WO2012142868A1

WO2012142868A1 - Method, system and device for monitoring network information

Info

Publication number: WO2012142868A1
Application number: PCT/CN2012/071314
Authority: WO
Inventors: 张延显; 于同泉
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-04-18
Filing date: 2012-02-20
Publication date: 2012-10-26
Also published as: CN102158362B; CN102158362A

Abstract

Disclosed are a method, system and device for monitoring network information. The method includes: establishing a monitoring LSP channel between a PE and a Monitor and configuring a policy route at an incoming interface thereof; the PE forwarding a suspicious message to the Monitor for detection via the monitoring LSP channel according to the configured policy route, and acting correspondingly according to the detection result fed back by the Monitor: switching to a normal LSP channel to forward the message when the detection result is that the detection is passed, otherwise, processing the message correspondingly according to a preset forwarding policy. In the present invention, the message forwarding is controlled by way of increasing monitoring channels and switching among different channels using the policy routing technology, realizing complete control and processing of harmful information during propagation.

Description

Method, system and device for realizing network information supervision

The present invention relates to the field of communications technologies, and in particular, to a method, system, and apparatus for implementing network information supervision. Background technique

With the rapid development of Internet services, various harmful information on the Internet is also increasingly rampant, and various operators are also required to shoulder the responsibility of network information supervision. For example, through the network anti-vice campaign in the past period of time, various domestic websites require real-name registration and management. This kind of supervision method is post-event supervision, it is unable to intervene in the information dissemination process, and the way to lease harmful information from overseas servers cannot be effectively supervised, so the overall effect is very limited. How to detect and filter in the process of harmful information transmission through network technology becomes an urgent problem to be solved. Summary of the invention

In view of the above analysis, the present invention is directed to a method, system and apparatus for implementing network information supervision to solve the problem that harmful information existing in the prior art is not effectively detected and filtered during propagation.

The object of the present invention is mainly achieved by the following technical solutions:

The present invention provides a method for implementing network information supervision, including:

Establishing and supervising the Label Switched Path (LSP) channel between the Carrier Edge Router (PE) and the Monitor (Monitor) and configuring policy routing on its own ingress interface;

The PE forwards the suspicious packets to the Monitor through the LSP through the LSP channel, and performs corresponding actions according to the detection result of the Monitor feedback. When the detection is passed, the packet is forwarded to the normal LSP channel, and the packet is processed according to a predetermined forwarding policy.

Further, after the establishing the LSP channel, the method further includes:

The PE sends a supervisory instance registration request to the Monitor through the supervisory LSP channel, and receives it.

After the instance feedback response of the Monitor feedback, a supervisory path is established between the PE and the Monitor.

Further, the suspicious packet is forwarded to the Monitor through the supervisory LSP channel, and the detection is:

A supervisory label is assigned to the supervisory path established between the PE and the monitor. After the PE sends the supervisory label to the outer forwarding label of the received suspicious packet, the PE forwards the monitor to the monitor for detection.

Further, the method further includes: after the policy route configured on the PE inbound interface is deleted, the PE sends a supervision instance revocation request, and after receiving the instance revocation response of the Monitor feedback, revoking the supervision established between the PE and the Monitor path.

The policy routing includes at least: a matching rule and a setting item forwarding entry. The present invention also provides a system for implementing network information supervision, including: an operator edge router (PE) and a supervisory router (Monitor), where

The PE is configured to establish a LSP channel with the Monitor and configure the policy route on the inbound interface. The policy is forwarded to the Monitor through the LSP through the LSP and the detection result is based on the feedback of the Monitor. Corresponding action: When the detection result is that the detection is passed, the packet is forwarded to the normal LSP channel to forward the packet, otherwise the packet is processed according to a predetermined forwarding policy;

The monitor is configured to detect a suspicious packet sent by the PE, and feed back the detection result to the PE.

The invention further provides an apparatus for implementing network information supervision, comprising:

a channel establishment and management module, configured to establish a supervisory LSP channel between the PE and the Monitor; a policy configuration module, configured to configure policy routing on the inbound interface of the PE;

The forwarding processing module is configured to forward the suspicious packet to the Monitor through the LSP channel according to the configured policy routing, and perform the corresponding action according to the detection result of the feedback: when the detection result is the detection, the switch is forwarded to the normal LSP channel. The packet is processed according to a predetermined forwarding policy.

Further, the device further includes:

The instance management module is configured to send a supervision instance registration request to the monitor through the supervisory LSP channel, and establish a supervision path between the PE and the monitor after receiving the instance registration response fed back by the monitor.

Further, the device further includes:

The label processing module is configured to allocate a supervised label to the supervised path established between the PE and the monitor, and put a supervised label on the outer forwarding label of the suspicious packet received by the PE, and the forwarding processing module forwards the label to the monitor through the supervising path. Detection.

Further, the instance management module is further configured to: after the policy route configured on the PE inbound interface is deleted, send a supervision instance revocation request to the Monitor through the supervised LSP channel, and after receiving the instance 4 response of the Monitor feedback, · The regulatory path established between 敦敦敦 and Monitor.

The beneficial effects of the present invention are as follows:

By adding a supervisory channel and using policy routing technology to switch between different channels, the invention realizes the control of message forwarding, and completely realizes the control and processing of harmful information in the process of propagation. DRAWINGS

1 is a schematic structural diagram of an example of networking in an embodiment of the present invention;

2 is a schematic flowchart of a method according to an embodiment of the present invention;

3 is a schematic structural diagram of a system according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an apparatus according to an embodiment of the present invention. detailed description

The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings in which FIG.

First, the method according to the embodiment of the present invention will be described in detail with reference to FIG. 1 and FIG. 2. For convenience of description, the method described in the embodiment of the present invention will be described in detail below by taking the networking shown in FIG. 1 as an example.

As shown in Figure 1, CE1 (User Border Equipment 1) and CE2 are on the same private network. A normal Label Switching Path (LSP) channel exists between PE1 (the carrier edge router 1) and PE2. In this network, you need to set up a Monitor (supervisor router). If you need to supervise the packets passing the PE1, you need to establish a supervised LSP channel between the Monitor and PE1. Similarly, if you need to supervise the packets passing the PE2. Then, a supervisory LSP channel needs to be established between Monitor and PE2.

As shown in FIG. 2, FIG. 2 is a schematic flowchart of a method according to an embodiment of the present invention. When a packet that passes through PE1 needs to be supervised, the method may include the following steps:

Step 201: Establish a supervisory LSP channel between PE1 and Monitor by running the supervisor enable command.

Step 202: Configure a policy route on the inbound interface of the PE1, where the policy route includes at least a Match rule and a Set entry forwarding entry, where the Match rule is used to filter the packets passing the PE1 to determine the need. Suspicious message detected; Set item forwarding entry is used to configure the supervision path;

Step 203: The PE sends a supervision instance registration request to the Monitor through the LSP channel, and after receiving the instance registration response fed back by the Monitor, the PE establishes a supervision path between the PE and the Monitor, and assigns a supervision label to the supervision path.

Step 204: When the packet from the CE1 passes the PE1, if the packet is determined to be a suspicious packet according to the policy route, the PE1 cuts the forwarding path of the suspicious packet from the normal forwarding LSP channel. Switch to the supervisory LSP channel, and use the policy label forwarding technology to put the outer forwarding label of the suspicious file on the regulatory label and send it to Monitor through the supervisory path for detection;

Step 205: When the Monitor receives the suspicious packet, the Monitor detects the packet and sends a response message to the PE1 to notify the PE1. The detection result may be the detection pass or the detection failure.

Step 206: The PE1 performs the corresponding action according to the received detection result: If the detection succeeds, the PE1 re-switches the forwarding path of the suspicious packet to the normal forwarding LSP channel. Otherwise, the packet is discarded according to the forwarding policy preconfigured by the user. It is handled by the text or other methods, and the specific processing method needs to be determined according to the requirements of the operator.

Next, the system described in the embodiment of the present invention will be described in detail.

As shown in FIG. 3, FIG. 3 is a schematic structural diagram of a system according to an embodiment of the present invention, which may include: a supervisory router (Monitor) and a PE, where

When a packet passing through a PE is to be supervised, the PE and the Monitor are configured to supervise the LSP and configure the policy route on the inbound interface of the PE. The policy is forwarded to the Monitor through the LSP. The detection is performed according to the detection result of the feedback from the monitor. If the detection succeeds, the packet is forwarded to the normal LSP channel to forward the packet, otherwise the packet is processed according to the predetermined forwarding policy. The Monitor detects the suspicious packets sent by the PE and feeds the detection results to the corresponding PEs.

Finally, the device according to the embodiment of the present invention is described in detail.

As shown in FIG. 4, FIG. 4 is a schematic structural diagram of a device according to an embodiment of the present invention. The device in the embodiment of the present invention may be configured in a PE, and specifically includes: a channel establishment and management module, a policy configuration module, and a forwarding processing module. , an instance management module, and a tag processing module, wherein

a channel management module, establishing a supervisory LSP channel between the PE and the monitor;

The policy configuration module configures a policy route on the inbound interface of the PE, where the policy route includes at least a Match rule and a Set entry forwarding entry, where the Match rule is used. The packets passing the PE1 are filtered to determine the suspicious packets that need to be detected. The Set entries are used to configure the supervised path.

The forwarding processing module forwards the suspicious packet to the Monitor through the LSP channel according to the configured policy routing, and performs the corresponding action according to the detection result of the feedback: If the detection succeeds, the packet is forwarded to the normal LSP channel, otherwise the packet is forwarded. The packet is processed correspondingly according to a predetermined forwarding policy.

The instance management module sends a supervisory instance registration request to the monitor through the supervisory LSP channel, and establishes a supervisory path between the PE and the monitor after receiving the instance registration response fed back by the monitor.

The label processing module assigns a supervisory label to the supervisory path established between the PE and the monitor, and puts a supervised label on the outer forwarding label of the suspicious packet received by the PE, and the forwarding processing module forwards the monitor to the monitor through the supervisory path for detection.

After the policy route configured on the inbound interface of the PE is deleted, the instance management module sends a supervisory instance pin request to the Monitor through the supervisory LSP channel, and after receiving the instance revocation response of the Monitor feedback, the relationship between the PE and the Monitor is established. Regulatory path.

It should be noted that the specific implementation process of the system and the device is described in detail in the above method, and therefore will not be described herein.

In summary, the embodiments of the present invention provide a method, a system, and a device for implementing network information supervision. The invention implements a policy of controlling the LSP channel and switching between the supervisory LSP channel and the normal LSP channel by using a policy routing technology. The control of message forwarding completely realizes the control and processing of harmful information in the process of dissemination; it is more effective than the existing post-event supervision methods and technologies, and the implementation method is also simpler, which can meet the deployment of the current network. need.

The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, this The scope of protection of the invention should be determined by the scope of the claims.

Claims

Claim

A method for implementing network information supervision, the method includes: the operator edge router PE establishes and supervises establishing a regulatory label switching path LSP channel between the routers and configuring a policy route on the inbound interface of the router;

The PE forwards the suspicious packet to the Monitor through the LSP through the LSP, and performs the corresponding action according to the detection result of the feedback. When the detection result is the detection, the switch forwards the packet to the normal LSP channel. Otherwise, the message is processed according to a predetermined forwarding policy.

The method according to claim 1, wherein after the establishing the RRC channel, the method further includes:

The PE sends a supervisory instance registration request to the Monitor through the LSP channel. After receiving the instance registration response from the Monitor, the PE establishes a supervisory path between the PE and the Monitor.

The method according to claim 2, wherein the suspicious message is forwarded to the monitor through the monitoring LSP channel, and the detection is:

4. The method according to claim 2 or 3, wherein the method further comprises:

After the policy route configured on the PE inbound interface is deleted, the PE sends a supervisory instance revocation request, and after receiving the instance 4 response from the Monitor feedback, the supervisory path established between the license and the monitor is established.

The method according to claim 1, wherein the policy routing includes at least: a matching rule and a setting item forwarding entry.

6. A system for implementing network information supervision, characterized in that it comprises: an operator edge Router PE and supervisor router Monitor, where

The PE is used to establish a RRC channel between the MPLS interface and the inbound interface of the device. The policy is configured to forward the spoofed packets to the Monitor through the LSP channel and detect it according to the Monitor. The detection result is performed correspondingly: when the detection result is that the detection is passed, the packet is switched to the normal LSP channel to forward the packet, otherwise the packet is processed according to a predetermined forwarding policy;

7. A device for implementing network information supervision, characterized in that:

a channel establishment and management module, configured to establish a supervisory LSP channel between the operator edge router PE and the supervisor router monitor;

a policy configuration module, configured to configure policy routing on the inbound interface of the PE;

The device according to claim 7, wherein the device further includes: an instance management module, configured to send a supervision instance registration request to the Monitor through the supervisory LSP channel, and after receiving the instance registration response of the Monitor feedback Establish a supervisory path between PE and Monitor.

The device according to claim 8, wherein the device further comprises: a label processing module, configured to allocate a supervision label to the supervision path established between the PE and the Monitor, and report the suspicious report received by the PE. The outer forwarding label of the text is marked with a supervision label, and the forwarding processing module forwards it to the Monitor through the supervision path for detection.

10. The apparatus according to claim 8 or 9, wherein the instance management module The block is also used to send a supervision instance t-pin request to the Monitor through the supervisory LSP channel after the policy route configured on the PE inbound interface is deleted, and after receiving the instance of the feedback from the monitor: the pin response, the PE and the Monitor are established. Regulatory path.