Network system for controlling network traffic

Abstract

The invention relates to a network system (S) for controlling network traffic (V), wherein the network system (S) is provided with a first and a second rule-set enforcement unit (PEP1, PEP2), which are designed to analyse incoming network traffic (V), retrieve predefined rules from a rule set database (RW1, RW2), and filter the network traffic (V) on the basis of these predefined rules, and with a monitoring unit (R) for monitoring the first and / or the second rule-set enforcement unit (PEP1, PEP2), wherein the monitoring unit (R) is designed, on the basis of the incoming network traffic (V) running through the first and / or the second rule-set enforcement unit (PEP1, PEP2), to activate filtering of the network traffic (V) by means of the first and / or the second rule-set enforcement unit (PEP1, PEP2). By means of this network system, demand-dependent activation or deactivation, in particular of the second rule-set enforcement unit, can be carried out, as a result of which overloading of the overall system and in particular of the first rule-set enforcement unit can be prevented.

Description

[0001] Description

[0002] Network system for controlling network traffic

[0003] The present invention relates to a network system for controlling network traffic. Furthermore, the present invention relates to a method for controlling network traffic. Furthermore, the present invention relates to a computer program product that initiates the execution of the method for controlling network traffic on a program-controlled device.

[0004] To prevent network traffic entering a network system from causing damage, e.g., through third-party attacks, malware, or similar, it is common practice to restrict network connections or examine incoming network traffic before forwarding it within the network system. Various types of policy enforcement points (PEPs) can be used for this purpose. These can be operated as standalone devices in the form of dedicated external firewall components or provided directly on an end device or host (e.g., using a Linux Netfilter firewall).

[0005] These rule enforcement units, also referred to as firewalls below, can vary in terms of their functionality and available analysis capabilities and can provide restriction functionalities at different ISO / OSI layers. Restriction functionality can generally be understood as forwarding or blocking incoming network traffic based on various network traffic characteristics, depending on the respective functionality of the rule enforcement unit. For example, a local firewall can regulate network traffic up to ISO / OSI layer 4 (TCP and UDP). Higher-level firewalls can provide more advanced functions, such as performing protocol analysis and content inspection of data packets in network traffic.This allows not only to check whether a connection is allowed at ISO / OSI layer 4 level, but also whether the actually expected protocol is being used on the enabled connection (e.g., it checks whether, when network traffic arrives via port 22, it actually uses the ssh protocol).

[0006] Further implementations of rule enforcement units include web application firewalls, which perform analysis on incoming requests at the application protocol level (ISO / OSI layer 7). In containerized environments, solutions such as Envoy (see also https: / / www.envoyproxy.io) provide application proxies, which also represent a rule enforcement unit at the application protocol level.

[0007] The resource requirements of the respective enforcement units depend on the analytical capabilities of the described enforcement units. In general, the following can be said: The higher the analytical capabilities of the enforcement unit, the higher the resource requirements.

[0008] Particularly in orchestrated container environments, east-west traffic (e.g., network connections between containers on the host) is restricted via local rule enforcement units operated on the host. At the same time, it is possible, for example, in an industrial environment, that devices are exposed within larger networks and are poorly protected (e.g., in medium-sized companies). In the worst case, such devices are exposed to the Internet. If a higher-level rule enforcement unit is operated on such a device (e.g., an edge device or a medical device), the problem arises that the higher level of the local rule enforcement unit and the associated higher resource requirements make it easier for an attacker to exceed certain resource limits of the device orThe rule enforcement unit implemented on the device can reach, thus increasing the likelihood of successful denial of service attacks. However, higher-quality rule enforcement unit functions are desirable in order to be able to filter the network traffic to be regulated more closely to the application and thus prevent, for example, the misuse of an open TCP or UDP port.

[0009] Against this background, one object of the present invention is to control network traffic in such a way that both sufficient filtering of incoming network traffic and sufficient protection against attacks, in particular denial-of-service attacks, are achieved, in particular in the case of limited resources.

[0010] Accordingly, a network system for controlling network traffic is proposed. The network system comprises a first and a second policy enforcement unit. These policy enforcement units, also called policy enforcement points (PEPs), can be provided as standalone units or can be implemented on a host system. In either case, they are configured to examine incoming network traffic, retrieve predefined rules from a rule database, and filter the network traffic based on these predefined rules.In an initial state, the network traffic is passed through the second policy enforcement unit without further filtering and the filtering is performed by the first, higher-level policy enforcement unit, with the first policy enforcement unit applying rules corresponding to a higher analysis capability and the second policy enforcement unit applying rules corresponding to a lower analysis capability.

[0011] This filtering of network traffic can be performed based on various characteristics of the network traffic or the data packets it contains. For example, network traffic can be filtered based on the origin of the data packets, meta information contained in the data packets, the requested port, etc. Depending on the specific functionality of the rule enforcement unit, the filtering can refer to more general filtering (size, origin, input port of the data packets) or more precise filtering (specifically, the content of the data packets).

[0012] The network system may further comprise a monitoring unit configured to monitor the first and / or second policy enforcement unit. In particular, the monitoring unit is configured to activate filtering of the network traffic by the first and / or second policy enforcement unit based on the incoming network traffic passing through the first and / or second policy enforcement unit.

[0013] In contrast to previous systems, in which incoming network traffic is filtered by the existing rule enforcement unit, the network system proposed here provides for the monitoring unit to monitor the first and second rule enforcement units and, based on the processing of the network traffic by these rule enforcement units, decide which of the rule enforcement units is responsible for filtering the network traffic. This allows the two rule enforcement units to be activated (or deactivated) as needed. For example, if, as described above, the resources of one rule enforcement unit are exhausted, the other rule enforcement unit can be activated to prevent a denial-of-service attack.The monitoring unit, like the policy enforcement units, can be provided as a standalone unit or can be implemented on a host system, for example, with one or both policy enforcement units. Furthermore, it should be noted that although a first and a second policy enforcement unit are described here, the network system may have more than two, for example, three or four, policy enforcement units. In this case, the monitoring unit can accordingly activate or deactivate the three or more policy enforcement units as needed.

[0014] The respective unit, for example, a monitoring unit or rule enforcement unit, can be implemented in hardware and / or software. In a hardware implementation, the respective unit can be embodied as a device or as part of a device, for example, as a computer or a microprocessor, or as a control unit on a server, a host system, or the like. In a software implementation, the respective unit can be embodied as a computer program product, as a function, as a routine, as part of a program code, or as an executable object.

[0015] According to one embodiment, the first and second rule enforcement units are configured to apply different predefined rules. For example, the first rule enforcement unit can apply rules that correspond to a higher analysis capability and are applied, for example, to the content of data packets in the incoming network traffic. The first rule enforcement unit can thus correspond to a rule enforcement unit with higher intelligence. However, such a rule enforcement unit typically requires more time and has higher resource requirements (e.g., computing resources). In contrast, the second rule enforcement unit can apply rules that correspond to a lower analysis capability and target more general properties of the network traffic or the data packets contained therein, i.e., without a deeper analysis of the content of the data packets (e.g., general analysis of their size, origin, etc.).). The second rule enforcement unit thus has less intelligence, but can operate faster. Depending on the network traffic passing through the rule enforcement units, the monitoring unit can activate or deactivate the rule enforcement units and thus initiate filtering of the network traffic. This is either faster but less secure, or very secure but slower and requires more resources. In this way, the monitoring unit implements automatic control, i.e., in particular, analysis and restriction, of network traffic, which depends on the respective network traffic currently present.

[0016] According to a further embodiment, the first rule enforcement unit is configured to filter all incoming network traffic based on the predefined rules. This means that in this embodiment, the incoming network traffic is initially filtered by the first rule enforcement unit, for example, as an initial or default state. The monitoring unit is then configured to activate the second rule enforcement unit to filter all or parts of the incoming network traffic based on the network traffic passing through the first rule enforcement unit.This means that the second policy enforcement unit does not filter network traffic in its initial state and is only activated when the monitoring unit decides, based on the network traffic currently passing through the first policy enforcement unit, that filtering by the second policy enforcement unit needs to be activated. In this way, the second policy enforcement unit can be activated or deactivated as needed. This can reduce the resource requirements of the entire network system (when the second policy enforcement unit is not needed and is therefore deactivated) and prevent resource overload of the first policy enforcement unit (since the second policy enforcement unit can be activated if the first policy enforcement unit is overloaded).

[0017] According to a further embodiment, the monitoring unit is configured to activate filtering by the second rule enforcement unit based on an event in the network traffic filtered by the first rule enforcement unit. Such an event, or multiple events leading to activation of the second rule enforcement unit, can be predefined and stored, for example, in a rule database. This embodiment enables the monitoring unit to automatically activate the second rule enforcement unit, allowing the network system to respond quickly to such events. An attack, e.g., a denial-of-service attack, on the network system can thus be reliably prevented. The event or events can be a property of the packets contained in the network traffic (e.g., size, origin, destination, etc.).), meta-information of the packets contained in the network traffic (e.g., a specific content of the header of a data packet), a result of a statistical analysis of the network traffic (e.g., the number of packets from an originating source is greater than a predefined threshold), and / or a match of the network traffic with the predefined rules. In the latter case, the predefined rules can, for example, store which type of data packet, quantity of data packets in general, etc., is to be interpreted as an event for activating the second rule enforcement unit.

[0018] For example, if a certain number of connections stored in the predefined rules is exceeded, the monitoring unit can shift the network traffic from the first rule enforcement unit to the second rule enforcement unit. Such a shift can include completely redirecting the network traffic from the first to the second rule enforcement unit, partially redirecting the network traffic from the first to the second rule enforcement unit, or placing the second rule enforcement unit upstream of the first rule enforcement unit.

[0019] By shifting network traffic from the first rule enforcement unit to the second rule enforcement unit, it can be ensured that significantly more network capacity is available in the event of an impending overload situation at the first rule enforcement unit. The first rule enforcement unit, which preferably has superior analysis capabilities, can thus be relieved by the second rule enforcement unit and thus does not become a target of denial-of-service attacks.

[0020] According to a further embodiment, the monitoring unit is designed to deactivate the second rule enforcement unit after a predetermined period of time. This has the advantage that monitoring of the network traffic is not required; instead, the second rule enforcement unit is deactivated automatically upon expiration of the predetermined period of time. Alternatively, the monitoring unit can be designed to deactivate the second rule enforcement unit when the network traffic meets a predetermined criterion (e.g., falling below certain parameters such as the number of specific connections within a time interval). This, in turn, has the advantage that the second rule enforcement unit is deactivated only when the event responsible for activating the second rule enforcement unit no longer occurs.This ensures that if the second rule enforcement unit is deactivated, the first rule enforcement unit can work properly without being directly overloaded.

[0021] According to a further embodiment, the first rule enforcement unit is connected downstream of the second rule enforcement unit, with incoming network traffic being forwarded by the second rule enforcement unit to the first rule enforcement unit without further filtering or looped through the second rule enforcement unit. This means that in the initial or default state, although the network traffic passes through the second rule enforcement unit, no filtering of the network traffic occurs there; instead, filtering occurs only in the downstream first rule enforcement unit. Upon activation of the second rule enforcement unit, the network traffic can then be at least partially filtered in the second rule enforcement unit.This means that fewer data packets of network traffic are forwarded to the first rule enforcement unit, thus reducing its load.

[0022] To activate the second rule enforcement unit, the monitoring unit can be configured to insert a rule into the rule database for the second rule enforcement unit in order to activate filtering of network traffic by the second rule enforcement unit. Such a rule can, for example, cause the second rule enforcement unit to filter network traffic for data packets of a specific origin. These data packets are subsequently no longer forwarded to the first rule enforcement unit. In this way, denial-of-service attacks, for example, which aim to overload the first rule enforcement unit with many data packets, can be prevented because data packets with the same origin are filtered out. It is also possible to insert multiple rules for the second rule enforcement unit so that it can filter out further data packets.

[0023] Once the triggering event no longer occurs or the predetermined period has expired, the monitoring unit can be configured to deactivate the filtering of network traffic by the second rule enforcement unit by deleting the rule from the rule database. Adding and deleting such a rule for the second rule enforcement unit provides a simple way to activate filtering by the second rule enforcement unit without having to turn the second rule enforcement unit itself on and off.

[0024] According to a further embodiment, the network system can comprise a switching unit, for example a router. This can preferably be located upstream of the first and second rule enforcement units. The monitoring unit can be configured to send a switching signal to the switching unit, which in turn is configured to route the network traffic to the first and / or second rule enforcement units based on the switching signal, wherein the switching signal indicates an activation of the filtering of the network traffic by the first and / or second rule enforcement units. Instead of looping network traffic through the second rule enforcement unit, in this case the switching unit can route the network traffic directly to the first rule enforcement unit, to the second rule enforcement unit, or to both, as required.For example, in this way, the network traffic can be distributed between both rule enforcement units, so that the load of the two rule enforcement units is also distributed.

[0025] One of the advantages of using such a switching unit is that the rule enforcement units do not need to be reconfigured. Network traffic can be easily redirected from the first rule enforcement unit to the second rule enforcement unit and vice versa. Therefore, the rule enforcement units do not need to be reconfigured; only the switching unit, at the request of the monitoring unit, performs the appropriate redirection.

[0026] Additionally, the first and second rule enforcement units can also be connected in series, as described above. In this case, a portion of the network traffic routed to the second rule enforcement unit can be filtered both by the second rule enforcement unit and subsequently by the first rule enforcement unit. It can also be provided that the switching unit already performs a type of pre-filtering and, for example, submits data packets from a specific origin to double filtering by both rule enforcement units. This can further increase the security of the overall system, since certain data packets, for example data packets with properties listed on a blacklist, undergo both coarse filtering by the second rule enforcement unit and more precise, detailed filtering by the first rule enforcement unit.Other data packets that are classified as potentially harmless by the switching unit can, however, be passed directly to the first rule enforcement unit.

[0027] According to a further aspect, a method for controlling network traffic, in particular for analyzing and restricting network traffic, is proposed, the method comprising the following steps: retrieving predefined rules from a rule database, examining incoming network traffic and filtering the network traffic based on the predefined rules by a first and a second rule enforcement unit, and monitoring the first and / or the second rule enforcement unit by a monitoring unit, wherein the monitoring comprises activating the filtering of the network traffic by the first and / or the second rule enforcement unit based on the incoming network traffic passing through the first and / or the second rule enforcement unit,wherein, in an initial state, the network traffic V is passed through the second rule enforcement unit (PEP2) without further filtering, and the filtering is performed by the first, higher-order rule enforcement unit (PEP1), and wherein the first rule enforcement unit (PEP1) applies rules corresponding to a higher analysis capability, and the second rule enforcement unit (PEP2) applies rules corresponding to a lower analysis capability.

[0028] Furthermore, a computer program product is proposed which causes the method as explained above to be carried out on a program-controlled device.

[0029] A computer program product, such as a computer program means, can be provided or delivered, for example, as a storage medium, such as a memory card, USB stick, CD-ROM, DVD, or in the form of a downloadable file from a server in a network. This can be done, for example, in a wireless communications network by transmitting a corresponding file with the computer program product or the computer program means.

[0030] The embodiments and features described for the proposed network system apply accordingly to the proposed method. Further possible implementations of the invention also include combinations of features or embodiments described previously or below with respect to the exemplary embodiments that are not explicitly mentioned. In this case, the person skilled in the art will also add individual aspects as improvements or additions to the respective basic form of the invention.

[0031] Further advantageous embodiments and aspects of the invention are the subject of the dependent claims and the exemplary embodiments of the invention described below. The invention will be explained in more detail below using preferred embodiments with reference to the accompanying figures.

[0032] Fig. 1 shows a schematic block diagram of a network system for controlling network traffic according to a first embodiment;

[0033] Fig. 2 shows a schematic block diagram of a network system for controlling network traffic according to a second embodiment;

[0034] Fig. 3 shows a message flow diagram of a method for controlling network traffic in a system according to Fig. 1 or Fig. 2; and

[0035] Fig. 4 shows a schematic flow diagram of the method for controlling network traffic according to Fig. 3.

[0036] In the figures, identical or functionally equivalent elements have been given the same reference numerals unless otherwise stated.

[0037] Fig. 1 shows a network system S. The network system S is used to filter incoming network traffic V using policy enforcement points (PEP1, PEP2). The network traffic V is generally referred to here as network traffic, whereby it should be understood that these are incoming data packets that originate from various external sources or origins and are forwarded via the network system to other units (not shown) after filtering.

[0038] As shown in Fig. 1, in the network system S shown here, two rule enforcement units PEP1 and PEP2 are connected in series. The two rule enforcement units PEP1 and PEP2 preferably have different functional scopes, whereby it is assumed here that the rule enforcement unit PEP1 carries out a higher-quality, i.e. more precise or detailed, analysis of the incoming network traffic V, although it has higher resource requirements (in terms of computing capacity and / or time) compared to the second rule enforcement unit PEP2. Each of the rule enforcement units PEP1, PEP2 has its own rule set RW1, RW2, in which predefined rules are stored according to which the incoming network traffic V is to be filtered.Furthermore, each of the rule enforcement units PEP1, PEP2 can be connected to a corresponding database L1, L2 in which log entries about events in the respective rule enforcement unit PEP1, PEP2 are stored.

[0039] In an initial or default state, the network traffic V is passed through the second rule enforcement unit PEP2 without further filtering, and the filtering is performed by the first, higher-order rule enforcement unit PEP1. As soon as the first rule enforcement unit PEP1 determines that certain requests with certain properties could excessively demand its resources, the first rule enforcement unit PEP1 can store such an event E in a database L1. A monitoring unit (PEP relocator component) R can either monitor this database L1 or directly the first rule enforcement unit PEP1 in order to detect such an event. As soon as the monitoring unit R detects the event, e.g.If a potential overload of the first rule enforcement unit PEP1 is detected, the monitoring unit R can retrieve from its own rule database RW whether a corresponding rule should be entered in the upstream second rule enforcement unit PEP2 or its rule set RW2, which prevents the network traffic V, which triggered the event in PEP1, from being forwarded to PEP1.

[0040] If such a rule is entered into the rule set RW2 of the second rule enforcement unit PEP2, the incoming network traffic V is pre-filtered in the second rule enforcement unit PEP2, and the network traffic V arriving at the first rule enforcement unit PEP1 is thus reduced. For example, the second rule enforcement unit PEP2 can filter out all data packets from a specific source that triggered the event in the first rule enforcement unit PEP1 and are considered, for example, to be a potential source of a denial-of-service attack. These packets are then no longer forwarded to the first rule enforcement unit PEP1, which therefore cannot become the target of a denial-of-service attack.As soon as certain criteria are met, the monitoring unit R can then shift the network traffic V back to the first rule enforcement unit PEP1, for example by removing the inserted rule from the second rule enforcement unit PEP2 based on criteria stored in the rule set.

[0041] In one embodiment, the first rule enforcement unit PEP1 can be an nftables-based firewall and the second rule enforcement unit PEP2 can be an XDP-based firewall. In this case, the rule for the relocation event E can generate a log entry in the firewall log L1 as soon as, for example, the number of TCP RST or TCP SYN packets exceeds a defined number of connections within a defined period of time. Nftables supports such rules with regard to the range of functions it provides. Another example of triggering a relocation would be, for a firewall or rule enforcement unit that operates at the application level, if, for example, cross-site scripting attempts by an attacker are detected within a defined period of time and, in addition to actually blocking these requests, the generation of corresponding log information is defined in the rule set RW2.This log information must contain appropriate data in order to be able to configure the upstream firewall accordingly.

[0042] As shown in Fig. 2, in a further embodiment the network system S can have a switching unit UE, e.g. a router. In this embodiment the monitoring unit R can cause the switching unit UE to redirect the network traffic V in whole or in part from the first rule enforcement unit PEP1 to the second rule enforcement unit PEP2 when an event E occurs. In this case the second rule enforcement unit PEP2 is not implemented as an upstream rule enforcement unit, but rather the two rule enforcement units PEP1, PEP2 are connected in parallel and the network traffic V is routed by the switching unit UE to one or the other or both rule enforcement units PEP1, PEP2 accordingly. The remaining functionalities and features of the embodiment of Fig. 1 apply accordingly.The two embodiments can also be combined and the switching unit UE can be integrated into the embodiment of Fig. 1.

[0043] As already mentioned above, the monitoring unit R can monitor the two

[0044] Rule enforcement units PEP1, PEP2 or their log databases L1, L2 monitor to detect an event E. It should be understood that this monitoring can be performed both actively by the monitoring unit R and passively, for example, by receiving information from the log databases L1, L2 or the two rule enforcement units PEP1, PEP2. The monitoring unit R can also be informed of corresponding events E by any other component of the network system S.

[0045] Fig. 3 shows an exemplary flow diagram of a method for controlling network traffic V, as can be performed by the network system of Figs. 1 and 2.

[0046] In a first step S1, network traffic V arrives at the first rule enforcement unit PEP1. The unit then checks in step S2 whether the incoming network traffic triggers an event E (e.g., by comparing it with its rule set RW1, when a trigger or threshold value is exceeded, etc.). In this step, the event E can also be written to the log database L1. In step S3, the monitoring unit R is informed of the event E (as described above, this can be done passively or actively). In step S4, the monitoring unit R can now compare it with the rule set or the rule database RW to determine whether there is at least one rule for the event E that can then be applied to the second rule enforcement unit PEP2. Various variants are possible when selecting the rule(s) to be applied to the second rule enforcement unit PEP2.Individual fields of event E can be checked, combined with each other, and all known string matching methods such as regular expressions can be applied. For the rules to be applied to the second rule enforcement unit PEP2, for example, a first-hit method or best match can be selected, or all determined rules can be applied to the second rule enforcement unit PEP2.

[0047] In order to be able to parameterize the rules to be applied to the second rule enforcement unit PEP2, the required parameters should be included in the notification, i.e., the notification about event E, from the first rule enforcement unit PEP1. Advantageously, the parameters required for the rules to be applied to the second rule enforcement unit PEP2 are supplied in full. Alternatively, the monitoring unit R can select no rule if parameters are missing, ignore the event E, and issue a corresponding error message. As already described, in addition to the matching parameters described above for the events E generated by the first rule enforcement unit PEP1, the rules to be applied to the second rule enforcement unit PEP2 are stored in the rule set RW.In addition to the parameter-based rule selection described above, it may also be possible for the parameters provided by the first rule enforcement unit PEP1 not to be directly inserted into the rules for the second rule enforcement unit PEP2, but instead for corresponding larger ranges of network traffic V to be blocked by the second rule enforcement unit PEP2. For example, the first rule enforcement unit PEP1 may only provide a source IP address, and the second rule enforcement unit PEP2 may then block the entire network range of this source IP address or a port range for a specific period of time instead of directly blocking the port.

[0048] In any case, in step S5, the corresponding rule (either directly as an explicit individual rule or, as described above, as a general filter rule) is delivered to the second rule enforcement unit PEP2 and stored there. The monitoring unit R can either insert the rule into the rule set RW2 of the second rule enforcement unit PEP2 using a best-match procedure, or the second rule enforcement unit PEP2 itself can support the insertion of the rule at the correct location. This ensures that the rule is appropriately active and is not blocked by higher-level activations.

[0049] In step S6, the second rule enforcement unit PEP2 writes log data to the log database L2. Furthermore, the monitoring unit R monitors the second rule enforcement unit PEP2 either directly or via the log database L2. This can be done actively or passively, as described above with respect to the first rule enforcement unit PEP1.

[0050] In step S7, the monitoring unit R monitors whether and when a state occurs in which the second policy enforcement unit PEP2 can or should be deactivated again. This state can, in particular, correspond to a property of the network traffic V incoming to the second or first policy enforcement unit PEP2, PEP1.

[0051] For example, this property could be that a certain number of connections must be exceeded within a defined interval, or simply that a predefined time interval must have elapsed. If the second rule enforcement unit (PEP2) requires corresponding notifications for this purpose, the generation of corresponding log messages within the rule set for the second rule enforcement unit (PEP2) can be implemented by the determined rule to be inserted.

[0052] Once the rule(s) have been imported into the rule set RW2 by monitoring unit R, monitoring unit R enters the rules into an internal status table. This table does not need to be persistent, as it is assumed that the rules inserted into the rule set RW2 are also not persistent and will also be lost upon system restart. If the inserted rules are persistent, the status table should either also be persistent or, upon system restart, a check should be made to determine whether previously configured temporary rules are still contained in the second rule enforcement unit PEP2 or its rule set RW2 and should be removed by monitoring unit R during its initialization.

[0053] In addition to the activated rule, the timestamp of the rule activation can also be checked in the status table. If corresponding notifications from the second rule enforcement unit PEP2 are required to deactivate the rules, the monitoring unit can also count a corresponding hit count for the corresponding log event. If an event occurs from the second rule enforcement unit PEP2, this is either incremented in step S8, or the temporarily inserted rule is removed by the monitoring unit R in the second rule enforcement unit PEP2, thus forwarding the network traffic V to be restricted to the first rule enforcement unit PEP1.

[0054] With an interval-based process, the monitoring unit R can read the status table periodically (e.g., every second). As soon as the interval has expired, the corresponding rule in the second rule enforcement unit PEP2 is deactivated. It should be noted that the rule inserted into the second rule enforcement unit PEP2 ensures that incoming network traffic V is already filtered by the second rule enforcement unit PEP2 and is not passed through or forwarded unfiltered to the first rule enforcement unit PEP1. Therefore, as soon as this (relocation) rule is removed, the network traffic V is again passed directly to the first rule enforcement unit PEP1, without pre-filtering by the second rule enforcement unit PEP2.The relocation of the network traffic V remains ineffective until new events in the first rule enforcement unit PEP1 trigger a redirection of the network traffic V by the monitoring unit R to the second rule enforcement unit PEP2.

[0055] Fig. 4 now shows, in addition to the method steps already described in Fig. 3, further states of the monitoring unit R when carrying out a shift of the network traffic V from the first to the second rule enforcement unit PEP1, PEP2 and its shift back.

[0056] Step S0 represents the start of the monitoring unit R. After receiving an event E in step S3, in step S3a, this event is first compared with the rule set RW of the first rule enforcement unit PEP1. This ensures that the event E is an event stored in the rule set RW1 and requires a redirection of network traffic V. In step S3b, it is determined whether the conditions for redirecting network traffic V are met. If this is not the case, the system waits for further events in step S3c.

[0057] If the condition in step S3b is fulfilled, the monitoring unit R proceeds with the steps S4 to S7 described above, ie determining the rule (S4), implementing the rule (S5), receiving events from the second rule enforcement unit PEP2 (S6) and comparing the events with the rule set RW2 (S7).

[0058] If the comparison of the events from step S7 shows that the conditions for deleting the rule and deactivating the redirection of network traffic V are met (step S7a), the rule is deleted in step S8 as described above and the monitoring unit R ends this process (S9) and starts again with step S0.

[0059] If the condition in step S7a is not met, the monitoring unit R waits for further events in step S7b. This continues until the conditions for deactivating the second rule enforcement unit PEP2 are met.

[0060] As already described above, the method steps of Figures 3 and 4 also apply to the embodiment of Figure 2. In this case, the method would additionally comprise corresponding steps that cause the switching unit UE to switch the network traffic V to the first and / or the second policy enforcement unit PEP1, PEP2. The method described above can be used locally on a host or on different devices. In the latter case, the notifications between the respective policy enforcement units PEP1, PEP2 and the monitoring unit R should be integrity and authenticity protected. Any known methods can be used for this purpose.

[0061] List of reference symbols

[0062] E event

[0063] L1, L2 database

[0064] PEP1 first rule enforcement unit PEP2 second rule enforcement unit

[0065] R monitoring unit

[0066] RW rules database

[0067] RW1 Rules database of the first rule enforcement unit

[0068] RW2 Rules database of the second rule enforcement unit S Network system

[0069] UE switching unit

[0070] V Network traffic

[0071] S0 - S9 process steps

Claims

Patent claims 1. A network system (S) for controlling network traffic (V), comprising a first and a second rule enforcement unit (PEP1, PEP2) configured to examine incoming network traffic (V), retrieve predefined rules from a rule database (RW1, RW2), and filter the network traffic (V) based on these predefined rules, and comprising a monitoring unit (R) for monitoring the first and / or second rule enforcement unit (PEP1, PEP2), wherein the monitoring unit (R) is configured to activate filtering of the network traffic (V) by the first and / or second rule enforcement unit (PEP1, PEP2) based on the incoming network traffic (V) passing through the first and / or second rule enforcement unit (PEP1, PEP2),wherein, in an initial state, the network traffic V is passed through the second rule enforcement unit (PEP2) without further filtering, and the filtering is performed by the first, higher-order rule enforcement unit (PEP1), and wherein the first rule enforcement unit (PEP1) applies rules corresponding to a higher analysis capability, and the second rule enforcement unit (PEP2) applies rules corresponding to a lower analysis capability.

2. Network system according to one of the preceding claims, characterized in that the first rule enforcement unit (PEP1) is designed to filter all incoming network traffic (V) based on the predefined rules, and in that the monitoring unit (R) is designed to activate the second rule enforcement unit (PEP2) to filter all network traffic (V) or parts of the incoming network traffic (V) based on the network traffic (V) passing through the first rule enforcement unit (PEP1).

3. Network system according to claim 2, characterized in that the monitoring unit (R) is designed to activate the filtering by the second rule enforcement unit (PEP2) based on an event (E) in the network traffic (V) filtered by the first rule enforcement unit (PEP1).

4. Network system according to claim 3, characterized in that the event (E) is a property of the packets contained in the network traffic (V), meta-information of the packets contained in the network traffic (V), a result of a statistical evaluation of the network traffic (V) and / or a conformity of the network traffic (V) with the predefined rules.

5. Network system according to one of claims 2 to 4, characterized in that the monitoring unit (R) is designed to deactivate the second rule enforcement unit (PEP2) after a predetermined period of time.

6. Network system according to one of claims 2 to 5, characterized in that the monitoring unit (R) is designed to deactivate the second rule enforcement unit (PEP2) if the network traffic (V) meets a predetermined criterion.

7. Network system according to one of the preceding claims, characterized in that incoming network traffic (V) is forwarded by the second rule enforcement unit (PEP2) to the first rule enforcement unit (PEP1) without further filtering.

8. Network system according to claim 7, characterized in that the monitoring unit (R) is designed to insert a rule into the rule database (RW2) for the second rule enforcement unit (PEP2) in order to activate filtering of the network traffic (V) by the second rule enforcement unit (PEP2).

9. Network system according to claim 8, wherein the monitoring unit (R) is designed to deactivate the filtering of the network traffic (V) by the second rule enforcement unit (PEP2) by deleting the rule from the rule database (RW2).

10. Network system according to one of the preceding claims, characterized in that the network system (S) has a switching unit (UE), wherein the monitoring unit (R) is designed to send a switching signal to the switching unit (UE), which is designed to route the network traffic (V) to the first and / or the second rule enforcement unit (PEP1, PEP2) based on the switching signal, wherein the switching signal indicates an activation of the filtering of the network traffic (V) by the first and / or the second rule enforcement unit (PEP1, PEP2).

11. A method for controlling network traffic (V), the method comprising the steps of: retrieving (S2, S4) predefined rules from a rule database (RW1, RW2), Examining (S1) incoming network traffic (V) and filtering the network traffic (V) based on the predefined rules by a first and a second rule enforcement unit (PEP1, PEP2), and Monitoring (S3, S6) of the first and / or the second rule enforcement unit (PEP1, PEP2) by a monitoring unit (R), wherein the monitoring comprises activating the filtering of the network traffic (V) by the first and / or the second rule enforcement unit (PEP1, PEP2) based on the incoming network traffic (V) passing through the first and / or the second rule enforcement unit (PEP1, PEP2), wherein in an initial state the network traffic V is passed through the second rule enforcement unit PEP2 without further filtering and the filtering is performed by the first, higher-order rule enforcement unit PEP1, and wherein the first rule enforcement unit (PEP1) applies rules that correspond to a higher analysis capability and the second rule enforcement unit (PEP2) applies rules that correspond to a lower analysis capability.

12. A computer program product which causes the method according to claim 11 to be carried out on a program-controlled device.

Images