WO2014085952A1 - 一种策略处理的方法及网络设备 - Google Patents

一种策略处理的方法及网络设备 Download PDF

Info

Publication number
WO2014085952A1
WO2014085952A1 PCT/CN2012/085721 CN2012085721W WO2014085952A1 WO 2014085952 A1 WO2014085952 A1 WO 2014085952A1 CN 2012085721 W CN2012085721 W CN 2012085721W WO 2014085952 A1 WO2014085952 A1 WO 2014085952A1
Authority
WO
WIPO (PCT)
Prior art keywords
condition
rule
business
conditions
mapping relationship
Prior art date
Application number
PCT/CN2012/085721
Other languages
English (en)
French (fr)
Inventor
刘赫伟
史云龙
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to ES12876592.2T priority Critical patent/ES2624219T3/es
Priority to EP12876592.2A priority patent/EP2760158B1/en
Priority to KR1020137031987A priority patent/KR101489420B1/ko
Priority to JP2014550617A priority patent/JP5813252B2/ja
Priority to CN201280003466.6A priority patent/CN103688489B/zh
Priority to PCT/CN2012/085721 priority patent/WO2014085952A1/zh
Priority to US14/088,665 priority patent/US9461888B2/en
Publication of WO2014085952A1 publication Critical patent/WO2014085952A1/zh
Priority to US15/269,381 priority patent/US10225150B2/en

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08Configuration management of networks or network elements
    • H04L41/0893Assignment of logical groups to network elements
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00Data switching networks
    • H04L12/28Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08Configuration management of networks or network elements
    • H04L41/0894Policy-based network configuration management
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/20Network management software packages
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227Filtering policies
    • H04L63/0263Rule management
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00Data switching networks
    • H04L12/54Store-and-forward switching systems 
    • H04L12/56Packet switching systems
    • H04L12/5601Transfer mode dependent, e.g. ATM
    • H04L2012/5603Access techniques

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method for processing a policy and a network device.
  • policy control is an essential function of various core network devices (such as routers, switches, gateways, etc.). As shown in Figure 1, users configure multiple policy rules through configuration interfaces or specific policy scripts. It is delivered to the device, and the device implements multiple services on the device based on policy rules.
  • ADC Application Delivery Controller
  • WOC WAN Optimization Controller
  • URLF Uniform / Universal Resource Locator Filter
  • the execution of the policy rule in the prior art includes the following four steps: message data processing (policy related information collection), condition matching, rule verification, and action execution.
  • the device After receiving the packet data, the device first performs the processing of the Layer 1-7 data, which usually includes unpacking, extracting the header information of each layer, extracting the information of the 7 layers of protocol fields, and the like; and then performing the policy condition on the collected information. Verification, if some conditions are met, enter the rule verification module to perform rule matching; for the matched policy rule, the corresponding business action is performed.
  • Different services may need to include a part of the packet special processing process if the processing of the >3 ⁇ 4 text is different.
  • the embodiments of the present invention provide a method for processing a policy and a network device, which are used to reduce redundancy and repeated operations during policy execution, and improve policy execution performance of the network device.
  • an embodiment of the present invention provides a network device, including: a hybrid orchestrator, a conditional matcher, and a rule matcher, where:
  • the hybrid orchestrator is configured to mix and match all business rules corresponding to multiple business applications running on the network device, each business rule includes conditions and actions to extract conditions of all the business rules, and Constructing at least one condition set using the extracted condition, and generating mapping relationship data for recording a mapping relationship between each business rule and a condition in the condition set;
  • the condition matcher for Each condition set constructed by the orchestration device performs condition matching on the packet feature information of the network data packet received by the network device, and outputs a condition matching result set; the condition matching result set is used to record a condition for successful matching;
  • the rule matcher is configured to determine, according to the condition matching result set, the mapping relationship data generated by the hybrid orchestrator, a service rule that matches the success, and trigger the corresponding business rule that is successfully matched.
  • the service application performs the action corresponding to the successfully matched business rule.
  • the hybrid orchestrator specifically includes: a rule splitting unit, configured to split each of the business rules into conditions and actions;
  • condition classification unit configured to classify the condition after the condition is selected to be de-duplicated, to obtain a condition set of at least one type
  • mapping unit configured to generate mapping relationship data for recording a mapping relationship between each business rule and a condition in the condition set.
  • the mapping unit is specifically configured to: map each condition in the condition set to all service rules that include the condition And establishing a mapping relationship between each of the business rules and the conditions in the condition set, and generating mapping relationship data for recording the mapping relationship; or, the mapping unit is specifically configured to: When each of the business rules is split into conditions and actions, a mapping relationship between each of the business rules and a condition in the business rule is recorded, and the condition is filtered to de-emphasize After the unit removes the repeated condition, the mapping relationship of the record is adjusted, so that each condition in the condition set is mapped to all the business rules including the condition, and a record for recording the adjusted mapping relationship is generated. Map relational data.
  • condition matcher is specifically configured to: receive network data received by the network device The packet characteristic information of the packet is matched with the conditions in the respective condition sets, and the identifier of the condition that the matching is successful is recorded to the condition matching result set.
  • the network device further includes: a detector, configured to the network device Receiving the network data packet to perform packet detection, to collect the packet characteristic information of the network data packet; the condition matching device is specifically configured to use, according to each condition set constructed by the hybrid orchestration device, the The packet feature information of the network packet collected by the detector is conditionally matched, and the condition matching result set is output.
  • the business rule is a composite rule, and the composite rule is a business rule that includes multiple conditions; the hybrid orchestrator is further configured to record a logical relationship between each condition in each of the composite rules;
  • the rule matcher is specifically configured to determine, according to the condition matching result set, the mapping relationship data generated by the hybrid orchestrator, and the logical relationship between the conditions, to determine a business rule that is successfully matched, And invoking the service application to which the successfully matched business rule belongs to perform the action corresponding to the successfully matched business rule, or sending the rule hit message to the service application corresponding to the successfully matched business rule, so that the service application is Performing the horse according to the rule hit message The action corresponding to the successful business rule.
  • the embodiment of the present invention further provides a multi-service policy processing method, including: mixing and arranging all service rules corresponding to multiple service applications, where each service rule includes conditions and actions to extract all the a condition of the business rule, and constructing at least one condition set using the extracted condition, and generating mapping relationship data for recording a mapping relationship between each business rule and a condition in the condition set;
  • condition matching on the packet characteristic information of the received network data packet to output a condition matching result set according to each condition set constructed; the condition matching result set is used to record a condition for successful matching; and matching the result according to the condition
  • the set, and the generated mapping relationship data determine a business rule that matches the success, and triggers the service corresponding to the successfully matched business rule to perform the action corresponding to the successfully matched business rule.
  • the all the business rules corresponding to the multiple service applications are mixed and arranged, including:
  • Classifying the conditions after deduplication to obtain at least one type of condition set
  • mapping relationship data is adjusted to map each condition in the condition set to one or more business rules including the condition, thereby obtaining mapping relationship data between the conditions in the condition set and the respective business rules.
  • the all the business rules corresponding to the multiple service applications are mixed and arranged, including:
  • Classifying the conditions after de-duplication to obtain at least one type of condition set
  • At least one of the service rules is a composite rule
  • the composite rule is a business rule that includes multiple conditions
  • the method further includes: recording a logical relationship between each condition in each of the composite rules;
  • the method for processing a policy and the network device in the embodiment of the present invention by mixing and scheduling the multi-service application policy rules, extract information required for all services in a packet data scanning process, and simultaneously multi-service Uniform condition matching and rule matching, which reduces redundant operations between multiple services, facilitates multi-service convergence on a single device, improves device integration and performance, and reduces service deployment and device hardware costs, and improves network devices.
  • Competitiveness by mixing and scheduling the multi-service application policy rules, extract information required for all services in a packet data scanning process, and simultaneously multi-service Uniform condition matching and rule matching, which reduces redundant operations between multiple services, facilitates multi-service convergence on a single device, improves device integration and performance, and reduces service deployment and device hardware costs, and improves network devices.
  • FIG. 1 is a schematic diagram of a hierarchical deployment manner of multi-service policy control according to the present invention
  • FIG. 2 is a schematic flowchart of a policy rule execution process according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a network of an enterprise private cloud according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a policy processing method according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for processing a policy according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of a method for mixing and scheduling multi-service rules according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a network device according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of a hybrid arranger according to an embodiment of the present invention.
  • FIG. 9 is a schematic flowchart of a process of a condition matcher according to an embodiment of the present disclosure
  • FIG. 10 is a schematic flowchart of a process of a condition matcher according to an embodiment of the present disclosure
  • FIG. 11 is a schematic flowchart of a rule matcher process according to an embodiment of the present invention.
  • FIG. 12 is a schematic flowchart of a policy processing method according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic diagram of a network device according to an embodiment of the present invention.
  • the application scenarios of the technical solutions of the embodiments of the present invention are briefly introduced.
  • the technical solutions provided by the embodiments of the present invention can be applied to multiple applications.
  • a policy control scenario such as a home network, an access network, an aggregation network, a backbone network, an enterprise network, a carrier network, and various private/public clouds.
  • the following is a brief description of the enterprise network private cloud as a typical application scenario.
  • FIG. 3 is a schematic diagram of a network diagram of an enterprise private cloud scenario provided by an embodiment of the present invention, as shown in FIG. 3
  • SW and the router group are built into the local area network.
  • the local area network is interconnected with the data center (WAN) through the WAN (Wide Area Network), and the data center is also deployed with multiple routers, gateways, and multiple Servers (such as Web servers, database servers, etc.);
  • routers and switch devices in each office area usually integrate firewall, WOC, IPS, URLF, etc.
  • routers and switch devices in data centers usually integrate firewalls and WOCs.
  • a variety of business applications such as ADC, IPS, etc. In this case, both routers and switches need to perform multiple types of policy processing.
  • the enterprise private cloud scenario is only a typical application scenario of the technical solution of the present invention, and does not limit the application scenario of the present invention.
  • the embodiment of the present invention The technical solutions are applicable.
  • the following is a general description of the policy processing method provided by the embodiment of the present invention. As shown in FIG. 4, the method mainly includes: message scanning, hybrid orchestration, unified condition matching, and unified rule verification.
  • the packet scanning is mainly performed by means of packet detection, such as DPI (Deep Packet Inspection) of Layer 2-7, and extracts all the packet characteristics required for multiple services from the received network data packet.
  • Information such as URLs, quintuples, protocol types, and more.
  • no unnecessary operations are performed, and only the packet feature information required by the service applications (such as WOC, ADC, IPS, etc.) running by the current network device is extracted.
  • Hybrid orchestration refers to the hybrid orchestration of business rules for all business applications. It mainly includes: (1) extracting similar conditions and constructing multiple types of condition sets only for the difference of related message information; (2) generating conditions and The mapping relationship between rules;
  • the service rule referred to in the embodiment of the present invention is an execution policy of a service application, where a rule includes two parts: a condition and an action.
  • Uniform conditional matching refers to the uniform condition matching of multiple condition sets after hybrid orchestration; unified rule verification refers to the unified rule matching of the mixed ordined rule sets to verify which business rules match successfully.
  • the purpose of unified condition matching and unified verification is to stop the individual conditions and rules from being matched one by one, but to collect multiple message feature information collected after the message is scanned, and to mix multiple condition sets.
  • the hierarchical message feature information is then uploaded to each corresponding condition data set for condition verification, and then the condition verification result is reported to the rule matching module for uniform rule matching, and the hit rule is obtained, and finally the hit rule is executed. Corresponding business actions.
  • the multi-service policy processing method provided by the example includes:
  • condition and action usually contain two parts: condition and action, which can be simply described as: Rule: if (condition set) then (action set); where the condition set includes the logical relationship between the condition and the condition, usually AND, OR; an action set includes a plurality of serial or parallel business actions corresponding to a rule, which may be sequentially represented, for example: action 1; action 2; for simplicity, in the embodiment of the present invention, only one condition and action are included Rule 1: if (condition 1) then action 1 to illustrate; this rule 1 indicates that when condition 1 is satisfied, the corresponding action 1 is executed.
  • all the business rules corresponding to the multiple services are mixed and arranged, including:
  • each business rule splits each business rule into two parts, a condition and an action, and generate mapping relationship data for recording a mapping relationship between each of the business rules and a condition in the business rule;
  • mapping relationship between the conditions in each business rule and the business rule needs to be recorded in the mapping relationship data.
  • Business rules if the verification is successful, it means that its corresponding business rules have been matched, and the actions contained in the business rules can also be triggered to execute; in one embodiment, if there are multiple conditions in all business rules.
  • the composite rule it is not enough to record the mapping relationship between each business rule and the condition of the business rule, because the condition does not uniquely correspond to the rule, which requires recording each rule and the rule.
  • the mapping relationship of conditions also records the logical relationship between the conditions in the same rule.
  • mapping relationship data is only a functional noun. In a specific implementation, it can be a data table, a data file, or the like, which can store data.
  • classifying conditions after removing the repetition to obtain at least one type of condition set specifically, classifying the conditions after the repetition is repeated, the conditions having the same characteristics are classified into one class, for example, an IP address is to be performed.
  • the matching conditions are divided into one category, and the conditions for URL matching are classified into one category.
  • you can also classify by matching for example, the condition of matching by regular expression.
  • it can also be classified according to the level of message information. For example, the conditions of L3 are classified into one class, and the conditions of L7 are classified into one class.
  • condition included in the service rule may be not only a condition related to the feature information of the L1-L7 message data, but also a service event, a protocol type, a service result, and the like.
  • S5014 Adjust the mapping relationship data to map each condition in the foregoing condition set to all the business rules including the condition, so as to obtain the mapping relationship between the condition in the condition set and the respective business rules.
  • step S5022 Since all the extracted conditions are de-emphasized in step S5022, the conditions in each condition set obtained after the classification are unique, but the de-duplication also destroys the previously established mapping relationship data, so the mapping relationship is required. After the data is adjusted, after the adjustment, the business rules containing the same conditions are mapped to the same condition corresponding to the condition set, that is, each condition in the condition set is mapped to one or more business rules including the condition.
  • the method may further include: S5015, compiling each condition set obtained after the classification into a unified format;
  • the classified condition sets are respectively compiled into categories and compiled into a format supported by the condition matching engine.
  • the mapping relationship data of the mapping relationship between the business rule and the condition of the business rule may be compiled into a format required by the rule matching engine; in addition, if there is a composite rule as described above, each of The logical relationship between the conditions in the composite rule is saved to the rule matching engine (or compiled into a format supported by the rule matching engine).
  • the condition matching engine is mainly responsible for the unified verification of various conditions, that is, verifying that the condition data in the business rules are successfully matched.
  • the condition matching engine can be implemented by software or hardware. The logic is implemented, and will not be described here.
  • S502 Perform condition matching on the packet feature information of the received network data packet according to each condition set that is constructed, and output a condition matching result set; the condition matching result set is used to record a condition for successful matching;
  • the packet feature information of the network data packet specifically includes all the packet features related to the service rule of each service application, that is, the packet characteristics that must be used when verifying whether the conditions in each service rule match.
  • the information may specifically be L1-L7 information of the network data packet, such as URL information related to the condition of the URLF rule, quintuple information related to the condition of the IPS rule, etc.
  • the packet characteristic information of the network data packet is further It may include message characteristics information related to conditions such as service events, protocol types, and service results that can be used to determine whether a certain type of service action is performed.
  • condition matching includes: matching the URL of the network packet into the URL condition set, and inputting the IP of the network packet into the IP address condition set for matching, and simultaneously
  • the application layer protocol type of the network packet is input to the application layer protocol type condition set for matching.
  • the specific process of matching is to compare whether the feature information of the network packet matches the condition of each condition set or whether the condition is met.
  • condition matching result set The matching result of each condition set is summarized into a "condition matching result set", and finally reported to the rule matching engine, wherein the condition matching result set is mainly used to indicate which conditions have been successfully matched (hit), and specifically, the matching may be successful.
  • Conditions, in the form of identification, are included in the conditional matching result set.
  • S502 specifically includes:
  • S5021 Perform packet detection on the received network data packet, to extract all the packet feature information required by the multiple service applications.
  • the packet feature information required by the service application specifically refers to the packet feature information related to the service rule corresponding to the service application, or more specifically, the packet feature corresponding to the condition in the service rule.
  • Information that is, message feature information that must be used when verifying that the conditions contained in the business rule are met.
  • the rule matching engine can determine which business rules according to the mapping relationship between the conditions recorded in the mapping relationship data and the business rules. If the matching is successful, that is, the rule is hit; if the business rule is a compound rule with multiple conditions, the rule matching engine needs to be based on the mapping relationship between each business rule and the condition, and the logical relationship between the conditions in each business rule. Determining whether the rule is hit; Finally, triggering the business application corresponding to the successfully matched business rule to perform the action corresponding to the business rule. It can be understood that, the process of performing the triggering action may be: calling the successfully matched business rule.
  • the associated service application performs the action corresponding to the successfully matched business rule; or sends the rule hit message to the service application corresponding to the successfully matched business rule, so that the service application performs the matching according to the rule hit message.
  • the action corresponding to the successful business rule; or the matching result of each business rule is reported to the corresponding business application, so that the service determines whether to perform the action corresponding to the rule according to the matching condition according to the own business rule.
  • the method for policy processing in the embodiment of the present invention by mixing and scheduling multiple service rules, uniformly organizes all service rules, and extracts information required for all services in a packet data scanning process, and only A conditional matching and rule verification process is required to reduce redundant operations between multiple services, facilitate multi-service convergence on a single device, improve device integration and performance, and reduce service deployment and device hardware costs, and improve network devices.
  • Competitiveness The following describes an apparatus embodiment for implementing the foregoing method.
  • the embodiment of the present invention provides a network device.
  • the network device 70 includes: a hybrid orchestrator 720, a condition matcher 730, and a rule matcher. 740, wherein each business rule includes conditions and actions;
  • the hybrid orchestrator 720 is configured to mix and match all the business rules corresponding to the multiple services running on the network device 70, to extract the conditions of the all the business rules, and construct at least one condition set by using the extracted conditions. And generating mapping relationship data for recording a mapping relationship between each business rule and a condition in the condition set; wherein
  • the condition matcher 730 is configured to perform condition matching on the packet feature information of the network data packet received by the network device 70 according to each condition set constructed by the hybrid orchestrator 720, and output a condition matching result set; the condition matching result set Used to record the conditions for successful matching;
  • the rule matcher 740 is configured to determine, according to the condition matching result set output by the condition matcher 730, the mapping relationship data generated by the hybrid orchestrator 720, the business rule matching the success, and trigger the corresponding business rule corresponding to the matching
  • the service application performs the action corresponding to the successfully matched business rule.
  • the hybrid orchestrator 720 specifically includes: a rule splitting unit 7201, a conditional deduplication unit 7202, a condition classification unit 7203, and a mapping unit 7204;
  • the rule splitting unit 7201 is mainly used to split each business rule in the multi-business rule set into Conditions and actions; wherein the multi-service rule set includes all business rules corresponding to one or more business applications running or deployed on the network device 70;
  • the condition filtering deduplication unit 7202 is configured to extract the conditions split by the rule splitting unit 7201, and remove the repeated conditions;
  • the condition classification unit 7203 is configured to classify the condition after the de-weighting unit 7202 is de-weighted to obtain at least one type of condition set;
  • the condition classification unit 7203 classifies the conditions having the same characteristics into one class, for example, classifying the conditions for performing IP address matching into one class, and classifying the conditions for performing URL matching into one class.
  • the conditions matched by the regular expression are classified into one class, and can also be classified according to the message information level.
  • the conditions of L3 are classified into one class, and the conditions of L7 are classified into one class. Wait.
  • the conditions included in the service rule may be not only conditions related to the feature information of the L1-L7 message data, but also may include a service event, a protocol type, a service result, and the like.
  • a policy condition that can be used to determine whether a certain type of business action is performed.
  • the mapping unit 7204 is configured to generate mapping relationship data between the condition set in the condition set and each business rule.
  • the mapping unit 7204 may directly map each condition in the condition set to all the service rules including the condition, to obtain mapping relationship data between the condition set and the service rule in the condition set; In an embodiment, the mapping unit 7204 may also generate, when the rule splitting unit 7201 splits each of the business rules into conditions and actions, for recording each of the business rules and the business rules. Mapping the relationship data between the conditions in the condition, and after the conditional deduplication unit 7202 removes the duplicate condition, adjusting the mapping relationship data to map each condition in the condition set to the inclusion On one or more business rules of the condition, the mapping relationship between the conditions in the condition set and the respective business rules is obtained.
  • the hybrid orchestrator 720 further includes: a compiling unit 7205, configured to separately compile the various types of condition sets obtained after the classification into a unified format; wherein the unified format is The format supported by the conditional matcher 730; correspondingly, the condition matcher 730 is specifically configured to perform the >3 ⁇ 4 text feature information of the network data packet received by the network device 70 according to the condition set of the unified format compiled by the compiling unit 7205. The conditions match, and the condition matches the result set.
  • a compiling unit 7205 configured to separately compile the various types of condition sets obtained after the classification into a unified format
  • the unified format is The format supported by the conditional matcher 730; correspondingly, the condition matcher 730 is specifically configured to perform the >3 ⁇ 4 text feature information of the network data packet received by the network device 70 according to the condition set of the unified format compiled by the compiling unit 7205.
  • the conditions match, and the condition matches the result set.
  • the compiling unit 7205 can also compile the mapping relationship data generated by the mapping unit 7204 into a format supported by the rule matcher 740; in addition, if there is a composite type as described above In the case of rules, the logical relationship between each condition in each business rule needs to be saved into the rule matcher 740 (or compiled into a format supported by the rule matcher before being saved).
  • the condition matcher 730 is specifically configured to match the packet feature information of the network data packet received by the network device 70 with the conditions in the respective condition sets, and the matching success condition And the identifier information is recorded to the condition matching result set.
  • the feature information of the network data packet used for matching herein specifically includes all packet feature information related to the service rule of the service application running on the network device 70, that is, each service.
  • the message characteristic information corresponding to the condition included in the rule; the identifier of the condition is used to uniquely represent the condition, and may be a number, a letter, a string, or the like.
  • the condition matcher 730 performs uniform condition matching in the condition set of each category according to the feature type corresponding to the condition, the message feature information, and the like. It should be noted that the condition set is not limited to the condition set related to the feature information of the L1-L7 message data, and may also include other service events, protocol types, service results, and the like that can be used to determine whether a certain type of service action is performed. Condition set.
  • the processing flow of the condition matcher 730 is as follows: First, the network packet is processed and parsed by one or more processing units (as shown in FIG. 9).
  • the network device 70 may further include: a detector 710, configured to perform packet detection on the received network data packet, to collect all the packets required for multiple services running on the network device.
  • the condition matcher 730 is specifically configured to perform condition matching on the packet feature information of the network packet collected by the detector 710 according to each condition set constructed by the hybrid orchestrator 720, and output a condition matching result set. .
  • the detector 710 may be a plurality of message processing units, wherein each message processing unit is solely responsible for one type of message scanning, such as a processing unit dedicated to L3 processing, which is specifically responsible for a processing unit of the L7 processing, etc.; each packet processing unit jointly extracts all the packet feature information required by the plurality of services; Information, specifically, the packet feature information related to all service rules corresponding to the service application on the network device, or more specifically, the message that must be used when verifying whether the various conditions included in the service rule match. Feature information.
  • the detector can also be a multi-function processor, such as a DPI module, that integrates L3-L7 processing and even other types of message processing functions.
  • the detector 710 can be deployed inside the network device or as a separate service module, deployed outside the network device, and through the bus between the network device. Or other communication methods.
  • condition matcher can be a separate matching engine, which can be implemented by a software algorithm or by hardware logic.
  • the condition matcher may also be divided into multiple logical functional units and deployed to each report in a distributed manner.
  • the hybrid orchestrator classifies the condition set obtained by the classification into the corresponding message processing unit according to the feature classification, and the condition matcher is deployed in each message processing unit, and the message is used as the message processing unit.
  • the processing unit extracts the packet feature information, it reports directly to the condition matcher in the message processing unit. If the condition matches successfully, the result is up to the condition matching result set. As shown in FIG.
  • the rule matcher 740 determines, according to the mapping relationship between each service rule recorded in the condition matching result set and the mapping relationship data and the condition in the business rule, to determine a business rule that has been successfully matched. Then, the service application is invoked to perform the action corresponding to the business rule. It should be noted that if the business rule is a "single condition rule" that only includes one condition, the rule matcher 740 specifically matches the result set according to the condition, and the mapping relationship data.
  • the mapping relationship between each business rule recorded and the condition in the business rule determining which business rules match successfully, that is, the rule is hit, and then triggering the action corresponding to the rule that the business application performs the hit; if the business rule exists
  • the rule matcher 740 specifically matches the result set, the mapping relationship between each business rule recorded in the mapping relationship data and the conditions in the business rule, and each business rule.
  • the rule matcher 740 may directly invoke the service application to which the successfully matched business rule belongs to perform the action corresponding to the successfully matched business rule in a manner of a process/function call; or send the rule hit message to the matching success.
  • Business application corresponding to the business rule to enable the business application And performing, according to the rule hit message, an action corresponding to the successfully matched service rule; where the rule hit message is used to indicate that the service rule has been successfully matched.
  • FIG. 12 is a network device, a multi-service policy execution method for HTTP message URL information, according to an embodiment of the present invention.
  • the network device in the embodiment of the present invention organizes all the service rules by using a mixed arrangement of the multiple service rules, and extracts information required for all services in a packet data scanning process, and only needs to perform condition matching and rule verification.
  • the process reduces redundant operations between multiple services, promotes multi-service convergence on a single device, improves device integration and performance, and reduces service deployment and device hardware costs, thereby improving the competitiveness of network devices.
  • FIG. 13 is a schematic diagram of another network device according to an embodiment of the present invention. As shown in FIG. 13, the network device includes: at least one processor 1001, a memory 1002, a communication interface 1003, and a bus.
  • the processor 1001, the memory 1002, and the communication interface 1003 are connected by a bus and complete communication with each other.
  • the bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Wait.
  • ISA Industry Standard Architecture
  • PCI Peripheral Component
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 12, but it does not mean that there is only one bus or one type of bus. among them:
  • the memory 1002 is for storing executable program code, the program code including computer operating instructions.
  • the memory 1002 may include a high speed RAM memory, and may also include a non-volatile memory, for example, at least one disk memory.
  • processor 1001 runs a program corresponding to the executable program code by reading executable program code stored in memory 1002 for:
  • each business rule includes conditions and actions to extract conditions of all the business rules, and at least one condition set is constructed by using the extracted conditions, and is generated.
  • Mapping relationship data for recording a mapping relationship between each business rule and a condition in the condition set;
  • condition matching on the packet characteristic information of the received network data packet to output a condition matching result set according to each condition set constructed; the condition matching result set is used to record a condition for successful matching; and matching the result according to the condition
  • the set, and the generated mapping relationship data determine a business rule that matches the success, and triggers the service corresponding to the successfully matched business rule to perform the action corresponding to the successfully matched business rule.
  • the processor 1001 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more configured to implement the embodiments of the present invention. integrated circuit.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • the foregoing processor 1001 may be used to perform other processes in the foregoing method embodiments, and details are not described herein again.
  • the communication interface 1003 is mainly used to implement communication between the traffic source determining device of the present embodiment and other devices or devices.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the components displayed by the unit may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in the network device provided by each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention may contribute to the prior art or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. .
  • a network device comprising: a hybrid orchestrator, a condition matcher, and a rule matcher, wherein:
  • the hybrid orchestrator is configured to mix and match all business rules corresponding to multiple business applications running on the network device, each business rule includes conditions and actions to extract conditions of all the business rules, and Constructing at least one condition set using the extracted condition, and generating mapping relationship data for recording a mapping relationship between each business rule and a condition in the condition set;
  • the condition matcher for Each condition set constructed by the orchestration device performs condition matching on the packet feature information of the network data packet received by the network device, and outputs a condition matching result set; the condition matching result set is used to record a condition for successful matching;
  • the rule matcher is configured to determine, according to the condition matching result set, the mapping relationship data generated by the hybrid orchestrator, a service rule that matches the success, and trigger the corresponding business rule that is successfully matched.
  • the service application performs the action corresponding to the successfully matched business rule.
  • hybrid orchestrator comprises:
  • a rule splitting unit configured to split each of the business rules into conditions and actions
  • condition classification unit configured to classify the conditions after the condition screening deduplication unit removes the repetition, to obtain a condition set of at least one type
  • mapping unit configured to generate mapping relationship data for recording a mapping relationship between each business rule and a condition in the condition set.
  • mapping unit is specifically configured to: map each condition in the condition set to all service rules including the condition, to establish each business rule a mapping relationship with the condition of the condition set, and generating mapping relationship data for recording the mapping relationship;

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明实施例提供一种策略处理的方法及网络设备,包括:将多个业务对应的所有业务规则进行混合编排,以构建多个条件数据集;根据构建的多个条件数据集,对接收到的网络数据包的报文特征信息进行统一条件匹配,输出条件匹配结果集;根据条件匹配结果集,调用业务应用执行所述条件匹配结果集中各个条件标识对应的策略动作。本发明实施例的方案,通过对多业务规则进行混合编排,将所有业务规则统一组织,在一次报文数据扫描过程中抽取所有业务所需的信息,且只需进行一次匹配和规则验证过程,减少了多业务之间冗余操作,促进单一设备上的多业务融合,提升设备集成度与性能。

Description

一种策略处理的方法及网络设备
技术领域
本发明涉及通信技术领域, 尤其涉及一种策略处理的方法及网络设备。
背景技术
在通信系统中, 策略控制是各种核心网络设备(如路由器、 交换机、 网关 等)必不可少的功能, 如图 1所示, 用户通过配置界面或特定策略脚本等方式 配置多种策略规则, 并下发到设备,设备基于策略规则实现设备上多种业务的 处理。
当前网络设备, 尤其是路由器、 交换机、 网关等设备上, 应用业务不断增 多, 如应用交付控制 ( Application Delivery Controller, ADC ), 广域网优化控 制( WAN Optimization Controller, WOC )、深度包检测( Deep Packet Inspection, DPI ), 入侵预防系统(Intrusion Prevention System, IPS )、 统一资源定位符过 滤( Uniform / Universal Resource Locator Filter, URLF )等应用业务等。 各种 业务应用对应的策略规则类型及数量也在不断增多。随着业务规则复杂度的提 升, 使得策略处理方法在设备高性能及可靠性方面面临挑战。
如图 2所示,现有技术中策略规则的执行包括以下四个步骤: 报文数据处 理(策略相关信息收集)、 条件匹配、 规则验证、 动作执行。 当设备收到报文 数据后, 首先进行 1-7层数据的处理, 通常包括解包、 抽取各层报文头信息、 抽取 7层协议字段信息等; 然后对收集到的信息进行策略条件的验证, 若某些 条件得到满足, 则进入规则验证模块进行规则匹配; 对于匹配到的策略规则则 会执行相对应的业务动作。 不同业务如果对 >¾文处理过程不同的话, 则有可能 需要包含一部分报文特殊处理过程。
现有技术中, 当各个业务所需要的报文信息存在重复时, 业务处理流程存 在重复。 比如, IPS、 URLF、 ADC都需要对 URL ( Uniform I Universal Resource Locator , 统一资源定位符)信息进行条件匹配, 此时, 每个业务内部的条件匹 配过程是重复的, 同样, 规则验证过程也存在重复。 另外, 报文的处理有时也 存在重复和多余过程, 比如当 IPS需要扫描整个报文数据, 而 URLF只需要扫 描 URL字段, ADC只需要 HTTP ( Hyper Text Transfer Protocol, 超文本传输 协议)报文头域数据时, 现有技术中通常会在 IPS、 URLF、 ADC业务中独立 对报文进行处理, 也就意味着报文会被扫描多次。 即使用现有技术, 重复操作 在报文处理、 条件匹配、 规则匹配各环节中都可能存在。 这种大量重复操作的 存在, 在拥有复杂策略及多业务的设备上会导致业务性能的下降。 发明内容
本发明实施例提供一种策略处理的方法及网络设备,用以减少策略执行过 程中的冗余和重复操作, 提高网络设备的策略执行性能。
第一方面, 本发明实施例提供一种网络设备, 包括: 混合编排器、 条件匹 配器和规则匹配器, 其中:
所述混合编排器,用于将所述网络设备上运行的多个业务应用所对应的所 有业务规则进行混合编排,每个业务规则包含条件和动作, 以提取所述所有业 务规则的条件, 并利用提取的所述条件构建至少一个条件集, 并且生成用于记 录每个业务规则与所述条件集中的条件之间的映射关系的映射关系数据; 所述条件匹配器, 用于根据所述混合编排器构建的各个条件集,对所述网 络设备接收到的网络数据包的报文特征信息进行条件匹配,并输出条件匹配结 果集; 所述条件匹配结果集用于记录匹配成功的条件;
所述规则匹配器, 用于根据所述条件匹配结果集, 以及所述混合编排器生 成的所述映射关系数据, 确定出匹配成功的业务规则, 并触发所述匹配成功的 业务规则所对应的业务应用执行所述匹配成功的业务规则对应的动作。
在第一方面的第一种可能的实施方式中, 所述混合编排器, 具体包括: 规则拆分单元,用于将所述所有业务规则中的每个业务规则拆分成条件和 动作;
条件 选去重单元, 用于提取所述拆分单元拆分成的所述条件,, 并去除 重复的条件;
条件分类单元, 用于将所述条件 选去重单元去重之后的条件进行分类, 得到至少一种类型的条件集;
映射单元,用于生成用于记录每个业务规则与所述条件集中的条件之间的 映射关系的映射关系数据。 结合第一方面的第一种可能的实施方式,在第二种可能的实施方式中, 所 述映射单元具体用于:将所述条件集中每个条件映射到包含所述条件的所有业 务规则上, 以建立每个业务规则与所述条件集中的条件之间的映射关系, 并生 成用于记录所述映射关系的映射关系数据; 或者, 所述映射单元具体用于: 在 规则拆分单元将所述所有业务规则中的每个业务规则拆分成条件和动作时,记 录所述每个业务规则与所述业务规则中的条件之间的映射关系,并在所述所述 条件筛选去重单元去除重复的条件之后,调整记录的所述映射关系, 以使所述 条件集中的每个条件映射到包含所述条件的所有业务规则上,并生成用于记录 所述调整后的映射关系的映射关系数据。
结合第一方面, 或者第一方面的第一、 第二种可能的实施方式, 在第三种 可能的实施方式中, 所述条件匹配器具体用于: 将所述网络设备接收到的网络 数据包的报文特征信息, 同时与所述各个条件集中的条件进行匹配, 并将匹配 成功的条件的标识记录到所述条件匹配结果集。
结合第一方面, 或者第一方面的第一、 第二或第三种可能的实施方式, 在 第四种可能的实施方式中, 该网络设备还包括: 检测器, 用于对所述网络设备 接收到的网络数据包进行报文检测, 以收集所述网络数据包的报文特征信息; 所述所述条件匹配器, 具体用于根据所述混合编排器构建的各个条件集,对所 述检测器收集到的网络数据包的报文特征信息进行条件匹配,并输出条件匹配 结果集。 结合第一方面, 或者第一方面的第一、 第二、 第三或第四种可能的实施方 式, 在第五种可能的实施方式中, 所述网络设备的所有业务规则中, 至少有一 个业务规则为复合型规则, 所述复合型规则为包含多个条件的业务规则; 所述混合编排器, 还用于, 记录每个所述复合型规则中, 各个条件之间的 逻辑关系;
所述规则匹配器, 具体用于, 根据所述条件匹配结果集、 所述混合编排器 生成的所述映射关系数据, 以及所述各个条件之间的逻辑关系, 确定出匹配成 功的业务规则 ,并调用所述匹配成功的业务规则所属的业务应用执行所述匹配 成功的业务规则对应的动作 ,或者发送规则命中消息到所述匹配成功的业务规 则所对应的业务应用, 以使所述业务应用根据所述规则命中消息,执行所述匹 配成功的业务规则对应的动作。
第二方面, 本发明实施例还提供一种多业务的策略处理方法, 包括: 将多个业务应用所对应的所有业务规则进行混合编排,每个业务规则包含 条件和动作, 以提取所述所有业务规则的条件, 并利用提取的所述条件构建至 少一个条件集,并且生成用于记录每个业务规则与所述条件集中的条件之间的 映射关系的映射关系数据;
根据构建的各个条件集,对接收到的网络数据包的报文特征信息进行条件 匹配,以输出条件匹配结果集;所述条件匹配结果集用于记录匹配成功的条件; 根据所述条件匹配结果集, 以及生成的所述映射关系数据,确定出匹配成 功的业务规则,并触发所述匹配成功的业务规则所对应的业务应用执行所述匹 配成功的业务规则对应的动作。
在第二方面的第一种可能的实施方式中,所述将多个业务应用所对应的所 有业务规则进行混合编排, 包括:
将所述所有业务规则中的每个业务规则拆分成条件和动作,并生成用于记 录所述每个业务规则与所述业务规则中的条件之间的映射关系的映射关系数 据;
提取拆分成的条件, 并去除重复的条件;
将去重之后的条件分类, 得到至少一种类型的条件集;
调整所述映射关系数据,以将所述条件集中的每个条件映射到包含所述条 件的一个或多个业务规则上,从而得到述条件集中的条件与各个业务规则之间 的映射关系数据。
在第二方面的第二种可能的实施方式中,所述将多个业务应用所对应的所 有业务规则进行混合编排, 包括:
将所述所有业务规则中的每个业务规则拆分成条件和动作;
提取拆分成的所述条件, 并去除重复的条件;
将去重之后的条件进行分类, 得到至少一种类型的条件集;
将所述条件集中每个条件映射到包含所述条件的所有业务规则上,以得到 所述条件集中的条件与各个业务规则之间的映射关系数据。
结合第二方面, 或者第二方面的第一或第二种可能的实施方式, 在第三种 可能的实施方式中,所述所有业务规则中,至少有一个业务规则为复合型规则, 所述复合型规则为包含多个条件的业务规则;
在将所述所有业务规则中的每个业务规则拆分成条件和动作之后,所述方 法还包括: 记录每个所述复合型规则中, 各个条件之间的逻辑关系;
所述根据所述条件匹配结果集, 以及生成的所述映射关系数据, 确定出匹 配成功的业务规则, 具体包括: 根据所述条件匹配结果集、 所述条件集中的条 件与到各个业务规则之间的映射关系数据, 以及所述各个条件之间的逻辑关 系,确定出匹配成功的业务规则, 并调用所述匹配成功的业务规则所属的业务 应用执行相应的动作。 由上述技术方案可知, 本发明实施例的策略处理的方法及网络设备,通过 对多业务应用策略规则进行混合编排,在一次报文数据扫描过程中抽取所有业 务所需的信息, 同时对多业务进行统一的条件匹配和规则匹配,从而减少了多 业务之间冗余操作, 促进单一设备上的多业务融合, 提升设备集成度与性能, 同时也降低业务部署和设备硬件成本, 提升了网络设备的竟争力。
附图说明 为了更清楚地说明本发明的技术方案 ,下面将对实施例中所需要使用的附 图作一简单地介绍, 显而易见地, 下面附图只是本发明的一些实施例的附图, 对于本领域普通技术人员来讲, 在不付出创造性劳动性的前提下,还可以根据 这些附图获得同样能实现本发明技术方案的其它附图。
图 1 为本发明提供的多业务策略控制的层级部署方式示意图;
图 2 为本发明实施例提供的策略规则执行流程示意图;
图 3为本发明实施例提供的企业私有云的网络示意图;
图 4为本发明实施例提供的策略处理方法的流程示意图;
图 5为本发明实施例提供的策略处理方法的流程图;
图 6为本发明实施例提供的多业务规则混合编排方法示意图;
图 7为本发明实施例提供的网络设备示意图;
图 8为本发明实施例提供的混合编排器示意图;
图 9为本发明实施例提供的条件匹配器的处理流程示意图; 图 10为本发明实施例提供的条件匹配器的处理流程示意图;
图 11为本发明实施例提供的规则匹配器处理流程示意图;
图 12为本发明实施例提供的策略处理方法流程示意图;
图 13为本发明实施例提供的网络设备示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚, 下面将结合本发明实施例 中的附图, 对本发明的技术方案进行清楚、 完整地描述。 显然, 下述的各个实 施例都只是本发明一部分的实施例。基于本发明下述的各个实施例, 本领域普 通技术人员即使没有作出创造性劳动,也可以通过等效变换部分甚至全部的技 术特征,而获得能够解决本发明技术问题,实现本发明技术效果的其它实施例, 而这些变换而来的各个实施例显然并不脱离本发明所公开的范围。
为使本领域一般技术人员更好的了解本发明实施例提供的技术方案,首先 对本发明实施例技术方案的应用场景做一些简单的介绍,本发明实施例提供的 技术方案可应用于多应用业策略控制场景下, 比如家庭网、 接入网、 汇聚网, 骨干网、 企业网、 运营商网络, 以及各种私有 /公有云。 下面以企业网私有云 作为一个典型的应用场景做一个简单说明。
图 3 示出了本发明实施例提供的企业私有云场景的网络示意图, 如图 3
SW ) 以及路由器 (Router )组建成局域网, 同时, 各个办公区构成的局域网 通过 WAN ( Wide Area Network, 广域网)与数据中心 (Data Center ) 互联, 数据中心也部署有多个路由器、 网关以及多种服务器(如 Web服务器、 数据 库服务器等); 其中,各个办公区的路由器和交换机设备上通常会集成防火墙、 WOC、 IPS, URLF等业务, 数据中心的路由器和交换机设备上通常也会集成 防火墙、 WOC、 ADC、 IPS 等多种业务应用, 在这种情形下, 路由器和交换 机都需要进行多种类型的策略处理。
需要说明的是, 企业私有云场景只是本发明技术方案的一个典型应用场 景, 并不对本发明的应用场景构成限制, 在其它的应用场景中, 只要涉及多种 类的策略处理, 本发明实施例的技术方案均适用。 下面先总体介绍本发明实施例提供的策略处理方法,如图 4所示, 该方法 主要包括: 报文扫描、 混合编排、 统一条件匹配, 以及统一规则验证这几个处 理环节。
其中, 报文扫描主要是通过报文检测手段, 比如从 2-7 层的 DPI ( Deep Packet Inspection, 深度报文检测), 从接收到的网络数据包中抽取多业务所需 的所有报文特征信息, 比如 URL、 五元组、 协议类型等信息。 而且, 在报文 扫描过程中, 不做多余操作, 只抽取当前网络设备运行的业务应用(如 WOC、 ADC, IPS等)所需的报文特征信息。
混合编排具体是指对所有业务应用的业务规则进行混合编排, 其主要包 括: ( 1 )仅针对相关报文信息的差异,抽取同类条件,构建多个类型的条件集; ( 2 )生成条件和规则之间的映射关系;
需要说明的是,在本发明实施例所指的业务规则, 即为业务应用的一种执 行策略, 其中, 一条规则包含条件和动作两部分, 具体地, 一条规则中包含的 条件可以为一个或多个, 动作也可以为一个或多个,且同一业务规则中的多个 条件可能来源于不同层次的报文信息, 比如规则 if (IP = 1丄 1.1 && HTTP.host = www.huawei.com) then drop packet 中, "IP = 1.1.1.1 " 和 "HTTP.host = www.huawd.com" 为两个并列的条件, 其中, 前者为 L3 层的条件, 后者为 L7层的条件, 且两者在逻辑上为 "与" 的关系; "drop packet" 则为条件匹配 时, 业务应用需要执行的动作。
统一条件匹配是指对混合编排后的多个条件集进行统一条件匹配; 统一规则验证是指对混合编排后的规则集进行统一的规则匹配,验证哪些 业务规则匹配成功。
统一条件匹配和统一验证的目的是,不再对单个的条件和规则做逐个匹配 的动作, 而是将经过报文扫描后收集的多种报文特征信息, 与混合编排后的多 个条件集进行统一的条件验证和规则匹配; 比如, 还是以上面的规则 if (IP = 1.1.1.1 && HTTP.host = www.huawei.com) then drop packet为例 ,通过才艮文识另 ll 先收集各层次的报文特征信息,然后分别上传至各个对应的条件数据集进行条 件验证, 然后将条件验证的结果上报给规则匹配模块进行统一的规则匹配,得 出已经命中的规则, 最后再执行命中规则对应的业务动作。
基于上述方法原理, 下面介绍一个具体实施例, 如图 5所示, 本发明实施 例提供的多业务的策略处理方法, 包括:
S501 ,将多个业务对应的所有业务规则进行混合编排, 以提取所述所有业 务规则的条件, 并利用提取的所述条件构建至少一个条件集, 并且生成用于记 录每个业务规则与所述条件集中的条件之间的映射关系的映射关系数据;
需要说明的是, 业务规则通常包含条件、 动作两部分, 可简单描述为: 规则: if (条件集) then (动作集); 其中, 条件集包括条件及条件间的逻辑 关系, 通常有 AND、 OR; 动作集包括对应到一条规则的多个串行或并行的业 务动作, 通常可顺序表示, 比如: 动作 1 ; 动作 2; 本发明实施例中为了简单 起见, 以仅包含了一个条件和动作的规则 1 : if (条件 1) then动作 1 , 来说明; 该规则 1表示当条件 1满足时, 就执行对应的动作 1。
具体地,在一个实施例中,对多个业务对应的所有业务规则进行混合编排, 具体包括:
55011 , 将每个业务规则拆分成条件和动作两部分, 并生成用于记录所述 每个业务规则与所述业务规则中的条件之间的映射关系的映射关系数据;
需要说明的是, 当所有业务规则都是如规则 1一样的 "单条件规则" 时, 只需要在映射关系数据中记录每条业务规则中的条件与该业务规则的映射关 系即可, 对于这样的业务规则, 条件如果验证成功, 也就代表其对应的业务规 则已经匹配, 该业务规则中包含的动作也可被触发执行; 在一个实施例中, 如 果所有业务规则中存在包含有多个条件的复合型规则时,仅仅记录每个业务规 则与该业务规则的条件之间的映射关系是不够的,因为此时条件并不能唯一对 应到规则, 这就需要在记录每条规则与该规则的条件的映射关系的同时,还记 录同一规则中各个条件之间的逻辑关系, 即这种情形下, 需要根据同一规则中 包含的每个条件的匹配结果, 以及各个条件的逻辑关系, 才能确定出规则是否 匹配成功。 最后需要说明的是, 映射关系数据仅仅是一个功能性的名词, 在具 体实现中, 其可以为数据表、 数据文件等等可存储数据的载体。
55012, 提取上述拆分成的所有业务规则的条件, 并去除重复的条件。
55013 ,对去除重复之后的条件进行分类, 以得到至少一种类型的条件集; 具体地,对去除重复之后的条件进行分类,是将具有相同特点的条件分为 一类, 例如将进行 IP地址匹配的条件分为一类, 将进行 URL匹配的条件分为 一类。 当然也可以按匹配方式进行分类, 例如按正则表达式方式匹配的条件分 为一类等, 还可以按照报文信息层次进行分类, 比如 L3的条件分为一类, L7 的条件分为一类等。 另外, 需要说明的是, 在另外一种实施方式中, 业务规则 中包含的条件不仅可以是与 L1-L7报文数据的特征信息相关的条件,还可以包 括业务事件、协议类型、业务结果等可以用于判断某一类业务动作是否执行的 策略条件。
S5014 , 调整上述映射关系数据, 以将上述条件集中的每个条件映射到包 含所述条件的所有业务规则上,从而得到述条件集中的条件与到各个业务规则 之间的映射关系数据。
由于步骤 S5022对提取出的所有条件,进行了去重, 因此分类后得到的各 个条件集中的条件均是唯一的,但是去重的同时也破坏了之前建立的映射关系 数据,故需要对映射关系数据进行调整,调整之后, 包含相同条件的业务规则, 均会被映射到条件集中对应的同一条件上, 即条件集中的每一个条件, 均映射 到包含该条件的一个或多个业务规则上。
当然可以理解的是, 在另一个实施例中, 可以对上述步骤做进一步简化, 不釆用先生成映射关系数据,去重之后再调整的方式, 而是在提取所有业务规 则的条件, 去重并分类形成条件集之后, 直接将各个条件集中每个条件映射到 包含所述条件的所有业务规则上,以得到所述条件集中的条件与各个业务规则 之间的映射关系数据。
进一步地, 在另一个实施例中, 在上述步骤 S5014之后, 还可以包括: S5015 , 将分类之后得到的各个条件集编译成统一的格式;
具体地,根据对去重后的条件分类的结果,将分类后的条件集按类别分别 编译, 编译成条件匹配引擎所支持的格式。 进一步地, 还可以将记录业务规则 与业务规则的条件的映射关系的映射关系数据,编译成规则匹配引擎所需的格 式; 另外, 如果存在如上所述的复合型规则时, 还需要将每个复合型规则中各 个条件之间的逻辑关系保存到规则匹配引擎内(或者编译成规则匹配引擎所支 持的格式后再保存)。 需要说明的是, 条件匹配引擎主要负责各种条件的统一 验证, 即验证哪些业务规则中的条件数据匹配成功, 本领域技术人员可以理解 的是, 条件匹配引擎既可由软件实现, 也可以用硬件逻辑来实现, 此处不再赘 述。
下面通过一个具体的实例对上述步骤做一个说明, 如图 6所示, 当前网络 设备具有的业务规则如下 (此处以上述的 "单条件" 规则为例进行说明):
IPS-rulel : if (URL = "url-1") alert threat 1 (告警进程 1 );
IPS-rule2: if (IP = "128.1.1.1") alert threat 2 (告警进程 2 ) ;
URLF-rule 1: if (URL = "url-2") block;
WOC-rulel: if (IP= "128.1.1.1" ) read cache (读緩存 ) ;
ADC-rule 1: if (URL = "url-2") block;
首先,对各个业务规则进行拆分, 将每个业务规则拆分成条件部分和动作 部分, 同时记录规则、 条件之间的映射关系; 图 6中的 URL = "url-l"、 URL = "url-2,,、 IP = "128.1.1.1"等均为条件; alert threat 1、 block, alert threat 2均为 动作; 然后, 对拆分出的所有条件进行去重, 去重的目的是为了去除重复的条 件, 比如 IPS-mle2与 WOC-mlel的条件是重复的, URLF-mlel与 ADC-mlel 的条件重复,将重复的条件去除后,还需要对条件、规则的映射关系进行调整, 比如图 6中所示的条件 ΙΡ = "128.1.1.Γ,, 经过去重操作后, 就需要同时映射到 IPS-mle2和 WOC-mlel这两个规则上, 条件 URL = "url-2", 就需要同时映射 到 URLF-mlel和 ADC-mlel ; 然后, 对去重之后的条件进行分类, 如图 6所 示的, 将 URL有关的条件归为一类, 将 IP有关的条件归为一类, 形成 URL 条件集和 IP条件集。
S502,根据构建的各个条件集,对接收到的网络数据包的报文特征信息进 行条件匹配,输出条件匹配结果集; 所述条件匹配结果集用于记录匹配成功的 条件;
具体地,所述网络数据包的报文特征信息具体包括与各个业务应用的业务 规则相关的所有报文特征,也即在验证各个业务规则中的条件是否匹配时, 必 须用到的报文特征信息,其具体可以为该网络数据包的 L1-L7的信息, 比如与 URLF规则的条件相关的 URL信息、 与 IPS规则的条件相关的五元组信息等, 网络数据包的报文特征信息还可以包括业务事件、协议类型、业务结果等可以 用于判断某一类业务动作是否执行的条件相关的报文特征信息。
假设将各个业务规则的条件进行分类、去重和编译后,形成了多个条件集, 比如 URL条件集、 IP条件集、 应用层协议类型条件集, 则对抽取出的报文特 征信息进行统一条件匹配, 具体包括: 将网络数据包的 URL输入 URL条件集 进行匹配, 同时将网络数据包的 IP输入到 IP地址条件集进行匹配, 同时将网 络数据包的应用层协议类型输入到应用层协议类型条件集进行匹配,匹配的具 体过程就是比较网络数据包的特征信息是否与各个条件集中的条件相匹配或 是否符合条件要求。 将各个条件集的匹配结果汇总成 "条件匹配结果集", 最 后上报至规则匹配引擎, 其中,条件匹配结果集主要用于指示哪些条件已经匹 配成功 (命中), 具体地, 可以将匹配成功的条件, 以标识的方式, 包含在条 件匹配结果集中。
在一种具体的实现方式中, S502具体包括:
S5021 , 对接收到的网络数据包进行报文检测, 以提取所述多个业务应用 所需的所有报文特征信息;
其中, 可以通过 4艮文检测手段, 比如从 2-7 层的 DPI ( Deep Packet
Inspection, 深度报文检测), 从接收到的网络数据包中抽取多业务所需的所有 文特征信息, 比如 URL、 五元组、 协议类型等信息。 而且, 在 ^艮文扫描过 程中, 不做多余操作, 只抽取当前网络设备运行的业务应用(如 WOC、 ADC, IPS等)所需的报文特征信息。 需要说明的是, 业务应用所需的报文特征信息, 具体是指业务应用所对应的业务规则相关的报文特征信息, 或者更确切的说 , 是该业务规则中的条件对应的报文特征信息,也即在验证该业务规则包含的条 件是否满足时, 必须要用到的报文特征信息。
S5022 将提取的所述报文特征信息, 同时与各个条件集中的条件进行匹 配, 并将匹配成功的条件的标识记录到所述条件匹配结果集中。
S503 , 根据条件匹配结果集, 以及生成的所述映射关系数据, 确定出匹配 成功的业务规则,并触发所述匹配成功的业务规则所对应的业务应用执行所述 匹配成功的业务规则对应的动作。
在具体的实施例中,如果业务规则为仅包含一个条件的 "单条件规则"时, 规则匹配引擎会根据映射关系数据中记录的条件与业务规则之间的映射关系, 即可确定哪些业务规则匹配成功, 即规则被命中; 如果业务规则为包含多个条 件的复合型规则时, 规则匹配引擎需要根据每个业务规则与条件的映射关系, 以及每个业务规则中条件间的逻辑关系, 来确定规则是否被命中; 最后, 触发 匹配成功的业务规则所对应的业务应用执行该业务规则对应的动作。可以理解 的是, 上述触发动作执行的过程, 具体可以为: 调用所述匹配成功的业务规则 所属的业务应用执行所述匹配成功的业务规则对应的动作;或者发送规则命中 消息到匹配成功的业务规则所对应的业务应用,以使所述业务应用根据所述规 则命中消息,执行所述匹配成功的业务规则对应的动作; 或者将每个业务规则 的匹配结果上报至对应的业务应用,以使业务根据根据自身的业务规则的匹配 情况, 来决定是否执行规则对应的动作。 由上述技术方案可知, 本发明实施例的策略处理的方法, 通过对多业务规 则进行混合编排, 将所有业务规则统一组织,在一次报文数据扫描过程中抽取 所有业务所需的信息,且只需进行一次条件匹配和规则验证过程, 减少了多业 务之间冗余操作, 促进单一设备上的多业务融合, 提升设备集成度与性能, 同 时也降低业务部署和设备硬件成本, 提升了网络设备的竟争力。 下面介绍实现上述方法的一个装置实施例,如图 7所示, 本发明实施例提 供一种网络设备, 根据图 7 , 该网络设备 70包括: 混合编排器 720、 条件匹配 器 730和规则匹配器 740, 其中, 每个业务规则包含条件和动作;
混合编排器 720, 用于将网络设备 70上运行的多个业务所对应的所有业 务规则进行混合编排, 以提取所述所有业务规则的条件, 并利用提取的所述条 件构建至少一个条件集,并且生成用于记录每个业务规则与所述条件集中的条 件之间的映射关系的映射关系数据; 其中,
条件匹配器 730, 用于根据混合编排器 720构建的各个条件集, 对网络设 备 70接收到的网络数据包的报文特征信息进行条件匹配, 并输出条件匹配结 果集; 所述条件匹配结果集用于记录匹配成功的条件;
规则匹配器 740, 用于根据条件匹配器 730输出的条件匹配结果集, 以及 混合编排器 720生成的映射关系数据, 确定出匹配成功的业务规则, 并触发所 述匹配成功的业务规则所对应的业务应用执行所述匹配成功的业务规则对应 的动作。
具体地, 在一种实施方式中, 如图 8所示, 混合编排器 720具体包括: 规 则拆分单元 7201、 条件 选去重单元 7202、 条件分类单元 7203 , 以及映射单 元 7204; 其中:
规则拆分单元 7201 , 主要用于将多业务规则集中的每个业务规则拆分成 条件和动作; 其中, 多业务规则集包含了网络设备 70上运行或部署的一个或 多个业务应用所对应的所有业务规则;
条件筛选去重单元 7202, 用于提取规则拆分单元 7201拆分出的条件, 并 去除重复的条件;
条件分类单元 7203 ,用于将条件 选去重单元 7202去重之后的条件分类, 得到至少一种类型的条件集;
具体地, 条件分类单元 7203将具有相同特点的条件分为一类, 例如将进 行 IP地址匹配的条件分为一类, 将进行 URL匹配的条件分为一类。 当然也可 以按匹配方式进行分类, 例如按正则表达式方式匹配的条件分为一类等,还可 以按照报文信息层次进行分类, 比如 L3的条件分为一类, L7的条件分为一类 等。 另外, 需要说明的是, 在另外一种实施方式中, 业务规则中包含的条件不 仅可以是与 L1-L7报文数据的特征信息相关的条件,还可以包括业务事件、协 议类型、 业务结果等可以用于判断某一类业务动作是否执行的策略条件。
映射单元 7204 , 用于生成所述条件集中的条件与各个业务规则之间的映 射关系数据。
具体地, 映射单元 7204可以直接将所述条件集中每个条件映射到包含所 述条件的所有业务规则上,以得到所述条件集中的条件与各个业务规则之间的 映射关系数据;在另一个实施例中 ,映射单元 7204也可以在规则拆分单元 7201 将所述所有业务规则中的每个业务规则拆分成条件和动作时,生成用于记录所 述每个业务规则与所述业务规则中的条件之间的映射关系的映射关系数据 ,并 在所述条件 选去重单元 7202去除重复的条件之后,调整所述映射关系数据, 以将所述条件集中的每个条件映射到包含所述条件的一个或多个业务规则上, 从而得到述条件集中的条件与各个业务规则之间的映射关系数据。
进一步地, 在一个实施例中, 混合编排器 720还包括: 编译单元 7205 , 用于将分类后得到的各种类型的条件集按类别分别编译成统一的格式; 其中, 所述统一的格式为条件匹配器 730所支持的格式; 相应地, 条件匹配器 730, 具体用于根据编译单元 7205编译成的统一格式的条件集,对网络设备 70接收 到的网络数据包的 >¾文特征信息进行条件匹配, 并输出条件匹配结果集。
进一步地,编译单元 7205同时还可以将映射单元 7204生成的映射关系数 据, 编译成规则匹配器 740所支持的格式; 另外, 如果存在如上所述的复合型 规则时,还需要将每个业务规则中各个条件之间的逻辑关系保存到规则匹配器 740内 (或者编译成规则匹配器所支持的格式后再保存)。 在一种具体的实现方式中, 条件匹配器 730具体用于将网络设备 70接收 到的网络数据包的报文特征信息, 同时与所述各个条件集中的条件进行匹配, 并将匹配成功的条件的标识记录到所述条件匹配结果集; 其中, 这里用于匹配 的网络数据包的特征信息, 具体包括与网络设备 70上运行的业务应用的业务 规则相关的所有报文特征信息,即各个业务规则包含的条件所对应的报文特征 信息;条件的标识用于唯一地表示条件,其具体可以为数字、字母或字符串等。
条件匹配器 730具体根据条件所对应的特征类型、报文特征信息等,在每 个类别的条件集内进行统一的条件匹配。 需要说明的是, 条件集并不限于与 L1-L7报文数据的特征信息相关的条件集, 还可以包括业务事件、 协议类型、 业务结果等可以用于判断某一类业务动作是否执行的其他条件集。
在一种实施方式中, 如图 9所示, 条件匹配器 730的处理流程如下: 首先, 网络数据包经过一个或多个处理单元的处理和解析(如图 9 中的
L3-L7 处理, 其他处理), 将多业务所需的所有报文特征信息抽取出来, 提交 给条件匹配器进行统一匹配, 然后,条件匹配器根据混合编排器生成的各个条 件集,对抽取出的报文特征信息进行相应的多模匹配, 这种匹配方式是一种集 中式的条件匹配, 条件匹配器的输出结果是条件匹配结果集, 即已经匹配成功 的条件的标识集合, 其中每个条件标识唯一表示一个条件。 在另一个实施例中, 网络设备 70还可以包括: 检测器 710 , 用于对接收 到的网络数据包进行报文检测,以收集所述网络设备上运行的多个业务所需的 所有报文特征信息; 相应地, 条件匹配器 730具体用于, 根据混合编排器 720 构建的各个条件集,对检测器 710收集到的网络数据包的报文特征信息进行条 件匹配, 并输出条件匹配结果集。
需要说明的是, 在实际应用中, 检测器 710可以是多个报文处理单元, 其 中每个报文处理单元单独负责一种类型的报文扫描, 比如专门负责 L3处理的 处理单元, 专门负责 L7处理的处理单元等; 各个报文处理单元共同抽取出所 述多个业务所需的所有报文特征信息; 需要说明的是, 业务所需的报文特征信 息 ,具体是指网络设备上的业务应用所对应的所有业务规则相关的报文特征信 息, 或者更确切的说, 是在验证业务规则包含的各个条件是否匹配时, 必须要 用到的报文特征信息。 在另一种实现方式中, 检测器也可以是一个集成了 L3-L7处理,甚至其它类型报文处理功能的多功能处理器,如 DPI模块。另夕卜, 本领域技术人员可以理解的是, 在实际应用中,检测器 710既可以部署在网络 设备内部, 也可以作为一个单独的业务模块, 部署在网络设备外部, 与网络设 备间通过总线或其他通信方式对接。
在一种应用场景中,条件匹配器可以为一个单独的匹配引擎, 该匹配引擎 可由软件算法来实现, 也可由硬件逻辑来实现。
在另一种应用场景中, 如图 10所示, 如果监测器 710包含多个 4艮文处理 单元, 则条件匹配器也可以分为多个逻辑功能单元, 以分布式的方式部署到各 个报文处理单元中; 在这种场景下, 混合编排器将分类后得到的条件集, 按照 特征分类分别下放到对应的报文处理单元,条件匹配器部署在各报文处理单元 内部, 当报文处理单元抽取出报文特征信息后, 直接上报至该报文处理单元中 的条件匹配器, 如果条件匹配成功时, 则将结果上 至条件匹配结果集。 如图 11所示, 规则匹配器 740, 具体根据条件匹配结果集和映射关系数 据中记录的每个业务规则与该业务规则中的条件之间的映射关系,确定出已经 匹配成功的业务规则, 然后调用业务应用执行该业务规则对应的动作, 需要说 明的是, 如果业务规则为仅包一个条件的 "单条件规则" 时, 规则匹配器 740 具体会根据条件匹配结果集,以及映射关系数据中记录的每个业务规则与该业 务规则中的条件之间的映射关系,确定哪些业务规则匹配成功,即规则被命中, 然后触发业务应用执行命中的规则所对应的动作;如果业务规则中存在包含有 多个条件的复合型规则时,规则匹配器 740具体会根据条件匹配结果集、 映射 关系数据中记录的每个业务规则与该业务规则中的条件之间的映射关系,以及 每个业务规则中的各个条件之间的逻辑关系, 来确定规则是否被命中, 最后, 触发匹配成功的业务规则所对应的业务应用执行该业务规则对应的动作。具体 地, 规则匹配器 740可以釆用进程 /函数调用的方式, 直接调用所述匹配成功 的业务规则所属的业务应用执行所述匹配成功的业务规则对应的动作;或者发 送规则命中消息到匹配成功的业务规则所对应的业务应用,以使所述业务应用 根据所述规则命中消息, 执行所述匹配成功的业务规则对应的动作; 其中, 该 规则命中消息用于指示业务规则已匹配成功。 下面通过一个具体的实例, 来描述上述网络设备进行策略执行的过程。 图 12是基于本发明实施例的网络设备, 针对 HTTP报文 URL信息的多业务策略 执行方法。根据图 12, 首先通过混合编排器对所有业务规则进行混合编排(图 11示出了 3条业务规则 ), 然后, 抽取出所有的 URL匹配条件下发至 URL条 件匹配器, 并将条件与策略规则及策略动作的对应关系下发至规则匹配器; 在 策略执行时, 报文经过 DPI处理后得到的 URL信息发送给 URL条件匹配器, 进行统一的条件匹配, 得到的匹配结果发送给规则匹配器, 假设此时命中了 ADC的规则, 则直接调用 ADC业务单元执行对应动作即可。 可见, 在本发明 方法实施例中, URL 只需进行一次匹配过程, 规则验证也只需一次, 而业务 单元的调用也只需一次, 去除了多业务之间的冗余操作。
最后需要说明的是,本发明实施例提供的网络设备的具体工作原理和工作 过程, 可以参照前述的方法实施例, 此处不再赘述。
本发明实施例的网络设备,通过对多业务规则进行混合编排,将所有业务 规则统一组织,在一次报文数据扫描过程中抽取所有业务所需的信息, 且只需 进行一次条件匹配和规则验证过程, 减少了多业务之间冗余操作,促进单一设 备上的多业务融合,提升设备集成度与性能, 同时也降低业务部署和设备硬件 成本, 提升了网络设备的竟争力。 图 13示出了本发明实施例提供的另一网络设备示意图,如图 13所示, 网络 设备包括: 至少一个处理器 1001、 存储器 1002、 通信接口 1003和总线。 处理器 1001、存储器 1002和通信接口 1003通过总线连接并完成相互间的通信。 所述总 线可以是工业标准体系结构( Industry Standard Architecture,简称为 ISA )总线、 外部设备互连( Peripheral Component, 简称为 PCI ) 总线或扩展工业标准体系 结构 (Extended Industry Standard Architecture, 简称为 EISA ) 总线等。 所述总 线可以分为地址总线、 数据总线、 控制总线等。 为便于表示, 图 12中仅用一条 粗线表示, 但并不表示仅有一根总线或一种类型的总线。 其中: 存储器 1002用于存储可执行程序代码, 该程序代码包括计算机操作指令。 存储器 1002可能包含高速 RAM存储器, 也可能还包括非易失性存储器 ( non-volatile memory ) , 例 口至少一个磁盘存 4诸器。
在一个实施例中,处理器 1001通过读取存储器 1002中存储的可执行程序代 码来运行与所述可执行程序代码对应的程序, 以用于:
将多个业务应用所对应的所有业务规则进行混合编排,每个业务规则包含 条件和动作, 以提取所述所有业务规则的条件, 并利用提取的所述条件构建至 少一个条件集,并且生成用于记录每个业务规则与所述条件集中的条件之间的 映射关系的映射关系数据;
根据构建的各个条件集 ,对接收到的网络数据包的报文特征信息进行条件 匹配,以输出条件匹配结果集;所述条件匹配结果集用于记录匹配成功的条件; 根据所述条件匹配结果集, 以及生成的所述映射关系数据,确定出匹配成 功的业务规则,并触发所述匹配成功的业务规则所对应的业务应用执行所述匹 配成功的业务规则对应的动作。
其中, 上述流程的具体细节, 可以参照上述方法及装置实施例, 此处不再 赘述。
处理器 1001可能是一个中央处理器( Central Processing Unit,简称为 CPU ), 或者是特定集成电路 ( Application Specific Integrated Circuit, 简称为 ASIC ) , 或者是被配置成实施本发明实施例的一个或多个集成电路。
需说明的是, 上述处理器 1001除了具有上述功能之外,还可用于执行上述 方法实施例中的其他流程, 在此不再赘述。
通信接口 1003主要用于实现本实施例的流量来源确定设备与其他设备或 装置之间的通信。 在本申请所提供的几个实施例中, 应该理解到, 所揭露的系 统, 装置和方法, 可以通过其它的方式实现。 例如, 以上所描述的装置实施例 仅仅是示意性的。 单元显示的部件可以是或者也可以不是物理单元, 即可以位于一个地方, 或者 也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部 单元来实现本实施例方案的目的。 另外,在本发明各个实施例提供的网络设备中的各功能单元可以集成在一 个处理单元中,也可以是各个单元单独物理存在, 也可以两个或两个以上单元 集成在一个单元中。上述集成的单元既可以釆用硬件的形式实现,也可以釆用 软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售 或使用时, 可以存储在一个计算机可读取存储介质中。 基于这样的理解, 本发 明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全 部或部分可以以软件产品的形式体现出来,该计算机软件产品存储在一个存储 介质中, 包括若干指令用以使得一台计算机设备(可以是个人计算机,服务器, 或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。 而前述 的存储介质包括: U盘、移动硬盘、 只读存储器(ROM, Read-Only Memory ) 、 随机存取存储器 ( RAM, Random Access Memory ) 、 磁碟或者光盘等各种可 以存储程序代码的介质。
最后应说明的是: 以上实施例仅用以说明本发明的技术方案, 而非对其限 制; 尽管参照前述实施例对本发明进行了详细的说明, 本领域的普通技术人员 应当理解: 其依然可以对前述各实施例所记载的技术方案进行修改, 或者对其 中部分技术特征进行等同替换; 而这些修改或者替换, 并不使相应技术方案的 本质脱离本发明各实施例技术方案的精神和范围。
权 利 要 求
1、 一种网络设备, 其特征在于, 包括: 混合编排器、 条件匹配器和规则 匹配器, 其中:
所述混合编排器,用于将所述网络设备上运行的多个业务应用所对应的所 有业务规则进行混合编排,每个业务规则包含条件和动作, 以提取所述所有业 务规则的条件, 并利用提取的所述条件构建至少一个条件集, 并且生成用于记 录每个业务规则与所述条件集中的条件之间的映射关系的映射关系数据; 所述条件匹配器, 用于根据所述混合编排器构建的各个条件集,对所述网 络设备接收到的网络数据包的报文特征信息进行条件匹配,并输出条件匹配结 果集; 所述条件匹配结果集用于记录匹配成功的条件;
所述规则匹配器, 用于根据所述条件匹配结果集, 以及所述混合编排器生 成的所述映射关系数据, 确定出匹配成功的业务规则, 并触发所述匹配成功的 业务规则所对应的业务应用执行所述匹配成功的业务规则对应的动作。
2、 根据权利要求 1所述的网络设备, 其特征在于, 所述混合编排器, 具 体包括:
规则拆分单元,用于将所述所有业务规则中的每个业务规则拆分成条件和 动作;
条件 选去重单元, 用于提取所述拆分单元拆分成的所述条件,, 并去除 重复的条件;
条件分类单元,用于将所述条件筛选去重单元去除重复之后的条件进行分 类, 得到至少一种类型的条件集;
映射单元,用于生成用于记录每个业务规则与所述条件集中的条件之间的 映射关系的映射关系数据。
3、 根据权利要求 2所述的网络设备, 其特征在于, 所述映射单元具体用 于: 将所述条件集中每个条件映射到包含所述条件的所有业务规则上, 以建立 每个业务规则与所述条件集中的条件之间的映射关系,并生成用于记录所述映 射关系的映射关系数据;

Claims

或者, 所述映射单元具体用于: 在规则拆分单元将所述所有业务规则中的 每个业务规则拆分成条件和动作时,记录所述每个业务规则与所述业务规则中 的条件之间的映射关系, 并在所述所述条件 选去重单元去除重复的条件之 后,调整记录的所述映射关系, 以使所述条件集中的每个条件映射到包含所述 条件的所有业务规则上,并生成用于记录所述调整后的映射关系的映射关系数 据。
4、 根据权利要求 2或 3所述的网络设备, 其特征在于, 所述混合编排器 还包括:编译单元,用于将所述条件分类单元分类后形成的各个类型的条件集, 分别编译成统一的格式, 所述统一的格式为所述条件匹配器所支持的格式; 所 述条件匹配器, 具体用于根据所述编译单元编译成的统一格式的条件集,对所 述网络设备接收到的网络数据包的报文特征信息进行条件匹配,并输出条件匹 配结果集。 5、 根据权利要求 1-4任一项所述的网络设备, 其特征在于, 所述条件匹 配器具体用于:
将所述网络设备接收到的网络数据包的报文特征信息,同时与所述各个条 件集中的条件进行匹配,并将匹配成功的条件的标识记录到所述条件匹配结果
6、 根据权利要求 5所述的网络设备, 其特征在于, 还包括:
检测器, 用于对所述网络设备接收到的网络数据包进行报文检测, 以收集 所述网络数据包的报文特征信息; 所述条件匹配器, 具体用于根据所述混合编 排器构建的各个条件集,对所述检测器收集到的网络数据包的报文特征信息进 行条件匹配, 并输出条件匹配结果集。
7、 根据权利要求 6所述的网络设备, 其特征在于, 所述检测器包括多个 文处理单元, 所述多个"¾文处理单元共同收集得到所述网络数据包中, 所述 多个业务应用所需的所有报文特征信息。 8、 根据权利要求 7所述的网络设备, 其特征在于, 所述条件匹配器以分 布式的方式部署在所述多个报文处理单元中。
9、 根据权利要求 1-8任一项所述的网络设备, 其特征在于, 所述所有业 务规则中, 至少有一个业务规则为复合型规则, 所述复合型规则为包含多个条 件的业务规则;
所述混合编排器, 还用于, 记录每个所述复合型规则中, 各个条件之间的 逻辑关系;
所述规则匹配器, 具体用于, 根据所述条件匹配结果集、 所述混合编排器 记录的所述映射关系, 以及所述各个条件之间的逻辑关系,确定出匹配成功的 业务规则 ,并调用所述匹配成功的业务规则所属的业务应用执行所述匹配成功 的业务规则对应的动作,或者发送规则命中消息到所述匹配成功的业务规则所 对应的业务应用, 以使所述业务应用根据所述规则命中消息,执行所述匹配成 功的业务规则对应的动作。
10、 一种多业务的策略处理方法, 其特征在于, 包括:
将多个业务应用所对应的所有业务规则进行混合编排,每个业务规则包含 条件和动作, 以提取所述所有业务规则的条件, 并利用提取的所述条件构建至 少一个条件集,并且生成用于记录每个业务规则与所述条件集中的条件之间的 映射关系的映射关系数据;
根据构建的各个条件集,对接收到的网络数据包的报文特征信息进行条件 匹配, 输出条件匹配结果集; 所述条件匹配结果集用于记录匹配成功的条件; 根据所述条件匹配结果集, 以及生成的所述映射关系数据,确定出匹配成 功的业务规则,并触发所述匹配成功的业务规则所对应的业务应用执行所述匹 配成功的业务规则对应的动作。
11、 根据权利要求 10所述的方法, 其特征在于, 所述将多个业务应用所 对应的所有业务规则进行混合编排, 包括:
将所述所有业务规则中的每个业务规则拆分成条件和动作,并生成用于记 录所述每个业务规则与所述业务规则中的条件之间的映射关系的映射关系数 据;
提取拆分成的条件, 并去除重复的条件;
将去除重复之后的条件分类, 得到至少一种类型的条件集;
调整所述映射关系数据,以将所述条件集中的每个条件映射到包含所述条 件的所有业务规则上,从而得到述条件集中的条件与各个业务规则之间的映射 关系数据。
12、 根据权利要求 10所述的方法, 其特征在于, 所述将多个业务应用所 对应的所有业务规则进行混合编排, 包括:
将所述所有业务规则中的每个业务规则拆分成条件和动作;
提取拆分成的所述条件, 并去除重复的条件;
将去除重复之后的条件进行分类, 得到至少一种类型的条件集; 将所述条件集中的每个条件映射到包含所述条件的所有业务规则上,以得 到所述条件集中的条件与各个业务规则之间的映射关系数据。 13、 根据权利要求 10-12任一项所述的方法, 其特征在于, 所述根据构建 的各个条件集,对接收到的网络数据包的报文特征信息进行条件匹配, 以输出 条件匹配结果集, 包括:
对接收到的网络数据包进行报文检测,以提取所述多个业务应用所需的所 有报文特征信息;
将提取的所述 文特征信息, 同时与各个条件集中的条件进行匹配, 并将 匹配成功的条件的标识记录到所述条件匹配结果集中。
14、 根据权利要求 10-13任一项所述的方法, 其特征在于, 所述所有业务 规则中, 至少有一个业务规则为复合型规则, 所述复合型规则为包含多个条件 的业务规则;
在将所述所有业务规则中的每个业务规则拆分成条件和动作之后,所述方 法还包括: 记录每个所述复合型规则中, 各个条件之间的逻辑关系;
所述根据所述条件匹配结果集, 以及生成的所述映射关系数据, 确定出匹 配成功的业务规则, 具体包括: 根据所述条件匹配结果集、 所述映射关系, 以 及所述各个条件之间的逻辑关系,确定出匹配成功的业务规则, 并调用所述匹 配成功的业务规则所属的业务应用执行相应的动作。
15、 根据权利要求 10-13任一项所述的方法, 其特征在于, 所述触发所述 匹配成功的业务规则所对应的业务应用执行所述匹配成功的业务规则对应的 动作, 包括:
调用所述匹配成功的业务规则所属的业务应用执行所述匹配成功的业务 规则对应的动作;或者发送规则命中消息到所述匹配成功的业务规则所对应的 业务应用, 以使所述业务应用根据所述规则命中消息,执行所述匹配成功的业 务规则对应的动作。
PCT/CN2012/085721 2012-12-03 2012-12-03 一种策略处理的方法及网络设备 WO2014085952A1 (zh)

Priority Applications (8)

Application Number Priority Date Filing Date Title
ES12876592.2T ES2624219T3 (es) 2012-12-03 2012-12-03 Método de procesamiento de políticas y dispositivo de red
EP12876592.2A EP2760158B1 (en) 2012-12-03 2012-12-03 Policy processing method and network device
KR1020137031987A KR101489420B1 (ko) 2012-12-03 2012-12-03 폴리시 처리 방법 및 네트워크 장치
JP2014550617A JP5813252B2 (ja) 2012-12-03 2012-12-03 ポリシー処理方法およびネットワークデバイス
CN201280003466.6A CN103688489B (zh) 2012-12-03 2012-12-03 一种策略处理的方法及网络设备
PCT/CN2012/085721 WO2014085952A1 (zh) 2012-12-03 2012-12-03 一种策略处理的方法及网络设备
US14/088,665 US9461888B2 (en) 2012-12-03 2013-11-25 Policy processing method and network device
US15/269,381 US10225150B2 (en) 2012-12-03 2016-09-19 Policy processing method and network device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2012/085721 WO2014085952A1 (zh) 2012-12-03 2012-12-03 一种策略处理的方法及网络设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/088,665 Continuation US9461888B2 (en) 2012-12-03 2013-11-25 Policy processing method and network device

Publications (1)

Publication Number Publication Date
WO2014085952A1 true WO2014085952A1 (zh) 2014-06-12

Family

ID=50323333

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/085721 WO2014085952A1 (zh) 2012-12-03 2012-12-03 一种策略处理的方法及网络设备

Country Status (7)

Country Link
US (2) US9461888B2 (zh)
EP (1) EP2760158B1 (zh)
JP (1) JP5813252B2 (zh)
KR (1) KR101489420B1 (zh)
CN (1) CN103688489B (zh)
ES (1) ES2624219T3 (zh)
WO (1) WO2014085952A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2835943A4 (en) * 2013-06-03 2015-05-27 Huawei Tech Co Ltd SERVICE PROCESS CONTROL METHOD AND NETWORK DEVICE

Families Citing this family (100)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014085952A1 (zh) * 2012-12-03 2014-06-12 华为技术有限公司 一种策略处理的方法及网络设备
US10749711B2 (en) 2013-07-10 2020-08-18 Nicira, Inc. Network-link method useful for a last-mile connectivity in an edge-gateway multipath system
US10454714B2 (en) 2013-07-10 2019-10-22 Nicira, Inc. Method and system of overlay flow control
CN104104615B (zh) * 2014-07-21 2017-07-07 华为技术有限公司 策略冲突解决方法以及装置
CN104202206A (zh) * 2014-07-25 2014-12-10 汉柏科技有限公司 报文处理装置及方法
CN104202249A (zh) * 2014-07-25 2014-12-10 汉柏科技有限公司 报文处理方法及装置
CN104219238B (zh) * 2014-08-30 2018-05-29 华为技术有限公司 报文处理方法和装置
CN104243487A (zh) * 2014-09-28 2014-12-24 网神信息技术(北京)股份有限公司 安全网关的规则匹配方法和装置
KR102364712B1 (ko) 2015-04-03 2022-02-18 한국전자통신연구원 분산 클라우드 환경에서 서비스 오케스트레이션 시스템 및 방법
US10425382B2 (en) 2015-04-13 2019-09-24 Nicira, Inc. Method and system of a cloud-based multipath routing protocol
US10498652B2 (en) 2015-04-13 2019-12-03 Nicira, Inc. Method and system of application-aware routing with crowdsourcing
US10135789B2 (en) 2015-04-13 2018-11-20 Nicira, Inc. Method and system of establishing a virtual private network in a cloud service for branch networking
CN105592053B (zh) * 2015-09-14 2018-11-27 新华三技术有限公司 一种匹配规则的匹配方法和装置
US10003466B1 (en) * 2015-09-15 2018-06-19 Amazon Technologies, Inc. Network traffic with credential signatures
CN106815112B (zh) * 2015-11-27 2020-03-24 大唐软件技术股份有限公司 一种基于深度包检测的海量数据监控系统及方法
US10069934B2 (en) 2016-12-16 2018-09-04 Vignet Incorporated Data-driven adaptive communications in user-facing applications
US11127308B2 (en) 2016-05-11 2021-09-21 Vignet Incorporated Personalized digital therapeutic interventions
US9753618B1 (en) 2016-05-11 2017-09-05 Vignet Incorporated Multi-level architecture for dynamically generating interactive program modules
US9858063B2 (en) 2016-02-10 2018-01-02 Vignet Incorporated Publishing customized application modules
US9848061B1 (en) 2016-10-28 2017-12-19 Vignet Incorporated System and method for rules engine that dynamically adapts application behavior
US9928230B1 (en) 2016-09-29 2018-03-27 Vignet Incorporated Variable and dynamic adjustments to electronic forms
US9983775B2 (en) 2016-03-10 2018-05-29 Vignet Incorporated Dynamic user interfaces based on multiple data sources
CN105912571A (zh) * 2016-03-30 2016-08-31 广东凯通软件开发有限公司 告警处理方法及装置
US10992568B2 (en) 2017-01-31 2021-04-27 Vmware, Inc. High performance software-defined core network
US11121962B2 (en) 2017-01-31 2021-09-14 Vmware, Inc. High performance software-defined core network
US11252079B2 (en) 2017-01-31 2022-02-15 Vmware, Inc. High performance software-defined core network
US20200036624A1 (en) 2017-01-31 2020-01-30 The Mode Group High performance software-defined core network
US11706127B2 (en) 2017-01-31 2023-07-18 Vmware, Inc. High performance software-defined core network
US20180219765A1 (en) 2017-01-31 2018-08-02 Waltz Networks Method and Apparatus for Network Traffic Control Optimization
US10992558B1 (en) 2017-11-06 2021-04-27 Vmware, Inc. Method and apparatus for distributed data network traffic optimization
US10778528B2 (en) 2017-02-11 2020-09-15 Nicira, Inc. Method and system of connecting to a multipath hub in a cluster
US10574528B2 (en) 2017-02-11 2020-02-25 Nicira, Inc. Network multi-source inbound quality of service methods and systems
CN106897927A (zh) * 2017-02-16 2017-06-27 中国人民银行清算总中心 一种交易系统业务检查方法及系统
US10803411B1 (en) 2017-04-17 2020-10-13 Microstrategy Incorporated Enterprise platform deployment
US10523539B2 (en) 2017-06-22 2019-12-31 Nicira, Inc. Method and system of resiliency in cloud-delivered SD-WAN
CN107508698B (zh) * 2017-07-20 2020-07-24 上海交通大学 雾计算中基于内容感知和带权图的软件定义服务重组方法
CN109391590A (zh) * 2017-08-07 2019-02-26 中国科学院信息工程研究所 一种面向网络访问控制的规则描述方法及构建方法、介质
US10805114B2 (en) 2017-10-02 2020-10-13 Vmware, Inc. Processing data messages of a virtual network that are sent to and received from external service machines
US10999100B2 (en) 2017-10-02 2021-05-04 Vmware, Inc. Identifying multiple nodes in a virtual network defined over a set of public clouds to connect to an external SAAS provider
US10959098B2 (en) 2017-10-02 2021-03-23 Vmware, Inc. Dynamically specifying multiple public cloud edge nodes to connect to an external multi-computer node
US11115480B2 (en) 2017-10-02 2021-09-07 Vmware, Inc. Layer four optimization for a virtual network defined over public cloud
US10999165B2 (en) 2017-10-02 2021-05-04 Vmware, Inc. Three tiers of SaaS providers for deploying compute and network infrastructure in the public cloud
US11089111B2 (en) 2017-10-02 2021-08-10 Vmware, Inc. Layer four optimization for a virtual network defined over public cloud
US10521557B2 (en) 2017-11-03 2019-12-31 Vignet Incorporated Systems and methods for providing dynamic, individualized digital therapeutics for cancer prevention, detection, treatment, and survivorship
US11153156B2 (en) 2017-11-03 2021-10-19 Vignet Incorporated Achieving personalized outcomes with digital therapeutic applications
US10756957B2 (en) 2017-11-06 2020-08-25 Vignet Incorporated Context based notifications in a networked environment
US11223514B2 (en) 2017-11-09 2022-01-11 Nicira, Inc. Method and system of a dynamic high-availability mode based on current wide area network connectivity
US10095688B1 (en) 2018-04-02 2018-10-09 Josh Schilling Adaptive network querying system
CN110830278A (zh) * 2018-08-09 2020-02-21 中兴通讯股份有限公司 一种设备配置更新方法、更新装置及计算机可读存储介质
US10775974B2 (en) 2018-08-10 2020-09-15 Vignet Incorporated User responsive dynamic architecture
CN109376988B (zh) * 2018-09-11 2022-11-18 创新先进技术有限公司 一种业务数据的处理方法和装置
US11158423B2 (en) 2018-10-26 2021-10-26 Vignet Incorporated Adapted digital therapeutic plans based on biomarkers
CN109361701A (zh) * 2018-12-07 2019-02-19 北京知道创宇信息技术有限公司 网络安全检测方法、装置及服务器
US10762990B1 (en) 2019-02-01 2020-09-01 Vignet Incorporated Systems and methods for identifying markers using a reconfigurable system
CN111698110B (zh) * 2019-03-14 2023-07-18 深信服科技股份有限公司 一种网络设备性能分析方法、系统、设备及计算机介质
CN110266746B (zh) * 2019-03-29 2022-04-29 星融元数据技术(苏州)有限公司 一种信息推送方法及装置
CN110336798B (zh) * 2019-06-19 2022-05-13 南京中新赛克科技有限责任公司 一种基于dpi的报文匹配过滤方法及其装置
CN110675236A (zh) * 2019-08-27 2020-01-10 阿里巴巴集团控股有限公司 基于分布式的税费计算方法以及装置
US11310170B2 (en) 2019-08-27 2022-04-19 Vmware, Inc. Configuring edge nodes outside of public clouds to use routes defined through the public clouds
US11714658B2 (en) 2019-08-30 2023-08-01 Microstrategy Incorporated Automated idle environment shutdown
US11755372B2 (en) 2019-08-30 2023-09-12 Microstrategy Incorporated Environment monitoring and management
US11044190B2 (en) 2019-10-28 2021-06-22 Vmware, Inc. Managing forwarding elements at edge nodes connected to a virtual network
US11394640B2 (en) 2019-12-12 2022-07-19 Vmware, Inc. Collecting and analyzing data regarding flows associated with DPI parameters
US11489783B2 (en) 2019-12-12 2022-11-01 Vmware, Inc. Performing deep packet inspection in a software defined wide area network
US11689959B2 (en) 2020-01-24 2023-06-27 Vmware, Inc. Generating path usability state for different sub-paths offered by a network link
US11102304B1 (en) 2020-05-22 2021-08-24 Vignet Incorporated Delivering information and value to participants in digital clinical trials
CN111600904B (zh) * 2020-05-29 2022-08-05 福建光通互联通信有限公司 一种绿色上网的方法和存储设备
US11245641B2 (en) 2020-07-02 2022-02-08 Vmware, Inc. Methods and apparatus for application aware hub clustering techniques for a hyper scale SD-WAN
US11709710B2 (en) 2020-07-30 2023-07-25 Vmware, Inc. Memory allocator for I/O operations
US11127506B1 (en) 2020-08-05 2021-09-21 Vignet Incorporated Digital health tools to predict and prevent disease transmission
US11504011B1 (en) 2020-08-05 2022-11-22 Vignet Incorporated Early detection and prevention of infectious disease transmission using location data and geofencing
US11456080B1 (en) 2020-08-05 2022-09-27 Vignet Incorporated Adjusting disease data collection to provide high-quality health data to meet needs of different communities
US11056242B1 (en) 2020-08-05 2021-07-06 Vignet Incorporated Predictive analysis and interventions to limit disease exposure
CN111917783B (zh) * 2020-08-06 2023-06-23 吉林亿联银行股份有限公司 一种通用报文的验证方法、装置及存储介质
US11763919B1 (en) 2020-10-13 2023-09-19 Vignet Incorporated Platform to increase patient engagement in clinical trials through surveys presented on mobile devices
US11444865B2 (en) 2020-11-17 2022-09-13 Vmware, Inc. Autonomous distributed forwarding plane traceability based anomaly detection in application traffic for hyper-scale SD-WAN
US11575600B2 (en) 2020-11-24 2023-02-07 Vmware, Inc. Tunnel-less SD-WAN
US11601356B2 (en) 2020-12-29 2023-03-07 Vmware, Inc. Emulating packet flows to assess network links for SD-WAN
US11417418B1 (en) 2021-01-11 2022-08-16 Vignet Incorporated Recruiting for clinical trial cohorts to achieve high participant compliance and retention
US11792127B2 (en) 2021-01-18 2023-10-17 Vmware, Inc. Network-aware load balancing
US11979325B2 (en) 2021-01-28 2024-05-07 VMware LLC Dynamic SD-WAN hub cluster scaling with machine learning
US11240329B1 (en) 2021-01-29 2022-02-01 Vignet Incorporated Personalizing selection of digital programs for patients in decentralized clinical trials and other health research
US11789837B1 (en) 2021-02-03 2023-10-17 Vignet Incorporated Adaptive data collection in clinical trials to increase the likelihood of on-time completion of a trial
US11586524B1 (en) 2021-04-16 2023-02-21 Vignet Incorporated Assisting researchers to identify opportunities for new sub-studies in digital health research and decentralized clinical trials
US11281553B1 (en) 2021-04-16 2022-03-22 Vignet Incorporated Digital systems for enrolling participants in health research and decentralized clinical trials
US11636500B1 (en) 2021-04-07 2023-04-25 Vignet Incorporated Adaptive server architecture for controlling allocation of programs among networked devices
US12009987B2 (en) 2021-05-03 2024-06-11 VMware LLC Methods to support dynamic transit paths through hub clustering across branches in SD-WAN
US11582144B2 (en) 2021-05-03 2023-02-14 Vmware, Inc. Routing mesh to provide alternate routes through SD-WAN edge forwarding nodes based on degraded operational states of SD-WAN hubs
US11729065B2 (en) 2021-05-06 2023-08-15 Vmware, Inc. Methods for application defined virtual network service among multiple transport in SD-WAN
US11489720B1 (en) 2021-06-18 2022-11-01 Vmware, Inc. Method and apparatus to evaluate resource elements and public clouds for deploying tenant deployable elements based on harvested performance metrics
US12015536B2 (en) 2021-06-18 2024-06-18 VMware LLC Method and apparatus for deploying tenant deployable elements across public clouds based on harvested performance metrics of types of resource elements in the public clouds
CN113505144A (zh) * 2021-07-08 2021-10-15 中国工商银行股份有限公司 一种规则有效性的确定方法、装置和设备
US12047282B2 (en) 2021-07-22 2024-07-23 VMware LLC Methods for smart bandwidth aggregation based dynamic overlay selection among preferred exits in SD-WAN
US11375005B1 (en) 2021-07-24 2022-06-28 Vmware, Inc. High availability solutions for a secure access service edge application
US11943146B2 (en) 2021-10-01 2024-03-26 VMware LLC Traffic prioritization in SD-WAN
US11705230B1 (en) 2021-11-30 2023-07-18 Vignet Incorporated Assessing health risks using genetic, epigenetic, and phenotypic data sources
US11901083B1 (en) 2021-11-30 2024-02-13 Vignet Incorporated Using genetic and phenotypic data sets for drug discovery clinical trials
US11909815B2 (en) 2022-06-06 2024-02-20 VMware LLC Routing based on geolocation costs
US12034587B1 (en) 2023-03-27 2024-07-09 VMware LLC Identifying and remediating anomalies in a self-healing network
US12057993B1 (en) 2023-03-27 2024-08-06 VMware LLC Identifying and remediating anomalies in a self-healing network

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1829160A (zh) * 2005-03-01 2006-09-06 联想(北京)有限公司 一种混合策略加载系统及实现策略管理的方法
CN101141295A (zh) * 2007-03-02 2008-03-12 中兴通讯股份有限公司 策略管理方法
CN101192967A (zh) * 2006-11-21 2008-06-04 中兴通讯股份有限公司 实施资源控制决策的方法
CN102130965A (zh) * 2011-04-13 2011-07-20 北京邮电大学 一种基于规则引擎的服务动态组合方法和系统
CN101876994B (zh) * 2009-12-22 2012-02-15 中国科学院软件研究所 一种多层次优化的策略评估引擎的建立方法及其实施方法

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7257833B1 (en) * 2001-01-17 2007-08-14 Ipolicy Networks, Inc. Architecture for an integrated policy enforcement system
US7058821B1 (en) * 2001-01-17 2006-06-06 Ipolicy Networks, Inc. System and method for detection of intrusion attacks on packets transmitted on a network
US7072958B2 (en) * 2001-07-30 2006-07-04 Intel Corporation Identifying network management policies
WO2004108223A1 (en) 2003-06-05 2004-12-16 Flexiped As Physical exercise apparatus and footrest platform for use with the apparatus
US20050222996A1 (en) 2004-03-30 2005-10-06 Oracle International Corporation Managing event-condition-action rules in a database system
US7505463B2 (en) * 2004-06-15 2009-03-17 Sun Microsystems, Inc. Rule set conflict resolution
US7792775B2 (en) 2005-02-24 2010-09-07 Nec Corporation Filtering rule analysis method and system
CN101055630A (zh) * 2006-04-12 2007-10-17 科凌力医学软件(深圳)有限公司 事件决策知识库组建方法及相应的事件决策方法和系统
US8065721B1 (en) * 2007-08-10 2011-11-22 Juniper Networks, Inc. Merging filter rules to reduce forwarding path lookup cycles
CN101739248A (zh) * 2008-11-13 2010-06-16 国际商业机器公司 执行规则集的方法和系统
WO2014085952A1 (zh) * 2012-12-03 2014-06-12 华为技术有限公司 一种策略处理的方法及网络设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1829160A (zh) * 2005-03-01 2006-09-06 联想(北京)有限公司 一种混合策略加载系统及实现策略管理的方法
CN101192967A (zh) * 2006-11-21 2008-06-04 中兴通讯股份有限公司 实施资源控制决策的方法
CN101141295A (zh) * 2007-03-02 2008-03-12 中兴通讯股份有限公司 策略管理方法
CN101876994B (zh) * 2009-12-22 2012-02-15 中国科学院软件研究所 一种多层次优化的策略评估引擎的建立方法及其实施方法
CN102130965A (zh) * 2011-04-13 2011-07-20 北京邮电大学 一种基于规则引擎的服务动态组合方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2760158A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2835943A4 (en) * 2013-06-03 2015-05-27 Huawei Tech Co Ltd SERVICE PROCESS CONTROL METHOD AND NETWORK DEVICE
AU2014277525B2 (en) * 2013-06-03 2016-06-09 Huawei Technologies Co., Ltd. Service process control method and network device
US9537982B2 (en) 2013-06-03 2017-01-03 Huawei Technologies Co., Ltd. Service process control method and network device
US10425510B2 (en) 2013-06-03 2019-09-24 Huawei Technologies Co., Ltd. Service process control method and network device
US11233884B2 (en) 2013-06-03 2022-01-25 Huawei Technologies Co., Ltd. Service process control method and network device
US11700322B2 (en) 2013-06-03 2023-07-11 Huawei Technologies Co., Ltd. Service process control method and network device

Also Published As

Publication number Publication date
US20140156823A1 (en) 2014-06-05
ES2624219T3 (es) 2017-07-13
EP2760158B1 (en) 2017-02-15
CN103688489B (zh) 2017-02-22
US10225150B2 (en) 2019-03-05
JP5813252B2 (ja) 2015-11-17
CN103688489A (zh) 2014-03-26
US20170005872A1 (en) 2017-01-05
JP2015508538A (ja) 2015-03-19
US9461888B2 (en) 2016-10-04
KR20140098671A (ko) 2014-08-08
EP2760158A4 (en) 2015-03-25
EP2760158A1 (en) 2014-07-30
KR101489420B1 (ko) 2015-02-03

Similar Documents

Publication Publication Date Title
WO2014085952A1 (zh) 一种策略处理的方法及网络设备
US10841279B2 (en) Learning network topology and monitoring compliance with security goals
CN107241186B (zh) 网络设备和用于网络通信的方法
US20230336527A1 (en) Efficient Packet Capture for Cyber Threat Analysis
US10021033B2 (en) Context driven policy based packet capture
CN108701187B (zh) 用于混合硬件软件分布式威胁分析的设备和方法
EP3871392B1 (en) Network security system with enhanced traffic analysis based on feedback loop
CN107683597B (zh) 用于异常检测的网络行为数据收集和分析
US8528047B2 (en) Multilayer access control security system
JP3954385B2 (ja) 迅速なパケット・フィルタリング及びパケット・プロセシングのためのシステム、デバイス及び方法
CN103609070B (zh) 网络流量检测方法、系统、设备及控制器
JP2008011537A (ja) ネットワークセキュリティデバイスにおけるパケット分類
US10868792B2 (en) Configuration of sub-interfaces to enable communication with external network devices
JP2016508353A (ja) ネットワークメタデータを処理する改良されたストリーミング方法およびシステム
EP2321934B1 (en) System and device for distributed packet flow inspection and processing
EP3718284B1 (en) Extending encrypted traffic analytics with traffic flow data
CN112437070A (zh) 一种基于操作生成树状态机完整性验证计算方法及系统
JP2022546879A (ja) ネットワークフォレンジックシステム及びこれを用いたネットワークフォレンジック方法
CN115883574A (zh) 工业控制网络中的接入设备识别方法及装置
CN114978563B (zh) 一种封堵ip地址的方法及装置
CN109462503A (zh) 一种数据检测方法和装置
WO2022171380A1 (en) Anomaly detection
CN116781303A (zh) 一种DDoS攻击防护方法和相关装置
CN116032592A (zh) 服务器的网络安全检测方法、装置及存储介质
CN116827564A (zh) 一种威胁事件识别方法及相关装置

Legal Events

Date Code Title Description
REEP Request for entry into the european phase

Ref document number: 2012876592

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2012876592

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 20137031987

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2014550617

Country of ref document: JP

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12876592

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE