing time will be increased.

In other words, the more effort is devoted to security assurance, the longer the transmission and processing time will be. On the contrary, if the transmission and processing time are prioritized, the security guarantee will not be sufficient.

[0007] On the other hand, the traffic flowing through the packet relay device includes not only the traffic from ordinary users who are not malicious, but also the traffic from users infected with viruses and the illegal traffic from users with malicious intent.

Regardless of this situation, if these traffics are transmitted to the module and monitored, the throughput will be greatly lost, and it will become a very inefficient transmission form for the traffic of ordinary users who are not malicious.

If the administrator appropriately changes the transmission module of each user according to the processing results in each module, the above problems can be solved. In this case, manual settings are required every time an illegal access is detected, which is cumbersome.

Moreover, after illegal access is detected, it takes time until the administrator recognizes and sets it up, which lacks timeliness

Images