WO2014008664A1 - 深度报文检测的方法及装置 - Google Patents

深度报文检测的方法及装置 Download PDF

Info

Publication number
WO2014008664A1
WO2014008664A1 PCT/CN2012/078618 CN2012078618W WO2014008664A1 WO 2014008664 A1 WO2014008664 A1 WO 2014008664A1 CN 2012078618 W CN2012078618 W CN 2012078618W WO 2014008664 A1 WO2014008664 A1 WO 2014008664A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
detection
module
built
external
Prior art date
Application number
PCT/CN2012/078618
Other languages
English (en)
French (fr)
Inventor
倪慧
胡伟华
谭仕勇
蔡慧
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201280001010.6A priority Critical patent/CN103718513B/zh
Priority to PCT/CN2012/078618 priority patent/WO2014008664A1/zh
Publication of WO2014008664A1 publication Critical patent/WO2014008664A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/50—Testing arrangements

Definitions

  • the present application relates to the field of internet technologies, and in particular, to a method and device for performing deep packet inspection.
  • Control Protocol/Internet Protocol In the upper layer network of the protocol, the TCP/IP protocol, but the operator cannot directly perceive these applications, causing the carrier network to gradually become pipelined, which makes the service difficult to manage, cannot achieve content charging, and cannot meet the information security requirements.
  • DPI deep packet inspection
  • Packet Inspection technology to improve the network's perception of message application information.
  • Deep packet inspection is a technique that is relatively common in packet analysis.
  • the normal packet detection only analyzes the content of the IP packet application layer.
  • the data packet is received according to the quintuple information (including the source address, the destination address, the source port, the destination port, and the protocol type) of the received IP packet.
  • Perform classification processing The DPI performs deeper detection on the packet, including performing application layer analysis or traffic feature detection on the packet, identifying the application layer service type corresponding to the packet, and/or extracting key information of the application layer therein. Subsequent business processing.
  • DPI is the basis for implementing application-based service management in carrier networks.
  • Various DPI devices have been deployed on a large scale in carrier networks. Due to the lack of standardization, today's DPI devices are customized devices that are deployed by various vendors according to the needs of operators.
  • the implementation of DPI functions basically adopts two methods:
  • Built-in DPI provides DPI processing by means of software or hardware acceleration inside the network element.
  • the network element service GPRS support node responsible for message forwarding (Serving) GPRS Support Node (SGSN), Gateway GPRS Support Node (GGSN), Serving Gateway (Serving) Gateway, Serving-GW), Packet Data Network Gateway Gateway, PDN-GW), Network Access Service Gateway (Access Service Networks) Gateway, ASN-GW) or fixed network network element broadband remote access service device (Broadband Remote Access) Servers, BRASs, routers, firewalls, and other physical network elements provide DPI capabilities for the network element through software modules or dedicated hardware boards.
  • GPRS support node responsible for message forwarding (Serving) GPRS Support Node (SGSN), Gateway GPRS Support Node (GGSN), Serving Gateway (Serving) Gateway, Serving-GW), Packet Data Network Gateway Gateway, PDN-GW), Network Access Service Gateway (Access Service Networks) Gateway, ASN-GW) or fixed network network element broadband remote access service device (Broadband Remote Access)
  • the external DPI solution provides DPI services for other network elements through an external DPI module, and uses an external message interface to implement DPI function calls with other network elements.
  • the inventor of the present application found in the long-term research and development that the implementation of the built-in DPI and the external DPI alone will result in a decrease in the overall forwarding performance of the network.
  • the present application provides a method for performing deep packet inspection and an apparatus embodiment thereof, which can improve maintainability and forwarding performance of the entire network.
  • An aspect of the present application is to provide a method for performing deep packet inspection, the method comprising: receiving a deep packet detection request, where the deep packet detection request is used to request deep packet detection of a packet; Determining the characteristics of the packet and the first condition for performing the built-in deep packet detection and the external depth packet detection, determining whether to perform the built-in deep packet detection or performing the external depth packet detection; if it is determined to perform the built-in depth packet Detecting, informing the built-in deep packet detecting module to detect the packet, and obtaining the detection report of the packet; or, if it is determined to perform the external deep packet detection, notifying the external deep packet detecting module to the report The document is tested to obtain a test report of the message.
  • Another aspect of the present application is to provide an apparatus for performing deep packet detection, where the apparatus includes: a receiving module, configured to receive a deep packet detection request, where the deep packet detection request is used to request an in-depth report on the packet And a determining module, configured to determine, according to the feature of the packet, the first condition of performing built-in deep packet detection and external depth packet detection, performing built-in deep packet detection or performing an external depth report. a detection report obtaining module, configured to notify the built-in deep packet detection module to detect the packet when the built-in deep packet detection is performed, to obtain a detection report of the packet; or, When the deep packet is detected, the external deep packet detecting module is notified to detect the packet, and the detection report of the packet is obtained.
  • a receiving module configured to receive a deep packet detection request, where the deep packet detection request is used to request an in-depth report on the packet
  • a determining module configured to determine, according to the feature of the packet, the first condition of performing built-in deep packet detection and external depth packet detection, performing
  • the foregoing technical solution determines that the built-in deep packet detection is performed according to the characteristics of the packet and the first condition of the built-in deep packet detection and the external deep packet detection.
  • the external deep packet inspection is performed, and the built-in deep packet detection module is configured to perform built-in deep packet detection on the packet or notify the external deep packet detection module to perform external deep packet detection on the packet according to the result of the judgment.
  • the built-in deep packet detection and the external deep packet detection can effectively implement the service sharing and collaboration, and complete the detection of the packet, without the need for frequent deep packet detection function upgrade.
  • the fast response of the deep packet detection capability while reducing the impact of the built-in deep packet detection on the computing power of the network element, and controlling the data traffic sent to the external deep packet detection, thereby improving the maintainability of the network element and Forwarding performance.
  • FIG. 1 is a flowchart of a method for performing deep packet inspection in an embodiment of the present application
  • FIG. 2 is another flowchart of a method for performing deep packet inspection according to an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of an apparatus for performing deep packet inspection according to an embodiment of the present application.
  • FIG. 4 is another schematic structural diagram of an apparatus for performing deep packet inspection according to an embodiment of the present application.
  • FIG. 5 is a flowchart of an implementation of an apparatus for performing deep packet inspection according to an embodiment of the present application
  • FIG. 6 is a flowchart of another implementation of an apparatus for performing deep packet detection according to an embodiment of the present application.
  • FIG. 7 is a flowchart of still another implementation of an apparatus for performing deep packet detection according to an embodiment of the present application.
  • FIG. 8 is a flowchart of still another implementation of an apparatus for performing deep packet detection according to an embodiment of the present application.
  • FIG. 9 is a flowchart of still another implementation of an apparatus for performing deep packet detection according to an embodiment of the present application.
  • FIG. 10 is a flowchart of still another implementation of an apparatus for performing deep packet detection according to an embodiment of the present application.
  • FIG. 1 is a flowchart of a method for performing deep packet detection according to an embodiment of the present application, where the method includes:
  • Step S101 Receive a deep packet detection request, where the deep packet detection request is used to request deep packet detection on the packet;
  • Deep packet inspection is a technique that is relatively common in packet analysis.
  • the normal packet detection only analyzes the content of the IP packet application layer, such as the quintuple information (including the source address, destination address, source port, destination port, and protocol type) of the received IP packet.
  • Perform classification processing The DPI performs deeper detection on the packet, including performing application layer analysis or traffic feature detection, identifying the application layer service type corresponding to the packet, and/or extracting the application layer key information. For subsequent business processing.
  • DPI is a relatively broad concept.
  • traffic-based feature detection techniques for packets are also referred to as flow feature-based detection (DFI, Deep Flow). Inspection ).
  • DFI flow feature-based detection
  • the identification and/or resolution technology of the above information based on the TCP/IP layer of the IP packet and the DFI technology are collectively referred to as DPI technology.
  • Terms such as message detection, recognition, and parsing used in this application have the same meaning as DPI.
  • Step S102 Determine, according to the feature of the packet, the first condition for performing the built-in deep packet detection and the external deep packet detection, to perform the built-in deep packet detection or the external deep packet detection;
  • the first condition of the built-in deep packet detection and the external deep packet detection is associated with the characteristics of the packet, and the built-in deep packet detection and the external depth packet are performed according to the characteristics of the packet to be detected and the set.
  • the first condition of the detection may determine whether the built-in deep packet detection or the external deep packet detection is performed on the packet to be detected.
  • Step S103 If it is determined that the built-in deep packet detection is performed, the built-in deep packet detection module is configured to detect the packet to obtain a detection report of the packet; or, if it is determined to perform an external deep packet inspection, notify the notification The deep packet detection module detects the packet and obtains a detection report of the packet.
  • the packet is sent to the built-in deep packet detection module, and the built-in deep packet detection module is configured to detect the packet, and obtain a built-in deep packet detection module. If the result of the determination is that the external deep packet inspection is performed, the packet is sent to the external deep packet detection module, and the external deep packet detection module is notified to the The packet is detected, and the detection report after the external depth packet detecting module detects the packet is obtained.
  • the built-in deep packet detection module notifies the built-in deep packet detection of the packet or notifies the external deep packet detection module to detect the external deep packet of the packet, and obtains the detection report of the packet.
  • the built-in deep packet detection and the external deep packet detection can effectively implement the service sharing and collaboration, and complete the detection of the packet, without the need for frequent deep packet detection function upgrade.
  • the fast response of the deep packet detection capability while reducing the impact of the built-in deep packet detection on the computing power of the network element, and controlling the data traffic sent to the external deep packet detection, thereby improving the maintainability of the network element and Forwarding performance.
  • FIG. 2 is another flowchart of a method for performing deep packet detection in the embodiment of the present application.
  • an execution subject of deep packet detection is a deep packet detecting apparatus. The process includes:
  • Step S201 Setting a first condition for performing built-in deep packet detection and external depth packet detection
  • Step S202 Set a second condition for performing built-in deep packet detection and external depth packet detection
  • the first condition for performing the built-in deep packet inspection and the external deep packet inspection includes: user level, device level, service flow level, packet delay, packet protocol type, packet difficulty level, and built-in depth. At least one of the detection capability of the packet detection module or the detection capability of the external depth packet detection module determines whether the built-in deep packet detection or the external depth packet detection is performed.
  • the second condition of the built-in deep packet inspection and the external deep packet detection includes: user level, device level, service flow level, packet delay, packet protocol type, packet difficulty level, and built-in depth packet. At least one of the detection capability of the detection module or the detection capability of the external depth packet detection module determines whether the built-in deep packet detection or the external depth packet detection is performed.
  • the device level According to the user level, the device level, the service flow level, the packet delay, the packet protocol type, the difficulty of the packet, the detection capability of the built-in deep packet detection module, and the detection capability of the external deep packet detection module. One of them, two of them, three or more of them are determined to perform built-in deep packet detection or external depth packet detection.
  • the set granularity of the first or second condition described above may be arbitrarily combined.
  • Example for setting the granularity according to the first condition You can set the built-in deep packet detection for the packets with the higher user level, and the external deep packet detection for the lower-level packets. The packets with the large traffic are inspected by the built-in deep packets.
  • the packets with lower user levels and smaller service traffic are detected by external deep packets.
  • the built-in deep packet detection is performed on the HTTP packet on the PDN-GW, and the other protocol packets on the PDN-GW or all the protocol packets on the Serving-GW are detected by the external deep packet; or the protocol is stable.
  • a packet with a simple analysis and a high delay is used to detect the built-in deep packet.
  • the packets with frequent protocol changes, complex resolution, and low latency are used for external deep packet inspection.
  • step S201 may or may not be performed according to actual conditions in the application.
  • step S201 and step S202 may be performed by a setting module in the depth message detecting device.
  • Step S203 requesting deep packet detection on the packet; step S203 may be performed by the request module in the deep packet detection device.
  • Step S204 Receive a deep packet detection request; step S204 may be performed by a receiving module in the deep packet detecting apparatus.
  • Deep packet inspection is a deeper detection of the packet, including application layer analysis or traffic feature detection, identifying the application layer service type corresponding to the packet, and/or extracting the application layer key. Information is used for subsequent business processing.
  • Step S205 Determine, according to the feature of the packet, the first condition that the built-in deep packet detection and the external depth packet detection are performed, to perform built-in deep packet detection or perform external depth packet detection; Step S205 It may be performed by a judging module in the deep message detecting device.
  • the packet characteristics may include a packet port number, a general routing encapsulation key field (GRE key), and an Internet Protocol version 6 flow label (IPv6).
  • IPv6 Internet Protocol version 6 flow label
  • Flow At least one of a differential service code point (DSCP code), an Internet Protocol (IP) destination address, or a message behavior feature.
  • DSCP code differential service code point
  • IP Internet Protocol
  • the packet whose port number is 80 or 8080 is initially determined to be the HTTP protocol. According to the first condition of the built-in deep packet detection and the external deep packet detection, it is determined whether the protocol packet can be detected by the built-in deep packet detection module.
  • the message GRE Key determines whether the packet can be detected by the external deep packet detection module; according to the IPv6 Flow of the packet
  • the label is used to determine whether the packet can be detected by the built-in deep packet detection module.
  • the differential service code point indicates that the packet with the higher forwarding priority is detected by the built-in deep packet detection module. Otherwise, the external deep packet detection module performs the detection. Detection.
  • Step S206 If it is determined that the built-in deep packet detection is performed, the built-in deep packet detection module is configured to detect the packet, obtain a detection report of the packet, and if it is determined to perform external depth packet detection, notify the external depth.
  • the packet detecting module detects the packet and obtains the detection report of the packet. If it is determined that the built-in deep packet detection is performed, the process proceeds to step S206a. If it is determined that the external deep packet detection is performed, the process proceeds to step S206f. Step S206 may be performed by the detection report obtaining module in the depth message detecting device.
  • the test report of the message is a final test report or an intermediate test report.
  • the step S206 specifically includes the following content:
  • Step S206a If it is determined that the built-in deep packet detection is performed, the packet to be detected is sent to the built-in deep packet detecting module; and the step S206a may be performed by the first sending unit of the detection report obtaining module in the deep packet detecting device.
  • Step S206b Receive a detection report that the built-in depth packet detection module detects the message; if step S202 is performed, the process proceeds to step S206c, and if step S202 is not performed, the process proceeds to step S207.
  • Step S206b may be performed by the first receiving unit of the detection report obtaining module in the depth message detecting device.
  • Step S206c Determine, according to the detection report of the packet, that the detection of the packet by the built-in deep packet detecting module fails; the step S206c may be performed by the first determining unit of the detection report obtaining module in the deep packet detecting device.
  • Step S206d Determine, according to the second condition that the built-in deep packet detection and the external depth packet detection are performed, to perform external depth packet detection on the packet, and step S206d may be detected in the deep packet detection device.
  • the second determining unit of the report obtaining module executes.
  • the second condition of the built-in deep packet detection and the external deep packet detection may be determined to perform external deep packet inspection on the packet.
  • Step S206e The external depth packet detecting module is notified to re-detect the packet to obtain a detection report of the packet. Step S206e may be performed by the detection report obtaining unit of the detection report obtaining module in the depth message detecting device.
  • the step S206e specifically includes:
  • Step S206e1 Send the message to be re-detected to the external depth packet detecting module; step S206e1 may be the sending circuit execution of the detection report obtaining unit of the detection report obtaining module in the deep packet detecting device.
  • the S206e1 includes: sending the re-detected packet, the indication that the built-in deep packet detection module fails to be detected, or the detection result of the built-in deep packet detection module to the external deep packet detection module.
  • Step S206e2 Receive a detection report after the re-detected packet is re-detected by the external depth packet detecting module.
  • Step S206e2 may be performed by a receiving circuit of the detection report obtaining unit of the detection report obtaining module in the depth message detecting device.
  • Step S206f If it is determined that the external deep packet inspection is performed, the packet to be detected is sent to the external deep packet detection module; and the step S206f may be performed by the second sending unit of the detection report obtaining module in the deep packet detection device.
  • Step S206g Receive a detection report after the external depth packet detecting module detects the packet.
  • Step S206g may be performed by a second receiving unit of the detection report obtaining module in the depth message detecting device.
  • Step S207 Perform service control on the packet according to the detection report of the packet. Step S207 may be performed by the control module in the deep message detecting device.
  • Service control includes but is not limited to: control of at least one of forwarding (such as selecting different routes, multicast, broadcast, etc.), charging, lawful interception, quality of service control, gating, priority control, redirection, or message enhancement.
  • the service quality control includes bandwidth control, service priority control, and forwarding delay control.
  • an algorithm such as a token bucket is used in the forwarding process to perform specific bandwidth guarantee on the user's service flow, and the gating includes User service packets are passed or discarded.
  • the built-in deep packet detection module notifies the built-in deep packet detection of the packet or notifies the external deep packet detection module to detect the external deep packet of the packet, and obtains the detection report of the packet.
  • the built-in deep packet detection and the external deep packet detection can effectively implement the service sharing and collaboration, and complete the detection of the packet, without the need for frequent deep packet detection function upgrade.
  • the fast response of the deep packet detection capability while reducing the impact of the built-in deep packet detection on the computing power of the network element, and controlling the data traffic sent to the external deep packet detection, thereby improving the maintainability of the network element and Forwarding performance.
  • FIG. 3 is a schematic structural diagram of an apparatus for performing deep packet detection according to an embodiment of the present application.
  • the apparatus includes: a receiving module 301, a determining module 302, and a detection report obtaining module 303.
  • the receiving module 301 is configured to receive a deep packet detection request, where the deep packet detection request is used to request deep packet detection on the packet;
  • the DPI is to perform deeper detection on the packet, including performing application layer analysis or traffic feature detection on the packet, identifying the application layer service type corresponding to the packet, and/or extracting key information of the application layer therein. Subsequent business processing.
  • the determining module 302 is configured to determine, according to the feature of the packet, the first condition that the built-in deep packet detection and the external depth packet detection are performed, to perform built-in deep packet detection or perform external depth packet detection;
  • the first condition of the built-in deep packet detection and the external deep packet detection is associated with the characteristics of the packet, and the built-in deep packet detection and the external depth packet are performed according to the characteristics of the packet to be detected and the set.
  • the first condition of the detection may determine whether the built-in deep packet detection or the external deep packet detection is performed on the packet to be detected.
  • the detection report obtaining module 303 is configured to notify the built-in deep packet detecting module to detect the packet when the built-in deep packet detection is performed, to obtain the detection report of the packet, or to determine the external depth report. During the text detection, the external depth packet detecting module is notified to detect the packet, and the detection report of the packet is obtained.
  • the packet is sent to the built-in deep packet detection module, and the built-in deep packet detection module is configured to detect the packet, and obtain a built-in deep packet detection module. If the result of the determination is that the external deep packet inspection is performed, the packet is sent to the external deep packet detection module, and the external deep packet detection module is notified to the The packet is detected, and the detection report after the external depth packet detecting module detects the packet is obtained.
  • the embodiment of the present application determines whether the built-in deep packet detection or the external deep packet detection is performed according to the characteristics of the packet and the conditions of the built-in deep packet detection and the external deep packet detection. After the packet is detected, a test report of the packet is obtained.
  • the internal and external deep packet detection can effectively perform service sharing and collaboration, and complete the detection of the packet.
  • the deep packet detection capability can be quickly implemented without the need for frequent deep packet inspection.
  • the responsiveness and the effect of the built-in deep packet detection on the computing power of the network element are also controlled, and the data traffic sent to the external deep packet detection is also controlled, thereby improving the maintainability and forwarding performance of the network element.
  • FIG. 4 is another schematic structural diagram of an apparatus for performing deep packet detection according to an embodiment of the present application.
  • the apparatus includes: a first setting module 401, a second setting module 402, a requesting module 403, a receiving module 404, and a determining The module 405, the test report obtaining module 406, the control module 407, and the built-in depth message detecting module 408.
  • the external depth message detecting module 409 is also shown together.
  • the first setting module 401 is configured to set a first condition for performing built-in depth packet detection and external depth packet detection;
  • the second setting module 402 is configured to set a second condition for performing built-in depth packet detection and external depth packet detection.
  • the first condition for performing the built-in deep packet inspection and the external deep packet inspection includes: user level, device level, service flow level, packet delay, packet protocol type, packet difficulty level, and built-in depth. At least one of the detection capability of the packet detection module 408 or the detection capability of the external depth packet detection module 409 determines to perform built-in deep packet detection or external depth packet detection.
  • the second condition of the built-in deep packet inspection and the external deep packet detection includes: user level, device level, service flow level, packet delay, packet protocol type, packet difficulty level, and built-in depth packet. At least one of the detection capability of the detection module or the detection capability of the external depth packet detection module determines whether the built-in deep packet detection or the external depth packet detection is performed.
  • the detection capability of the built-in deep packet detection module 408 and the detection capability of the external depth packet detection module 409 can be determined according to the user level, the device level, the service flow level, the packet delay, the packet protocol type, the packet difficulty level, the built-in depth packet detection module 408. One of the two, two of them, or three or more of them are determined to perform built-in deep packet detection or external depth packet detection.
  • the requesting module 403 is configured to request to perform deep packet inspection on the packet.
  • the receiving module 404 is configured to receive a deep packet detection request.
  • the determining module 405 is configured to determine, according to the feature of the packet, the first condition that the built-in deep packet detection and the external deep packet detection are performed, to perform built-in deep packet detection or perform external depth packet detection;
  • the message feature may include at least one of a message port number, a universal route encapsulation key field, an Internet Protocol Protocol version 6 flow tag, a differential service code point, an Internet protocol destination address, or a message behavior feature.
  • the detection report obtaining module 406 is configured to notify the built-in deep packet detection module 408 to detect the packet when the built-in deep packet detection is performed, obtain a detection report of the packet, and determine to perform an external depth packet.
  • the external depth packet detecting module 409 is configured to detect the packet and obtain a detection report of the packet.
  • the test report of the message is a final test report or an intermediate test report.
  • the detection report obtaining module 406 includes: a first sending unit 4061, a first receiving unit 4062, a first determining unit 4063, a second determining unit 4064, a detection report obtaining unit 4065, a second sending unit 4066, and a second receiving unit 4067. .
  • the first sending unit 4061 is configured to send the to-be-detected packet to the built-in deep packet detecting module 408 when determining to perform the built-in deep packet detection;
  • the first receiving unit 4062 is configured to receive a detection report after the built-in deep packet detecting module 408 detects the packet.
  • the first determining unit 4063 is configured to determine, according to the detection report of the packet, that the detection of the packet by the built-in deep packet detecting module 408 fails;
  • the second determining unit 4064 is configured to determine, according to the set second condition that the built-in depth packet detection and the external depth packet detection are performed, to perform external depth packet detection on the packet.
  • the detection report obtaining unit 4065 is configured to notify the external depth packet detecting module 409 to re-detect the packet to obtain a detection report of the packet.
  • the detection report obtaining unit 4065 includes: a transmitting circuit and a receiving circuit.
  • the sending circuit is configured to send the packet to be re-detected to the external depth packet detecting module 409;
  • the sending circuit is configured to send the packet to be re-detected, and the indication that the built-in deep packet detecting module 408 detects the failure or the detection result of the built-in deep packet detecting module 408 to the external deep packet detecting.
  • Module 409
  • the receiving circuit is configured to receive the detection report after the re-detected packet is re-detected by the external depth packet detecting module 409.
  • the second sending unit 4066 is configured to send the to-be-detected message to the external depth packet detecting module 409 when determining the external depth packet detection;
  • the second receiving unit 4067 is configured to receive a detection report after the external depth packet detecting module 409 detects the packet.
  • the control module 407 is configured to perform service control on the packet according to the detection report of the packet.
  • the service control includes, but is not limited to, control of at least one of forwarding, charging, lawful interception, quality of service control, gating, priority control, redirection, or message enhancement.
  • the first setting module 401 or the first setting module 401 and the second setting module 402 and the requesting module 403, the receiving module 404, the determining module 405, the detection report obtaining module 406, the built-in depth packet detecting module 408, and the external depth report At least one of the text detection modules 409 is integrally formed.
  • the at least two of the requesting module 403, the receiving module 404, the determining module 405, the detection report obtaining module 406, and the built-in depth packet detecting module 408 are integrally formed.
  • the request module 403, the receiving module 404, the determining module 405, the detection report obtaining module 406, and the built-in deep packet detecting module 408 are internal modules of the device, and the operations between the internal modules are implemented by internal message interaction or internal function calling. .
  • the following describes the first setting module 401 or the first setting module 401 and the second setting module 402 and the requesting module 403, the receiving module 404, the determining module 405, the detection report obtaining module 406, the built-in depth packet detecting module 408, and the external depth.
  • At least one of the message detection modules is integrally formed, and at least two of the request module 403, the receiving module 404, the determination module 405, the detection report obtaining module 406, and the built-in depth message detecting module 408 are integrally formed.
  • FIG. 5 is a flowchart of an implementation of an apparatus for performing deep packet detection in an embodiment of the present application.
  • This embodiment describes a specific implementation method for implementing internal and external DPI collaboration in a gateway device, and preliminary protocol type identification is performed according to a destination port number.
  • the DPI interface module 502 acquires, from the DPI management network element 503, a first condition for performing built-in deep packet detection and external depth packet detection.
  • the first setting module 401 and the DPI management network element in FIG. 4 are integrally formed into a DPI management network element 503.
  • the receiving module 404, the determining module 405, and the detection report obtaining module 406 in FIG. 4 are integrally formed into a DPI interface module 502.
  • the implementation process includes:
  • the DPI interface module 502 obtains internal and external DPI selection conditions from the DPI management network element 503. For example, the HTTP protocol is detected by the built-in DPI module 504, and the remaining protocols are detected by the external DPI module 505.
  • the DPI requesting module 501 sends a message detection request to the DPI interface module 502, where the memory pointer of the to-be-detected message is included;
  • the DPI interface module 502 initially determines the protocol type according to the destination port number of the packet. For example, the packet whose destination port is 80 or 8080 is initially determined to be the HTTP protocol, and is based on the detection of the built-in deep packet detection and the external depth packet detection. Condition, determining whether the protocol message can be detected by the built-in DPI module 504;
  • step 3 If it is determined in step 3 that the built-in DPI module 504 detects, the DPI interface module 502 sends the to-be-detected message pointer to the built-in DPI module 504 through the built-in DPI request for protocol identification and detection;
  • the built-in DPI module 504 detects the packet according to the HTTP protocol, and returns the packet detection result to the DPI interface module 502;
  • the DPI interface module 502 sends the to-be-detected message to the external DPI module 505 through the external DPI request message for protocol identification and detection, optionally at the same time.
  • DPI context information such as associated messages
  • the external DPI module 505 performs protocol identification and detection on the packet, and returns the packet detection result to the DPI interface module 502.
  • the DPI interface module 502 sends the packet detection result obtained from the built-in or external DPI module to the DPI request module 501;
  • the DPI requesting network element (corresponding to the control module 407 in FIG. 4) performs service control operations, such as QoS control, charging, caching, and redirection, on the packet.
  • the operation between the internal modules of the DPI requesting network element may be implemented by using an internal message interaction or an internal function call.
  • the implementation of the inter-module operation in the subsequent embodiments is similar to the embodiment. Narration.
  • the built-in deep packet detection module notifies the built-in deep packet detection of the packet or notifies the external deep packet detection module to detect the external deep packet of the packet, and obtains the detection report of the packet.
  • the built-in deep packet detection and the external deep packet detection can effectively implement the service sharing and collaboration, and complete the detection of the packet, without the need for frequent deep packet detection function upgrade.
  • the fast response of the deep packet detection capability while reducing the impact of the built-in deep packet detection on the computing power of the network element, and controlling the data traffic sent to the external deep packet detection, thereby improving the maintainability of the network element and Forwarding performance.
  • FIG. 6 is a flowchart of another implementation of an apparatus for performing deep packet detection in an embodiment of the present application.
  • This embodiment describes a specific implementation method for implementing internal and external DPI coordination in a forwarding device, and performs built-in deep packet detection and external
  • the first condition and the second condition of the deep packet detection are performed according to the destination port number, and the DPI interface module 602 obtains the first condition and the second condition for performing the internal and external DPI from the DPI management network element 603.
  • the first setting module 401, the second setting module 402 and the DPI management network element in FIG. 4 are integrally formed into a DPI management network element 603, and the receiving module 404, the determining module 405 and the detection report obtaining module 406 in FIG. It is a DPI interface module 602.
  • the implementation process includes:
  • the DPI interface module 602 obtains the first condition for performing the internal and external DPI from the DPI management network element 603. For example, the FTP/DNS protocol is detected by the built-in DPI module 604, and the remaining protocols are detected by the external DPI module 605.
  • the DPI requesting module 601 sends a message detection request to the DPI interface module 602, where the memory pointer of the to-be-detected message is included;
  • the DPI interface module 602 initially determines the protocol type according to the destination port number of the packet. For example, the packet whose target port is 21/22 or 53 is initially determined to be an FTP/DNS protocol, and the protocol is determined according to the first condition of the internal and external DPI. Whether the message can be detected by the built-in DPI module 604;
  • step 3 If the determination in step 3 is detected by the built-in DPI module 604, the DPI interface module 602 sends the to-be-detected message pointer to the built-in DPI module 604 through the built-in DPI request for protocol identification and detection;
  • the built-in DPI module 604 detects the packet according to the FTP/DNS protocol. If the packet is not the protocol packet, the detection fails. The built-in DPI module 604 returns the packet detection response to the DPI interface module 602, which includes Detection failure indication;
  • the DPI interface module 602 determines that the packet can be further detected by the external DPI module 605 according to the second condition of the internal and external DPI, and the DPI interface module 602 sends the to-be-detected message to the external device through the external DPI request message.
  • the DPI module 605 performs protocol identification and detection, and optionally includes a built-in DPI detection failure indication in the message at the same time;
  • the external DPI module 605 performs protocol identification and detection on the packet, and returns the packet identification detection result to the DPI interface module 602;
  • the DPI interface module 602 sends the packet detection result obtained by the external DPI module 605 to the DPI request module 601;
  • the DPI requesting network element (corresponding to the control module 407 in FIG. 4) performs service control operations, such as QoS control, charging, caching, and redirection, on the packet.
  • the built-in deep packet detection module notifies the built-in deep packet detection of the packet or notifies the external deep packet detection module to detect the external deep packet of the packet, and obtains the detection report of the packet.
  • the built-in deep packet detection and the external deep packet detection can effectively implement the service sharing and collaboration, and complete the detection of the packet, without the need for frequent deep packet detection function upgrade.
  • the fast response of the deep packet detection capability while reducing the impact of the built-in deep packet detection on the computing power of the network element, and controlling the data traffic sent to the external deep packet detection, thereby improving the maintainability of the network element and Forwarding performance.
  • FIG. 7 is a flowchart of still another implementation of an apparatus for performing deep packet detection in an embodiment of the present application.
  • This embodiment describes a specific implementation method for implementing internal and external DPI coordination in a router device, and the preliminary protocol type identification is based on a GRE message.
  • GRE The key is performed, and the DPI interface module 702 acquires the first condition for performing the internal and external DPI from the external DPI module 704.
  • the first setting module 401 and the external DPI module 704 in FIG. 4 are integrally formed into an external DPI module 704.
  • the receiving module 404, the determining module 405, and the detection report obtaining module 406 in FIG. 4 are integrally formed into a DPI interface module 702. .
  • the implementation process includes:
  • the DPI interface module 702 obtains the first condition for performing the internal and external DPI from the external DPI module 704. For example, the external DPI module 704 detects only the GRE. A message whose key range is 0x0000-0x00FF;
  • the DPI requesting module 701 sends a message detection request to the DPI interface module 702, where the memory pointer of the to-be-detected message is included;
  • the DPI interface module 702 determines, according to the GRE key of the packet, whether the packet can be detected by the external DPI module 704.
  • step 3 If it is determined in step 3 that the external DPI module 704 cannot be detected, the DPI interface module 702 sends the to-be-detected message to the built-in DPI module 703 through the built-in DPI module for protocol identification and detection;
  • the built-in DPI module 703 performs protocol identification and detection on the packet, and returns the packet detection result to the DPI interface module 702;
  • the DPI interface module 702 sends the to-be-detected message to the external DPI module 704 through the external DPI request message for protocol identification and detection, optionally simultaneously
  • the message includes DPI context information such as an associated message
  • the external DPI module 704 performs protocol identification and detection on the packet, and returns the packet identification detection result to the DPI interface module 702;
  • the DPI interface module 702 sends the packet detection result obtained from the built-in or external DPI module to the DPI request module 701;
  • the DPI requesting network element (corresponding to the control module 407 in FIG. 4) performs service control operations, such as QoS control, charging, caching, and redirection, on the packet.
  • FIG. 8 is a flowchart of still another implementation of an apparatus for performing deep packet detection according to an embodiment of the present disclosure.
  • This embodiment describes a specific implementation method for implementing internal and external DPI coordination in a gateway device, and the preliminary protocol type identification is based on IPv6.
  • Flow According to Label the first condition for performing internal and external DPI is stored in the DPI interface module through configuration.
  • the first setting module 401 and the receiving module 404, the determining module 405, and the detection report obtaining module 406 in FIG. 4 are integrally formed into a DPI interface module 802.
  • the implementation process includes:
  • the DPI requesting module 801 sends a packet detection request to the DPI interface module 802, where the memory pointer of the packet to be detected is included;
  • the DPI interface module 802 is based on the IPv6 Flow of the packet. Label and the first condition of performing internal and external DPI, determining whether the protocol message can be detected by the built-in DPI module 803;
  • step 2 If it is determined in step 2 that the built-in DPI module 803 detects, the DPI interface module 802 sends the to-be-detected message pointer to the built-in DPI module 803 through the built-in DPI module for protocol identification and detection;
  • the built-in DPI module 803 detects the packet according to the HTTP protocol, and returns the packet detection result to the DPI interface module 802;
  • step 2 it is determined by the external DPI module 804 that the DPI interface module 802 sends the to-be-detected message to the external DPI module 804 for protocol identification and detection.
  • the external DPI module 804 performs protocol identification and detection on the packet, and returns the packet identification detection result to the DPI interface module 802.
  • the DPI interface module 802 sends the packet detection result obtained from the built-in or external DPI module to the DPI request module 801;
  • the DPI requesting network element (corresponding to the control module 407 in FIG. 4) performs service control operations, such as QoS control, charging, caching, and redirection, on the packet.
  • the built-in deep packet detection module notifies the built-in deep packet detection of the packet or notifies the external deep packet detection module to detect the external deep packet of the packet, and obtains the detection report of the packet.
  • the built-in deep packet detection and the external deep packet detection can effectively implement the service sharing and collaboration, and complete the detection of the packet, without the need for frequent deep packet detection function upgrade.
  • the fast response of the deep packet detection capability while reducing the impact of the built-in deep packet detection on the computing power of the network element, and controlling the data traffic sent to the external deep packet detection, thereby improving the maintainability of the network element and Forwarding performance.
  • FIG. 9 is a flowchart of still another implementation of an apparatus for performing deep packet detection in an embodiment of the present application.
  • This embodiment describes a specific implementation method for implementing internal and external DPI coordination in a forwarding device, where a first internal and external DPI is performed.
  • the condition and the second condition are performed according to the DSCP code, and the DPI requesting the network element to set the first condition and the second condition for performing the internal and external DPI are in the DPI requesting module 901.
  • the first setting module 401 and the second setting module 402 and the request module 403, the receiving module 404, the determining module 405, and the detection report obtaining module 406 in FIG. 4 are integrally formed into a DPI requesting module 901.
  • the implementation process includes:
  • the DPI requesting module 901 determines whether the protocol packet needs to be detected by the built-in DPI module 902 according to the DSCP code of the IP packet and the first condition of the internal and external DPI. For example, the DSCP code indicates that the packet with a higher priority is forwarded. Then detected by the built-in DPI module 902, otherwise detected by the external DPI module 903;
  • the DPI requesting module 901 sends the to-be-detected message pointer to the built-in DPI module 902 for protocol identification and detection by the built-in DPI request message.
  • the built-in DPI module 902 detects the packet and returns a built-in DPI response. If the built-in DPI module 902 detects successfully, the response message includes the identification and detection result. If the detection fails, the response message includes a detection failure indication and/or Intermediate test result;
  • step 3 the DPI requesting module 901 determines that the packet can be re-detected by the external DPI module 903 according to the second condition.
  • the DPI requesting module 901 sends the to-be-detected message to the external DPI module 903 for protocol identification and detection by using an external DPI request message, optionally including a built-in DPI detection failure indication and/or an intermediate detection result in the message. ;
  • the external DPI module 903 performs protocol identification and detection on the packet, and returns the packet identification detection result to the DPI request module 901;
  • the DPI requesting network element (corresponding to the control module 407 in FIG. 4) performs service control operations, such as QoS control, charging, caching, and redirection, on the packet.
  • the built-in deep packet detection module notifies the built-in deep packet detection of the packet or notifies the external deep packet detection module to detect the external deep packet of the packet, and obtains the detection report of the packet.
  • the built-in deep packet detection and the external deep packet detection can effectively implement the service sharing and collaboration, and complete the detection of the packet, without the need for frequent deep packet detection function upgrade.
  • the fast response of the deep packet detection capability while reducing the impact of the built-in deep packet detection on the computing power of the network element, and controlling the data traffic sent to the external deep packet detection, thereby improving the maintainability of the network element and Forwarding performance.
  • FIG. 10 is a flowchart of still another implementation of an apparatus for performing deep packet detection according to an embodiment of the present disclosure.
  • This embodiment describes a specific implementation method for implementing internal and external DPI coordination in a forwarding device, and the built-in DPI module 1002 is configured to perform internal and external operations.
  • the first condition and the second condition of the DPI are performed by the internal and external DPI selection according to the destination port number.
  • the first setting module 401, the second setting module 402, the receiving module 404, the determining module 405, the detection report obtaining module 406, and the built-in depth packet detecting module 408 in FIG. 4 are integrally formed into the built-in depth packet detecting module 1002.
  • the implementation process includes:
  • the DPI requesting module 1001 sends the to-be-detected message pointer to the built-in DPI module 1002 through the built-in DPI request message for protocol identification and detection;
  • the built-in DPI module 1002 determines whether the protocol packet needs to be detected by the built-in DPI module 1002 according to the destination port number of the packet to be detected and the first condition of the internal and external DPI; for example, the packet with the destination port number of 80 or 8080 It is detected by the built-in DPI module 1002, otherwise it is detected by the external DPI module 1003. If the selection condition of the built-in DPI module 1002 is met, the built-in DPI module 1002 detects the message, otherwise directly executes step 4;
  • step 2 If it is determined in step 2 that the built-in DPI module 1002 detects that the built-in DPI module 1002 fails to detect, it is determined whether the external DPI module 1003 performs re-detection according to the second condition.
  • step 2 or step 3 If it is determined in step 2 or step 3 that the packet detection is performed by the external DPI module 1003, the built-in DPI module 1002 sends the to-be-detected message to the external DPI module 1003 for protocol identification and detection by using an external DPI request message.
  • the selected location also includes a built-in DPI detection failure indication and/or a built-in detection result in the message;
  • the external DPI module 1003 performs protocol identification and detection on the packet, and returns the packet identification detection result to the built-in DPI module 1002.
  • the built-in DPI module 1002 returns the message recognition detection result to the DPI request module 1001;
  • the DPI requesting network element (corresponding to the control module 407 in FIG. 4) performs service control operations, such as QoS control, charging, caching, and redirection, on the packet.
  • the built-in deep packet detection module notifies the built-in deep packet detection of the packet or notifies the external deep packet detection module to detect the external deep packet of the packet, and obtains the detection report of the packet.
  • the built-in deep packet detection and the external deep packet detection can effectively implement the service sharing and collaboration, and complete the detection of the packet, without the need for frequent deep packet detection function upgrade.
  • the fast response of the deep packet detection capability while reducing the impact of the built-in deep packet detection on the computing power of the network element, and controlling the data traffic sent to the external deep packet detection, thereby improving the maintainability of the network element and Forwarding performance.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be another division manner for example, multiple units or components may be used. Combinations can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present application which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium, including a plurality of instructions for making a A computer device (which may be a personal computer, server, or network device, etc.) or a processor executes all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read only memory (ROM, Read-Only) Memory, random access memory (RAM), disk or optical disk, and other media that can store program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开一种进行深度报文检测的方法及装置，所述方法包括：接收深度报文检测请求；根据所述报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；若确定进行内置深度报文检测，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告，若确定进行外置深度报文检测，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告。通过上述方式，能够提升网络整体的可维护性和转发性能。

Description

深度报文检测的方法及装置
【技术领域】
本申请涉及互联网络技术领域，特别是涉及一种进行深度报文检测的方法及其装置。
【背景技术】
目前，在电信运营商的承载网络中，各类新应用承载在传输控制协议/因特网互联协议（Transmission Control Protocol/Internet Protocol，TCP/IP协议）的上层网络中，但运营商对这些应用无法直接感知，造成运营商网络逐渐管道化，导致业务难于管理，无法实现内容计费，不能满足信息安全需求等问题。为解决这些问题，电信网络中开始引入了深度报文检测（DPI，Deep Packet Inspection）技术来提高网络对报文应用信息的感知能力。
深度报文检测是相对普通报文分析而言的一种技术。普通报文检测仅仅分析IP报文应用层以下的内容，例如，根据接收到的IP报文的五元组信息（包括源地址、目的地址、源端口、目的端口以及协议类型）对数据报文进行分类处理。而DPI则对报文进行更深层次的检测，包括对报文进行应用层的分析或基于流量特征的检测，识别出报文对应的应用层业务类型和/或提取其中的应用层关键信息用于后续业务处理。
DPI是目前运营商网络中实现基于应用的业务管理的基础，各类DPI设备在运营商网络中得到了大规模的部署。由于缺乏标准化，现在的DPI设备都是由各厂商根据运营商需求部署的定制化设备。目前DPI功能的实现基本采用两种方式：
1. 内置DPI方案：内置DPI通过在网元内部通过软件或硬件加速的方式，提供DPI处理功能。如在移动网络负责报文转发的网元服务GPRS支持节点（Serving GPRS Support Node，SGSN）、网关GPRS支持节点（Gateway GPRS Support Node，GGSN）、服务网关（Serving Gateway， Serving-GW）、分组数据网络网关（Packet Data Network Gateway，PDN-GW）、网络接入服务网关(Access Service Networks Gateway，ASN-GW)或固定网络网元宽带远程接入服务设备（Broadband Remote Access Server，BRAS）、路由器、防火墙等物理网元内部通过软件模块或专用硬件板卡的方式为该网元提供DPI能力。
2. 外置DPI方案：通过外置DPI模块，为其它网元提供DPI服务，与其它网元之间采用外部消息接口实现DPI功能的调用。
本申请发明人在长期研发中发现，单纯采用内置DPI与外置DPI的实现方式都会导致网络整体转发性能的下降。
【发明内容】
本申请提供一种进行深度报文检测的方法及其装置实施例，能够提升网络整体的可维护性和转发性能。
本申请的一方面是提供一种进行深度报文检测的方法，所述方法包括：接收深度报文检测请求，所述深度报文检测请求用于请求对报文进行深度报文检测；根据所述报文的特征，以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；若确定进行内置深度报文检测，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告；或，若确定进行外置深度报文检测，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告。
本申请另一方面是提供一种进行深度报文检测的装置，所述装置包括：接收模块，用于接收深度报文检测请求，所述深度报文检测请求用于请求对报文进行深度报文检测；判断模块，用于根据所述报文的特征，以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；检测报告获得模块，用于在确定进行内置深度报文检测时，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告；或，在确定进行外置深度报文检测时，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告。
上述技术方案，在接收到需要深度报文检测的请求后，根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断是进行内置深度报文检测还是进行外置深度报文检测，根据判断的结果，通知内置深度报文检测模块对报文进行内置深度报文检测或者通知外置深度报文检测模块对报文进行外置深度报文检测，获得报文的检测报告。通过这种方式，内置深度报文检测与外置深度报文检测之间能够通过有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
【附图说明】
图1是本申请实施例进行深度报文检测的方法的流程图；
图2是本申请实施例进行深度报文检测的方法的另一流程图；
图3是本申请实施例进行深度报文检测的装置的结构示意图；
图4是本申请实施例进行深度报文检测的装置的另一结构示意图；
图5是本申请实施例进行深度报文检测的装置的实现流程图；
图6是本申请实施例进行深度报文检测的装置的另一实现流程图；
图7是本申请实施例进行深度报文检测的装置的又一实现流程图；
图8是本申请实施例进行深度报文检测的装置的又一实现流程图；
图9是本申请实施例进行深度报文检测的装置的又一实现流程图；
图10是本申请实施例进行深度报文检测的装置的又一实现流程图。
【具体实施方式】
下面结合附图和实施例对本申请进行详细说明。
参阅图1，图1是本申请实施例进行深度报文检测的方法的流程图，该方法包括：
步骤S101：接收深度报文检测请求，所述深度报文检测请求用于请求对报文进行深度报文检测；
深度报文检测（DPI，Deep Packet Inspection )是相对普通报文分析而言的一种技术。普通报文检测仅仅分析IP报文应用层以下的内容，如根据接收到的IP报文的五元组信息（包括源地址、目的地址、源端口、目的端口以及协议类型），对数据报文进行分类处理。而DPI则对报文进行更深层次的检测，包括对报文进行应用层的分析或基于流量特征的检测，识别出报文对应的应用层业务类型，和/或提取其中的应用层关键信息用于后续业务处理。
DPI是一个相对宽泛的概念。在某些文献中，也将对报文进行基于流量特征的检测技术称为基于流特征的检测（DFI, Deep Flow Inspection )。在本申请中，将基于IP报文的TCP/IP层以上信息的识别和/或解析技术和DFI技术统称为DPI技术。本申请中所使用的报文检测、识别、解析等术语与DPI表示相同含义。
步骤S102：根据报文的特征，以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；
设置的进行内置深度报文检测和外置深度报文检测的第一条件与报文的特征有关联，根据待检测的报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，可以判断出对于待检测的报文是进行内置深度报文检测还是进行外置深度报文检测。
步骤S103：若确定进行内置深度报文检测，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告；或，若确定进行外置深度报文检测，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告。
如果判断的结果是进行内置深度报文检测，将所述报文发送给内置深度报文检测模块，通知内置深度报文检测模块对所述报文进行检测，并获得内置深度报文检测模块对所述报文进行检测后的检测报告；如果判断的结果是进行外置深度报文检测，将所述报文发送给外置深度报文检测模块，通知外置深度报文检测模块对所述报文进行检测，并获得外置深度报文检测模块对所述报文进行检测后的检测报告。
本申请实施例根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断是进行内置深度报文检测还是进行外置深度报文检测，根据判断的结果，通知内置深度报文检测模块对报文进行内置深度报文检测或者通知外置深度报文检测模块对报文进行外置深度报文检测，获得报文的检测报告。通过这种方式，内置深度报文检测与外置深度报文检测之间能够通过有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
参阅图2，图2是本申请实施例进行深度报文检测的方法的另一流程图，在本实施例中，进行深度报文检测的执行主体是深度报文检测装置。该流程包括：
步骤S201：设置进行内置深度报文检测和外置深度报文检测的第一条件；
步骤S202：设置进行内置深度报文检测和外置深度报文检测的第二条件；
其中，进行内置深度报文检测和外置深度报文检测的第一条件包括：根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块的检测能力或外置深度报文检测模块的检测能力中的至少一种，确定进行内置深度报文检测或外置深度报文检测。进行内置深度报文检测和外置深度报文检测的第二条件包括：根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块的检测能力或外置深度报文检测模块的检测能力中的至少一种，确定进行内置深度报文检测或外置深度报文检测。
可以根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块的检测能力和外置深度报文检测模块的检测能力中的其中一种、其中两种、其中三种或者其中三种以上确定进行内置深度报文检测或外置深度报文检测。在本发明的各实施例中，上述第一或第二条件的设置粒度可以任意组合。以第一条件的不同设置粒度举例：可以设置为将用户级别较高的报文进行内置深度报文检测、将用户级别较低的报文进行外置深度报文检测；或将用户级别较高、业务流量较大的报文进行内置深度报文检测，将用户级别较低、业务流量较小的报文进行外置深度报文检测。或在PDN-GW上的HTTP报文进行内置深度报文检测，将PDN-GW上的其它协议报文或Serving-GW上的所有协议报文进行外置深度报文检测；或将协议稳定、解析简单、时延要求高的报文进行内置深度报文检测，将协议变化频繁、解析复杂、时延要求不高的报文进行外置深度报文检测。
需要说明的是，在进行了步骤S201后，根据应用中的实际情况，步骤S202可以执行也可以不执行。步骤S201和步骤S202可以由深度报文检测装置中的设置模块执行。
通过上述方式，可以在计算能力和转发能力之间取得性能平衡。
步骤S203：请求对报文进行深度报文检测；步骤S203可以是深度报文检测装置中的请求模块执行。
步骤S204：接收深度报文检测请求；步骤S204可以是深度报文检测装置中的接收模块执行。
深度报文检测是对报文进行更深层次的检测，包括对报文进行应用层的分析或基于流量特征的检测，识别出报文对应的应用层业务类型，和/或提取其中的应用层关键信息用于后续业务处理。
步骤S205：根据所述报文的特征，以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；步骤S205可以是深度报文检测装置中的判断模块执行。
报文特征可以包括报文端口号、通用路由封装密钥域（GRE key）、因特网络协议第六版流标签（IPv6 Flow Label）、差别服务编码点（DSCP码）、因特网络协议（IP）目的地址或报文行为特征中的至少一种。例如：端口号为80或8080的报文初步判断为HTTP协议，根据内置深度报文检测和外置深度报文检测的第一条件，判断该协议报文是否可由内置深度报文检测模块进行检测；根据报文的GRE key判断该报文是否可由外置深度报文检测模块进行检测；根据报文的IPv6 Flow Label，判断该报文是否可由内置深度报文检测模块进行检测；差别服务编码点表示转发优先级较高的报文由内置深度报文检测模块进行检测，否则由外置深度报文检测模块进行检测。
步骤S206：若确定进行内置深度报文检测，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告，若确定进行外置深度报文检测，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告；如果确定进行内置深度报文检测，进入步骤S206a，如果确定进行外置深度报文检测，进入步骤S206f。步骤S206可以是深度报文检测装置中的检测报告获得模块执行。
其中，报文的检测报告是最终检测报告或者中间检测报告。
其中，步骤S206具体包括以下内容：
步骤S206a：若确定进行内置深度报文检测，将待检测的报文发送给内置深度报文检测模块；步骤S206a可以是深度报文检测装置中检测报告获得模块的第一发送单元执行。
步骤S206b：接收所述内置深度报文检测模块对所述报文进行检测后的检测报告；如果执行了步骤S202，则进入步骤S206c，如果没有执行步骤S202，则进入步骤S207。步骤S206b可以是深度报文检测装置中检测报告获得模块的第一接收单元执行。
步骤S206c：根据所述报文的检测报告，确定所述内置深度报文检测模块对报文的检测失败；步骤S206c可以是深度报文检测装置中检测报告获得模块的第一确定单元执行。
步骤S206d：根据设置的进行内置深度报文检测和外置深度报文检测的第二条件，确定对所述报文再进行外置深度报文检测；步骤S206d可以是深度报文检测装置中检测报告获得模块的第二确定单元执行。
如果检测失败，根据设置的进行内置深度报文检测和外置深度报文检测的第二条件，可以确定对所述报文进行外置深度报文检测。
步骤S206e：通知所述外置深度报文检测模块对所述报文进行再检测，获得所述报文的检测报告。步骤S206e可以是深度报文检测装置中检测报告获得模块的检测报告获得单元执行。
其中，步骤S206e具体包括：
步骤S206e1：将所述待再检测的报文发送给所述外置深度报文检测模块；步骤S206e1可以是深度报文检测装置中检测报告获得模块的检测报告获得单元的发送电路执行。
其中，S206e1具体包括：将所述再检测的报文，以及内置深度报文检测模块检测失败的指示或者内置深度报文检测模块的检测结果发送给所述外置深度报文检测模块。
步骤S206e2：接收所述外置深度报文检测模块对所述再检测的报文进行再检测后的检测报告。步骤S206e2可以是深度报文检测装置中检测报告获得模块的检测报告获得单元的接收电路执行。
步骤S206f：若确定进行外置深度报文检测，将待检测的报文发送给外置深度报文检测模块；步骤S206f可以是深度报文检测装置中检测报告获得模块的第二发送单元执行。
步骤S206g：接收所述外置深度报文检测模块对所述报文进行检测后的检测报告。步骤S206g可以是深度报文检测装置中检测报告获得模块的第二接收单元执行。
步骤S207：根据所述报文的检测报告，对所述报文进行业务控制。步骤S207可以是深度报文检测装置中控制模块执行。
业务控制包括但不限于：转发（如选择不同路由、多播、广播等）、计费、合法监听、服务质量控制、门控、优先级控制、重定向或报文增强中至少一种的控制。其中服务质量控制包括带宽控制、业务优先级控制、转发时延控制等（如根据用户签约信息，在转发过程中使用令牌桶等算法对用户的业务流执行特定带宽保障），门控包括对用户业务报文执行通过或丢弃操作。
本申请实施例根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断是进行内置深度报文检测还是进行外置深度报文检测，根据判断的结果，通知内置深度报文检测模块对报文进行内置深度报文检测或者通知外置深度报文检测模块对报文进行外置深度报文检测，获得报文的检测报告。通过这种方式，内置深度报文检测与外置深度报文检测之间能够通过有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
参阅图3，图3是本申请实施例进行深度报文检测的装置的结构示意图，所述装置包括：接收模块301、判断模块302以及检测报告获得模块303。
接收模块301用于接收深度报文检测请求，所述深度报文检测请求用于请求对报文进行深度报文检测；
DPI是对报文进行更深层次的检测，包括对报文进行应用层的分析或基于流量特征的检测，识别出报文对应的应用层业务类型，和/或提取其中的应用层关键信息用于后续业务处理。
判断模块302用于根据所述报文的特征，以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；
设置的进行内置深度报文检测和外置深度报文检测的第一条件与报文的特征有关联，根据待检测的报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，可以判断出对于待检测的报文是进行内置深度报文检测还是进行外置深度报文检测。
检测报告获得模块303用于在确定进行内置深度报文检测时，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告；或，在确定进行外置深度报文检测时，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告。
如果判断的结果是进行内置深度报文检测，将所述报文发送给内置深度报文检测模块，通知内置深度报文检测模块对所述报文进行检测，并获得内置深度报文检测模块对所述报文进行检测后的检测报告；如果判断的结果是进行外置深度报文检测，将所述报文发送给外置深度报文检测模块，通知外置深度报文检测模块对所述报文进行检测，并获得外置深度报文检测模块对所述报文进行检测后的检测报告。
综上所述，本申请实施例根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的条件，判断是进行内置深度报文检测还是进行外置深度报文检测，对报文进行检测后，获得报文的检测报告。通过这种方式，内外置深度报文检测之间能够有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
参阅图4，图4是本申请实施例进行深度报文检测的装置的另一结构示意图，所述装置包括：第一设置模块401、第二设置模块402、请求模块403、接收模块404、判断模块405、检测报告获得模块406、控制模块407以及内置深度报文检测模块408。在图4中，将外置深度报文检测模块409也一并表示出来。
第一设置模块401用于设置进行内置深度报文检测和外置深度报文检测的第一条件；
第二设置模块402用于设置进行内置深度报文检测和外置深度报文检测的第二条件。
其中，进行内置深度报文检测和外置深度报文检测的第一条件包括：根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块408的检测能力或外置深度报文检测模块409的检测能力中的至少一种，确定进行内置深度报文检测或外置深度报文检测。进行内置深度报文检测和外置深度报文检测的第二条件包括：根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块的检测能力或外置深度报文检测模块的检测能力中的至少一种，确定进行内置深度报文检测或外置深度报文检测。
可以根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块408的检测能力和外置深度报文检测模块409的检测能力中的其中一种、其中两种、其中三种或者其中三种以上确定进行内置深度报文检测或外置深度报文检测。
请求模块403用于请求对报文进行深度报文检测；
接收模块404用于接收深度报文检测请求；
判断模块405用于根据所述报文的特征，以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；
报文特征可以包括报文端口号、通用路由封装密钥域、因特网络协议第六版流标签、差别服务编码点、因特网络协议目的地址或报文行为特征中的至少一种。
检测报告获得模块406用于在确定进行内置深度报文检测时，通知内置深度报文检测模块408对所述报文进行检测，获得所述报文的检测报告，在确定进行外置深度报文检测时，通知外置深度报文检测模块409对所述报文进行检测，获得所述报文的检测报告；
其中，报文的检测报告是最终检测报告或者中间检测报告。
其中，检测报告获得模块406包括：第一发送单元4061、第一接收单元4062、第一确定单元4063、第二确定单元4064、检测报告获得单元4065、第二发送单元4066以及第二接收单元4067。
第一发送单元4061用于在确定进行内置深度报文检测时，将待检测的报文发送给内置深度报文检测模块408；
第一接收单元4062用于接收所述内置深度报文检测模块408对所述报文进行检测后的检测报告。
第一确定单元4063用于根据所述报文的检测报告，确定所述内置深度报文检测模块408对报文的检测失败；
第二确定单元4064用于根据所述设置的进行内置深度报文检测和外置深度报文检测的第二条件，确定对所述报文再进行外置深度报文检测；
检测报告获得单元4065用于通知外置深度报文检测模块409对所述报文进行再检测，获得所述报文的检测报告。
其中，检测报告获得单元4065包括：发送电路和接收电路。
发送电路用于将所述待再检测的报文发送给所述外置深度报文检测模块409；
其中，发送电路具体用于将所述待再检测的报文，以及内置深度报文检测模块408检测失败的指示或者内置深度报文检测模块408的检测结果发送给所述外置深度报文检测模块409。
接收电路用于接收所述外置深度报文检测模块409对所述再检测的报文进行再检测后的检测报告。
第二发送单元4066用于在确定进行外置深度报文检测时，将待检测的报文发送给外置深度报文检测模块409；
第二接收单元4067用于接收所述外置深度报文检测模块409对所述报文进行检测后的检测报告。
控制模块407用于根据所述报文的检测报告，对所述报文进行业务控制。
业务控制包括但不限于：转发、计费、合法监听、服务质量控制、门控、优先级控制、重定向或报文增强中至少一种的控制。
其中，第一设置模块401或者第一设置模块401与第二设置模块402与请求模块403、接收模块404、判断模块405、检测报告获得模块406、内置深度报文检测模块408以及外置深度报文检测模块409中的至少一个一体成型。
其中，请求模块403、接收模块404、判断模块405、检测报告获得模块406以及内置深度报文检测模块408中的至少两个一体成型。
其中，请求模块403、接收模块404、判断模块405、检测报告获得模块406以及内置深度报文检测模块408是该装置的内部模块，内部模块间的操作采用内部消息交互或内部函数调用的方式实现。
总之，通过这种方式，内外置深度报文检测之间能够有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
下面举例说明第一设置模块401或者第一设置模块401与第二设置模块402与请求模块403、接收模块404、判断模块405、检测报告获得模块406、内置深度报文检测模块408以及外置深度报文检测模块中的至少一个一体成型，以及请求模块403、接收模块404、判断模块405、检测报告获得模块406以及内置深度报文检测模块408中的至少两个一体成型。
参阅图5，图5是本申请实施例进行深度报文检测的装置的实现流程图，本实施例描述网关设备中实现内外置DPI协同的具体实现方法，初步协议类型识别根据目的端口号进行，DPI接口模块502从DPI管理网元503获取进行内置深度报文检测和外置深度报文检测的第一条件。其中，图4中的第一设置模块401与DPI管理网元一体成型为DPI管理网元503，图4中的接收模块404、判断模块405以及检测报告获得模块406一体成型为DPI接口模块502。实现流程包括：
1、DPI接口模块502从DPI管理网元503获取内外置DPI选择条件，如HTTP协议由内置DPI模块504检测，其余协议由外置DPI模块505检测；
2、DPI请求模块501向DPI接口模块502发送报文检测请求，其中包括待检测报文的内存指针；
3、DPI接口模块502根据报文目的端口号初步判断协议类型，如目标端口为80或8080的报文初步判断为HTTP协议，根据进行内置深度报文检测和外置深度报文检测的第一条件，判断该协议报文是否可由内置DPI模块504进行检测；
4、如步骤3中判断由内置DPI模块504检测，DPI接口模块502将待检测报文指针通过内置DPI请求发送给内置DPI模块504进行协议识别和检测；
5、内置DPI模块504根据HTTP协议对报文进行检测，并将报文检测结果返回DPI接口模块502；
6、如步骤3中判断由外置DPI模块505检测，DPI接口模块502将待检测报文通过外置DPI请求消息发送给外置DPI模块505进行协议识别和检测，可选地同时在该消息中包括如关联报文等DPI上下文信息；
7、外置DPI模块505对报文进行协议识别与检测，并将报文检测结果返回DPI接口模块502；
8、DPI接口模块502将从内置或外置DPI模块获取的报文检测结果发送给DPI请求模块501；
9、根据DPI请求模块501获取的报文检测结果，DPI请求网元（对应图4中的控制模块407）对该报文执行业务控制操作，如QoS控制、计费、缓存和重定向等。
本实施例中，所涉及的DPI请求网元内部模块间的操作，可以采用内部消息交互或内部函数调用的方式实现，后续实施例中的内部模块间操作实现方式与本实施例类似，不再赘述。
本申请实施例根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断是进行内置深度报文检测还是进行外置深度报文检测，根据判断的结果，通知内置深度报文检测模块对报文进行内置深度报文检测或者通知外置深度报文检测模块对报文进行外置深度报文检测，获得报文的检测报告。通过这种方式，内置深度报文检测与外置深度报文检测之间能够通过有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
参阅图6，图6是本申请实施例进行深度报文检测的装置的另一实现流程图，本实施例描述转发设备中实现内外置DPI协同的具体实现方法，进行内置深度报文检测和外置深度报文检测的第一条件和第二条件是根据目的端口号进行的，DPI接口模块602从DPI管理网元603获取进行内外置DPI的第一条件及第二条件。其中，图4中的第一设置模块401、第二设置模块402与DPI管理网元一体成型为DPI管理网元603，图4中的接收模块404、判断模块405以及检测报告获得模块406一体成型为DPI接口模块602。实现流程包括：
1、DPI接口模块602从DPI管理网元603获取进行内外置DPI的第一条件，如FTP/DNS协议由内置DPI模块604检测，其余协议由外置DPI模块605检测；
2、DPI请求模块601向DPI接口模块602发送报文检测请求，其中包括待检测报文的内存指针；
3、DPI接口模块602根据报文目的端口号初步判断协议类型，如目标端口为21/22或53的报文初步判断为FTP/DNS协议，根据进行内外置DPI的第一条件，判断该协议报文是否可由内置DPI模块604进行检测；
4、如步骤3中判断由内置DPI模块604检测，DPI接口模块602将待检测报文指针通过内置DPI请求发送给内置DPI模块604进行协议识别和检测；
5、内置DPI模块604根据FTP/DNS协议对报文进行检测，如该报文实际并不是上述协议报文，则检测失败，内置DPI模块604将报文检测应答返回DPI接口模块602，其中包括检测失败指示；
6、DPI接口模块602根据进行内外置DPI的第二条件，判断该报文可以通过外置DPI模块605进行进一步检测，DPI接口模块602通过外置DPI请求消息将待检测报文发送给外置DPI模块605进行协议识别和检测，可选地同时在该消息中包括内置DPI检测失败指示；
7、外置DPI模块605对报文进行协议识别与检测，并将报文识别检测结果返回DPI接口模块602；
8、DPI接口模块602将从外置DPI模块605获取的报文检测结果发送给DPI请求模块601；
9、根据DPI请求模块601获取的报文检测结果，DPI请求网元（对应图4中的控制模块407）对该报文执行业务控制操作，如QoS控制、计费、缓存和重定向等。
本申请实施例根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断是进行内置深度报文检测还是进行外置深度报文检测，根据判断的结果，通知内置深度报文检测模块对报文进行内置深度报文检测或者通知外置深度报文检测模块对报文进行外置深度报文检测，获得报文的检测报告。通过这种方式，内置深度报文检测与外置深度报文检测之间能够通过有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
参阅图7，图7是本申请实施例进行深度报文检测的装置的又一实现流程图，本实施例描述路由器设备中实现内外置DPI协同的具体实现方法，初步协议类型识别根据GRE报文的GRE key进行，DPI接口模块702从外置DPI模块704获取进行内外置DPI的第一条件。其中，图4中的第一设置模块401与外置DPI模块704一体成型为外置DPI模块704，图4中的接收模块404、判断模块405以及检测报告获得模块406一体成型为DPI接口模块702。实现流程包括：
1、DPI接口模块702从外置DPI模块704获取进行内外置DPI的第一条件，如外置DPI模块704仅检测GRE key范围为0x0000-0x00FF的报文；
2、DPI请求模块701向DPI接口模块702发送报文检测请求，其中包括待检测报文的内存指针；
3、DPI接口模块702根据报文的GRE key判断该报文是否可由外置DPI模块704进行检测；
4、如步骤3中判断无法由外置DPI模块704检测，DPI接口模块702将待检测报文通过内置DPI请求发送给内置DPI模块703进行协议识别和检测；
5、内置DPI模块703对报文进行协议识别与检测，并将报文检测结果返回DPI接口模块702；
6、如步骤3中判断符合进行外置DPI的第一条件，DPI接口模块702将待检测报文通过外置DPI请求消息发送给外置DPI模块704进行协议识别和检测，可选地同时在该消息中包括如关联报文等DPI上下文信息；
7、外置DPI模块704对报文进行协议识别与检测，并将报文识别检测结果返回DPI接口模块702；
8、DPI接口模块702将从内置或外置DPI模块获取的报文检测结果发送给DPI请求模块701；
9、根据DPI请求模块701获取的报文检测结果，DPI请求网元（对应图4中的控制模块407）对该报文执行业务控制操作，如QoS控制、计费、缓存和重定向等。
参阅图8，图8是本申请实施例进行深度报文检测的装置的又一实现流程图；本实施例描述网关设备中实现内外置DPI协同的具体实现方法，初步协议类型识别根据IPv6 Flow Label进行，进行内外置DPI的第一条件通过配置方式存储在DPI接口模块上。其中，图4中的第一设置模块401与接收模块404、判断模块405以及检测报告获得模块406一体成型为DPI接口模块802。实现流程包括：
1、DPI请求模块801向DPI接口模块802发送报文检测请求，其中包括待检测报文的内存指针；
2、DPI接口模块802根据报文的IPv6 Flow Label及进行内外置DPI的第一条件，判断该协议报文是否可由内置DPI模块803进行检测；
3、如步骤2中判断由内置DPI模块803检测，DPI接口模块802将待检测报文指针通过内置DPI请求发送给内置DPI模块803进行协议识别和检测；
4、内置DPI模块803根据HTTP协议对报文进行检测，并将报文检测结果返回DPI接口模块802；
5、如步骤2中判断由外置DPI模块804检测，DPI接口模块802将待检测报文通过外置DPI请求消息发送给外置DPI模块804进行协议识别和检测；
6、外置DPI模块804对报文进行协议识别与检测，并将报文识别检测结果返回DPI接口模块802；
7、DPI接口模块802将从内置或外置DPI模块获取的报文检测结果发送给DPI请求模块801；
8、根据DPI请求模块801获取的报文检测结果，DPI请求网元（对应图4中的控制模块407）对该报文执行业务控制操作，如QoS控制、计费、缓存和重定向等。
本申请实施例根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断是进行内置深度报文检测还是进行外置深度报文检测，根据判断的结果，通知内置深度报文检测模块对报文进行内置深度报文检测或者通知外置深度报文检测模块对报文进行外置深度报文检测，获得报文的检测报告。通过这种方式，内置深度报文检测与外置深度报文检测之间能够通过有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
参阅图9，图9是本申请实施例进行深度报文检测的装置的又一实现流程图，本实施例描述转发设备中实现内外置DPI协同的具体实现方法，其中进行内外置DPI的第一条件和第二条件根据DSCP码进行，DPI请求网元设置进行内外置DPI的第一条件及第二条件在DPI请求模块901中。其中，图4中的第一设置模块401与第二设置模块402与请求模块403、接收模块404、判断模块405以及检测报告获得模块406一体成型为DPI请求模块901。实现流程包括：
1、DPI请求模块901根据IP报文的DSCP码及进行内外置DPI的第一条件，判断该协议报文是否需要由内置DPI模块902进行检测，例如DSCP码表示转发优先级较高的报文则由内置DPI模块902检测，否则由外置DPI模块903检测；
2、如步骤1中判断由内置DPI模块902检测，DPI请求模块901将待检测报文指针通过内置DPI请求消息发送给内置DPI模块902进行协议识别和检测；
3、内置DPI模块902对报文进行检测并返回内置DPI应答，如内置DPI模块902检测成功，则应答消息中包括识别与检测结果，如检测失败，则应答消息中包括检测失败指示和/或中间检测结果；
4、如步骤3内置DPI应答指示检测失败，DPI请求模块901根据第二条件，判断该报文可以通过外置DPI模块903进行重新检测；
5、DPI请求模块901通过外置DPI请求消息将待检测报文发送给外置DPI模块903进行协议识别和检测，可选地同时在该消息中包括内置DPI检测失败指示和/或中间检测结果；
6、外置DPI模块903对报文进行协议识别与检测，并将报文识别检测结果返回DPI请求模块901；
7、根据DPI请求模块901获取的报文检测结果，DPI请求网元（对应图4中的控制模块407）对该报文执行业务控制操作，如QoS控制、计费、缓存和重定向等。
本申请实施例根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断是进行内置深度报文检测还是进行外置深度报文检测，根据判断的结果，通知内置深度报文检测模块对报文进行内置深度报文检测或者通知外置深度报文检测模块对报文进行外置深度报文检测，获得报文的检测报告。通过这种方式，内置深度报文检测与外置深度报文检测之间能够通过有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
参阅图10，图10是本申请实施例进行深度报文检测的装置的又一实现流程图；本实施例描述转发设备中实现内外置DPI协同的具体实现方法，内置DPI模块1002设置进行内外置DPI的第一条件及第二条件，进行内外置DPI选择根据目的端口号进行。其中，图4中的第一设置模块401、第二设置模块402与接收模块404、判断模块405、检测报告获得模块406以及内置深度报文检测模块408一体成型为内置深度报文检测模块1002。实现流程包括：
1、DPI请求模块1001将待检测报文指针通过内置DPI请求消息发送给内置DPI模块1002进行协议识别和检测；
2、内置DPI模块1002根据待检测报文的目的端口号及内外置DPI的第一条件，判断该协议报文是否需要由内置DPI模块1002进行检测；例如目的端口号为80或8080的报文由由内置DPI模块1002检测，否则由外置DPI模块1003检测。如果满足内置DPI模块1002的选择条件，则内置DPI模块1002对报文进行检测，否则直接执行步骤4；
3、如步骤2中判断由内置DPI模块1002检测，且内置DPI模块1002检测失败，可选地根据第二条件确定是否由外置DPI模块1003进行重新检测；
4、如步骤2或步骤3判断由外置DPI模块1003进行报文检测，则内置DPI模块1002通过外置DPI请求消息将待检测报文发送给外置DPI模块1003进行协议识别和检测，可选地同时在该消息中包括内置DPI检测失败指示和/或内置检测结果；
5、外置DPI模块1003对报文进行协议识别与检测，并将报文识别检测结果返回内置DPI模块1002；
6、内置DPI模块1002将报文识别检测结果返回DPI请求模块1001；
7、根据DPI请求模块1001获取的报文检测结果，DPI请求网元（对应图4中的控制模块407）对该报文执行业务控制操作，如QoS控制、计费、缓存和重定向等。
本申请实施例根据报文的特征以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断是进行内置深度报文检测还是进行外置深度报文检测，根据判断的结果，通知内置深度报文检测模块对报文进行内置深度报文检测或者通知外置深度报文检测模块对报文进行外置深度报文检测，获得报文的检测报告。通过这种方式，内置深度报文检测与外置深度报文检测之间能够通过有效地进行业务分担和协同，共同完成报文的检测，不需要进行频繁的深度报文检测功能升级即可实现深度报文检测能力的快速响应，并且在降低内置深度报文检测对网元计算能力影响的同时，也控制了发送到外置深度报文检测的数据流量，从而提升网元的可维护性和转发性能。
上述装置的结构和功能具体描述可以参见上述的相应的方法实施例。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备（可以是个人计算机，服务器，或者网络设备等）或处理器（processor）执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器（ROM，Read-Only Memory）、随机存取存储器（RAM，Random Access Memory）、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (33)

  1. 一种进行深度报文检测的方法，其特征在于，包括：
    接收深度报文检测请求，所述深度报文检测请求用于请求对报文进行深度报文检测；
    根据所述报文的特征，以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；
    若确定进行内置深度报文检测，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告；或，
    若确定进行外置深度报文检测，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告。
  2. 根据权利要求1所述的方法，其特征在于，所述若确定进行内置深度报文检测，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告，包括：
    若确定进行内置深度报文检测，将所述报文发送给内置深度报文检测模块；
    接收所述内置深度报文检测模块对所述报文进行检测后的检测报告。
  3. 根据权利要求2所述的方法，其特征在于，所述接收内置深度报文检测模块对所述报文进行检测后的检测报告之后，还包括：
    根据所述报文的检测报告，确定所述内置深度报文检测模块对报文的检测失败；
    根据设置的进行内置深度报文检测和外置深度报文检测的第二条件，确定对所述报文再进行外置深度报文检测，并通知所述外置深度报文检测模块对所述报文进行再检测，获得所述报文的检测报告。
  4. 根据权利要求3所述的方法，其特征在于，所述通知所述外置深度报文检测模块对所述报文进行再检测，获得所述报文的检测报告，包括：
    将所述待再检测的报文发送给所述外置深度报文检测模块；
    接收所述外置深度报文检测模块对所述再检测的报文进行再检测后的检测报告。
  5. 根据权利要求4所述的方法，其特征在于，所述将所述待再检测的报文发送给所述外置深度报文检测模块，包括：
    将所述再检测的报文，以及内置深度报文检测模块检测失败的指示或者内置深度报文检测模块的检测结果发送给所述外置深度报文检测模块。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述若确定进行外置深度报文检测，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告，包括：
    若确定进行外置深度报文检测，将待检测的报文发送给外置深度报文检测模块；
    接收所述外置深度报文检测模块对所述报文进行检测后的检测报告。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述接收深度报文检测请求之前，包括：设置进行内置深度报文检测和外置深度报文检测的第一条件。
  8. 根据权利要求7所述的方法，其特征在于，所述接收深度报文检测请求之前，包括：设置进行内置深度报文检测和外置深度报文检测的第二条件。
  9. 根据权利要求7所述的方法，其特征在于，所述进行内置深度报文检测和外置深度报文检测的第一条件包括：根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块的检测能力和外置深度报文检测模块的检测能力中的至少一种，确定进行内置深度报文检测或外置深度报文检测。
  10. 根据权利要求8所述的方法，其特征在于，所述进行内置深度报文检测和外置深度报文检测的第二条件包括：根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块的检测能力和外置深度报文检测模块的检测能力中的至少一种，确定进行内置深度报文检测或外置深度报文检测。
  11. 根据权利要求1所述的方法，其特征在于，所述接收深度报文检测请求之前，还包括：请求对报文进行深度报文检测。
  12. 根据权利要求1所述的方法，其特征在于，所述报文特征包括：报文端口号、通用路由封装密钥域、因特网络协议第六版流标签、差别服务编码点、因特网络协议目的地址或报文行为特征中的至少一种。
  13. 根据权利要求1至12任一项所述的方法，其特征在于，所述报文的检测报告是最终检测报告或者中间检测报告。
  14. 根据权利要求1至13任一项所述的方法，其特征在于，所述获得报文的检测报告之后，包括：根据所述报文的检测报告，对所述报文进行业务控制。
  15. 根据权利要求14所述的方法，其特征在于，所述业务控制包括：转发、计费、合法监听、服务质量控制、门控、优先级控制、重定向或报文增强中至少一种的控制。
  16. 一种进行深度报文检测的装置，其特征在于，所述装置包括：
    接收模块，用于接收深度报文检测请求，所述深度报文检测请求用于请求对报文进行深度报文检测；
    判断模块，用于根据所述报文的特征，以及设置的进行内置深度报文检测和外置深度报文检测的第一条件，判断进行内置深度报文检测或进行外置深度报文检测；
    检测报告获得模块，用于在确定进行内置深度报文检测时，通知内置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告；或，在确定进行外置深度报文检测时，通知外置深度报文检测模块对所述报文进行检测，获得所述报文的检测报告。
  17. 根据权利要求16所述的装置，其特征在于，所述检测报告获得模块包括：
    第一发送单元，用于在确定进行内置深度报文检测时，将待检测的报文发送给内置深度报文检测模块；
    第一接收单元，用于接收所述内置深度报文检测模块对所述报文进行检测后的检测报告。
  18. 根据权利要求17所述的装置，其特征在于，所述检测报告获得模块还包括：
    第一确定单元，用于根据所述报文的检测报告，确定所述内置深度报文检测模块对报文的检测失败；
    第二确定单元，用于根据设置的进行内置深度报文检测和外置深度报文检测的第二条件，确定对所述报文再进行外置深度报文检测；
    检测报告获得单元，用于通知所述外置深度报文检测模块对所述报文进行再检测，获得所述报文的检测报告。
  19. 根据权利要求18所述的装置，其特征在于，所述检测报告获得单元包括：
    发送电路，用于将所述待再检测的报文发送给所述外置深度报文检测模块；
    接收电路，用于接收所述外置深度报文检测模块对所述再检测的报文进行再检测后的检测报告。
  20. 根据权利要求19所述的装置，其特征在于，所述发送电路具体用于将所述待再检测的报文，以及内置深度报文检测模块检测失败的指示或者内置深度报文检测模块的检测结果发送给所述外置深度报文检测模块。
  21. 根据权利要求16至20任一项所述的装置，其特征在于，所述检测报告获得模块还包括：
    第二发送单元，用于在确定进行外置深度报文检测时，将待检测的报文发送给外置深度报文检测模块；
    第二接收单元，用于接收所述外置深度报文检测模块对所述报文进行检测后的检测报告。
  22. 根据权利要求16至21任一项所述的装置，其特征在于，所述装置还包括第一设置模块，所述第一设置模块用于设置进行内置深度报文检测和外置深度报文检测的第一条件。
  23. 根据权利要求22所述的装置，其特征在于，所述装置还包括第二设置模块，所述第二设置模块用于设置进行内置深度报文检测和外置深度报文检测的第二条件。
  24. 根据权利要求23所述的装置，其特征在于，所述进行内置深度报文检测和外置深度报文检测的第二条件包括：根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块的检测能力和外置深度报文检测模块的检测能力中的至少一种，确定进行内置深度报文检测或外置深度报文检测。
  25. 根据权利要求22所述的装置，其特征在于，所述进行内置深度报文检测和外置深度报文检测的第一条件包括：根据用户级别、设备级别、业务流级别、报文时延、报文协议类型、报文难易程度、内置深度报文检测模块的检测能力或外置深度报文检测模块的检测能力中的至少一种，确定进行内置深度报文检测或外置深度报文检测。
  26. 根据权利要求16所述的装置，其特征在于，所述装置还包括请求模块，所述请求模块用于请求对报文进行深度报文检测。
  27. 根据权利要求16所述的装置，其特征在于，所述报文特征包括：报文端口号、通用路由封装密钥域、因特网络协议第六版流标签、差别服务编码点、因特网络协议目的地址或报文行为特征中的至少一种。
  28. 根据权利要求16至27任一项所述的装置，其特征在于，所述报文的检测报告是最终检测报告或者中间检测报告。
  29. 根据权利要求16至28任一项所述的装置，其特征在于，所述装置还包括控制模块，所述控制模块用于根据所述报文的检测报告，对所述报文进行业务控制。
  30. 根据权利要求29所述的装置，其特征在于，所述业务控制包括：转发、计费、合法监听、服务质量控制、门控、优先级控制、重定向或报文增强中至少一种的控制。
  31. 根据权利要求16至30任一项所述的装置，其特征在于，所述第一设置模块或者第一设置模块与第二设置模块与所述请求模块、接收模块、判断模块、检测报告获得模块、内置深度报文检测模块以及外置深度报文检测模块中的至少一个一体成型。
  32. 根据权利要求16至30任一项所述的装置，其特征在于，所述请求模块、接收模块、判断模块、检测报告获得模块以及内置深度报文检测模块中的至少两个一体成型。
  33. 根据权利要求16至30任一项所述的装置，其特征在于，所述请求模块、接收模块、判断模块、检测报告获得模块以及内置深度报文检测模块是所述装置的内部模块，所述内部模块间的操作采用内部消息交互或内部函数调用的方式实现。
PCT/CN2012/078618 2012-07-13 2012-07-13 深度报文检测的方法及装置 WO2014008664A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201280001010.6A CN103718513B (zh) 2012-07-13 2012-07-13 深度报文检测的方法及装置
PCT/CN2012/078618 WO2014008664A1 (zh) 2012-07-13 2012-07-13 深度报文检测的方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2012/078618 WO2014008664A1 (zh) 2012-07-13 2012-07-13 深度报文检测的方法及装置

Publications (1)

Publication Number Publication Date
WO2014008664A1 true WO2014008664A1 (zh) 2014-01-16

Family

ID=49915335

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/078618 WO2014008664A1 (zh) 2012-07-13 2012-07-13 深度报文检测的方法及装置

Country Status (2)

Country Link
CN (1) CN103718513B (zh)
WO (1) WO2014008664A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9088508B1 (en) * 2014-04-11 2015-07-21 Level 3 Communications, Llc Incremental application of resources to network traffic flows based on heuristics and business policies
CN107104944A (zh) * 2017-03-10 2017-08-29 林榆坚 一种网络入侵的检测方法及装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045302A (zh) * 2009-10-10 2011-05-04 中兴通讯股份有限公司 网络攻击的防范方法、业务控制节点及接入节点
CN102542063A (zh) * 2011-12-30 2012-07-04 华为技术有限公司 内容过滤的方法、装置及系统

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102075566A (zh) * 2010-12-24 2011-05-25 华为技术有限公司 业务的分流处理方法、通信设备及网络系统

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045302A (zh) * 2009-10-10 2011-05-04 中兴通讯股份有限公司 网络攻击的防范方法、业务控制节点及接入节点
CN102542063A (zh) * 2011-12-30 2012-07-04 华为技术有限公司 内容过滤的方法、装置及系统

Also Published As

Publication number Publication date
CN103718513B (zh) 2017-02-01
CN103718513A (zh) 2014-04-09

Similar Documents

Publication Publication Date Title
AU2019271627B2 (en) Electronic device for performing network connection based on data transmission of application and method thereof
WO2021010693A1 (en) Method and apparatus for identifying user in ran communication system
WO2018074703A1 (ko) 기지국장치 및 무선구간의 qos 제어방법
WO2016039576A2 (ko) 무선 통신 시스템에서 다중 망 접속을 위한 장치 및 방법
WO2014158008A1 (en) Method and apparatus for controlling congestion in wireless communication system
WO2021141291A1 (ko) 무선 통신 시스템에서 네트워크 트래픽을 수집하는 방법 및 장치
WO2015030491A1 (ko) 멀티 플로우 그룹핑에 기반한 대역폭 제공 방법
WO2020071809A1 (en) Method and apparatus for enhanced assertion management in cloud media processing
EP4133713A1 (en) Method and device for generating and removing dynamic eas using ue app and status
WO2017092498A1 (zh) 一种信息管理方法及用户终端
WO2014077458A1 (ko) 통신망의 종류를 구분하는 방법 및 이를 이용한 콘텐츠 제공 방법
WO2019235813A1 (en) Electronic device supporting multiple wireless communication protocols and method therefor
WO2020197184A1 (en) Multicore electronic device and packet processing method thereof
WO2014119912A1 (ko) 서버 그룹핑 방법 및 장치와 기록매체
WO2016021773A1 (ko) Qos 보장 영상 스트림 방법 및 시스템과 송신 서버
WO2020032353A1 (ko) 전자 장치, 외부 전자 장치 및 외부 전자 장치의 esim 관리 방법
WO2017131332A1 (ko) 기능 분리된 코어 네트워크에서 하향링크 패킷 전송방법
WO2018212537A1 (en) Qos information control method and apparatus
WO2017131285A1 (ko) 컨테이너 네트워크 관리 시스템 및 컨테이너 네트워킹 방법
WO2014008664A1 (zh) 深度报文检测的方法及装置
WO2013122362A1 (ko) 무선 네트워크 부하 저감 정책 운영 방법 및 시스템과 기록매체
WO2015080525A1 (ko) Sdn 환경에서 트래픽의 동적 제어를 위한 방법 및 장치
WO2015096040A1 (zh) 接入节点、移动管理网元以及寻呼消息处理方法
WO2020027631A1 (en) Apparatus and method for establishing connection and clat aware affinity (caa)-based scheduling in multi-core processor
WO2019035634A1 (ko) 소프트웨어 정의 네트워크에서 네트워크 공격을 처리하기 위한 장치 및 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12881016

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12881016

Country of ref document: EP

Kind code of ref document: A1