Method for processing traffic in protection device, and protection device
AssigneeHuawei Technologies Co., Ltd.
InventorBo Wu
Life of this patent
Estimating the term…
Abstract
In accordance with an embodiment, a method includes: receiving, by a dedicated security chip, first traffic from a first network interface of the protection device, where the first network interface is configured to receive traffic sent by a first network device, and a destination internet protocol (IP) address of the first traffic comprises a first IP address; determining, by the dedicated security chip, whether the first IP address exists in a first destination IP table stored on the dedicated security chip, wherein the first destination IP table comprises at least one IP address having a risk of being attacked; and in response to a determination that the first IP address exists in the first destination IP table, sending, by the dedicated security chip, the first traffic to the CPU.
Claims20
A method for processing traffic in a protection device, wherein the protection device comprises a central processing unit (CPU) and a dedicated security chip, and the method comprises:
- receiving, by the dedicated security chip, first traffic from a first network interface of the protection device, wherein the first network interface is configured to receive traffic sent by a first network device, and a destination internet protocol (IP) address of the first traffic comprises a first IP address;
- determining, by the dedicated security chip, whether the first IP address exists in a first destination IP table stored on the dedicated security chip, wherein the first destination IP table comprises at least one IP address having a risk of being attacked;
- in response to a determination that the first IP address exists in the first destination IP table, sending, by the dedicated security chip, the first traffic to the CPU;
- and
- in response to a determination that the first IP address does not exist in the first destination IP table:
- sending, by the dedicated security chip, the first traffic to a second network interface of the protection device, so that the second network interface forwards the first traffic to a second network device,
- sampling, by the dedicated security chip, the first traffic to obtain sampled packets, and
- sending, by the dedicated security chip, the sampled packets to the CPU.
A method for processing traffic in a protection device, wherein the protection device comprises a central processing unit (CPU) and a dedicated security chip, and the method comprises:
- receiving, by the CPU, first traffic from the dedicated security chip;
- determining, by the CPU based on the first traffic, a rate of data destined for a first internet protocol (IP) address;
- in response to a determination that a duration in which the rate meets a threshold condition is greater than a first duration, generating, by the CPU, an addition message, wherein the addition message comprises the first IP address, and the addition message comprises a request to add the first IP address to a destination IP table that is stored on the dedicated security chip;
- and
- sending, by the CPU, the addition message to the dedicated security chip.
A protection device, comprising:
- a central processing unit (CPU);
- a dedicated security chip;
- a first network interface;
- and
- a second network interface, wherein
- the first network interface is configured to:
- receive first traffic from a first network device, and send the first traffic to the dedicated security chip, wherein a destination internet protocol (IP) address of the first traffic comprises a first IP address,
- the dedicated security chip is configured to:
- receive the first traffic from the first network interface, and determine whether the first IP address exists in a first destination IP table stored on the dedicated security chip, wherein the first destination IP table comprises at least one IP address having a risk of being attacked,
- the dedicated security chip is further configured to send the first traffic to the CPU in response to a determination that the first IP address exists in the first destination IP table,
- the dedicated security chip is further configured to:
- in response to a determination that the first IP address does not exist in the first destination IP table, sample the first traffic to obtain sampled packets, and send the sampled packets to the CPU,
- the CPU is configured to:
- perform attack detection on the first traffic sent by the dedicated security chip, and send traffic on which attack detection is performed to the second network interface, and
- the second network interface is configured to forward the traffic on which attack detection is performed to a second network device.
Dependencies are inferred from the claim text.