Method, apparatus, and system for cooperative defense on network

Patent metadata

Field	Value
Publication number	US-10298600-B2
Application number	US-201514985807-A
Country	US
Kind code	B2
Filing date	Dec 31, 2015
Priority date	Nov 12, 2013
Publication date	May 21, 2019
Grant date	May 21, 2019

Abstract

The present disclosure provides a method, an apparatus, and a system for cooperative defense on a network. Alarm information sent by a security device of a first subnet that is being attacked is received by a controller; the controller generates flow table information according to the alarm information, and forwards the flow table information to a switching device of the first subnet and a switching device of at least one second subnet, which is equivalent to that, after detecting an attack, a security device of a subnet generates alarm information, and shares, by using the controller, the alarm information with a switching device of the subnet and a switching device of another subnet that is not being attacked, to form networkwide cooperative defense, thereby enhancing network security.

First claim

What is claimed is:

1. A method for cooperative defense on a network with an attacked subnet and a second subnet controlled by a controller, the method comprising:
receiving, by a controller, feature information of an attack information sent by a security device of the attacked subnet;
generating, by the controller according to the feature information, flow table information, wherein the flow table information indicates the data flow of the attack information; and
forwarding, by the controller, the flow table information to a switching device of the attacked subnet and a switching device of the second subnet;
receiving, by the controller, a first defense rule generated by the security device of the attacked subnet according to the attack information, and the first defense rule is an access rule for an external network to access the attacked subnet; and
sending, by the controller, the first defense rule to a security device of the second subnet, so that the security device of the second subnet performs, according to the first defense rule, filtering on a data flow that accesses the second subnet; and
generating, by the controller according to the feature information, a second defense rule, wherein the second defense rule is an access rule for an external network to access the attacked subnet or the second subnet; and
sending, by the controller, the second defense rule to the security device of the attacked subnet and a security device of the second subnet, so that the security device of the attacked and the security device of the second subnet performs filtering on a data flow according to the second defense rule.

2. The method of claim 1 , further comprising rejecting, by the switching device of the attacked subnet and the switching device of the second subnet, a data that matches the flow table information.

3. A method for cooperative defense on a network, the network comprises a controller, a first subnet, and a second subnet, and the controller controls the first subnet and the second subnet, the method comprises:
receiving, by a security device of the first subnet, attack information;
generating, by the security device of the first subnet according to the attack information, a first defense rule, wherein the first defense rule is an access rule for an external network to access the first subnet; and
sending, by the security device of the first subnet, alarm information to the controller, wherein the alarm information comprises feature information of the attack information and the first defense rule;
receiving, by the controller, a first defense rule generated by the security device of the attacked subnet according to the attack information, and the first defense rule is an access rule for an external network to access the attacked subnet; and
sending, by the controller, the first defense rule to a security device of the second subnet, so that the security device of the second subnet performs, according to the first defense rule, filtering on a data flow that accesses the second subnet; and
generating, by the controller according to the feature information, a second defense rule, wherein the second defense rule is an access rule for an external network to access the attacked subnet or the second subnet; and
sending, by the controller, the second defense rule to the security device of the attacked subnet and a security device of the second subnet, so that the security device of the attacked and the security device of the second subnet performs filtering on a data flow according to the second defense rule.

4. A method for cooperative defense on a network, further comprising:
receiving, by the controller, alarm information sent by a security device of a first subnet, wherein the first subnet is a subnet that is being attacked, the alarm information is a defense rule generated by the security device of the first subnet according to attack information, and the defense rule is an access rule for an external network to access the first subnet; and
sending, by the controller, the defense rule to a security device of the at least one second subnet, so that the security device of the at least one second subnet performs filtering on a data flow according to the defense rule;
receiving, by the controller, a first defense rule generated by the security device of the attacked subnet according to the attack information, and the first defense rule is an access rule for an external network to access the attacked subnet; and
sending, by the controller, the first defense rule to a security device of the second subnet, so that the security device of the second subnet performs, according to the first defense rule, filtering on a data flow that accesses the second subnet; and
generating, by the controller according to the feature information, a second defense rule, wherein the second defense rule is an access rule for an external network to access the attacked subnet or the second subnet; and
sending, by the controller, the second defense rule to the security device of the attacked subnet and a security device of the second subnet, so that the security device of the attacked and the security device of the second subnet performs filtering on a data flow according to the second defense rule.

5. A method for cooperative defense on a network, comprising:
receiving, by a security device of a first subnet, attack information;
generating, by the security device of the first subnet according to the attack information, a defense rule, wherein the defense rule is an access rule for an external network to access the first subnet; and
sending, by the security device of the first subnet, the defense rule to a controller;
sending, by the controller, the defense rule to a security device of at least one second subnet;
receiving, by the controller, a first defense rule generated by the security device of the attacked subnet according to the attack information, and the first defense rule is an access rule for an external network to access the attacked subnet; and
sending, by the controller, the first defense rule to a security device of the second subnet, so that the security device of the second subnet performs, according to the first defense rule, filtering on a data flow that accesses the second subnet; and
generating, by the controller according to the feature information, a second defense rule, wherein the second defense rule is an access rule for an external network to access the attacked subnet or the second subnet; and
sending, by the controller, the second defense rule to the security device of the attacked subnet and a security device of the second subnet, so that the security device of the attacked and the security device of the second subnet performs filtering on a data flow according to the second defense rule.

6. An apparatus for cooperative defense on a network, comprising:
a receiver, configured to receive alarm information sent by a security device of a first subnet, wherein the first subnet is being attacked, and the alarm information is a feature information of attack information;
a processor, configured to generate flow table information according to the feature information of the attack information, wherein the flow table information indicates the data flow corresponding to the flow table information belongs to the attack information; and
a transmitter, configured to forward the flow table information to a switching device of the first subnet and a switching device of at least one second subnet, so that the switching device of the first subnet and the switching device of the at least one second subnet perform filtering on a data flow according to the flow table information;
wherein the alarm information further comprises a first defense rule generated by the security device of the fir

Assignees

• Huawei Tech Co Ltd

Inventors

• Li Jinming
• Wang Donghui

Classifications

• H04L12/6418 Primary

  Hybrid transport · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title