Menya uburyo umuhuzabikorwa w’inzobere mu bijyanye n’itumanaho (Network Packet Broker) akoresha neza uburyo bwo kugenzura imiyoboro kuva ku mpera kugeza ku mpera, akavanaho aho abantu batabona amakuru, kandi agashimangira umutekano w’imiyoboro y’ubucuruzi binyuze mu guteranya amakuru, kuyakuraho, kuyakuraho no kuyahisha.
Mylinking ML-NPB-5690: 1.8Tbps 100G Network Packet Broker itanga uburyo bwose bwo kugaragara kuri interineti ku mutekano wa interineti w’ikigo cy’amakuru kigezweho
1. Intangiriro: Ikibazo cyo Kugaragara Gikomeje Kwiyongera mu Miyoboro y'Amasosiyete ya Gihanga
Impinduka mu buryo bw'ikoranabuhanga, imiterere y'ibicu bivanze, 10G/40G/100G yihuta cyane, hamwe n'urujya n'uruza rw'ubucuruzi rukwirakwira cyane byateje ibibazo bikomeye ku matsinda y'umutekano w'imiyoboro n'abakurikirana imiyoboro hirya no hino ku isi mu bigo by'amakuru. Amatsinda menshi y'ikoranabuhanga abanza kwishingikiriza ku mbuga zoroshye za SPAN cyangwa TAP zitagira urumuri kugira ngo zifate urujya n'uruza rw'abantu, nyamara ibi bikoresho by'ibanze ntibitanga uburyo bwo kureba bwizewe kandi budatakaza akazi ku mirimo igezweho.
Imbuga za SPAN zigabanya amapaki mu gihe cy’ubwiyongere bw’imihanda, ntizishobora gusuzuma imitwe y’imihanda nka VXLAN cyangwa GRE, ibikoresho by’umutekano w’amazi bifite amapaki abiri akoreshwa, kandi nta buryo bwo kugenzura amategeko y’abakoresha buhari. Uko ibitero bya interineti bigenda byihisha mu mapaki ya TLS ahishe n’imiyoboro y’amakuru y’iburasirazuba n’iburengerazuba, kugaragara neza kw’umuyoboro bitaramenyekana neza bihindura ingaruka zo kwangirika kw’amakuru, amakosa y’imikorere adahari, n’igenzura ry’amategeko ritaragenze neza.
Aha nihoUmuhuzabikorwa w'amapake y'umuyoboro (NPB)ihinduka urwego rw'ingenzi rw'ibikorwa remezo byo kugenzura imikorere y'ikigo. Nk'uko bisobanurwa n'ubuyobozi bwemewe bwa tekiniki bwa Mylinking, Network Packet Broker ni igikoresho cyihariye gishyirwa hagati ya TAPs za network, SPAN ports n'ibikoresho byo gusesengura biri inyuma, gifite inshingano zo gufata paki nta gihombo, gutunganya neza traffic, no gutanga neza amakuru ajyanye na IDS, NPM, APM, SIEM na sisitemu zo gushakisha amakuru.
Iyi blog isobanura neza ibisobanuro by'ingenzi, imikorere y'ingenzi, ikoreshwa ry'ibintu nyabyo, n'agaciro gashoboka mu bucuruzi bwo gushyiraho Network Packet Broker, hamwe n'ibitekerezo byihariye ku matsinda ya SecOps na NetOps bishyize imbere umutekano ukomeye w'umuyoboro no kugenzura umuyoboro mu buryo butagoramye.
2. Ibisobanuro by'ingenzi: Umuhuzabikorwa w'amapaketi y'umuyoboro ni iki?
Umuhuzabikorwa wa Network Packet akora nk'ihuriro ry'itumanaho rihuriweho ryihariye ku miyoboro yose igenzura imiyoboro. Imiterere yayo ibiri y'ibanze ishobora kuvugwa muri make mu buryo bworoshye:
Ukusanya amapaki n'ibicuruzwa: Ifata urujya n'uruza rw'itumanaho ruri mu murongo n'uruza rw'itumanaho rudapfusha ubusa paki, ihuza amakuru agabanyijemo ibice aturuka kuri swichi zikwirakwizwa, router, firewalls na optique TAPs.
Umucuruzi w'ibinyabiziga ufite ubwenge: Itunganya paki mbisi binyuze muri politiki yihutishwa na hardware kandi igatanga itsinda rikwiye ry'abakoresha amakuru ku bikoresho bikwiye by'umutekano no gukurikirana, ikuraho ubucucike bw'amakuru butari ngombwa n'icyuho cyo kugaragara.
Bitandukanye n'ibikoresho bigabanya amakuru bidakoresheje uburyo bwo gukoporora gusa urujya n'uruza rw'amakuru bidahinduwe, ikigo gishinzwe ikoranabuhanga rya Network Packet Brokers gihuza ubushobozi bwose bwo guhindura paki za L2-L7. Buri gikorwa cyo gutunganya gikora ku muvuduko w'umurongo, cyirinda inzitizi zo gukoresha amakuru nubwo haba hari umutwaro wa 100Gbps uhoraho. Ku bigo bivugurura ibikorwa remezo bya kera bya 1G/10G bigenzura imyenda ya 40G na 100G, NPB ikora neza yongera igihe cyo gukoresha ibikoresho by'umutekano bisanzwe bikoreshwa mu kwagura urujya n'uruza rw'amakuru nta gusimbuza ibikoresho bihenze.
3. Imirimo y'ingenzi y'umuhuza w'amapaketi y'itumanaho rigezweho
Agaciro k'umuhuza wa Network Packet w'umwuga gafite mu irushanwa riri mu byiciro byayo byuzuye by'uburyo bwo gutunganya amakuru, buri kimwe kigamije kongera imikorere myiza mu kugenzura umuyoboro no gukaza umutekano w'umuyoboro. Hasi aha hari ubushobozi bw'ingenzi bwemewe mu itsinda rya Mylinking rishinzwe gukora NPB:
Guteranya ibinyabiziga, gukopera no kuringaniza imizigo bishingiye kuri politiki
Ibi bikorwa by'ibanze bigize urufatiro rw'imikorere y'ubumwe mu kugenzura imiyoboro y'itumanaho:
○Guteranya amasoko menshi: Huza urujya n'uruza rw'abantu baturutse ku byambu byinshi bya SPAN bitandukanye na TAP z'urumuri mu muyoboro umwe uhuriweho, bikuraho uburyo bwo kubona ibintu mu buryo butari buri hagati y'imyenda myinshi y'amakuru ajyanye n'urumuri.
○Gukoporora hakoreshejwe imiyoboro myinshi: Kopisha urujya n'uruza rw'imodoka zinjira mu nzira nyinshi zo kugenzura aho zijya icyarimwe, bigatuma habaho kohereza amakuru ku buryo bwo gutahura ibitero, NPM y'imikorere n'ibikoresho byo kugenzura iyubahirizwa ry'amategeko hatabayeho gukoresha ibikoresho bya TAP by'inyongera.
○Kugenzura imizigo mu buryo bw'ubwenge: Gukwirakwiza 40G/100G yihuta cyane mu matsinda y'ibikoresho byo gusesengura 1G/10G byihuta cyane hakoreshejwe uburyo bwa L2-L7 bwo kumenya neza amakuru. Ibi birinda ibikoresho by'umutekano bya buri kimwe mu bikoresho byacyo gutakaza amafaranga menshi no gutakaza paki, bikongera inyungu ku ishoramari risanzwe rishinzwe kugenzura imiyoboro y'itumanaho.
Gukuraho Pake Idakenewe
Ibigo bikora inyubako za multi-switch mirroring architectures akenshi bitanga umubare munini w’amapaki asa n’aya aturutse ku ngingo zifata zihurirana. Izi paki zidafite akamaro zipfusha ubusa CPU, ububiko n’umutungo wo kubika ku bikoresho by’umutekano biri inyuma, bigatinda kubona ibitero no guhisha ibimenyetso by’ingenzi by’umuhanda.
Umuhuzabikorwa wa Network Packet akuramo paki ebyiri zishingiye ku mategeko ajyanye n'uburyo bwo kuzihuza (IP y'aho zikomoka, aho zijya, imibare ya TCP sequence n'ibindi). Abatanga serivisi z'imari n'ibicu bavuga ko ubwinshi bw'abagenda bagezwa ku mbuga zo kugenzura bwagabanutseho 40-60% nyuma yo gukoresha politiki yo kuzikoresha, binoza cyane uburyo ibikoresho by'umutekano w'umuyoboro byitabwaho mu gihe cy'umutwaro mwinshi.
Gukuraho Uburiganya bwa SSL bwihuta bwa Hardware kugira ngo hagaragare neza ikibazo kiri mu bubiko
Ibirenga 95% by'abakoresha interineti igezweho n'ibigo by'ubucuruzi banyura mu buryo bwo gukingira SSL/TLS, abatera ikoranabuhanga bakoresha kugira ngo bahishe malware, imikorere ya ransomware ku ruhande ndetse n'ibikorwa byo gusohora amakuru. Ibikoresho bisanzwe by'umutekano bitwara CPU iremereye iyo bihawe inshingano zo gukuraho uburinzi bw'amakuru menshi yashyizwe mu buryo bwo gukingira, bigatera kwangirika k'imikorere.
Ibikoresho by’ingenzi bya Network Packet Broker bikuramo decryption yuzuye ya SSL ku miyoboro yabigenewe ya hardware. Nyuma yo gushyira impapuro z’ubugenzuzi bw’ibigo, NPB ikuraho decryption ya HTTPS ku gipimo cy’umurongo hanyuma yohereza abantu banyura kuri platform za IDS na NDR. Iyi porogaramu y’ingenzi y’umutekano w’umuyoboro igaragaza decryption ihishe idasize inyuma uburyo bwo kugenzura cyangwa ngo itange igihombo cya packet.
Gupfuka amakuru kugira ngo habeho iyubahirizwa ry'amategeko agenga iyubahirizwa ry'amategeko
Uburyo bwo kubahiriza amategeko ku isi hose burimo PCI-DSS, HIPAA na GDPR butegeka ko amakuru y’ingenzi aranga umuntu ku giti cye acungwa, amakuru y’amakarita yo kwishyura n’amakuru y’ubuzima arinzwe (PHI). Uburyo bwo kugenzura amakuru butari bwatunganywa bwoherezwa ku bikoresho byo kugenzura amakuru ku bakozi batabifitiye uburenganzira n’abandi bantu, bigatera inshingano zikomeye zo kubahiriza amategeko.
Uburyo bwo gupfuka amakuru bwubatswe muri Network Packet Broker buhita busuzuma imitwaro y’amapaki kandi bukandika amashami y’ingenzi nka nimero z’amakarita y’inguzanyo, indangamuntu z’ubwishingizi bw’imibereho myiza n’inyandiko z’ubuvuzi bw’abarwayi zifite agaciro katahinduka mbere yo kohereza amakuru. Ubu buryo bwo gukumira ikoranabuhanga bukuraho gukenera ibikoresho bitandukanye byo gukaraba, bunoza imikorere y’inganda zigenzurwa.
Gukuraho umutwe w'umuhanda wo mu bwoko bwa Tunnel mu kugenzura ibinyabiziga bifunze
Ibigo bigezweho by’amakuru bya virtualization byishingikiriza cyane ku mikorere ya overlay tunneling irimo VXLAN, GRE, ERSPAN, MPLS na GTP kugira ngo bikora imyenda myinshi y’ibicu. Ibikoresho byinshi by’ibanze byo kugenzura ntibishobora gusuzuma imitwe y’ibice byo hanze by’ibice, bigatuma habaho ahantu hadasobanutse neza ku buryo ibitero by’uburasirazuba n’uburengerazuba bishyirwa mu byiciro bya virtualization.
Umuhuzabikorwa wa Network Packet akora igikorwa cyo gukuraho VLAN, VXLAN, L3VPN n'izindi tunnel wrappers, agaragaza ipaki y'umwimerere y'urwego rw'imbere kugira ngo ikore isesengura ryuzuye ry'umutekano. Ubu bushobozi ni ngombwa ku ngamba z'umutekano wa Zero Trust, zisaba igenzura ryuzuye rya buri ruziga ruhuza seriveri mu gice cy'amakuru.
Isesengura ry'Ubwenge n'Ibibazo bya Porogaramu ya L7
Abahuza ba Packet za Network zigezweho bahuza moteri zigenzura pakiti (DPI) zigaragaza amakuru arenze urwego rw'ubwikorezi rwa L2-L4 kugeza ku kumenya amakuru yose yerekeye urwego rw'ubwikorezi. Uru rubuga ruhita rugaragaza ibikumwe ku mabwiriza y'ibigo birimo HTTP, FTP, DNS, MySQL, BitTorrent na traffic ya cloud SaaS, bigatuma habaho amakuru menshi ajyanye n'imiterere y'urubuga no gukurikirana impanuka.
Amakipe ya SecOps akoresha ubu bushishozi bwa porogaramu kugira ngo amenye imyitwarire ishobora guteza akaga nko kohereza ububiko bw'amashusho y'igicucu cya IT, gusangira dosiye ku buryo butemewe n'abakora porogaramu ndetse n'ibitero bya malware. Amakuru ajyanye n'imiterere y'amapaki afasha amakipe y'umutekano kumenya ibimenyetso by'ubwumvikane (IOCs), kumenyekanisha aho igitero gituruka, no gukurikirana intambwe z'ibitero ku ruhande rw'umuyoboro wose.
4. Ibintu bibiri by'ingenzi byo gukoresha mu ikoreshwa ry'amakuru: Umutekano w'Umuyoboro n'igenzura ry'Umuyoboro
Gutahura ibibangamiye umutekano w'umuyoboro w'itumanaho no guhangana n'ibibazo
Ku matsinda ya SOC yibanda ku mutekano w'imiyoboro, Network Packet Broker ni urwego rw'ibanze rwo guhiga ibitero byizewe:
○Gukusanya amakuru yose yerekeye imipaka ya interineti hagati y’amajyaruguru n’amajyepfo kugira ngo harebwe abagerageza kwinjira hanze n’abashoramari ba DDoS.
○Gukuraho utubumbe twa VXLAN/GTP kugira ngo harebwe uko urusobe rw'amakuru rugenda hagati ya seriveri zisanzwe rugenda.
○Gukuraho uburiganya bwa SSL kugira ngo hagaragare malware zihishe mu biganiro by'ubucuruzi bya HTTPS bifitwe.
○Guhisha amakuru kugira ngo harebwe ko yubahirizwa mu gihe cyo kohereza inyandiko z'abakoresha ikoranabuhanga ku mbuga za interineti zisesengura ibitero by'abandi.
○Gukuraho no kuyungurura kugira ngo bigabanye urusaku, bigatuma abasesenguzi b'umutekano bashobora gushyira imbere ibitero bishobora gutera abantu benshi badakoresheje amakuru adafite ishingiro.
Hatabayeho ubushobozi bwa NPB bwo gutunganya amakuru mbere y’uko atangwa, ibikoresho bya IDS na NDR byakira amakuru atuzuye kandi yuzuye, bigatuma habaho amakosa atari yo, kutubahiriza amategeko no gutinda gutabara mu gihe cy’impanuka.
Gukurikirana no gukemura ibibazo by'imikorere y'umuyoboro kuva ku mpera kugeza ku mpera
Amakipe ya NetOps yishingikiriza kuri Network Packet Brokers kugira ngo batange amakuru yuzuye kandi adakoresha urusaku rwinshi yo kugenzura no gucunga imikorere ya porogaramu:
○Guhuza urujya n'uruza rw'abantu benshi kugira ngo ukurikirane ikoreshwa ry'umurongo w'itumanaho hagati y'ibikoresho bitandukanye no kumenya imbogamizi zo gutinda.
○100G yihuta cyane ihuza abantu benshi basura urubuga rwabo n'ibikoresho byo kugenzura imikorere ya 10G APM n'umuyoboro w'itumanaho.
○Koresha uburyo bwo gukata amapaki bushingiye kuri politiki kugira ngo ugabanye amakuru y'imizigo idakenewe, ugabanye ikiguzi cyo kubika no gukoresha interineti mu bubiko bw'igihe kirekire bw'abakoresha amakuru.
○Kora metadata isanzwe y'imigendekere y'amakuru (NetFlow / IPFIX) kugira ngo ugene ubushobozi, uburyo bw'ibanze bw'urujya n'uruza rw'abantu ndetse n'uburyo bwo gutanga amakuru adasanzwe mu gihe nyacyo.
○Subiramo inzira z'urujya n'uruza rw'abantu mu byiciro ukoresheje ibikoresho byihariye byo gukurikirana kugira ngo ubone uburyo butandukanye bwo gukoresha, gukoresha inzira no gusuzuma amakosa.
5. Inyungu z'ingenzi mu bucuruzi zo gukoresha umuhuzabikorwa wa Network Packet
○Kuraho ahantu hatagaragara neza ku miyoboro y'itumanaho: Gukuraho amakuru yose ajyanye n'urujya n'uruza rw'abantu mu buryo bwa "crypt" kugira ngo harebwe uburyo bwose bwo kuva mu majyaruguru kugera mu majyepfo no kuva mu burasirazuba kugera mu burengerazuba, biziba icyuho cy'umutekano cyatewe n'imiterere y'ikoranabuhanga rya SPAN gusa.
○Kongera ROI y'Igikoresho Gihari: Kugenzura imitwaro, gukuramo no kuyungurura birinda umutekano no kugenzura ibikoresho birengeje urugero, bigatinza kuvugurura ibikoresho bihenze ku bidukikije bya 100G byihuta cyane.
○Kongera Umutekano w'Umuyoboro w'Ikoranabuhanga: Gukuraho uburinzi bwa SSL mu bikoresho no gukuraho imiyoboro y'amashanyarazi bigaragaza ibitero byihishe byo kuri interineti, byihutisha uburyo bwo kubona ibitero no kugabanya igihe cyo gukemura ibibazo by'umutekano (MTTR).
○Koroshya iyubahirizwa ry'amategeko agenga iyubahirizwa ry'amategeko: Imikorere yo gupfuka amakuru karemano yujuje amategeko yo kurinda PII kuri PCI-DSS, HIPAA na GDPR nta bindi bikoresho byo gukaraba by’abandi.
○Uburyo bwo Gukata Imikorere Igoye: Gukusanya amakuru ajyanye n'ibinyabiziga bihuriweho bihuza uburyo bwinshi bwo gufata amakuru mu muyoboro umwe ucungwa, bigabanyiriza amafaranga yo kubungabunga buri munsi ya NOC na SOC.
6. Kubaka uburyo bwo kugaragara neza ukoresheje umuhuza w’ibicuruzwa by’inzobere mu bijyanye n’itumanaho
Uko umuvuduko wa interineti wiyongera ukagera kuri 100G kandi uburyo bwo gushakisha amakuru bugahinduka nk'uburyo busanzwe bwo gukora, imiterere y'ibanze ya SPAN na TAP zidafite aho zihuriye ntabwo bigishoboka gushyigikira ibisabwa bigezweho byo kurinda umutekano wa interineti no kugenzura interineti. Umuhuza ukomeye wa Network Packet atanga urwego rw'ingenzi rwo gutunganya amakuru akenewe kugira ngo afate, anonosore kandi akwirakwize amakuru adafite igihombo kuri buri gikoresho kiri mu bubiko bwawe bwo kureba.
Kuva kuri SSL decryption na tunnel header stripping kugeza kuri draduplication, gupfuka amakuru no kuringaniza load-aware, buri kintu cy'ingenzi cya Network Packet Broker cyagenewe gukemura ibibazo nyabyo bya SecOps na NetOps ku isi. Waba ukorera ikigo cy’amakuru cya hyperscale, ikigo cy’ibicu bivanze, cyangwa ibikorwa remezo by’imari/ubuvuzi bigenzurwa, gushyira hamwe NPB ikora neza ni bwo buryo buhendutse bwo kugera ku kugaragara neza kw’umuyoboro w’amakuru no gukomera k’umutekano w’umuyoboro w’amakuru.
Kugira ngo umenye urutonde rwuzuye rwa Mylinking rw'ibisubizo bya Network Packet Broker bya terabit-grade byagenewe kugenzura umuyoboro wa 10G/25G/40G/100G, sura urupapuro rwacu rwemewe rw'ikoranabuhanga:https://www.mylinking.com/mylinking-network-packet-brokernpb-ml-npb-5690-product/
Igihe cyo kohereza: 27 Nyakanga-2026
