A network security management method, device, equipment and machine-readable storage medium

Abstract

The present disclosure provides a network security management method, device, equipment and machine-readable storage medium, the method comprising: according to the policy configured by each tenant, marking the corresponding attack feature in the effective table; receiving the message to be detected, detecting whether the message to be detected hits the attack feature with the tenant's detection turned on; detecting whether the tenant associated with the message to be detected that hits the attack feature with the tenant's detection turned on has turned on the detection of the attack feature; and configuring the policy according to the tenant who has turned on the detection of the attack feature. Through the technical solution of the present disclosure, the attack features turned on by each tenant are uniformly recorded, and according to the effective table, it is detected whether the message to be detected hits the attack feature and whether the associated tenant has turned on the detection of the corresponding attack feature, so as to determine whether the message to be detected is released, without loading the enabled attack features for each tenant separately, avoiding the waste of memory space caused by repeated loading of the same attack feature.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a network security management method, device, equipment, and machine-readable storage medium. Background Art

[0002] IPS (Intrusion Prevention System) is a security defense technology that can detect and defend against application layer attacks. The IPS device first upgrades and loads the attack signature library. Users configure IPS policies to filter attack signatures and add attack signatures to the kernel's deep packet inspection engine. When network traffic enters the IPS device, it scans the AC tree through the AC (Aho-Corasick) algorithm to detect intrusions, and blocks intrusions through certain response actions, thereby protecting enterprise information systems and networks from attacks.

[0003] vSystem is a lightweight virtualization technology that can divide a physical device into multiple independent logical devices. Each vSystem is equivalent to a real device that provides external services and has independent interfaces, VLANs, routing table entries, address ranges, policies, and users / user groups. Therefore, IPS devices can use vSystem to achieve multi-tenant network isolation.

[0004] After the IPS device supports vSystem to implement multi-tenancy, each tenant needs the attack signature of the IPS signature library. After the tenant configures the IPS policy function, the attack signature of the loaded signature library is filtered and sent to the kernel. If the IPS is enabled for multiple tenants, and some attack signatures of the signature library are filtered by the IPS policies configured by multiple tenants at the same time, and sent to the kernel. In this way, the kernel will store multiple copies of the attack signature, wasting the device memory, which will lead to a decrease in the device's forwarding performance for data streams. Summary of the invention

[0005] In view of this, the present disclosure provides a network security management method, device, electronic device, and machine-readable storage medium to improve the above-mentioned problem of large multi-tenant memory usage.

[0006] The specific technical solutions are as follows:

[0007] The present disclosure provides a network security management method, which is applied to a network security device, wherein the network security device has at least two tenants, and the method comprises: according to the IPS policy configured by each tenant, marking and enabling the corresponding attack feature in the effective table, wherein the IPS policy comprises various types of attack features that need to be detected enabled by the associated tenant, and the effective table is used to record the attack features enabled for detection by each tenant; receiving a message to be detected, and according to the effective table, detecting whether the message to be detected hits the attack feature enabled for detection by the tenant; according to the effective table, detecting whether the tenant associated with the message to be detected that hits the attack feature enabled for detection by the tenant has enabled detection of the attack feature; and executing a corresponding processing action according to the policy configured by the tenant that has enabled detection of the attack feature.

[0008] As a technical solution, the received message to be detected detects whether the message to be detected hits the attack feature with tenant-enabled detection according to the effectiveness table, including: releasing the message to be detected that does not hit the attack feature with tenant-enabled detection.

[0009] As a technical solution, the method of detecting whether the tenant associated with the message to be detected that hits the attack feature enabled by the tenant has enabled the detection of the attack feature according to the effectiveness table includes: releasing the message to be detected, and detecting the corresponding attack feature of the tenant associated with the released message to be detected, wherein the corresponding attack feature refers to the attack feature with the tenant enabled detection that is hit by the message to be detected according to the effectiveness table.

[0010] As a technical solution, according to the IPS policy configured by each tenant, the corresponding attack features are marked in the effective table, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenants, and the effective table is used to record the attack features enabled for detection by each tenant, including: loading the attack features with the tenant-enabled detection into the memory storage space.

[0011] The present disclosure also provides a network security management device, which is applied to a network security device, wherein the network security device has at least two tenants, and the device includes: a table entry module, which is used to mark the corresponding attack features in the effective table according to the IPS policy configured by each tenant, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenant, and the effective table is used to record the attack features enabled for detection by each tenant; a detection module, which is used to receive a message to be detected, and detect whether the message to be detected hits the attack feature enabled for detection by the tenant according to the effective table; a matching module, which is used to detect whether the tenant associated with the message to be detected that hits the attack feature enabled for detection by the tenant has enabled the detection of the attack feature according to the effective table; and a processing module, which is used to execute corresponding processing actions according to the policy configured by the tenant who has enabled the detection of the attack feature.

[0012] As a technical solution, the received message to be detected detects whether the message to be detected hits the attack feature with tenant-enabled detection according to the effectiveness table, including: releasing the message to be detected that does not hit the attack feature with tenant-enabled detection.

[0013] As a technical solution, the method of detecting whether the tenant associated with the message to be detected that hits the attack feature enabled by the tenant has enabled the detection of the attack feature according to the effectiveness table includes: releasing the message to be detected, and detecting the corresponding attack feature of the tenant associated with the released message to be detected, wherein the corresponding attack feature refers to the attack feature with the tenant enabled detection that is hit by the message to be detected according to the effectiveness table.

[0014] As a technical solution, according to the IPS policy configured by each tenant, the corresponding attack features are marked in the effective table, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenants, and the effective table is used to record the attack features enabled for detection by each tenant, including: loading the attack features with the tenant-enabled detection into the memory storage space.

[0015] The present disclosure also provides an electronic device, including a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the aforementioned network security management method.

[0016] The present disclosure also provides a machine-readable storage medium, which stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement the aforementioned network security management method.

[0017] The above technical solution provided by the present disclosure brings at least the following beneficial effects:

[0018] The attack features enabled for detection by each tenant are uniformly recorded in the effective table. The effective table is used to detect whether the message to be detected hits the attack feature and whether the associated tenant has enabled detection of the corresponding attack feature, thereby determining whether the message to be detected is released. There is no need to load the enabled attack features for each tenant separately, thus avoiding repeated loading of the same attack feature and wasting memory space. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments of the present disclosure or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present disclosure. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present disclosure.

[0020] Figure 1 is a flow chart of a network security management method in one embodiment of the present disclosure;

[0021] Figure 2 is a structural diagram of a network security management device in one embodiment of the present disclosure;

[0022] Figure 3 It is a hardware structure diagram of an electronic device in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments, rather than limiting the present disclosure. The singular forms of "a", "said" and "the" used in the present disclosure and claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to any or all possible combinations of one or more associated listed items.

[0024] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present disclosure, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, in addition, the word "if" used may be interpreted as "at the time of" or "when" or "in response to determining".

[0025] The present disclosure provides a network security management method, device, electronic device, and machine-readable storage medium to improve the problem of large multi-tenant memory usage.

[0026] Specifically, the technical solution is as described below.

[0027] In one embodiment, the present disclosure provides a network security management method, which is applied to a network security device, wherein the network security device has at least two tenants, and the method includes: according to the IPS policy configured by each tenant, marking the corresponding attack feature in the effective table, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenant, and the effective table is used to record the attack features enabled for detection by each tenant; receiving a message to be detected, and according to the effective table, detecting whether the message to be detected hits the attack feature enabled for detection by the tenant; according to the effective table, detecting whether the tenant associated with the message to be detected that hits the attack feature enabled for detection by the tenant has enabled detection of the attack feature; and executing corresponding processing actions according to the policy configured by the tenant who has enabled detection of the attack feature.

[0028] Specifically, Figure 1 , including the following steps:

[0029] Step S11, according to the IPS policy configured by each tenant, mark the corresponding attack features in the effective table;

[0030] Step S12: receiving a message to be detected, and detecting whether the message to be detected matches an attack feature for which the tenant has enabled detection according to the validation table;

[0031] Step S13: According to the validation table, it is detected whether the tenant associated with the to-be-detected message having the attack feature enabled by the tenant has enabled the detection of the attack feature;

[0032] Step S14: executing corresponding processing actions according to the policy configured by the tenant that has enabled the detection of the attack signature.

[0033] The attack features enabled for detection by each tenant are uniformly recorded in the effective table. The effective table is used to detect whether the message to be detected hits the attack feature and whether the associated tenant has enabled detection of the corresponding attack feature, thereby determining whether the message to be detected is released. There is no need to load the enabled attack features for each tenant separately, thus avoiding repeated loading of the same attack feature and wasting memory space.

[0034] In one implementation, the receiving of the message to be detected and detecting whether the message to be detected hits an attack feature with tenant-enabled detection according to the validation table includes: releasing the message to be detected that does not hit an attack feature with tenant-enabled detection.

[0035] In one embodiment, the detection, according to the effective table, of whether the tenant associated with the message to be detected that hits the attack feature enabled by the tenant has enabled the detection of the attack feature includes: releasing the message to be detected, and detecting the corresponding attack feature of the tenant associated with the released message to be detected, wherein the corresponding attack feature refers to the attack feature with the tenant enabled detection that is hit by the message to be detected according to the effective table.

[0036] In one embodiment, the IPS policy configured according to each tenant is marked to enable the corresponding attack features in the effective table, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenants, and the effective table is used to record the attack features enabled for detection by each tenant, including: loading the attack features with the tenant-enabled detection into the memory storage space.

[0037] For IPS devices that support multiple tenants, a hash table is stored in the user state with the ID of the attack feature parsed from the feature library as the key to record the features that have been filtered by one of the tenants and downloaded into the kernel. This hash table is called the effective table. In network security devices, such as security IPS devices, up to 4095 tenants can be created, and each tenant will be assigned a non-repeating ID. In addition to the content of the attack feature, a new bitmap is created in the data node stored in the hash table to record whether the bit where the tenant's ID is located is set. If an attack feature is filtered by the IPS policies configured by multiple tenants at the same time, the bit of the tenant ID corresponding to the bitmap of the attack feature will be set to 1. If a tenant removes the feature from the filter, its bit will be cleared to 0. Then the user saves the configuration and submits it, and the feature will be downloaded to the message detection engine for detection.

[0038] The multi-tenant IPS device configures the IPS policy to filter attack features, enters the tenant environment, configures the IPS to filter attack features, obtains the current tenant ID at the configuration level, traverses the attack features being filtered, and uses the feature ID to find the feature node from the effective table. If found, obtain the bitmap of the feature. If not found, create a new feature hash node, create a feature bitmap, and set it. After finding and obtaining the bitmap of the feature, determine whether the corresponding bit of the tenant ID is set to 1. If set to 1, directly traverse the next filtered attack feature for processing. If not set to 1, set it to 1 and continue with the next processing. After all features have been traversed and processed, submit to save the configuration and activate it, and notify the kernel to update the process.

[0039] The message detection engine will also store the attack feature information (including bitmap) from the user state in a hash table. Each time the user configures the policy and filters the features and submits the activation configuration, the hash table will be cleared first, and a new node will be created based on the latest attack feature data sent from the user state and inserted into the hash table. This ensures that the latest bitmap and other feature information in the user state are updated and kept consistent.

[0040] After a message enters the message detection engine, if it hits a certain attack feature, it will obtain the tenant context of the current forwarding thread, that is, the tenant ID of the current forwarded message, and then use the ID to perform bitmap matching on the feature.

[0041] After the message enters the detection engine, the AC algorithm is used to scan the tree. After scanning the AC string, the corresponding attack feature information will be obtained from the record information of the string, and then the rule will be deduced from the rule_option and feature-level options to see if the attack feature is hit; if the attack feature is hit, the current tenant id is obtained, and if it is not hit, it means that the tenant releases the message; after obtaining the current tenant id, the bitmap match of the feature is performed, that is, the tenant id is used to check whether the bitmap of the attack feature is set to 1. If so, it means that the tenant hits the feature and executes the action configured by the tenant. Otherwise, it means that the feature is not filtered by the tenant and is filtered by the IPS policy configured by other tenants, and the default release action is executed.

[0042] In the above scenario, the CPU only processes the first packet of a new flow, and subsequent packets are processed and forwarded at high speed through hardware logic.

[0043] Through the above processing, in a multi-tenant IPS device environment, a bitmap is added to each feature data that needs to be downloaded to the message processing engine, so that the attack features can be shared in the multi-tenant environment, thereby solving the problem that the attack features are simultaneously filtered by IPS policies configured by multiple tenants and downloaded to the kernel for storage in multiple copies, resulting in a waste of memory.

[0044] In one embodiment, the present disclosure also provides a network security management device, such as Figure 2 , applied to a network security device, the network security device has at least two tenants, the device comprises: a table entry module 21, for marking the corresponding attack features in the effective table according to the IPS policy configured by each tenant, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenant, and the effective table is used to record the attack features enabled for detection by each tenant; a detection module 22, for receiving a message to be detected, and detecting whether the message to be detected hits an attack feature with the tenant enabled detection according to the effective table; a matching module 23, for detecting whether the tenant associated with the message to be detected that hits the attack feature with the tenant enabled detection has enabled the detection of the attack feature according to the effective table; a processing module 24, for executing corresponding processing actions according to the policy configured by the tenant that has enabled the detection of the attack feature.

[0045] In one implementation, the receiving of the message to be detected and detecting whether the message to be detected hits an attack feature with tenant-enabled detection according to the validation table includes: releasing the message to be detected that does not hit an attack feature with tenant-enabled detection.

[0046] In one embodiment, the detection, according to the effective table, of whether the tenant associated with the message to be detected that hits the attack feature enabled by the tenant has enabled the detection of the attack feature includes: releasing the message to be detected, and detecting the corresponding attack feature of the tenant associated with the released message to be detected, wherein the corresponding attack feature refers to the attack feature with the tenant enabled detection that is hit by the message to be detected according to the effective table.

[0047] In one embodiment, the IPS policy configured according to each tenant is marked to enable the corresponding attack features in the effective table, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenants, and the effective table is used to record the attack features enabled for detection by each tenant, including: loading the attack features with the tenant-enabled detection into the memory storage space.

[0048] The device implementation is the same as or similar to the corresponding method implementation, and will not be described in detail here.

[0049] In one embodiment, the present disclosure provides an electronic device, including a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the aforementioned network security management method. From a hardware level, the hardware architecture diagram can be seen in Figure 3 shown.

[0050] In one embodiment, the present disclosure provides a machine-readable storage medium storing machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement the aforementioned network security management method.

[0051] Here, the machine-readable storage medium may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.

[0052] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0053] For the convenience of description, the above device is described in terms of functions and is divided into various units and described separately. Of course, when implementing the present disclosure, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0054] It will be appreciated by those skilled in the art that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may be provided in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the embodiments of the present disclosure may be provided in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0055] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0056] Moreover, these computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0057] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0058] It will be appreciated by those skilled in the art that the embodiments of the present disclosure may be provided as methods, systems or computer program products. Therefore, the present disclosure may be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may be in the form of a computer program product implemented on one or more computer-usable storage media (which may include but are not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0059] The above description is only an embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the scope of the claims of the present disclosure.

Claims

1. A network security management method, characterized in that: Applied to a network security device, the network security device having at least two tenants, the method comprising: According to the IPS policy configured by each tenant, mark and enable the corresponding attack features in the effective table, wherein the IPS policy includes the attack features of various types that need to be detected enabled by the associated tenant, and the effective table is used to record the attack features enabled for detection by each tenant; Receive the message to be detected, and detect whether the message to be detected matches the attack feature enabled by the tenant according to the effective table; According to the effective table, detect whether the tenant associated with the to-be-detected message that hits the attack feature enabled by the tenant has enabled the detection of the attack feature; According to the policy configured by the tenant that has enabled the detection of the attack feature, a corresponding processing action is performed.

2. The method according to claim 1, characterized in that The receiving of the message to be detected and detecting whether the message to be detected hits the attack feature with the tenant enabling detection according to the effectiveness table include: Release the packets to be detected that do not match the attack features that the tenant has enabled for detection.

3. The method according to claim 1, characterized in that The detecting, according to the validation table, whether the tenant associated with the message to be detected that hits the attack feature enabled by the tenant has enabled the detection of the attack feature includes: The message to be detected is released, and the corresponding attack feature of the tenant associated with the released message to be detected is detected, wherein the corresponding attack feature refers to the attack feature with tenant-enabled detection that is hit by the message to be detected according to the effective table.

4. The method according to claim 1, characterized in that: According to the IPS policy configured by each tenant, the corresponding attack features in the effective table are marked and enabled, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenant, and the effective table is used to record the attack features enabled for detection by each tenant, including: Loads attack signatures with tenant-enabled detection into the memory storage space.

5. A network security management device, characterized in that: Applied to a network security device, the network security device having at least two tenants, the device comprising: A table entry module, used to mark and enable corresponding attack features in the effective table according to the IPS policy configured by each tenant, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenant, and the effective table is used to record the attack features enabled for detection by each tenant; The detection module is used to receive the message to be detected and detect whether the message to be detected hits the attack feature with the tenant's detection enabled according to the effectiveness table; A matching module, used to detect, according to the effective table, whether the tenant associated with the message to be detected that hits the attack feature with the tenant-enabled detection has enabled the detection of the attack feature; The processing module is used to execute corresponding processing actions according to the policy configured by the tenant that enables the detection of the attack feature.

6. The device according to claim 5, characterized in that The receiving of the message to be detected and detecting whether the message to be detected hits the attack feature with the tenant enabling detection according to the effectiveness table include: Release the packets to be detected that do not match the attack features that the tenant has enabled for detection.

7. The device according to claim 5, characterized in that The detecting, according to the validation table, whether the tenant associated with the message to be detected that hits the attack feature enabled by the tenant has enabled the detection of the attack feature includes: The message to be detected is released, and the corresponding attack feature of the tenant associated with the released message to be detected is detected, wherein the corresponding attack feature refers to the attack feature with tenant-enabled detection that is hit by the message to be detected according to the effective table.

8. The device according to claim 5, characterized in that According to the IPS policy configured by each tenant, the corresponding attack features in the effective table are marked and enabled, wherein the IPS policy includes various types of attack features that need to be detected enabled by the associated tenant, and the effective table is used to record the attack features enabled for detection by each tenant, including: Loads attack signatures with tenant-enabled detection into the memory storage space.

9. An electronic device, characterized in that: include: A processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the method described in any one of claims 1 to 4.

10. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement any one of the methods of claims 1-4.

Images