Back to results
US 2016/0261638 A1Published application
Network Security Method and Device
AssigneeHuawei Technologies Co., Ltd.
InventorsYibin Xu, Bing Sun, Jun Li
Life of this patent
Estimating the term…
Abstract
A network security method and a device relating to the field of network communication where the method includes, recording a correspondence between an Internet Protocol (IP) address and an security group tag (SGT), and executing a network security policy on a receiver of a data packet according to the recorded correspondence between the IP address and the SGT such that SGT information of the receiver does not need to be specially propagated, thereby decreasing network resource consumption and reducing network complexity.
Claims14
A network security method, comprising:
- receiving, by a network device, a first data packet that comprises a first security group tag, wherein the first security group tag is used to identify a security group to which the first data packet belongs, and wherein the network device is located in a trusted domain;
- recording, by the network device, a first correspondence, wherein the first correspondence is a correspondence between the first security group tag and an Internet Protocol (IP) address in a source IP address field of the first data packet;
- receiving, by the network device, a second data packet, wherein an IP address in a destination IP address field of the second data packet is the IP address in the source IP address field of the first data packet;
- acquiring, by the network device, the first security group tag according to the IP address in the destination IP address field of the second data packet and the first correspondence;
- acquiring, by the network device, a network security policy according to the acquired first security group tag and a preset second correspondence, wherein the second correspondence is a correspondence between the first security group tag and the network security policy;
- and
- executing, by the network device, the network security policy on the second data packet.
4 more elements
A network security method, comprising:
- receiving, by a network device, a synchronization message sent by another network device, wherein a payload of the synchronization message comprises a first correspondence, wherein the first correspondence is a correspondence between an Internet Protocol (IP) address and a first security group tag, wherein the network device is located in a trusted domain, wherein the other network device is located in another trusted domain, and wherein a network that does not support the first security group tag exists between the trusted domain and the other trusted domain;
- receiving, by the network device, a data packet, wherein an IP address in a destination IP address field of the data packet is the IP address in the first correspondence;
- acquiring, by the network device, the first security group tag according to the IP address in the destination IP address field of the data packet and the first correspondence;
- acquiring, by the network device, a network security policy according to the acquired first security group tag and a preset second correspondence, wherein the second correspondence is a correspondence between the first security group tag and the network security policy;
- and
- executing, by the network device, the network security policy on the data packet.
3 more elements
A network device located in a trusted domain, comprising:
- an interface;
- and
- a processor,
- wherein the processor is connected to the interface using a bus, wherein the processor is configured to:
- receive, using the interface, a first data packet that comprises a first security group tag, wherein the first security group tag is used to identify a security group to which the first data packet belongs;
- record, a first correspondence, wherein the first correspondence is a correspondence between the first security group tag and an Internet Protocol (IP) address in a source IP address field of the first data packet;
- receive, using the interface, a second data packet, wherein an IP address in a destination IP address field of the second data packet is the IP address in the source IP address field of the first data packet;
- acquire, the first security group tag according to the IP address in the destination IP address field of the second data packet and the first correspondence;
- and
- acquire, a network security policy according to the acquired first security group tag and a preset second correspondence, wherein the second correspondence is a correspondence between the first security group tag and the network security policy;
- and
- execute the network security policy on the second data packet.
9 more elements
A network device located in a trusted domain, comprising:
- a processor;
- and
- an interface,
- wherein the processor is connected to the interface using a bus,
- wherein the processor is configured:
- receive, using the interface, a synchronization message sent by another network device, wherein a payload of the synchronization message comprises a first correspondence, wherein the first correspondence is a correspondence between an Internet Protocol (IP) address and a first security group tag, wherein the other network device is located in another trusted domain, and wherein a network that does not support the first security group tag exists between the trusted domain in which the network device is located and the other trusted domain;
- receive, a data packet using the interface, wherein an IP address in a destination IP address field of the data packet is the IP address in the first correspondence;
- acquire, the first security group tag according to the IP address in the destination IP address field of the data packet and the first correspondence;
- acquire, a network security policy according to the acquired first security group tag and a preset second correspondence, wherein the second correspondence is a correspondence between the first security group tag and the network security policy;
- and
- execute the network security policy on the data packet.
8 more elements
Dependencies are inferred from the claim text.