WO2009097715A1

WO2009097715A1 - Device for uniform threat management and method for loading threat defense modules

Info

Publication number: WO2009097715A1
Application number: PCT/CN2008/072237
Authority: WO
Inventors: Xiuying Ni
Original assignee: Chengdu Huawei Symantec Technologies Co., Ltd.
Priority date: 2008-02-02
Filing date: 2008-09-02
Publication date: 2009-08-13
Also published as: CN101227289A

Abstract

A device for uniform threat management and a method for loading threat defense modules are disclosed. The device includes at least a threat defense module and an adaptive loading module that dynamically loads the threat defense module according to the processing performance information of the device for uniform threat management. The method includes: after the device for uniform threat management receives the packets, the processing performance information of the device for uniform threat management is got. The threat defense module is loaded according to the processing performance information. The threat defense module is dynamically loadedby the adaptive and dynamic adjusting, that is according to the processing performance of the device. The variable security defense functions and the normal service processing capability of the device are achieved at the same time. The maximum throughout of the device is maintained.

Description

Unified threat management device and method for loading threat defense module

The present invention relates to a network processing device and an application method thereof, and in particular, to a unified threat management device (UTM) and a method for loading a threat defense module. Background technique

With the development of network applications, network security requirements are also being updated. Traditional firewalls are mainly used for attack detection of individual packets and have insufficient defense capabilities against application layer threats. Therefore, based on existing firewalls, unified threat management is proposed. (Unified Threat Management, UTM) solution. Unified threat management devices integrate firewalls and some application-layer threat defense features, including Anti-Virus (AV), Intrusion Prevention System (IPS), Anti-Spam | Anti Spam , AS), Uniform Resource Location (Universal Resource Location) filtering, etc. These functions do not have to be used at the same time. A UTM device can only have some of these functions.

The firewall module provides forwarding and single-packet detection, and functions such as Network Address Translation (NAT) and Virtual Private Network (VPN). The IPS module provides content depth detection to filter packets containing malicious content. The AS module provides the function of detecting emails. It filters most of the spam by filtering the sender's IP, email header, and email body content. The AV module provides virus scanning for packets and restores the packets. Filed, and pre-processed (decompressed, unpacked, etc.) and virus scan; The unified resource location filtering module filters the requested uniform resource location according to a predefined uniform resource location blacklist or a uniform resource location classification.

As shown in FIG. 1 , it is a schematic diagram of a network structure in which a unified threat management device is applied in the prior art. The unified threat management device is deployed at the egress of the enterprise network as a gateway device to receive packets. According to the different characteristics of the packets, the unified threat management device sends packets to the packet based on the application layer protocol. The same function module performs safety detection. For example, the message of the mail protocol is sent to the AS module for further detection, and the HTTP request message is sent to the unified resource location filtering module.

The existing unified threat management device has the following defects:

1) Based on the existing unified threat management device, in the case of only firewall security defense, the existing software system can meet the performance requirements of the firewall because the firewall does not further analyze and filter the message content. However, in most cases, the unified threat management device needs to perform security analysis and detection on a large number of message contents, such as anti-spam, anti-virus, etc., all need to scan the entire message to determine the security of the message. However, the software in the existing unified threat management device cannot meet the processing performance requirements of the device, and the hardware acceleration causes the device cost to increase rapidly.

2) Once the network traffic exceeds the processing capacity of the unified threat management device, the packets will be randomly discarded. All services may be greatly affected, and the operation of critical services cannot be guaranteed.

3) QoS (Quality of Service, QoS for short) technology provides the required services for specific services on the IP network. It mainly guarantees throughput, delay, jitter and packet loss rate. From the current application, it is mainly to provide transmission quality assurance for applications such as voice and video that are sensitive to delay packet loss. However, after the QoS function is enabled, the overall performance of the unified threat management device will be further reduced, and the throughput cannot be increased. Summary of the invention

The embodiments of the present invention provide a unified threat management device and a method for loading a threat defense module, so as to dynamically adjust various defense functions, and maintain normal service processing of the device to ensure the throughput of the device.

To achieve the foregoing, the present invention provides a unified threat management device, including: at least one threat defense module, configured to perform security detection on a packet;

The adaptive loading module is configured to dynamically load the threat anti-P module according to processing performance information of the unified threat management device.

The invention also provides a method for loading a threat defense module, comprising: After receiving the packet, obtain the processing performance information of the unified threat management device.

According to the processing performance information, the threat defense module is loaded.

According to the foregoing technical solution, the embodiment of the present invention dynamically loads the threat defense module according to the adaptive dynamic adjustment mode, that is, according to the processing performance of the device, and takes into account various security defense functions and normal service processing capabilities of the device, and maximizes The throughput of the device is guaranteed. DRAWINGS

1 is a schematic structural diagram of a network in which a unified threat management device is applied in the prior art; FIG. 2 is a schematic structural diagram of a unified threat management device according to an embodiment of the present invention;

3 is another schematic structural diagram of a unified threat management device according to an embodiment of the present invention;

4 is another schematic structural diagram of a unified threat management device according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for loading a threat defense module according to an embodiment of the present invention. detailed description

The unified threat management device in the embodiment of the present invention will be described below with reference to the accompanying drawings. FIG. 2 is a schematic structural diagram of a unified threat management device according to an embodiment of the present invention, including: at least one threat defense module 1 configured to perform security detection on a packet;

The adaptive loading module 2 is configured to dynamically load the threat defense module according to the processing performance information of the unified threat management device.

As shown in FIG. 3, the threat defense module 1 may be any one of the firewall module 1 1 , the unified resource location filtering module 12 , the spam filtering module 13 , the virus scanning module 14 , and the intrusion detection module 15 in the embodiment of the present invention. . The types and combinations of the threat defense modules can be loaded according to actual needs. This embodiment only gives a schematic diagram of a possible combination.

The processing performance information of the unified threat management device may be one or more of CPU usage information, memory usage information, and network traffic information. The adaptive loading module dynamically loads each threat defense module based on these processing performance information, thereby taking into account various security defense functions and The normal service processing capability of the device ensures the throughput of the device to the utmost extent.

The embodiment of the present invention further provides another embodiment of the unified threat management device. As shown in FIG. 4, compared with the previous embodiment, the difference in this embodiment is that the unified threat management device further includes: The configuration module 3 is configured to configure a priority of the threat defense module and store the configured priority information.

The adaptive loading module dynamically loads the threat defense module according to the priority information in the priority configuration module and the processing performance information of the unified threat management device.

The following takes the network traffic as the standard of the device performance information as an example to further illustrate the loading principle of the adaptive loading module of the embodiment of the present invention.

To adapt to the security policy of different network traffic, you can ensure the balance between throughput and security by setting the network bandwidth threshold and the threat defense module priority. The network threshold and the priority of the threat defense module can be pre-defined by the user. . When there is a firewall module, the priority of the firewall is set to the highest priority, and the user cannot customize it. In addition to the firewall module, the user can define the priority of the threat defense module according to actual needs. For example, in a network architecture, users of the mail server can set the priority of the spam filtering function module to the highest and the priority of the unified resource location filtering module to be low. The user can also set the threshold of the network bandwidth as needed. For example, the state network traffic point that needs to be adjusted to load the threat defense module is set to a low threshold of 100 Mbps and a high threshold of 200 Mbps. In practical applications, thresholds of multiple network traffic may also be set, and each threat defense module may be dynamically loaded according to the threshold of the network traffic and the priority of the threat defense module, for example, the threshold may be set to 100 Mbps, 150 Mbps, 200 Mbps, when the traffic is greater than 150 Mbps. When the traffic with the lowest priority is closed, when the traffic is greater than 200 Mbps, the medium-priority threat defense module is also disabled except for the lowest priority threat defense module. When the traffic is restored to less than 150 Mbps, the medium priority threat defense module is restored, and the lowest priority threat defense module remains closed; when the traffic is less than lOOMBps, the lowest priority threat defense module is restored.

Similarly, this embodiment can also use the CPU usage rate of the unified threat management device as the device property. The standard of the energy, the threshold of the CPU usage and the priority of the function module are pre-defined by the user. For example, the threshold of the CPU usage of the device can be set to 80%. When the value is greater than 80%, the unified resource positioning with the lowest priority is disabled. Filter module. You can also set multiple CPU usage thresholds, dynamically load each threat defense module based on the CPU usage threshold and the threat defense module's priority. For example, you can set the threshold to 80%, 60%, 40%, when CPU usage. When the CPU usage is greater than %80, the medium-priority threat defense module is disabled. When the CPU usage is greater than %80, the medium-priority threat defense module is also disabled. When the CPU usage is restored to less than 60%, the medium priority threat defense module is restored, and the lowest priority threat defense module continues to be closed; when the CPU usage is less than 40%, the lowest priority threat defense module is restored.

In addition, the unified threat management device in the foregoing two embodiments may further include: a performance detecting module, configured to detect processing performance of the unified threat management device, and send the detected processing performance information of the unified threat management device to the adaptive Load the module. The performance detection module may specifically include one or more of a CPU usage detection module, a memory usage detection module, and a network traffic detection module.

It can be seen from the foregoing embodiment that the adaptive dynamic adjustment mode, that is, dynamically loading the threat defense module according to the processing performance of the device, takes into account various security defense functions and normal service processing capabilities of the device, and ensures the maximum guarantee. The throughput of the device. The threshold of the device processing performance and the priority of each threat defense module can also be flexibly set according to the actual application, which better adjusts the contradiction between the security defense function and the normal service processing capability of the device.

Next, a method of loading a threat defense module according to an embodiment of the present invention will be described.

The method for loading the threat defense module in this embodiment includes:

After receiving the packet, the unified threat management device obtains the processing performance information of the unified threat management device.

In addition, when there are multiple threat defense modules, the multiple threat defense modules may also be set. Priority information; and load multiple threat defense modules according to priority information and processing performance information of multiple threat defense modules. The device performance threshold and the priority of the function module can be pre-defined by the user. When the unified threat management device receives the packet, it can obtain the device performance information in real time, and then compare the device performance information with a preset threshold. Each threat defense module is dynamically loaded according to a preset threshold and a priority of the threat defense module.

The foregoing multiple threat defense modules may be one or any of a firewall module, a unified resource location filtering module, a spam filtering module, a virus scanning module, and an intrusion detection module.

In practical applications, the priority of the firewall module can be set to the highest priority, and the user cannot change the priority of the firewall module.

The processing performance information of the unified threat management device may be one or more of CPU usage information, memory usage information, and network traffic information.

According to the priority information of the threat defense module and the processing performance information of the unified threat management device, loading multiple threat defense modules may be specifically implemented as follows:

Setting thresholds for multiple levels of processing performance, the thresholds of each level are in one-to-one correspondence with multiple priority levels, and each of the embodiments is dynamically loaded according to a preset threshold and a priority of the threat defense module. A method of loading a threat defense module.

As shown in FIG. 5, a flow chart of a method for loading a threat defense module according to an embodiment of the present invention is shown. In this embodiment, the performance of the unified threat management device to be considered is network traffic. To simplify the description, the network traffic threshold is set to two, that is, a high threshold and a low threshold. The specific process is as follows:

Step 101: After receiving the packet, check the current network traffic statistics.

Step 102: Determine whether the current network traffic exceeds a set high threshold (for example, 200 Mbps). If yes, according to the priority of the threat defense module preset by the user (for example, the priority of the uniform resource location filtering module is the lowest), the threat defense module with the lowest priority is closed (for example, unified) Resource location filtering module). Otherwise, go to step 103;

Step 103: Determine whether the current network traffic is less than a set low threshold (for example, 100 Mbps). If yes, and there is a threat defense module that has been shut down, restore the threat defense module that has been shut down (ie, re-enable the lowest priority threat defense module). Otherwise, the current state is maintained, that is, the threat defense module with the lowest priority is still in the closed state, and the closed threat defense module does not detect the packet.

In practice, multiple thresholds for network traffic can also be set. The priority of the threat protection module can be set to the lowest priority, medium priority, and high priority, and each threshold corresponds to the priority of the threat defense module. For example, you can set the network traffic threshold to 100Mbps (corresponding to the low-priority threat defense module), 150Mbps (corresponding to the medium-priority threat defense module), 200Mbps (corresponding to the high-priority threat defense module), when the traffic is greater than 150Mbps. When the traffic of the lowest priority threat defense module is turned off, when the traffic is greater than 200 Mbps, in addition to turning off the lowest priority threat defense module, the medium priority threat defense module needs to be shut down. When the traffic is restored to less than 150 Mbps, the medium priority function is detected, and when the traffic is less than 100 MBps, the lowest priority threat defense module is restored.

In addition, the following modes can also be used in the embodiments of the present invention:

When the traffic is greater than 100 Mbps, the lowest priority threat defense module is turned off, and when the traffic is less than 100 Mbps, the lowest priority threat defense module is enabled;

When the traffic is greater than 150 Mbps, in addition to turning off the lowest priority threat defense module, the medium priority threat defense module is also turned off; when the traffic is less than 150 Mbps, the medium priority threat defense module is enabled, and the lowest priority threat is maintained. The defense module is in the off state; when the traffic is greater than 200 Mbps, in addition to turning off the lowest priority and medium priority threat defense modules, the high priority threat defense module is also turned off; when the traffic is less than 200 Mbps, the high priority threat is turned on. The defense module, and the lowest priority and medium priority threat defense modules are turned off.

When the device processing performance information is CPU usage information, its implementation is similar. set up The multiple thresholds of CPU usage correspond to the priority of each threat defense module, and will not be described again.

It can be seen by the embodiment of the present invention that the user can set different threat defense modules to perform priority, in case the device processing performance is low, for example, the network traffic is small or the device

When the CPU usage is low, security detection is performed on all traffic. When the network traffic exceeds the processing capability of the device, the function module with low priority is dynamically shut down according to the actual application of the user and the priority level of the threat defense module. Increases the throughput of the device, ensures the normal business, and ensures the necessary security protection.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Claim

1. A unified threat management device, characterized in that it comprises:

At least one threat defense module for performing security detection on the packet;

2. The device according to claim 1, further comprising:

a priority configuration module, configured to configure a priority of the threat defense module, and store the configured priority information;

The adaptive module dynamically loads the threat prevention module according to the priority information in the priority configuration module and the processing performance information of the unified threat management device.

The device according to claim 1, wherein the threat defense module is one or more of a firewall module, a unified resource location filtering module, a spam filtering module, a virus scanning module, and an intrusion detection module.

The device according to claim 3, wherein when the firewall module has a firewall module, the priority of the firewall module is the highest priority.

The device according to any one of claims 1 to 4, wherein the device further comprises:

The performance detection module is configured to detect processing performance of the unified threat management device, and send the detected processing performance information of the unified threat management device to the adaptive loading module.

The device according to claim 5, wherein the performance detecting module comprises:

One or more of the CPU usage detection module, the memory usage detection module, and the network traffic detection module.

7. A method for loading a threat defense module, comprising:

After receiving the packet, obtain the processing performance information of the unified threat management device.

According to the processing performance information, the threat anti-P module is loaded.

8. The method according to claim 7, further comprising: setting the threat prevention Priority information of the Royal Module;

And loading the threat defense module according to the priority information of the threat defense module and the processing performance information of the unified threat management device.

The method according to claim 7, wherein the loading threat defense module is specifically one or any of a load firewall module, a unified resource location filtering module, a spam filtering module, a virus scanning module, and an intrusion detection module. Multiple.

10. The method according to claim 9, wherein the loading threat defense module comprises at least loading the firewall module.

The method according to any one of claims 7 to 10, wherein the processing performance information of the unified threat management device is: CPU usage information and memory usage information of the unified threat management device , one or more of the network traffic information.

12. The method according to claim 8, wherein the method further comprises: setting thresholds of processing performance of the plurality of levels, the thresholds of the respective levels corresponding to the plurality of priority levels;

And loading the threat defense module according to the priority information of the threat defense module and the processing performance information of the unified threat management device:

Comparing the obtained device performance information with each threshold, if it is greater than a certain threshold, the threat defense module of the priority level corresponding to the threshold of the level is closed; if it is smaller than the threshold of one of the levels, The threat threshold module of the priority level corresponding to the threshold of the level.