Security policy matching method and device based on IP slice

Abstract

A security policy matching method based on IP slices mainly comprises the steps of IP address slicing, policy association, policy tree generation, policy fast matching and the like, the method adopts a virtual address thought, an address object is sliced into an address unit, the corresponding relation between the address unit and a policy is reflected by utilizing a bit, and then an ordered AVL policy tree is constructed, so that the security policy matching efficiency is improved. And efficient matching between the source IP and the destination IP of the message and the security policy is realized. According to the method, when the number of strategies is configured more, the influence on the performance is smaller, and the expansibility is high; and meanwhile, the support for the ipv4 and the ipv6 is relatively good, the occupied memory is relatively small, and the hardware requirements of low-end equipment are met.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a security policy matching method and device based on IP slicing. Background Art

[0002] With the continuous advancement of Internet technology and the increasing variety of application scenarios, the network rate has developed to 100G / b or even higher. Current intrusion detection devices will use security policies to perform security detection, blocking or release of data packets. According to the current network rate status, more efficient and faster security policy matching algorithms are needed to meet its performance requirements. There are usually two solutions:

[0003] Solution 1: Use the space-for-time thinking, hash the IP into hash for each node, use hash to save all IP nodes, and perform hash search O(1) times. Of course, this solution has an obvious disadvantage, which is the large memory overhead. If one IP is stored through Int, then at least 4 (bytes) * 4294967295 (255.255.255.255) = 17179869180 (bytes) of memory is required, which is about 15G of memory. The IPV6 address is 128 bits, so the memory overhead is even greater. Therefore, the biggest problem with IP matching is the memory problem.

[0004] Solution 2: Use matrix thinking to put the IP description information into the matrix [A, B, C, D]. Associate and map each independent IP range with the policy through bits. When the policy matches, perform bit operations A&B&C&D on the entire matrix. When the result of the operation is not 0, it means that the policy set of the address object is hit. Then, the policy calculation is performed to obtain the policy number. This solution meets IPV4 requirements, but still requires higher memory to support IPV6, which cannot be supported by low-end device memory.

[0005] Patents similar to the present invention mainly include:

[0006] CN111181964A: "Security policy matching method, device, network equipment, storage medium" proposes a method of cascading the five-tuple node in the security policy with the security policy information in the security policy through a security policy linked list. In this way, in the security policy matching process, the message can be matched according to the five-tuple node first, and then the message can be matched according to the policy information node in the security policy node where the five-tuple node can match the message. This scheme adopts the thinking of a two-dimensional linked list to ensure that in the policy where the five-tuple node can match the message, all security policy information nodes are traversed, and then the policy information nodes set later can be effective, but it ignores the problem that the performance problem cannot be solved when there are many security policy configurations.

[0007] CN117834789A: "Message security policy matching method, device, electronic device and storage medium" proposes a message security policy matching method, the local tuple sorting table includes a local maximum element sorting subtable of each element category and a local minimum element sorting subtable of each element category, the local maximum element sorting subtable is determined by sorting the maximum elements belonging to the same category in a descending order, the maximum element is used to indicate the upper limit of the value, the local minimum element sorting subtable is determined by sorting the minimum elements belonging to the same category in a descending order, the minimum element is used to indicate the lower limit of the value, the matching items corresponding to the target element include the maximum matching items and the minimum matching items, the scheme uses the distinction between the IP maximum value and the IP minimum value to associate with the number of policies, but ignores that when the local maximum element and the local minimum element are reused too much, it will cause too many policy hits when performing AND operations, which will inevitably lead to performance degradation when obtaining policies. At the same time, the scheme does not provide a detailed description of IPv6, and the number of policies is not easy to expand. Summary of the invention

[0008] In order to solve the problem of insufficient policy matching performance under high-bandwidth data traffic, the present invention provides an efficient security policy matching method based on IP slicing. The method mainly adopts the virtual address idea and performs policy matching through address description rather than real address matching. It has small memory usage, is easy to expand the number of policies, and has the ability to support IPv6.

[0009] The security policy matching method based on IP slicing provided in the present disclosure includes the following steps:

[0010] S1, IP address slicing: Create address objects and divide each address object into several independent IP address units;

[0011] S2, policy association: a policy attribute value consisting of n bits is set for each independent IP address unit, where each bit corresponds to a policy and n is the total number of all policies; when a policy references an address unit, the bit corresponding to the policy in the policy attribute value of the address unit is set to 1, thereby establishing an association between the referenced policy and the IP address unit obtained after slicing;

[0012] S3, strategy tree generation: by sequentially mounting each independent IP address unit, an ordered AVL tree is constructed, where each node in the tree corresponds to an IP address unit;

[0013] S4, fast policy matching: for the passing message, obtain the source IP and destination IP of the message, and search in the AVL policy tree whether there is an IP address unit corresponding to the source IP and / or destination IP. If found, further read the policy attribute value of the address unit, and determine the hit policy based on the policy attribute value.

[0014] Furthermore, the IP address slicing method in step S1 includes:

[0015] When the IP address ranges of two address objects overlap, the overlapping part is treated as an independent IP address unit;

[0016] The non-overlapping part is treated as another address unit and compared with other address objects. If there is overlap, the overlapping IP address range is treated as an independent address unit.

[0017] By comparing address objects one by one, each address object is eventually divided into several independent IP address units that do not overlap each other.

[0018] Furthermore, the step S4 specifically includes:

[0019] When a message passes through, first obtain the source and destination IP of the message, first use the source IP to search through the AVL tree to find out whether the source IP finds the corresponding IP address unit in the policy tree. If it is found, then take out the policy attribute value of the address unit; if not, then forward the traffic;

[0020] Then use the destination IP to search the AVL tree to find out whether the destination IP finds the corresponding IP address unit in the policy tree. If it is found, the policy attribute value of the unit is taken out, otherwise the traffic is forwarded;

[0021] Perform an AND operation on the policy attribute value of the source IP and the policy attribute value of the destination IP. If the result of the operation is non-zero, it indicates that a policy is hit. Then, the hit policy is determined based on the number of hit bits.

[0022] Furthermore, the step S4 further includes the following steps:

[0023] After determining the hit policy, take out all hit policies according to business needs, or take out a certain policy according to the policy priority.

[0024] The security policy matching device using the above method includes the following modules:

[0025] The IP address slicing module is used to divide each established address object into several independent IP address units;

[0026] The policy association module is used to generate a policy attribute value for each independent IP address unit. The policy attribute value includes n bits, each bit corresponds to a policy, and n is the total number of all policies. When a policy references an address unit, the bit corresponding to the policy in the policy attribute value of the address unit is set to 1, thereby establishing an association between the referenced policy and the IP address unit obtained after slicing.

[0027] Strategy tree generation module: used to construct an ordered AVL tree through the ordered mounting of each independent IP address unit, where each node in the tree corresponds to an IP address unit;

[0028] Policy fast matching module: used to obtain the source IP and destination IP of the passing message, and search whether there is an IP address unit corresponding to the source IP and / or destination IP in the AVL policy tree. If found, the policy attribute value of the address unit is further read, and the hit policy is determined based on the policy attribute value.

[0029] Compared with the prior art, the advantages of the present invention are as follows: (1) the proposed method and device have less impact on performance and strong scalability when a large number of policies are configured; (2) the proposed method and device have better support for IPv4 and IPv6, less memory usage, and meet the hardware requirements of low-end devices; (3) the proposed method and device are not only used for security policy matching of intrusion protection detection, but can also be applied to scenarios such as firewall policy matching and IDS policy matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present disclosure.

[0031] Figure 1 The overall flow chart of the security policy matching method based on IP slicing provided by the present disclosure;

[0032] Figure 2 This is an example of IP address slicing results;

[0033] Figure 3 This is an example of the IP address slicing method;

[0034] Figure 4 This is an example of an AVL strategy tree;

[0035] Figure 5 The following is an example of a strategy matching flowchart. DETAILED DESCRIPTION

[0036] The preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure will be more thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0037] The present disclosure proposes a method for efficient matching of security policies based on IP slicing. It mainly adopts the idea of virtual addresses and realizes policy matching mainly through address description methods rather than real address matching. Generally speaking, it is divided into four steps: IP address slicing, policy association, policy tree generation, and policy fast matching, as shown in the attached Figure 1 figure.

[0038] 1. IP address slicing

[0039] During the process of policy reference, address objects are first established. However, there may be a situation where each address object contains each other. Therefore, the purpose of IP address slicing is to split each address object into independent IP address units, and one address unit is called a node.

[0040] For example: address object 1: 172.168.1.0 / 24, address object 2: 172.168.1.100 - 172.168.3.200, address object 3: 172.168.0.0 / 16, address object 4: 172.168.3.0 / 24; the slicing is as shown in the attached Figure 2 figure:

[0041] Address objects 1 to 4 are disassembled into 7 independent and non-overlapping nodes, and these 7 nodes are independent IP address units. The calculation method of the number of nodes: the maximum number of nodes is 2N - 1, where N represents the IP segment (point). If each policy reference is to a different address object, then for 1024 policies, at most 1024 different address objects are referenced, and the maximum number of nodes 2N - 1 = 2 * 1024 - 1 = 2047 independent IP address units.

[0042] Therefore, the difficulty in IP address slicing lies in the critical permutations and combinations of IP segments, IP single points, and the boundaries between IP segments and IP ranges, mainly including: non - overlapping of two address nodes, coincidence of single points at the boundaries of two address nodes, intersection of two address nodes, etc., as shown in Figure 3 the figure. For example: address objects A and B, the address range of A is (A.min, A.max), the address range of B is (B.min, B.max), and at the same time A.max - A.min < B.max - B.min; of course, this is just one of the situations. Through mathematical permutation and combination derivation, there are a total of 22 ways of permutation and combination.

[0043] This IP slicing method is not only applicable to IPV4 but also to IPV6.

[0044] 2. Policy association

[0045] For each address unit, a policy attribute represented by n bits is set (n is the number of policies). Each bit represents a policy bit. When a policy references the address unit, the corresponding policy bit in the policy attribute of the address unit will be set to 1 for subsequent bit operations. For example:

[0046] Suppose address objects 1, 2, and 3 are divided into three independent nodes (i.e., address units) A, B, and C. Strategy 1 references nodes A and B, strategy 2 references nodes B and C, strategy 3 references nodes A and C, and so on, as shown in Table 1:

[0047] Table 1

[0048] Strategy Reference Address Object node illustrate Strategy 1 Address Object 1 AB Strategy 1 is address object 1, which contains address nodes A and B. Strategy 2 Address Object 2 BC Strategy 2 is address object 2, which contains address nodes B and C. Strategy 3 Address Object 3 AC Strategy 3 is address object 3, which contains address nodes A and C.

[0049] According to the corresponding relationship in the above table, the process of determining the policy attributes of the three nodes A, B, and C is as follows: (If the number of policies is 1024, there are 1024 bits, which are simply described as 4 bits here)

[0050] The first bit of the A node address corresponds to strategy 1. There is node A in strategy 1, so it is set to 1, 0001

[0051] The first bit of the B node address corresponds to strategy 1. There is node B in strategy 1, so it is set to 1, 0001

[0052] The first bit of the C node address corresponds to strategy 1. Strategy 1 does not have node C, so it is set to 0, 0000

[0053] The second bit of the A node address corresponds to strategy 2. Strategy 2 does not have node A, so it is set to 0, 0001

[0054] The second bit of the B node address corresponds to strategy 2. There is node B in strategy 2, so it is set to 1, 0011

[0055] The second bit of the C node address corresponds to strategy 2. There is node C in strategy 2, so it is set to 1, 0010

[0056] The third bit of the A node address corresponds to strategy 3. There is node A in strategy 3, so it is set to 1, 0101

[0057] The third bit of the B node address corresponds to strategy 3. Strategy 3 does not have node B, so it is set to 1, 0001

[0058] The third bit of the C node address corresponds to strategy 3. There is node C in strategy 3, so it is set to 0, 0110;

[0059] The final results are shown in Table 2:

[0060] Table 2

[0061]

[0062]

[0063] By associating the policy bits with the IP independent units in this way, memory overhead is greatly saved. For example, 64 policies correspond to the longA[1] type in a 64-bit system, 128 bits correspond to the longA[2] array, and so on. 1024 policies correspond to the longA

[16] array. The policy bits in the IP unit only occupy 8*16=128 bytes. If each policy references a different address object, then 1024 policies can reference at most 1024 different address objects. The maximum number of nodes is 2N-1=2*1024-1=2047 IP independent units, and the memory occupies at most 2047*128 (bytes)=262,016 (bytes)=255K. Therefore, the memory occupancy is less. At the same time, the current CPU supports AVX (256-bit operation). For 1024 bits, only 4 operations are needed to get the result, and the operation efficiency is high. If you want to expand it to 2048 strategies, you only need to expand the strategy bit, which corresponds to longA

[32] , so it has strong scalability.

[0064] 3. Strategy tree generation

[0065] After the IP slices are associated with the policies, each independent IP address unit is arranged in order from small to large according to the IP address range in the IP address unit, and the AVL tree is constructed in order.

[0066] The time complexity of AVL tree search is O(log N), where N represents the nodes of the tree. For example, in 1024 policies, at most 1024 different address objects are referenced, and the maximum number of nodes is 2N-1=2*1024-1=2047 independent IP address units. Then the time complexity of matching 1024 policies is log(2047)=3.3, and the IP address node search can be completed with at most 4 searches.

[0067] For example, yes Figure 2 The 7 nodes separated from the , are mounted in order, such as Figure 4 shown.

[0068] In policy configuration, address objects are not frequently modified, so the AVL tree structure is selected to achieve fast search, thereby realizing an efficient search algorithm to meet the performance of policy matching.

[0069] 4. Strategy Matching

[0070] When a message passes through an intrusion protection device (IPS), the source and destination IP addresses of the message are first obtained. The source IP address is first used to search through the AVL tree to find whether the source IP address unit is found in the policy tree. If it is found, the policy attribute of the IP address unit is taken out. If it is not found, no processing is performed and the traffic is forwarded directly.

[0071] Then use the destination IP to search the AVL tree to find out whether the destination IP finds the corresponding IP address unit in the policy tree. If it is found, the policy attribute of the IP address unit is taken out, otherwise the traffic is forwarded;

[0072] Perform an AND operation on the policy attributes of the source IP and the destination IP. If the result is non-zero, it means that a policy is matched. The matched policy can be determined by the matched bit.

[0073] Arbitrate according to the respective business, you can get all the hit strategies, or you can determine a strategy by strategy priority. The strategy matching process is as follows: Figure 5 shown.

[0074] The above technical scheme is only an exemplary embodiment of the present invention. For those skilled in the art, it is easy to make various types of improvements or modifications based on the application methods and principles disclosed in the present invention, and it is not limited to the method described in the above specific embodiment of the present invention. Therefore, the method described above is only preferred and does not have a restrictive meaning.

Claims

1. A security policy matching method based on IP slicing, comprising the following steps: S1, IP address slicing: Create address objects and divide each address object into several independent IP address units; S2, policy association: a policy attribute value consisting of n bits is set for each independent IP address unit, where each bit corresponds to a policy and n is the total number of all policies; when a policy references an address unit, the bit corresponding to the policy in the policy attribute value of the address unit is set to 1, thereby establishing an association between the referenced policy and the IP address unit obtained after slicing; S3, strategy tree generation: by sequentially mounting each independent IP address unit, an ordered AVL tree is constructed, where each node in the tree corresponds to an IP address unit; S4, fast policy matching: for the passing message, obtain the source IP and destination IP of the message, and search in the AVL policy tree whether there is an IP address unit corresponding to the source IP and / or destination IP. If found, further read the policy attribute value of the address unit, and determine the hit policy based on the policy attribute value.

2. The method according to claim 1, characterized in that The IP address slicing method in step S1 includes: When the IP address ranges of two address objects overlap, the overlapping part is treated as an independent IP address unit; The non-overlapping part is treated as another address unit and compared with other address objects. If there is overlap, the overlapping IP address range is treated as an independent address unit. By comparing address objects one by one, each address object is eventually divided into several independent IP address units that do not overlap each other.

3. The method according to claim 1, characterized in that The step S4 specifically includes: When a message passes through, first obtain the source and destination IP of the message, first use the source IP to search through the AVL tree to find out whether the source IP finds the corresponding IP address unit in the policy tree. If it is found, then take out the policy attribute value of the address unit; if not, then forward the traffic; Then use the destination IP to search the AVL tree to find out whether the destination IP finds the corresponding IP address unit in the policy tree. If it is found, the policy attribute value of the unit is taken out, otherwise the traffic is forwarded; Perform an AND operation on the policy attribute value of the source IP and the policy attribute value of the destination IP. If the result of the operation is non-zero, it indicates that a policy is hit. Then, the hit policy is determined based on the number of hit bits.

4. The method according to claim 3, wherein step S4 further comprises the following steps: After determining the hit policy, take out all hit policies according to business needs, or take out a certain policy according to the policy priority.

5. A security policy matching device using the method described in any one of claims 1 to 4, characterized in that: Includes the following modules: The IP address slicing module is used to divide each established address object into several independent IP address units; The policy association module is used to generate a policy attribute value for each independent IP address unit. The policy attribute value includes n bits, each bit corresponds to a policy, and n is the total number of all policies. When a policy references an address unit, the bit corresponding to the policy in the policy attribute value of the address unit is set to 1, thereby establishing an association between the referenced policy and the IP address unit obtained after slicing. Strategy tree generation module: used to construct an ordered AVL tree through the ordered mounting of each independent IP address unit, where each node in the tree corresponds to an IP address unit; Policy fast matching module: used to obtain the source IP and destination IP of the passing message, and search whether there is an IP address unit corresponding to the source IP and / or destination IP in the AVL policy tree. If found, the policy attribute value of the address unit is further read, and the hit policy is determined based on the policy attribute value.

Images