Back to results
US 12,585,790 B2Granted
Traffic processing method and protection system
AssigneeHuawei Technologies Co., Ltd.
InventorZhendi Xi
Life of this patent
Estimating the term…
Abstract
A method includes: A protection device obtains a local statistical result, where the local statistical result indicates frequent key data in first traffic, the local statistical result includes a plurality of entries, each of the plurality of entries includes one piece of key data and a corresponding count value, and the first traffic is traffic that passes, in a first time segment, through a network location in which the protection device is applied; the protection device replaces the key data of each entry in the local statistical result with masked data corresponding to the key data, to obtain a local masking result; and the protection device sends the local masking result to a security service server.
Claims20
A method, comprising:
- obtaining, by a protection device, a local statistical result, wherein the local statistical result indicates frequent key data in first traffic, the local statistical result comprises a first plurality of entries, each entry of the first plurality of entries comprises one piece of key data and a corresponding count value, and the first traffic is traffic that passes, in a first time segment, through a network location in which the protection device is applied;
- replacing, by the protection device, a respective piece of key data of each entry of the first plurality of entries in the local statistical result with masked data corresponding to the respective piece of key data, to obtain a local masking result;
- sending, by the protection device, the local masking result to a security service server;
- receiving, by the protection device, a global masking result sent by the security service server, wherein the global masking result is obtained by analyzing local masking results from at least two protection devices by the security service server, the global masking result comprises at least one entry, and each entry in the global masking result comprises respective masked data;
- determining, by the protection device, for a plurality of packets in traffic that passes through the network location in which the protection device is applied, whether key data from the packets correspond to a first target entry existing in the global masking result, wherein the plurality of packets comprises a first packet that has first key data that corresponds to the first target entry and a second packet that does not have the first key data that corresponds to the first target entry;
- performing, by the protection device, additional security detection for the second packet based in part in response to the second packet not having the first key data that corresponds to the first target entry;
- and
- skipping, by the protection device, performing additional security detection on the first packet, in response to the first target entry existing in the global masking result, wherein the first target entry comprises first masked data corresponding to the first key data.
5 more elements
A method, comprising:
- receiving, by a security service server, N local masking results, wherein each of the N local masking results comes from a protection device, N is a natural number greater than or equal to 2, each local masking result comprises a first plurality of entries, and each entry of the first plurality of entries comprised in each local masking result comprises respective first masked data and a corresponding first count value;
- generating, by the security service server, a global masking result based on the N local masking results, wherein the global masking result comprises a second plurality of entries, each entry of the second plurality of entries comprised in the global masking result comprises second masked data, and the second masked data comprised in the global masking result is a subset of the respective first masked data comprised in the N local masking results;
- and
- sending, by the security service server, the global masking result to the protection device, wherein the global masking result comprises at least one entry, and each entry in the global masking result comprises respective masked data, the global masking result causing the protection device to perform:
- determining, for a plurality of packets in traffic that passes through a network location in which the protection device is applied, whether key data from the packets correspond to a first target entry existing in the global masking result, wherein the plurality of packets comprises a first packet that has first key data that corresponds to the first target entry and a second packet that does not have the first key data that corresponds to the first target entry;
- performing additional security detection for the second packet based in part in response to the second packet not having the first key data that corresponds to the first target entry;
- and
- skipping performing additional security detection on the first packet, in response to the first target entry existing in the global masking result, wherein the first target entry comprises first masked data corresponding to the first key data.
5 more elements
A system, comprising:
- a memory configured to store program instructions;
- at least one processor, wherein the program instructions, when executed by the at least one processor, cause the system to perform operations including:
- obtaining a local statistical result, wherein the local statistical result indicates frequent key data in first traffic, the local statistical result comprises a first plurality of entries, each entry of the first plurality of entries comprises one piece of key data and a corresponding count value, and the first traffic is traffic that passes, in a first time segment, through a network location in which the system is applied;
- and
- replacing a respective piece of key data of each entry of the first plurality of entries in the local statistical result with masked data corresponding to the respective piece of key data, to obtain a local masking result;
- sending the local masking result to a security service server;
- receiving a global masking result sent by the security service server, wherein the global masking result is obtained by analyzing local masking results from at least two protection devices by the security service server, the global masking result comprises at least one entry, and each entry in the global masking result comprises respective masked data;
- determining, for a plurality of packets in traffic that passes through the network location in which the system is applied, whether key data from the packets correspond to a first target entry existing in the global masking result, wherein the plurality of packets comprises a first packet that has first key data that corresponds to the first target entry and a second packet that does not have the first key data that corresponds to the first target entry;
- performing additional security detection for the second packet based in part in response to the second packet not having the first key data that corresponds to the first target entry;
- and
- skipping performing additional security detection on the first packet, in response to the first target entry existing in the global masking result, wherein the first target entry comprises first masked data corresponding to the first key data.
8 more elements
A system, comprising:
- a memory configured to store program instructions;
- at least one processor, wherein the program instructions, when executed by the at least one processor, cause the system to perform operations including:
- receiving N local masking results, wherein each of the N local masking results comes from a protection device, N is a natural number greater than or equal to 2, each local masking result comprises a first plurality of entries, and each entry of the first plurality of entries comprised in each local masking result comprises respective first masked data and a corresponding first count value;
- and
- generating a global masking result based on the N local masking results, wherein the global masking result comprises a second plurality of entries, each entry of the second plurality of entries comprised in the global masking result comprises second masked data, and the second masked data comprised in the global masking result is a subset of the respective first masked data comprised in the N local masking results;
- sending the global masking result to the protection device, wherein the global masking result comprises at least one entry, and each entry in the global masking result comprises respective masked data, the global masking result causing the protection device to perform:
- determining, for a plurality of packets in traffic that passes through a network location in which the protection device is applied, whether key data from the packets correspond to a first target entry existing in the global masking result, wherein the plurality of packets comprises a first packet that has first key data that corresponds to the first target entry and a second packet that does not have the first key data that corresponds to the first target entry;
- performing additional security detection for the second packet based in part in response to the second packet not having the first key data that corresponds to the first target entry;
- and
- skipping performing additional security detection on the first packet, in response to the first target entry existing in the global masking result, wherein the first target entry comprises first masked data corresponding to the first key data.
7 more elements
Dependencies are inferred from the claim text.