WO2014198229A1 - 报文处理方法、设备和系统 - Google Patents

报文处理方法、设备和系统 Download PDF

Info

Publication number
WO2014198229A1
WO2014198229A1 PCT/CN2014/079802 CN2014079802W WO2014198229A1 WO 2014198229 A1 WO2014198229 A1 WO 2014198229A1 CN 2014079802 W CN2014079802 W CN 2014079802W WO 2014198229 A1 WO2014198229 A1 WO 2014198229A1
Authority
WO
WIPO (PCT)
Prior art keywords
layer
forwarding device
forwarding
message
keyword
Prior art date
Application number
PCT/CN2014/079802
Other languages
English (en)
French (fr)
Inventor
周洪
李峰
殷悦
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP14811596.7A priority Critical patent/EP2996291B1/en
Publication of WO2014198229A1 publication Critical patent/WO2014198229A1/zh
Priority to US14/966,943 priority patent/US20160099891A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/64—Hybrid switching systems
    • H04L12/6418—Hybrid transport
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/60—Software-defined switches
    • H04L49/602—Multilayer or multiprotocol switching, e.g. IP switching
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/19—Flow control; Congestion control at layers above the network layer
    • H04L47/193—Flow control; Congestion control at layers above the network layer at the transport layer, e.g. TCP related
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/33—Flow control; Congestion control using forward notification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/50—Queue scheduling
    • H04L47/58—Changing or combining different scheduling modes, e.g. multimode scheduling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1004—Server selection for load balancing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1029—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers using data related to the state of servers by a load balancer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/563—Data redirection of data network streams
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H04L67/63—Routing a service request depending on the request content or context
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/329—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer [OSI layer 7]

Definitions

  • the present invention relates to communication technologies, and in particular, to a message method, device, and system. Background technique
  • the processing of the network service is performed by the network service processing device.
  • the load balancing technology is used to distribute the load among multiple computers, disk drives or other resources to optimize resource usage, maximize throughput and minimize Time to respond to other purposes.
  • Machines that provide load balancing services are generally referred to as load balancers.
  • An important application of this load balancer is to provide load balancing for multiple servers.
  • the load balancer is called the Server Load Balancer.
  • three servers are respectively connected to a server load balancer, and the server load balancer provides a virtual network interconnection protocol (IP) address.
  • IP virtual network interconnection protocol
  • the algorithm can be an algorithm such as polling, minimum number of connections, and fastest response speed.
  • the server load balancer processes the business data and returns it to the user.
  • the computer network is hierarchical, and a network layering model proposed by the International Organization for Standardization (ISO), that is, the OSI model divides the network into seven layers, namely: application layer (layer 7), presentation layer
  • the server load balancer may select a server according to information of the following layers of the fourth layer and the fourth layer included in the received network packet, or may The server is selected based on information of four or more layers.
  • the load balancer when the load balancer only processes the following layer information of the fourth layer and the fourth layer, the load balancer has stronger processing capability and higher processing efficiency; and the load balancer processes more than four layers of information, the load balancer The processing power and efficiency are low.
  • the current network service processing is implemented by a single network service processing device, that is, information processing of the following layers of the fourth layer and the fourth layer, or processing of information of four or more layers; for example, the above All network-level services are processed in the device of the load balancer, so that all network-level services are handled by the same device, which may cause the service processing capability of the network service processing device such as the load balancer to be reduced.
  • the information processing at different network levels will affect each other and reduce the overall business processing capacity of the device, and the service processing capability of the device is low. Summary of the invention
  • the embodiment of the invention provides a packet processing method, device and system to improve service processing capability.
  • the first aspect provides a packet processing method, which is applied to a system including a four-layer forwarding device, a seven-layer forwarding device, and a controller, where the four-layer forwarding device and the seven-layer forwarding device respectively communicate with the controller, and A data channel for transmitting a message exists between the four-layer forwarding device and the seven-layer forwarding device.
  • the method includes:
  • the controller sends a first forwarding entry to the four-layer forwarding device, where the first forwarding entry includes a first keyword and a first processing policy corresponding to the first keyword; And including the four-layer information of the packet, where the first forwarding entry is used to indicate that the four-layer forwarding device receives the first packet matching the first keyword, according to the first processing policy,
  • the Layer 7 forwarding device sends the second packet.
  • controller sends a control rule for instructing the layer 7 forwarding device to process the packet, so that the layer 7 forwarding device processes the second packet according to the control rule.
  • a first implementation manner where the method further includes:
  • the controller sends a second forwarding entry to the four-layer forwarding device, where the second forwarding entry includes a second keyword and a second processing policy corresponding to the second keyword; And including the fourth layer of information of the packet, where the second forwarding entry is used to indicate that the fourth layer forwarding device receives the third packet that matches the second keyword, and processes the according to the second processing policy.
  • the third packet omits sending a packet to the layer 7 forwarding device.
  • a second implementation manner is provided, After the controller sends the control rule to the layer 7 forwarding device, the method further includes: the controller receiving the packet parsing result sent by the layer 7 forwarding device, where the packet parsing result is the seventh The layer forwarding device obtains the second packet by parsing the second packet;
  • the controller sends a third forwarding entry to the four-layer forwarding device according to the packet parsing result, where the third forwarding entry includes the first keyword and the first keyword corresponding to the first
  • the third processing policy is configured to: when the fourth layer forwarding device receives the fourth packet that matches the first keyword, process the fourth packet according to the third processing policy, The sending of the message to the layer 7 forwarding device is omitted.
  • the third implementation manner is provided. Before the controller receives the packet parsing result sent by the layer 7 forwarding device, the method further includes:
  • the controller sends the conditional seven-layer information to the seven-layer forwarding device, where the condition seven-layer information is used to indicate that the seven-layer forwarding device sends the information when the second packet is parsed to obtain the condition seven-layer information.
  • the result of the message parsing is used to indicate that the seven-layer forwarding device sends the information when the second packet is parsed to obtain the condition seven-layer information.
  • a fourth implementation manner is provided. Before the controller sends the third forwarding entry to the four-layer forwarding device, the method further includes :
  • the controller receives the message sent by the layer 7 forwarding device, where the message is used to notify the controller to send the third forwarding entry to the layer 4 forwarding device.
  • the controller sends the control rule to the layer 7 forwarding device, including:
  • the controller sends a fifth processing policy or a fourth forwarding entry to the layer 7 forwarding device, where the fourth forwarding entry includes: a fourth keyword and a fourth processing policy corresponding to the fourth keyword.
  • a sixth implementation manner where the controller sends a fifth processing policy or a fourth forwarding entry to the layer 7 forwarding device, including:
  • the controller After receiving the packet parsing result sent by the layer 7 forwarding device, the controller sends the fifth processing policy or the fourth forwarding entry to the layer 7 forwarding device.
  • the seventh implementation manner where the controller sends the first forwarding entry to the four-layer forwarding device, including:
  • the controller sends the first forwarding entry to the layer 4 forwarding device by using an intermediate control device.
  • the eighth implementation manner is provided, where the four-layer forwarding device provides a firewall service, and the seven-layer forwarding device provides a load balancing service.
  • the second aspect provides a packet processing method, which is applied to a system including a four-layer forwarding device, a seven-layer forwarding device, and a controller, where the four-layer forwarding device and the seven-layer forwarding device respectively communicate with the controller, and A data channel for transmitting a message exists between the four-layer forwarding device and the seven-layer forwarding device.
  • the method includes:
  • the first layer forwarding device receives the first forwarding entry sent by the controller, where the first forwarding entry includes a first keyword and a first processing policy corresponding to the first keyword;
  • the word includes four layers of information of the packet, where the first forwarding entry is used to indicate that the fourth layer forwarding device receives the first packet matching the first keyword, according to the first processing policy
  • the seventh layer forwarding device sends the second packet.
  • the four-layer forwarding device receives the first packet
  • the Layer 4 forwarding device sends the second packet to the Layer 7 forwarding device by using the data channel according to the first forwarding entry.
  • a first implementation manner where the method further includes:
  • the second layer forwarding device receives the second forwarding entry sent by the controller, where the second forwarding entry includes a second keyword and a second processing policy corresponding to the second keyword;
  • the word includes four layers of information of the packet, where the second forwarding entry is used to indicate that the fourth layer forwarding device receives the third packet matching the second keyword, according to the second processing policy.
  • the third packet is omitted, and the sending of the packet to the layer 7 forwarding device is omitted.
  • the second implementation manner is provided, after the sending, by the four-layer forwarding device, the second packet to the seven-layer forwarding device by using the data channel, the method further includes: The fourth forwarding device receives the third forwarding entry sent by the controller, where the third forwarding entry includes the third keyword and the third processing policy corresponding to the first keyword; The publication item is configured to instruct the fourth layer forwarding device to process the fourth packet according to the third processing policy when receiving the fourth packet matching the first keyword, and omitting sending to the layer 7 forwarding device Message.
  • the third implementation manner is provided, where the four-layer forwarding device provides a firewall service, and the seven-layer forwarding device provides a third aspect of the load balancing industry, providing one Network service processing method, applied to a four-layer forwarding device and first a network service processing system of the seven-layer forwarding device, the system further includes a controller, wherein the four-layer forwarding device and the first seven-layer forwarding device respectively communicate with the controller, and the four-layer forwarding device and A data channel for transmitting a message exists between the first layer 7 forwarding devices; the network service processing method includes:
  • the controller receives service statistics information sent by the first layer 7 forwarding device
  • the controller adds a second layer 7 forwarding device according to the service statistics information, and a data channel for transmitting a message exists between the second layer 7 forwarding device and the layer 4 forwarding device.
  • the controller adds the second layer seven forwarding device according to the service statistics information, including:
  • the controller Determining, by the controller, that the second layer seven forwarding device needs to be added according to the service statistics information; the controller adding the second layer seven forwarding device to the system, and forwarding the device to the layer four forwarding device Sending a forwarding entry, the forwarding entry includes a keyword and a processing policy corresponding to the keyword; the keyword includes four layers of information, and the forwarding entry is used to indicate that the four-layer forwarding device receives When the first packet matching the keyword is matched, the second packet is sent to the second layer 7 forwarding device according to the processing policy.
  • a controller including:
  • a processing unit configured to generate a first forwarding entry, where the first forwarding entry includes a first processing policy corresponding to the first keyword and the first keyword; and the first keyword includes four layers of the packet
  • the communication unit is configured to send the first forwarding entry to the four-layer forwarding device, where the first forwarding entry is used to indicate that the four-layer forwarding device receives the first packet that matches the first keyword. Sending a second packet to the layer 7 forwarding device according to the first processing policy;
  • the processing unit is further configured to generate a control rule, where the control rule is used to guide the layer 7 forwarding device to process a message;
  • the communication unit is further configured to send the control rule to the layer 7 device, so that the layer 7 forwarding device processes the second packet according to the control rule.
  • the processing unit is further configured to generate a second forwarding entry, where the second forwarding entry includes a second keyword and a second processing corresponding to the second keyword
  • the second keyword includes four layers of information of the packet
  • the communication unit is further configured to send the second forwarding entry to the four-layer forwarding device, where the second forwarding entry is used to indicate that the four-layer forwarding device receives the second matching keyword.
  • Three messages The third packet is processed according to the second processing policy, and the sending of the packet to the layer 7 forwarding device is omitted.
  • the second implementation manner is provided, where the communication unit is further configured to receive a packet parsing result sent by the layer 7 forwarding device, where the packet parsing result is The layer 7 forwarding device obtains the second packet by parsing the second packet;
  • the processing unit is further configured to generate a third forwarding entry according to the packet parsing result, where the third forwarding entry includes a third processing policy corresponding to the first keyword and the first keyword;
  • the communication unit is further configured to send the third forwarding entry to the four-layer forwarding device, where the third forwarding entry is used to indicate that the four-layer forwarding device receives the first matching keyword.
  • the fourth packet is processed according to the third processing policy, and the sending of the packet to the layer 7 forwarding device is omitted.
  • a fifth aspect provides a controller, which is applied to a network service processing system including a four-layer forwarding device and a first seven-layer forwarding device, where the system further includes a controller, the four-layer forwarding device, and the first The seven-layer forwarding device is in communication with the controller, and the data channel for transmitting the packet exists between the four-layer forwarding device and the first seven-layer forwarding device, and the controller includes:
  • a communication unit configured to receive the service indication information sent by the first layer 7 forwarding device, and the processing unit, configured to add, according to the service statistics, a second layer 7 forwarding device, the second layer 7 forwarding device, and the There is a data channel for transmitting messages between the four layer forwarding devices.
  • a first implementation manner where the processing unit is specifically configured to determine, according to the service statistics, that the second layer seven forwarding device needs to be added, and add the second layer seven in the system. Forwarding the device, and sending a forwarding entry to the four-layer forwarding device, where the forwarding entry includes a keyword and a processing policy corresponding to the keyword; the keyword includes four layers of information, the forwarding table The item is used to send the second packet to the second layer 7 forwarding device according to the processing policy when the fourth layer forwarding device receives the first packet that matches the keyword.
  • the sixth aspect provides a four-layer forwarding device, including: a receiving unit and a sending unit; the receiving unit is configured to receive a first forwarding entry sent by the controller, where the first forwarding entry includes a first keyword and a first processing policy corresponding to the first keyword; the first keyword includes four layers of information of the packet, where the first forwarding entry is used to indicate that the four-layer forwarding device receives the matching first And sending, by the first processing policy, the second packet to the layer 7 forwarding device, where the first packet of the keyword is sent; The receiving unit is further configured to receive the first packet;
  • the sending unit is configured to send the second packet to the layer 7 forwarding device by using a data channel according to the first forwarding entry after the receiving unit receives the first packet.
  • the receiving unit is further configured to receive a second forwarding entry sent by the controller, where the second forwarding entry includes a second keyword and the second key a second processing policy corresponding to the word; the second keyword includes four layers of information of the packet, where the second forwarding entry is used to indicate that the four-layer forwarding device receives the third that matches the second keyword And processing the third packet according to the second processing policy, and omitting sending the packet to the layer 7 forwarding device.
  • a network service processing system including: the four-layer forwarding device, the controller, and the seven-layer forwarding device described above; the four-layer forwarding device and the seven-layer forwarding device respectively communicate with the controller And a data channel for transmitting network service packets exists between the four-layer forwarding device and the seven-layer forwarding device.
  • the four-layer forwarding device receives the first forwarding entry sent by the controller, and parses the four layers of the received packet.
  • the first forwarding entry sent by the controller is matched, and the packet is sent to the layer 7 forwarding device.
  • the Layer 4 forwarding device processes the Layer 4 information of the packet
  • the Layer 7 forwarding device processes the Layer 7 information of the packet. It is beneficial to improve the processing capability of the four-layer forwarding device, thereby also improving the overall service processing capability.
  • FIG. 1 is an application architecture diagram of a network service processing method according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an embodiment of a packet processing method according to the present invention.
  • FIG. 3 is a schematic flowchart of another embodiment of a packet processing method according to the present invention.
  • FIG. 4 is an application system diagram of an embodiment of a network service processing method according to the present invention.
  • FIG. 5 is a schematic diagram of packet sending signaling according to an embodiment of a network service processing method according to the present invention.
  • FIG. 6 is a schematic diagram of packet sending signaling according to an embodiment of a network service processing method according to the present invention.
  • FIG. 7 is a schematic diagram of an application system of another embodiment of a network service processing method according to the present invention.
  • FIG. 8 is a schematic diagram of packet sending signaling according to another embodiment of a network service processing method according to the present invention.
  • FIG. 9 is a schematic diagram of an application system of another embodiment of a network service processing method according to the present invention.
  • FIG. 10 is a schematic diagram of an application system of another embodiment of a network service processing method according to the present invention
  • FIG. 11 is a schematic diagram of an application system of another embodiment of a network service processing method according to the present invention.
  • FIG. 12 is a schematic structural diagram of an embodiment of a controller according to the present invention.
  • FIG. 13 is a schematic structural diagram of an embodiment of a controller according to the present invention.
  • FIG. 14 is a schematic structural diagram of an embodiment of a four-layer forwarding device according to the present invention.
  • FIG. 15 is a schematic structural diagram of an embodiment of a four-layer forwarding device according to the present invention. detailed description
  • the network services in the network for example, load balancing services, firewall services, etc.
  • Different network services need to process different network level information during specific processing. For example, for a certain network service, the service is processed.
  • the packets corresponding to this service need to process four layers of information, or need to process seven layers of information.
  • the four or seven layers here refer to the network layering according to the OSI model, that is, the usual seventh layer - Application Layer, Layer 6 - Presentation Layer, Layer 5 - Session Session Layer, Layer 4 - Transport Layer, Layer 3 - Network Layer, Layer 2 - Data Link Layer and Layer 1 - Physical Layer (Physical) Layer).
  • FIG. 1 is an application architecture diagram of a network service processing method according to an embodiment of the present invention. As shown in FIG.
  • the architecture includes a controller, a four-layer forwarding device, and a seven-layer forwarding device; the four-layer forwarding device and seven-layer forwarding
  • the device communicates with the controller separately, and the four-layer forwarding device and the controller may be directly connected or connected through other devices.
  • the layer 7 forwarding device and the controller may also be directly connected or connected through other devices.
  • the embodiments of the invention are not limited.
  • Some of the network services may only need to be implemented by the controller and the four-layer forwarding device. In this case, the Layer 7 forwarding device is not required. Some network services may use the controller, the four-layer forwarding device, and the seven-layer forwarding device. .
  • the Layer 4 forwarding device and the Layer 7 forwarding device can be used to process a specific network layer service. For example, the Layer 4 forwarding device processes Layer 4 services, and the Layer 7 forwarding device processes Layer 7 services.
  • a four-layer control interface can be set between the four-layer forwarding device and the controller, and a seven-layer control interface can be set between the seven-layer forwarding device and the controller.
  • the data channel for transmitting the message is set, and the data channel may be an independent physical channel, or may be a channel connected between the four-layer control interface and the seven-layer control interface.
  • the controller can schedule and control the processing of packets between the Layer 4 forwarding device and the Layer 7 forwarding device.
  • FIG. 2 is a schematic flowchart of a method for processing a packet according to an embodiment of the present invention.
  • the method is performed by a controller in the system architecture of FIG. 1. As shown in FIG. 2, the method may include the following processing.
  • the steps 201, 202, etc. in this embodiment do not limit the order of execution.
  • the controller sends a first forwarding entry to the layer 4 forwarding device.
  • the controller sends the first forwarding entry to the four-layer forwarding device by using the foregoing four-layer control interface, where the first forwarding entry includes a first keyword and a first processing policy corresponding to the first keyword;
  • the first keyword includes four layers of information of the packet, where the first forwarding entry is used to indicate that the fourth layer forwarding device receives the first packet matching the first keyword, according to the first
  • the processing policy sends a second packet to the layer 7 forwarding device.
  • the controller may send the first forwarding entry to the layer 4 forwarding device by using an intermediate control device.
  • the controller sends, to the layer 7 forwarding device, a control rule for guiding the layer 7 forwarding device to process the packet.
  • the controller may further send a control rule for guiding the layer 7 forwarding device to process the packet to the layer 7 forwarding device by using the layer 7 control interface, so that the layer 7 forwarding device processes the second according to the control rule.
  • the Layer 4 forwarding device can process the packet according to the first forwarding entry.
  • the Layer 7 forwarding device can process the packet according to the control rule. For example, forwarding, discarding, copying, and counting, for example, forwarding the packet to a server. , or forward to another forwarding device, etc.
  • the controller may further send a second forwarding entry to the four-layer forwarding device, where the second forwarding entry includes a second keyword and a second processing policy corresponding to the second keyword;
  • the second keyword includes four layers of information of the packet, where the second forwarding entry is used to indicate that the fourth layer forwarding device receives the third packet that matches the second keyword, according to the first
  • the second processing policy processes the third packet, and omits sending a packet to the layer 7 forwarding device.
  • the controller further includes: the controller receiving the packet parsing result sent by the layer 7 forwarding device, where the packet parsing result is The seven-layer forwarding device is obtained by parsing the second packet.
  • the controller parses according to the packet
  • the third forwarding entry is sent to the four-layer forwarding device, where the third forwarding entry includes the third keyword and the third processing policy corresponding to the first keyword;
  • the item is used to indicate that the fourth layer forwarding device processes the fourth packet according to the third processing policy when receiving the fourth packet that matches the first keyword, and omits sending the packet to the layer 7 forwarding device.
  • the embodiment of the present invention separately sets a four-layer forwarding device and a seven-layer forwarding device, and also provides a controller for controlling the processing of the two devices, and the working cooperation manner between the two devices may be
  • the packet is first forwarded to the Layer 4 forwarding device.
  • the Layer 4 forwarding device forwards the packet to the Layer 7 forwarding device.
  • the Layer 7 forwarding device parses the packet to obtain the packet analysis result.
  • the packet parsing result may be four layers of information, seven layers of protocol information, and the like included in the packet.
  • the Layer 7 forwarding device can also obtain service statistics.
  • the service statistics are used to represent the service processing load of the Layer 7 forwarding device itself, such as traffic and CPU load.
  • the Layer 7 forwarding device can report the service statistics and/or the packet analysis result to the controller, and the controller can perform service control on the Layer 4 forwarding device and/or the Layer 7 forwarding device according to the information.
  • the controller can send the third packet to the Layer 4 forwarding device.
  • the third forwarding entry is used to instruct the fourth layer forwarding device to process the fourth packet according to the third processing policy when receiving the fourth packet matching the first keyword, and omitting Sending a message to the Layer 7 forwarding device.
  • the method further includes: the controller sending the condition seven layers of information to the layer seven forwarding device, where the condition seven layers of information And the method is configured to send the packet parsing result when the second layer forwarding device parses the second packet to obtain the conditional layer 7 information.
  • the method further includes: the controller receiving a message sent by the layer 7 forwarding device, where the message is used to notify the The controller sends the third forwarding entry to the four-layer forwarding device.
  • the controller sends a control rule to the layer 7 forwarding device, where: the controller sends a fifth processing policy or a fourth forwarding entry to the layer 7 forwarding device, where the fourth forwarding table is The item includes: a fourth processing policy corresponding to the fourth keyword and the fourth keyword.
  • the controller sends the fifth processing policy or the fourth forwarding entry to the layer 7 forwarding device, where: the controller receives the packet parsing result sent by the layer 7 forwarding device. Then, the fifth processing policy or the fourth forwarding entry is sent to the layer 7 forwarding device.
  • the existing network services of all levels are handled by the same device.
  • a device handles four layers of services and processes seven layers of services. When seven layers of services need to process seven layers of information, the processing efficiency is slower, which reduces the four.
  • the processing efficiency of the layer business separately sets a four-layer forwarding device, and further sets a controller.
  • the four-layer forwarding device receives the first forwarding entry sent by the controller, and parses the four layers of the received packet, and the matching controller sends the packet.
  • the first forwarding entry sends a packet to the Layer 7 forwarding device.
  • the Layer 4 forwarding device processes the Layer 4 information of the packet
  • the Layer 7 forwarding device processes the Layer 7 information of the packet.
  • the four-layer forwarding device is dedicated to processing four-layer services, which improves service throughput and processing efficiency, and the service arrangement is very flexible.
  • the system architecture of the embodiment of the present invention may include a forwarding device that belongs to different services respectively.
  • the four-layer forwarding device provides a firewall service
  • the seven-layer forwarding device provides a load balancing service.
  • Layer services are handled by different devices.
  • the Layer 4 forwarding device is dedicated to processing Layer 4 services. The efficiency of service processing is improved.
  • the Layer 7 forwarding device is used only when it needs to process more than four layers of services. High flexibility.
  • FIG. 3 is a schematic flowchart of another embodiment of a packet processing method according to the present invention.
  • the method is performed by a layer 4 forwarding device in the system architecture of FIG. 1.
  • the method may include the following processing.
  • the steps in this embodiment are not limited to the order of execution; and, since the method is similar to the first embodiment, the embodiment is briefly described.
  • the fourth layer forwarding device receives the first forwarding entry sent by the controller.
  • the first forwarding entry includes a first processing policy corresponding to the first keyword and the first keyword; the first keyword includes four layers of information of the packet, where the first forwarding entry is used.
  • the first layer forwarding device is instructed to receive the first packet that matches the first keyword, the second packet is sent to the layer 7 forwarding device according to the first processing policy.
  • the layer 4 forwarding device receives the first packet.
  • the layer 4 forwarding device sends the second packet to the layer 7 forwarding device by using the data channel according to the first forwarding entry.
  • the fourth layer forwarding device may further receive a second forwarding entry sent by the controller, where the second forwarding entry includes a second keyword and a second processing policy corresponding to the second keyword; Place The second keyword includes four layers of information of the packet, where the second forwarding entry is used to indicate that the fourth layer forwarding device receives the third packet that matches the second keyword, according to the second The processing policy processes the third packet, and omits sending a packet to the layer 7 forwarding device.
  • the method further includes: the fourth layer forwarding device receiving the third packet sent by the controller a third forwarding entry includes a third processing policy corresponding to the first keyword and the first keyword, where the third forwarding entry is used to indicate that the four-layer forwarding device receives a match
  • the fourth packet of the first keyword is processed according to the third processing policy, and the sending of the packet to the layer 7 forwarding device is omitted.
  • Embodiment 3 The method of the embodiment of the present invention will be described below in combination with several specific network services: Embodiment 3
  • FIG. 4 is an application system diagram of an embodiment of a network service processing method according to the present invention. This embodiment assumes that there are four layers of forwarding devices and seven layers of forwarding devices (of course, the seven-layer forwarding device is used when needed, and may not be used or not set when not needed).
  • FIG. 5 is a schematic diagram of packet sending signaling according to an embodiment of a network service processing method according to the present invention.
  • FIG. 5 is an example of sending a packet to a server by a client, including:
  • the load balancing controller sends a first forwarding entry to the fourth layer forwarding device.
  • the load balancing controller generates the first forwarding entry, for example, according to the server information, the load balancing algorithm, and the like, and obtains information about the server load and the link state between the server and the forwarding device, and obtains the first forwarding table. item.
  • the information about the server load and the like may be obtained by setting a management interface between the load balancing controller and the server, and obtaining the management interface through the management interface.
  • There are several types of communication between the load balancing controller and the server such as Network Address Translation (NAT), tunneling, or direct routing.
  • the information about the server load and the like can also be collected and reported to the load balancing controller by the load balancing controller to indicate the four-layer forwarding device directly connected to the server.
  • the first forwarding entry sent by the load balancing controller to the four-layer forwarding device includes a first keyword and a first processing policy corresponding to the first keyword.
  • the first keyword includes four layers of information of the packet.
  • the four layers of information are, for example, at least one of a source IP address, a destination IP address, a source port, a destination port, a source MAC address, a destination MAC address, a protocol number, and a VLAN ID.
  • the first forwarding entry is used to send the second packet to the Layer 7 forwarding device according to the first processing policy when the first layer forwarding device receives the first packet that matches the first keyword.
  • the first forwarding entry may be in the form of a flow entry.
  • the flow entry includes: forwarding the packet conforming to the four-layer information 1 to the server 1 (the four-layer information 1 may be referred to as a first keyword, and the forwarding to the server 1 is the information described above and the fourth layer. 1 corresponding message processing strategy); the message conforming to the layer 4 information 2 is forwarded to the server 2; the message conforming to the layer 4 information 3 is forwarded to the server 3. Further, the foregoing flow entry may further include: the packet conforming to the fourth layer information 4 is forwarded to the layer 7 forwarding device.
  • the load balancing controller may deliver the foregoing flow entry by using the open flow protocol, or may also use a hypertext transfer protocol (HTTP), an extensible communication and a protocol (The Extensible Messaging). And Presence Protocol, abbreviation: XMPP) and other extensions of the protocol to achieve delivery.
  • HTTP hypertext transfer protocol
  • XMPP Presence Protocol
  • the load balancing controller sends a control rule to the layer 7 forwarding device, where the control rule is used to guide the layer 7 forwarding device to process the packet.
  • the control rule sent by the load balancing controller to the layer 7 forwarding device is specifically, for example, a fifth processing policy or a fourth forwarding entry.
  • the fourth forwarding entry may include a fourth keyword and the fourth keyword corresponding to the fourth keyword.
  • the fourth processing strategy, the fourth keyword may include seven layers of information of the packet.
  • the fourth forwarding entry may be in the form of a flow entry, for example, including: a packet conforming to the seven-layer information 1 is forwarded to the server 1 (the seven-layer information 1 may be referred to as a fourth keyword, and the forwarding to the server 1 is It is the fourth processing strategy corresponding to the seven-layer information 1); the packet conforming to the seven-layer information 2 is forwarded to the server 2; the packet conforming to the seven-layer information 3 is forwarded to the server 3.
  • the seven layers of information here include information on the seven layers and below.
  • the four-layer forwarding device can be implemented by a high-performance forwarding hardware, such as a switch or a router.
  • the device forwards the packet according to a pre-delivered forwarding table, such as a flow entry.
  • the Layer 7 forwarding device generally performs the identification and analysis of the required protocol layer according to the requirements of the network service, and extracts the key information and processes it.
  • the control mode of the device is more flexible.
  • the control rule can be sent to the Layer 7 forwarding device.
  • the time and method of sending the control rule are also flexible.
  • the Layer 7 forwarding device Before receiving the packet, the Layer 7 forwarding device sends the control rule to the Layer 7 forwarding device. For example, before the Layer 4 forwarding device forwards the packet to the Layer 7 forwarding device, the above-mentioned message conforming to Layer 7 information 1 is sent. The file is forwarded to the server 1 for the same flow entry.
  • the packet is received by the Layer 7 forwarding device, the packet is parsed and processed according to the control rule according to the seven layers of the parsed information.
  • the layer-by-layer forwarding device may first receive the packet, and after parsing the packet to obtain the packet parsing result, send the packet parsing result to the load balancing controller. After receiving the result, the load balancing controller receives the result.
  • the control rule is determined according to the packet parsing result and sent to the layer 7 forwarding device, that is, the fifth processing policy or the fourth forwarding entry is sent to the layer 7 forwarding device.
  • the load balancing controller may send the information reporting condition to the layer 7 forwarding device.
  • the information reporting conditions include: a conditional seven-layer information obtained by parsing the message, where the conditional seven-layer information refers to seven layers of information reported as a reporting condition of the packet analysis result to the load balancing controller, and the condition seven layers of information.
  • the layer 7 forwarding device is configured to send the packet parsing result when parsing the second packet to obtain the conditional layer 7 information; that is, when the parsing packet is parsed, the seven layers of information are the condition seven layers.
  • the packet analysis result is reported to the load balancing controller.
  • the condition seven-layer information may include: a message conforming to the seven-layer information 4 to the load balancing controller; wherein, the seven-layer information 4 is equivalent to the condition seven-layer information, and is a seven-layer forwarding device request.
  • the load balancing controller sends the conditions of the forwarding table.
  • the control rule sent by the load balancing controller to the layer 7 forwarding device may be the fifth processing policy or the fourth forwarding entry; wherein the fourth forwarding entry is a forwarding policy that the load balancing controller has determined, for example
  • the packet conforming to the seventh layer information 1 is sent to the server 1.
  • the fourth forwarding entry is obtained by the load balancing controller according to the load balancing algorithm, the server information, and the like, and may be sent to the layer 7 forwarding device by using, for example, a flow entry, and the layer 7 forwarding device processes the receiving according to the fourth forwarding entry. The message arrived.
  • the fifth processing strategy refers to that the load balancing controller notifies the seven-layer forwarding device that the load balancing algorithm according to the fourth forwarding entry is obtained, for example, "according to the load balancing algorithm a, when the server load is less than b, The packet is forwarded to the server.
  • the seventh layer forwarding device determines the server to which the received packet should be forwarded according to the fifth processing policy delivered by the load balancing controller. This embodiment takes the fourth forwarding entry as an example.
  • the layer 4 forwarding device receives the first packet sent by the client.
  • the packets sent by the client are directly sent to the Layer 4 forwarding device. 504.
  • the layer 4 forwarding device sends the second packet to the layer 7 forwarding device according to the first packet and the first forwarding entry.
  • the four-layer forwarding device After receiving the first packet, the four-layer forwarding device forwards the packet according to the first forwarding entry received at 501; for example, if the four layers of information obtained by the parsing packet are four layers of information 1, The packet is forwarded to the server 1; if the four layers of information obtained by the parsing message are the four layers of information 2, the packet is forwarded to the server 2 and the like.
  • the four layers of information obtained by parsing the message are four layers of information 4
  • the Bet Layer layer forwarding device sends a second packet to the Layer 7 forwarding device, and the second packet may be, for example, four layers of forwarding.
  • the device copies the first packet to obtain the received packet.
  • the layer 7 forwarding device parses the second packet to obtain a packet parsing result.
  • the Layer 7 forwarding device After receiving the second packet sent by the Layer 4 forwarding device, the Layer 7 forwarding device caches and parses the packet.
  • the message parsing result includes, for example, seven layers of information 4, which may include: four layers of information 4 (for example, network quintuple information); seven layers of protocol information, for example, HTTP cookie header information, session initiation The Call-ID of the Protocol Initiation Protocol (SIP).
  • the Layer 7 forwarding device queries the flow entry received in 302 according to the parsing result, and performs a seven-layer forwarding according to the flow entry "message conforming to the seven-layer information 4 to the load balancing controller".
  • the device needs to report the packet analysis result to the load balancing controller.
  • the layer 7 forwarding device reports the packet analysis result to the load balancing controller.
  • the Layer 7 forwarding device can report the packet parsing result to the load balancing controller and request the next processing policy from the load balancing controller.
  • the format and content of the information sent by the Layer 7 forwarding device may be related to a specific network service.
  • a seven-layer load balancing service may include ⁇ network quintuple information, a server that is desired to be selected, and seven layers of protocol information (for example, , HTTP cookie header information, SIP Call_ID header information) ⁇ .
  • the load balancing controller selects a server according to the analysis result.
  • the load balancing controller selects an appropriate server according to the packet parsing result reported by the layer 7 forwarding device. This embodiment assumes that the server 1 is selected; of course, the load balancing controller may also integrate other information to select the server. For example, based on message parsing results and server status.
  • the load balancing controller sends a fourth forwarding entry to the layer 7 forwarding device.
  • the load balancing controller sends the fourth forwarding entry to the Layer 7 forwarding device.
  • the fourth forwarding entry may include: the packet conforming to the Layer 7 information 4 is forwarded to the server 1.
  • the basic format for delivering the fourth forwarding entry may be ⁇ number, status (for example, whether it is valid), priority, and seven-layer network service-specific flow entry content ⁇ .
  • the format and content of the content of the specific flow entry of the seven-layer network service may be related to a specific service.
  • the seven-layer load balancing service may include ⁇ server information, actions (for example, forwarding the packet of the flow, and transmitting the packet) Send it to the controller, report the service statistics, etc.) ⁇ .
  • the layer 7 forwarding device forwards the second packet to the server 1 according to the layer 7 flow entry.
  • the Layer 7 forwarding device forwards the second packet to the server 1, which can be forwarded through the Layer 4 forwarding device, and can be forwarded through the data channel between the Layer 7 forwarding device and the Layer 4 forwarding device, and then forwarded through the Layer 4 forwarding device.
  • the device is sent to server 1.
  • the message transit path consisting of 509a and 509b is shown in FIG.
  • the load balancing controller can determine that the packet is no longer needed to be processed by the Layer 7 forwarding device according to the packet parsing result, that is, after the fourth layer forwarding device receives the packet, The seven-layer forwarding device can be used without further processing.
  • the load balancing controller can also execute 510; the steps of 510 are performed after 507, and the time sequence of 508 and 509 is not limited.
  • the load balancing controller sends a third forwarding entry to the fourth layer forwarding device.
  • the load balancing controller directly sends a third forwarding entry to the four-layer forwarding device, where the third forwarding entry includes the first keyword and a third processing policy corresponding to the first keyword;
  • the third forwarding entry is used to instruct the four-layer forwarding device to process the fourth packet according to the third processing policy when receiving the fourth packet matching the first keyword, and omitting forwarding to the seventh layer
  • the device sends a message.
  • the four-layer forwarding device forwards the packet to the layer-7 forwarding device according to the "four-layer information 4-compliant packet forwarding" in the flow entry, and then sends the packet to the seven-layer forwarding device;
  • the flow entry may include the message of the four-layer information 4 being forwarded to the server 1 so that the fourth-layer forwarding device will directly execute 511 the next time the first message sent by the client of the 503 is received.
  • the four-layer forwarding device sends the received fourth packet matching the first keyword to the server 1.
  • the Layer 4 forwarding device does not send the packet to the Layer 7 forwarding device, but directly sends the received fourth packet matching the first keyword to the server 1.
  • FIG. 5 is an example in which a client sends a message to a server.
  • FIG. 6 is an example of a server sending a message to a client, and is assumed to be in some cases (for example, a seven-layer session of HTTP).
  • FIG. 6 is a schematic diagram of packet sending signaling according to an embodiment of a method for processing a network service according to the present invention.
  • the method may include:
  • the load balancing controller sends the first forwarding entry to the fourth layer forwarding device.
  • the first forwarding table may include a first keyword and a first processing policy corresponding to the first keyword.
  • the first keyword includes four layers of information, where the fourth layer information is, for example, a source IP address. At least one of a destination IP address, a source port, a destination port, a source MAC address, a destination MAC address, a protocol number, and a VLAN ID.
  • the first forwarding entry may be in the form of a flow entry, and the flow entry includes, for example, the packet conforming to the fourth layer information 5 is forwarded to the layer 7 forwarding device.
  • the four layers of information 5 may be referred to as a first keyword, and the forwarding to the layer 7 forwarding device may be referred to as a first processing policy corresponding to the first keyword.
  • the load balancing controller sends a control rule to the layer 7 forwarding device, where the control rule is used to guide the layer 7 forwarding device to process the packet.
  • control rule may also be sent in the form of a forwarding table, for example, may be a fourth forwarding entry, where the fourth forwarding entry includes a fourth keyword, and a fourth processing policy corresponding to the fourth keyword.
  • the fourth keyword may include seven layers of information of the message.
  • the fourth forwarding entry may also be in the form of a flow entry, for example, the flow entry may include: a message conforming to the seven-layer information 5 to the load balancing controller.
  • the seven-layer information 5 is a conditional seven-layer information.
  • the load balancing controller is requested to instruct the user to process the message.
  • the fourth layer forwarding device receives the first packet sent by the server 1;
  • the layer 4 forwarding device sends the second packet to the layer 7 forwarding device according to the first packet and the first forwarding entry.
  • the present embodiment assumes that the Layer 4 forwarding device parses the packet to obtain the Layer 4 information 5. Therefore, the second packet is sent to the Layer 7 forwarding device according to the first processing policy in the first forwarding entry.
  • the The second packet can be obtained by the fourth layer forwarding device copying the first packet.
  • the layer 7 forwarding device parses the second packet to obtain a packet parsing result.
  • This embodiment assumes that the Layer 7 forwarding device parses the second packet, and the obtained packet parsing result is a seven-layer letter. 606.
  • the layer 7 forwarding device reports the packet analysis result to the load balancing controller.
  • the seven-layer forwarding device needs to report to the load balancing controller how to process the packet according to the flow entry sent by the controller received in 602, and the seven-layer forwarding device needs to process the packet. Report the packet analysis result to the load balancing controller.
  • the load balancing controller performs corresponding processing according to the packet parsing result, and selects a client.
  • the load balancing controller performs corresponding processing according to the received packet parsing result, for example, for HTTP seven-layer session holding, the controller
  • the process can be to establish the association of server 1 with Coolea information.
  • the load balancing controller also determines which client to send the message to, and this embodiment assumes that there is only one client. Optionally, there may be multiple clients, and for example, one of them may be selected.
  • the load balancing controller sends a flow entry to the layer 7 forwarding device.
  • the flow entry may include: the packet conforming to the layer 7 information 5 is forwarded to the client.
  • the Layer 7 forwarding device forwards the packet to the client according to the flow entry sent by the controller.
  • the Layer 7 forwarding device forwards the packet to the client, which can be completed through the Layer 4 forwarding device.
  • the data channel between the layer forwarding device and the Layer 4 forwarding device is forwarded and sent to the client through the Layer 4 forwarding device.
  • the path of the message consisting of 609a and 609b is shown in Fig. 6.
  • the load balancing controller may also determine that the layer 7 forwarding device does not need to process the packet subsequently, that is, after the fourth layer forwarding device receives the packet, the layer 7 forwarding device You don't have to participate in the process. Then in this case, the load balancing controller can also execute 610;
  • the load balancing controller sends a third forwarding entry to the fourth layer forwarding device.
  • the load balancing controller directly sends a third forwarding entry to the four-layer forwarding device, where the third forwarding entry includes the first keyword and a third processing policy corresponding to the first keyword;
  • the third forwarding entry is used to instruct the four-layer forwarding device to process the fourth packet according to the third processing policy when receiving the fourth packet matching the first keyword, and omitting forwarding to the seventh layer
  • the device sends a message.
  • the four-layer forwarding device sends the second packet according to the first packet to the seventh-layer forwarding device according to the message that the four-layer information 5 is forwarded to the layer-by-layer forwarding device.
  • the third forwarding entry sent at this time may include "message conforming to the four layers of information 5 to the client", which The next four-layer forwarding device will directly execute the fourth message matching the first keyword.
  • the four-layer forwarding device sends the fourth packet matching the first keyword to the client.
  • the Layer 7 forwarding device reports the packet analysis result to the load balancing controller and causes the load balancing controller to send the third forwarding entry to the Layer 4 forwarding device
  • the load balancing controller can determine, according to the result of the packet parsing, that the packet is not required to be processed by the Layer 7 forwarding device.
  • the load balancing controller sends the third forwarding entry to the four-layer forwarding device.
  • the Layer 7 forwarding device when the Layer 7 forwarding device determines that the packet does not need to be processed by the Layer 7 forwarding device, the Layer 7 forwarding device can not only send the packet parsing result to the load balancing controller, but also send a message, where the message is used. The controller is notified to send the third forwarding entry to the four-layer forwarding device, so that the load balancing controller sends the third forwarding entry to the four-layer forwarding device according to the indication.
  • FIG. 7 is an application system diagram of another embodiment of the network service processing method according to the present invention.
  • the architecture of the system is similar to that of Figure 4.
  • the server sends a message to the client.
  • the attacker and the host send a message.
  • the attacker sends the attack packet.
  • the firewall controller and the forwarding device are configured to process the attack packets to ensure network security.
  • Some attacks in the cyber attack for example, the Fraggle attack
  • Some attacks for example, the TCP flag malformation attack
  • FIG. 8 is a signaling diagram of packet transmission according to another embodiment of a method for processing a network service according to the present invention.
  • a firewall service When a firewall service is implemented, a cooperation processing manner between the controller, a layer 4 forwarding device, and a layer 7 forwarding device, and a load balancing service are implemented.
  • the method of this embodiment is similar, except that the processing of the parsed message information and the corresponding message information obtained by different services are different.
  • the method can include:
  • the firewall controller sends a first forwarding entry to the fourth layer forwarding device.
  • the first forwarding entry includes a first keyword and a first processing policy corresponding to the first keyword.
  • the first keyword includes four layers of information, where the fourth layer information is, for example, a source IP address. , At least one of an IP address, a source port, a destination port, a source MAC address, a destination MAC address, a protocol number, and a VLAN ID.
  • the first forwarding entry may be in the form of a flow entry, and the flow entry may be generated according to a feature of the network attack.
  • the flow entry for preventing the Fraggle attack may be described as: If the destination IP address is a broadcast address and the destination port is UDP port 7 or 19, it will be discarded.
  • the flow table entry for preventing Fraggle attacks, "broadcast address" and "UDP port 7 or 19" are The first keyword, the discarding, is the packet processing policy corresponding to the first keyword.
  • the flow entry for the TCP flag malformation attack can be described as follows: If it is a TCP packet, it is forwarded to the Layer 7 forwarding device.
  • the firewall controller sends a control rule to the layer 7 forwarding device, where the control rule is used to guide the layer 7 forwarding device to process the packet.
  • the control rule may also be sent in the form of a forwarding table, for example, may be a fourth forwarding entry, where the fourth forwarding entry includes a fourth keyword, and a fourth processing policy corresponding to the fourth keyword.
  • the fourth keyword may include seven layers of information of the packet.
  • the layer 7 information may be a TCP flag.
  • a flow entry for preventing a TCP flag malformation attack may be described as: if the packet is TCP The flag is all 0 or all 1s are discarded; otherwise, the packet parsing result is reported to the firewall controller for processing. Taking this as an example, the above "TCP flag bits are all 0 or all 1" is the fourth keyword, and "discard" is the fourth processing strategy corresponding to the fourth keyword.
  • the four-layer forwarding device receives the first packet sent by the attacker.
  • the Layer 4 forwarding device receives the first packet, but before the subsequent processing and the judgment, the Layer 4 forwarding device may not know whether the packet is sent by the attacker. For the Layer 4 forwarding device, The packet is sent by a certain client. After the subsequent judgment, the packet is determined to be an ordinary packet or an attack packet sent by the attacker.
  • the layer 4 forwarding device sends a second packet to the layer 7 forwarding device according to the first packet and the first forwarding entry.
  • the four-layer forwarding device processes the received first packet according to the first forwarding entry in 801. For example, if the destination IP address of the received first packet is a broadcast address and the destination port is port 7 or 19 of UDP, it indicates that it is a Fmggle attack packet, and the four-layer forwarding device will receive the packet. The first packet is discarded. If the first packet is a TCP packet, the Layer 4 forwarding device forwards the received first packet to the Layer 7 forwarding device according to the first forwarding table. This embodiment assumes that the first packet received is a TCP packet, and the four-layer forwarding device will be based on the first packet. The second packet is sent to the Layer 7 forwarding device. For example, the second packet can be obtained by the Layer 4 forwarding device copying the first packet.
  • the Layer 7 forwarding device parses the second packet to obtain an analysis result.
  • the Layer 7 forwarding device caches and parses the second packet.
  • the parsing result contains seven layers of information.
  • the seven layers of information may include: network quintuple information, TCP flag bit information, and the like.
  • the Layer 7 forwarding device reports the analysis result to the firewall controller according to the control rule.
  • the Layer 7 forwarding device processes the packet according to the obtained packet analysis result and the control rule received in the foregoing 602. For example, the Layer 7 forwarding device discards the packet according to the control rule received in 602. If the TCP flag is found to be 0 or all 1s, the packet is a TCP flag malformed attack and the packet is discarded; otherwise, The result of the analysis is reported to the firewall controller.
  • This embodiment assumes that the result of the parsing of the packet is analyzed by the Layer 7 forwarding device. If the TCP flag is not all 0s or all 1, the Layer 7 forwarding device reports the parsing result according to the control rule. Go to the firewall controller and request the firewall controller to send a packet of message processing information.
  • the firewall controller makes a decision according to the analysis result.
  • the firewall controller analyzes the analysis results and processes them accordingly. For example, if the message is found to be suspicious, for example, if the TCP flag is found to set the SY and FIN bits at the same time, the decision may be to discard, record, or count the message; if the message is found to be normal, the decision may be an indication.
  • the Layer 7 forwarding device forwards packets normally.
  • the firewall controller sends a new flow entry to the Layer 7 forwarding device.
  • the flow entry is generated and sent according to the decision, so that the layer 7 forwarding device performs corresponding processing on the packet according to the received flow entry. That is, the Layer 7 forwarding device receives the control rule that is sent by the firewall in the previous 802.
  • the control rule is also in the form of a flow entry, but is included in the flow entry in the 802. If the TCP flag of the packet is not all 0s or all 1s, the packet parsing result is reported to the firewall controller for processing. ", that is, when the TCP flag is not all 0s or all 1s.
  • the firewall controller needs to make a further judgment according to the parsing result reported by the layer 7 forwarding device, for example, whether the packet is an attack packet and how to process it. Therefore, in 806, the Layer 7 forwarding device reports the parsing result, and the firewall obtains a decision based on the parsing result and sends a new flow entry to the Layer 7 forwarding device to guide the Layer 7 forwarding device to process the packet. For example, when the second packet is suspicious, the Layer 7 forwarding device can discard, record, and count the packet according to the flow entry sent by the firewall in 708. When the second packet is normal, the Layer 7 forwarding device can The flow entry sent by the firewall forwards the packet normally. For example, the packet is forwarded to the host 2 (can be transited through the Layer 4 forwarding device).
  • the firewall controller sends a third forwarding entry to the layer 4 forwarding device.
  • the firewall controller sends a third forwarding entry to the Layer 4 forwarding device, as determined by the analysis result in the 807, if it is determined that the Layer 7 forwarding device does not need to be processed.
  • the third forwarding entry is used to instruct the fourth layer forwarding device to process the fourth packet according to the third processing policy when receiving the fourth packet matching the first keyword, and omitting the The Layer 7 forwarding device sends packets.
  • the packet that meets the attack message quintuple information can be directly If the packet is discarded, then the quintuple information is equivalent to the first keyword in the first forwarding entry, and the first processing policy corresponding to the first keyword is discarded. In this way, the four-layer forwarding device can directly execute 810 when receiving the packet again.
  • the attack message quintuple information for example, the quintuple information of the 805 in the 805, the network quintuple information obtained by the seven-layer forwarding device
  • the layer 4 forwarding device discards the packet.
  • the four layers of services are processed by the four layers of forwarding devices, and the seven layers of services are processed by the seven layers of forwarding devices, such that the four layers of forwarding devices It can be dedicated to processing four-layer services, and the service processing capability and efficiency will be improved; and the solution also has great flexibility.
  • the four-layer forwarding device can forward it to the seven-layer forwarding. The device can handle the processing of the seven-layer service.
  • the controller may further send the first forwarding table to the Layer 4 forwarding device, so that the subsequent Layer 4 forwarding device can directly process the packet.
  • the change in message processing mode is very flexible and also helps to improve processing efficiency.
  • the controller and the forwarding device implement a service, such as a firewall service or a load balancing service.
  • a system composed of a controller and multiple forwarding devices can process multiple The network service chain in which the network services are connected together.
  • the service execution sequence of a network service chain is as follows: The packets pass through the firewall and then pass through the load balancer, that is, the packets must pass the security protection of the firewall service and must be load balanced. deal with.
  • the network service chain can be implemented by a controller and a plurality of forwarding devices.
  • control A packet forwarding table (which may be referred to as a fifth forwarding table) sent by the controller to the Layer 4 forwarding device or the Layer 7 forwarding device may be used to instruct the Layer 4 forwarding device or the Layer 7 forwarding device to forward the packet to another network.
  • the forwarding device corresponding to the service implements forwarding processing between the forwarding devices that process different services.
  • FIG. 9 is a schematic diagram of an application system of a network service processing method according to another embodiment of the present invention.
  • the controller of this embodiment may include a load balancing controller and a firewall controller, and may also be responsible for one controller. Control the load balancing and firewall services; At the same time, the controller is also responsible for connecting the entire network service chain.
  • the Layer 7 forwarding device 1 is a Layer 7 forwarding device that performs firewall services.
  • the Layer 7 forwarding device 1 is a Layer 4 forwarding device that performs load balancing services.
  • the Layer 4 forwarding device 1 is a Layer 4 forwarding device for firewall services.
  • Device 2 is a four-layer forwarding device for load balancing services.
  • the controller sends a flow entry to the Layer 4 forwarding device and the Layer 7 forwarding device through the Layer 4 control interface and the Layer 7 control interface.
  • the flow direction of the packets processed by the flow entry has the following possibilities: Layer 4 forwarding device 1 -> Layer 4 forwarding device 2 (The packets are processed in the firewall service and the load balancing service, and then sent to the server.
  • the packet processing information sent by the controller to the forwarding device includes a forwarding device for instructing the forwarding device to forward the packet to another network service; for example, In the path of the four-layer forwarding device 1 -> the four-layer forwarding device 2, the flow entry sent by the controller to the four-layer forwarding device 1 is used to instruct the four-layer forwarding device 1 to forward the packet to another service, that is, load balancing.
  • the four-layer forwarding device 2 of the service is set up between the forwarding devices, and packet forwarding is forwarded through the data channel.
  • the packet is sent from the Layer 7 forwarding device 1 to the Layer 4 forwarding device 2, which may be a path of Layer 7 forwarding device 1 -> Layer 4 forwarding device 1 -> Layer 4 forwarding device 2, that is, through Layer 4 forwarding.
  • Device 1 is relayed.
  • the packet processing control between the controller and the forwarding device of each service is similar to that of the foregoing embodiment, and details are not described herein.
  • Embodiment 6 The existing network services of all levels are handled by the same device. When the traffic of a certain level changes, it cannot dynamically and quickly adapt to such changes. For example, if the traffic of the seven layers is greatly increased, it is actually necessary to upgrade seven.
  • the processing capability of the layer service is as follows: The current technology may only replace the high-capacity processing device or increase the number of processing devices, which is high in cost and low in efficiency.
  • the controller of the embodiment of the present invention may use the service statistics reported by the layer-by-layer forwarding device. Information, business control for Layer 7 devices separately, such as creating a new Layer 7 forwarding device, that is, expanding the number of Layer 7 forwarding devices.
  • This method does not involve the change of the four-layer forwarding device, and can dynamically expand the processing capability of the seven-layer forwarding device according to the service statistics reported by the Layer 7 forwarding device in real time, and has strong adaptability to the service and flexible improvement. The ability of the system to handle the business.
  • the network service processing system includes a layer 4 forwarding device and a first layer 7 forwarding device, where the controller receives the service statistics information sent by the first layer 7 forwarding device; The information is added to the second layer 7 forwarding device, and the data channel for transmitting the message exists between the second layer 7 forwarding device and the layer 4 forwarding device.
  • FIG. 10 is a schematic diagram of an application system of a network service processing method according to another embodiment of the present invention.
  • the controller can dynamically expand the number of seven-layer forwarding devices according to the change of the traffic volume processed by the seven-layer forwarding device. Changes in business volume.
  • the method includes:
  • the first layer 7 forwarding device reports service statistics information to the controller.
  • the service statistics information may include network traffic, CPU of a seven-layer forwarding device, memory consumption, and the like.
  • the four first seven-layer forwarding devices included in block B in Figure 10 are currently existing devices.
  • the controller determines, according to the service statistics, that the second layer seven forwarding device needs to be added, and requests a new computing resource from the computing resource manager.
  • the controller determines that the traffic volume of the first layer 7 forwarding device increases greatly according to the service statistics reported by the first layer 7 forwarding device, so that the load of the first layer 7 forwarding device is heavy, and the controller determines that the If the number of Layer 7 forwarding devices is extended, a new computing resource is requested from the computing resource manager, and the second layer 7 forwarding device is prepared to be added.
  • the computing resource manager creates a new computing resource.
  • creating a new computing resource here is to create a second layer seven forwarding device, that is, four second layer seven forwarding devices included in the box A shown in FIG. 10; this embodiment assumes that four second layers are added. Seven-layer forwarding device.
  • the computing resource manager returns information about the computing resources created by the controller.
  • the computing resource that the resource manager replies that is, the information of the second layer seven forwarding device, may include: an IP address, a computing capability, and the like of the second layer seven forwarding device, and the controller is notified that the second layer seven forwarding device has been created.
  • the controller starts the second layer seven forwarding device.
  • the controller may further send a layer 7 flow entry to the second layer 7 forwarding device, so that the second layer 7 forwarding device performs forwarding processing of the subsequent received packet according to the layer 7 flow entry.
  • the controller sends a forwarding entry to the fourth layer forwarding device.
  • the forwarding entry includes a keyword and a processing policy corresponding to the keyword; the keyword includes four layers of information, where the forwarding entry is used to indicate that the four-layer forwarding device receives the matching
  • the second packet is sent to the second layer 7 forwarding device according to the processing policy. That is, at this time, a part of the traffic originally sent to the first layer 7 forwarding device in the box B can be offloaded to the second layer 7 forwarding device, thereby reducing the burden on the original first layer 7 forwarding device.
  • the fourth layer forwarding device sends a second packet to the second layer 7 forwarding device according to the processing policy when receiving the first packet matching the keyword.
  • the network service processing method in this embodiment can implement dynamic expansion of a layer 7 forwarding device and dynamically adapt to changes in traffic volume.
  • FIG. 11 is a schematic diagram of an application system of a network service processing method according to another embodiment of the present invention. As shown in FIG. 11, this embodiment is mainly used to describe that a controller may not directly control a four-layer forwarding device, but The layer forwarding device controls.
  • the intermediate control device may be an Openflow controller or a network management system, and the controller may indirectly control the four-layer forwarding device through an Openflow controller or a network management system.
  • the controller and the Openflow controller or the network management system can communicate through the four-layer control interface, and send the fourth forwarding table to the Openflow controller or the network management system through the four-layer control interface, and then the Openflow controller or the network management system.
  • the system sends the fourth forwarding table to the layer 4 forwarding device.
  • the format of information transmitted between the controller and the Openflow controller or the network management system may be performed according to a format specified by the two protocols; and a format of information transmitted between the Openflow controller or the network management system and the four-layer forwarding device, It can also be done in the format specified by the two protocols.
  • FIG. 12 is a schematic structural diagram of an embodiment of a controller according to the present invention. As shown in FIG. 12, the controller may The processing unit includes a processing unit 1201 and a communication unit 1202.
  • the processing unit 1201 is configured to generate a first forwarding entry, where the first forwarding entry includes a first keyword and a first processing policy corresponding to the first keyword; the first keyword includes a packet Four layers of information.
  • the communication unit 1202 is configured to send the first forwarding entry to the four-layer forwarding device, where the first forwarding entry is used to indicate that the four-layer forwarding device receives the first matching the first keyword. And sending, by the first processing policy, the second packet to the layer 7 forwarding device.
  • the processing unit 1201 is further configured to generate a control rule, where the control rule is used to guide the layer 7 forwarding device to process the message.
  • the communication unit 1202 is further configured to send the control rule to the layer 7 device, so that the layer 7 forwarding device processes the second packet according to the control rule.
  • the processing unit 1201 is further configured to generate a second forwarding entry, where the second forwarding entry includes a second keyword and a second processing policy corresponding to the second keyword;
  • the word includes the four layers of information.
  • the communication unit 1202 is further configured to send the second forwarding entry to the four-layer forwarding device, where the second forwarding entry is used to indicate that the four-layer forwarding device receives the matching of the second keyword.
  • the third packet is processed according to the second processing policy, and the sending of the packet to the layer 7 forwarding device is omitted.
  • the communication unit 1202 is further configured to receive a packet parsing result sent by the layer 7 forwarding device, where the packet parsing result is obtained by parsing the second packet by the layer 7 forwarding device.
  • the processing unit 1201 is further configured to generate a third forwarding entry according to the packet parsing result, where the third forwarding item includes the first keyword and a third processing policy corresponding to the first keyword.
  • the communication unit 1202 is further configured to send the third forwarding entry to the four-layer forwarding device, where the third forwarding entry is used to indicate that the four-layer forwarding device receives the matching of the first keyword.
  • the fourth packet is processed according to the third processing policy, and the sending of the packet to the layer 7 forwarding device is omitted.
  • FIG. 13 is a schematic structural diagram of an embodiment of a controller according to the present invention. As shown in FIG. 13, the controller may include: a processor 1301 and a transceiver 1302.
  • the processor 1301 is configured to generate a first forwarding entry, where the first forwarding entry includes a first processing policy corresponding to the first keyword and the first keyword, where the first keyword includes a packet Four floors Self
  • the transceiver 1302 is configured to send the first forwarding entry to the four-layer forwarding device, where the first forwarding entry is used to indicate that the four-layer forwarding device receives the first matching the first keyword. And sending, by the first processing policy, the second packet to the layer 7 forwarding device.
  • the processor 1301 is further configured to generate a control rule, where the control rule is used to guide the layer 7 forwarding device to process a message.
  • the transceiver 1302 is further configured to send the control rule to the layer 7 device, so that the layer 7 forwarding device processes the second packet according to the control rule.
  • the processor 1301 is further configured to generate a second forwarding entry, where the second forwarding entry includes a second keyword and a second processing policy corresponding to the second keyword;
  • the word includes the four layers of information.
  • the transceiver 1302 is further configured to send the second forwarding entry to the four-layer forwarding device, where the second forwarding entry is used to indicate that the four-layer forwarding device receives the matching of the second keyword.
  • the third packet is processed according to the second processing policy, and the sending of the packet to the layer 7 forwarding device is omitted.
  • the transceiver 1302 is further configured to receive a packet parsing result sent by the layer 7 forwarding device, where the packet parsing result is obtained by parsing the second packet by the layer 7 forwarding device.
  • the processor 1301 is further configured to generate a third forwarding entry according to the packet parsing result, where the third forwarding entry includes the first keyword and a third processing policy corresponding to the first keyword.
  • the transceiver 1302 is further configured to send the third forwarding entry to the four-layer forwarding device, where the third forwarding entry is used to indicate that the four-layer forwarding device receives the matching of the first keyword.
  • the fourth packet is processed according to the third processing policy, and the sending of the packet to the layer 7 forwarding device is omitted.
  • FIG. 14 is a schematic structural diagram of an embodiment of a four-layer forwarding device according to the present invention. As shown in FIG. 14, the four-layer forwarding device may include: a receiving unit 1401 and a sending unit 1402.
  • the receiving unit 1401 is configured to receive a first forwarding entry that is sent by the controller, where the first forwarding entry includes a first keyword and a first processing policy corresponding to the first keyword; And including the fourth layer of information of the packet, where the first forwarding entry is used to indicate that the fourth layer forwarding device receives the first packet that matches the first keyword, and is configured to the seventh layer according to the first processing policy.
  • Forwarding device sends the first Second message;
  • the receiving unit 1401 is further configured to receive the first packet
  • the sending unit 1402 is configured to send the second packet to the layer 7 forwarding device by using a data channel according to the first forwarding entry after the receiving unit 1401 receives the first packet.
  • the receiving unit 1401 is further configured to receive a second forwarding entry that is sent by the controller, where the second forwarding entry includes a second keyword and a second processing policy corresponding to the second keyword.
  • the second keyword includes four layers of information of the packet, where the second forwarding entry is used to indicate that the fourth layer forwarding device receives the third packet that matches the second keyword, according to the The second processing policy processes the third packet, and omits sending a packet to the layer 7 forwarding device.
  • FIG. 15 is a schematic structural diagram of an embodiment of a four-layer forwarding device according to the present invention. As shown in FIG. 15, the four-layer forwarding device may include: a receiver 1501 and a transmitter 1502.
  • the receiver 1501 is configured to receive a first forwarding entry that is sent by the controller, where the first forwarding entry includes a first keyword and a first processing policy corresponding to the first keyword; And including the fourth layer of information of the packet, where the first forwarding entry is used to indicate that the fourth layer forwarding device receives the first packet that matches the first keyword, and is configured to the seventh layer according to the first processing policy.
  • the forwarding device sends the second packet.
  • the receiver 1501 is further configured to receive the first packet.
  • the transmitter 1502 is configured to send the second packet to the layer 7 forwarding device by using a data channel according to the first forwarding entry after the receiver 1501 receives the first packet.
  • the receiver 1501 is further configured to receive a second forwarding entry sent by the controller, where the second forwarding entry includes a second keyword and a second processing policy corresponding to the second keyword.
  • the second keyword includes four layers of information of the packet, where the second forwarding entry is used to indicate that the fourth layer forwarding device receives the third packet that matches the second keyword, according to the The second processing policy processes the third packet, and omits sending a packet to the layer 7 forwarding device.
  • the embodiment of the present invention further provides a controller, which is applied to a network service processing system including a layer 4 forwarding device and a first layer 7 forwarding device, where the system further includes a controller, the layer 4 forwarding device, and the a first seven-layer forwarding device respectively communicating with the controller, and the four-layer forwarding device and the There is a data channel for transmitting messages between the first layer 7 forwarding devices.
  • the controller includes: a communication unit, configured to receive service indication information sent by the first layer 7 forwarding device, and a processing unit, configured to add, according to the service statistics, a second layer 7 forwarding device, where the second A data channel for transmitting a message exists between the layer 7 forwarding device and the layer 4 forwarding device.
  • the processing unit is configured to determine, according to the service statistics, that the second layer seven forwarding device needs to be added, add the second layer seven forwarding device to the system, and send the fourth layer to the fourth
  • the layer forwarding device sends a forwarding entry, where the forwarding entry includes a keyword and a processing policy corresponding to the keyword; the keyword includes four layers of information, and the forwarding entry is used to indicate the fourth layer
  • the forwarding device receives the first packet matching the keyword, the forwarding device sends the second packet to the second layer 7 forwarding device according to the processing policy.
  • This embodiment provides a network service processing system, including the foregoing four-layer forwarding device, a controller, and a seven-layer forwarding device.
  • the four-layer forwarding device and the seven-layer forwarding device respectively communicate with the controller.
  • a data channel for transmitting network service packets exists between the four-layer forwarding device and the seven-layer forwarding device.
  • the system includes a controller and a forwarding device for processing traffic at the first network level.
  • the structure of the system can be, for example, the structure shown in FIG.
  • the network service processing system may include only a controller and a four-layer forwarding device, or may also include a controller, a four-layer forwarding device, and a seven-layer forwarding device.
  • the four-layer forwarding device and the controller can be connected through a four-layer control interface, and the controller sends packet processing information to the four-layer forwarding device through the four-layer control interface.
  • the Layer 7 forwarding device and the controller can be connected through a Layer 7 control interface, and the controller sends packet processing information to the Layer 7 forwarding device through the Layer 7 control interface.
  • a data channel for forwarding network service packets can be set between the Layer 7 forwarding device and the Layer 4 forwarding device.
  • the Layer 7 forwarding device may include: multiple Layer 7 forwarding devices corresponding to different Layer 7 protocols, or multiple Layer 7 forwarding devices corresponding to different network services. For example, there may be different Layer 7 forwarding devices depending on the Layer 7 service. For example, a seven-layer load balancing forwarding device and a seven-layer firewall forwarding device. The Layer 7 load balancing and forwarding device can be further subdivided according to the supported Layer 7 protocol. For example, a Layer 7 HTTP load balancing forwarding device and a Layer 7 SIP load balancing forwarding device.
  • a Layer 7 forwarding device can be processed by a Layer 7 protocol, or The seven-layer forwarding device corresponds to the processing of multiple Layer 7 protocols.
  • the forwarding device may include: a plurality of forwarding devices respectively corresponding to different network services, for example, in the network service processing system shown in FIG. 7, the forwarding device includes multiple services in the network service chain, different The forwarding devices of the services can be combined to form a processing system to implement serial connection of multiple services.
  • the forwarding devices belonging to different network services may be respectively controlled by controllers corresponding to the network services; or controlled by the same controller.
  • the forwarding device of the firewall service and the load balancing service shown in FIG. 7 may be controlled by the controllers of the respective services, for example, the forwarding device of the firewall service is controlled by the firewall controller, and the forwarding device of the load balancing service is load balanced.
  • the controller controls; or, the forwarding device of the firewall service and the load balancing service are controlled by the same controller.
  • a controller can control one or more four-layer forwarding devices.
  • a controller can also control one or more seven-layer forwarding devices.
  • a 4 forwarding device or a 7 forwarding device can be controlled by a plurality of controllers.
  • controllers There may be different controllers depending on the network service. For example, a load balancing controller, a firewall controller, and an IPSec/SSL VPN gateway controller.
  • an embodiment of the present invention provides an implementation process of an interaction process between a layer 7 forwarding device and a controller, including:
  • the registration process Used for the seven-layer forwarding device to register with the controller.
  • the registration request can include information such as the seven-layer forwarding device ID, authentication information, protocol version number, and seven-layer service type (for example, load balancing service, firewall service, etc.).
  • the controller replies with a registration response to indicate that the registration was successful or failed.
  • Capability exchange process Used for negotiation of business capabilities between the two parties.
  • the exchangeable capabilities include seven layers of service protocols (eg, HTTP, FTP, etc.) and seven layers of business processing capabilities (eg, maximum concurrency, new connections per second, etc.) ⁇ .
  • the seven-layer forwarding device requests the controller to obtain a flow entry.
  • a seven-layer process is performed:
  • the controller sends a flow entry to the Layer 7 forwarding device, which can be delivered by the controller or sent by the device.
  • the request for the seven-layer processing flow and the delivery of the seven-layer processing flow have been described in the foregoing method embodiments, and will not be described in detail.
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the above method embodiments;
  • the storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供一种报文处理方法、设备和系统。上述方法应用于包括四层转发设备、七层转发设备和控制器的系统，四层转发设备和七层转发设备分别与控制器通信，且四层转发设备和七层转发设备之间存在用于传输报文的数据通道；方法包括：控制器向四层转发设备发送第一转发表项，第一转发表项包括第一关键字和第一关键字对应的第一处理策略；第一关键字包括报文的四层信息，第一转发表项用于指示四层转发设备接收到匹配所述第一关键字的第一报文时，根据第一处理策略向七层转发设备发送第二报文；控制器向七层转发设备发送用于指导所述七层转发设备处理报文的控制规则，使得所述七层转发设备根据所述控制规则处理所述第二报文。

Description

报文处理方法、 设备和系统
技术领域
本发明涉及通信技术， 尤其涉及一种报文方法、 设备和系统。 背景技术
网络中存在着各种各样的网络业务， 比如： 负载均衡 （Load balancing) 业 务、 防火墙（Firewall)业务等。 网络业务的处理是由网络业务处理设备完成的， 以负载均衡业务为例， 通过负载均衡技术在多个计算机、 磁盘驱动器或其他资 源中分配负载， 以达到优化资源使用、 最大化吞吐率和最小化响应时间等目的。 提供负载均衡服务能力的机器一般称为负载均衡器 （Load Balancer )。 该负载均 衡器重要的一个应用是为多台服务器提供负载均衡， 此时负载均衡器称为服务 器负载均衡器 （Server Load Balancer )。 举例来说， 三台服务器分别与服务器负 载均衡器相连， 服务器负载均衡器对外提供一虚拟网络互连协议 （Internet Protocol, 简称： IP) 地址。 用户要访问服务器所提供的业务时， 需要向虚拟 IP 地址发起访问请求， 由服务器负载均衡器根据负载均衡算法选择合适的服务器
(其算法可以是轮询、 最小连接数和最快响应速度等算法）， 服务器负载均衡器 处理业务数据后返回给用户。
现有网络业务， 比如上述的负载均衡业务中， 用于处理网络业务的设备， 比如负载均衡器， 在处理网络业务时需要根据不同网络层次的信息作为处理依 据。 具体的， 计算机网络是分层的， 国际标准化组织 （ISO)提出的一种网络分 层模型， 即 OSI模型将网络划分为七层， 分别为： 应用层 （第 7层）、 表示层
(第 6层）、 会话层 （第 5层）、 传输层 （第 4层）、 网络层 （第 3层）、 数据链 路层 （第 2层） 和物理层 （第 1层）。 不同的网络业务需要处理不同网络层次的 信息作为处理依据， 即使同一个网络业务在不同场景下可能也会需要处理不同 网络层次的信息。 比如， 服务器负载均衡器在选择服务器时， 可以根据接收到 的网络报文中所包含的第四层及第四层的以下层的信息来选择服务器， 也可能 是根据四层以上的信息来选择服务器。 一般来说， 负载均衡器只处理四层及第 四层的以下层信息时， 负载均衡器的处理能力较强， 处理效率较高； 而负载均 衡器如果处理四层以上的信息， 负载均衡器的处理能力和效率都较低。
但是， 当前的网络业务处理， 都是由单一的网络业务处理设备实现， 即不 论是四层及第四层的以下层的信息处理， 还是四层以上信息的处理都耦合在一 起； 比如上述的， 所有网络层次的业务都在负载均衡器这一个设备中处理， 这 样所有网络层次的业务都由同一设备处理的方式， 会造成负载均衡器等网络业 务处理设备的业务处理能力的降低， 比如， 不同网络层次的信息处理之间会相 互影响而降低设备整体的业务处理量， 设备的业务处理能力较低。 发明内容
本发明实施例提供一种报文处理方法、 设备和系统， 以提高业务处理能力。 第一方面， 提供一种报文处理方法， 应用于包括四层转发设备、 七层转发 设备和控制器的系统， 所述四层转发设备和七层转发设备分别与所述控制器通 信， 且所述四层转发设备和七层转发设备之间存在用于传输报文的数据通道； 所述方法包括：
所述控制器向所述四层转发设备发送第一转发表项， 所述第一转发表项包 括第一关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包括报 文的四层信息， 所述第一转发表项用于指示所述四层转发设备接收到匹配所述 第一关键字的第一报文时， 根据所述第一处理策略向所述七层转发设备发送第 二报文；
所述控制器向所述七层转发设备发送用于指导所述七层转发设备处理报文 的控制规则， 使得所述七层转发设备根据所述控制规则处理所述第二报文。
根据第一方面， 提供第一种实现方式， 所述方法还包括：
所述控制器向所述四层转发设备发送第二转发表项， 所述第二转发表项包 括第二关键字和所述第二关键字对应的第二处理策略； 所述第二关键字包括报 文的四层信息， 所述第二转发表项用于指示所述四层转发设备接收到匹配所述 第二关键字的第三报文时， 根据所述第二处理策略处理所述第三报文， 省略向 所述七层转发设备发送报文。
根据第一方面或者第一方面的第一种实现方式， 提供第二种实现方式， 在 所述控制器向所述七层转发设备发送控制规则之后， 所述方法还包括： 所述控制器接收所述七层转发设备发送的报文解析结果， 所述报文解析结 果是所述七层转发设备通过解析所述第二报文得到；
所述控制器根据所述报文解析结果， 向所述四层转发设备发送第三转发表 项， 所述第三转发表项包括所述第一关键字和所述第一关键字对应的第三处理 策略； 所述第三转发表项用于指示所述四层转发设备接收到匹配所述第一关键 字的第四报文时根据所述第三处理策略处理所述第四报文， 省略向所述七层转 发设备发送报文。
根据第一方面的第二种实现方式， 提供第三种实现方式， 在所述控制器接 收所述七层转发设备发送的报文解析结果之前， 所述方法还包括：
所述控制器向所述七层转发设备发送条件七层信息， 所述条件七层信息用 于指示所述七层转发设备在解析所述第二报文得到所述条件七层信息时发送所 述报文解析结果。
根据第一方面的第二种实现方式或者第三种实现方式， 提供第四种实现方 式， 所述控制器向所述四层转发设备发送所述第三转发表项之前， 所述方法还 包括：
所述控制器接收所述七层转发设备发送的消息， 所述消息用于通知所述控 制器向所述四层转发设备发送所述第三转发表项。
根据第一方面的第二种到第四种实现方式中的任何一种实现方式， 提供第 五种实现方式， 所述控制器向所述七层转发设备发送控制规则， 包括：
所述控制器向所述七层转发设备发送第五处理策略或者第四转发表项， 所 述第四转发表项包括： 第四关键字和所述第四关键字对应的第四处理策略。
根据第一方面的第五种实现方式， 提供第六种实现方式， 所述控制器向所 述七层转发设备发送第五处理策略或者第四转发表项， 包括：
所述控制器在接收到所述七层转发设备发送的所述报文解析结果之后， 向 所述七层转发设备发送所述第五处理策略或者所述第四转发表项。
根据第一方面或者第一方面的上述任何一种实现方式， 提供第七种实现方 式， 所述控制器向所述四层转发设备发送第一转发表项， 包括：
所述控制器通过中间控制设备向所述四层转发设备发送所述第一转发表 项。 根据第一方面或者第一方面的上述任何一种实现方式， 提供第八种实现方 式， 所述四层转发设备提供防火墙业务， 所述七层转发设备提供负载均衡业务。
第二方面， 提供一种报文处理方法， 应用于包括四层转发设备、 七层转发 设备和控制器的系统， 所述四层转发设备和七层转发设备分别与所述控制器通 信， 且所述四层转发设备和七层转发设备之间存在用于传输报文的数据通道； 所述方法包括：
所述四层转发设备接收所述控制器发送的第一转发表项， 所述第一转发表 项包括第一关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包 括报文的四层信息， 所述第一转发表项用于指示所述四层转发设备接收到匹配 所述第一关键字的第一报文时， 根据所述第一处理策略向所述七层转发设备发 送第二报文；
所述四层转发设备接收所述第一报文；
所述四层转发设备根据所述第一转发表项， 通过所述数据通道向所述七层 转发设备发送所述第二报文。
根据第二方面， 提供第一种实现方式， 所述方法还包括：
所述四层转发设备接收所述控制器发送的第二转发表项， 所述第二转发表 项包括第二关键字和所述第二关键字对应的第二处理策略； 所述第二关键字包 括报文的四层信息， 所述第二转发表项用于指示所述四层转发设备接收到匹配 所述第二关键字的第三报文时， 根据所述第二处理策略处理所述第三报文， 省 略向所述七层转发设备发送报文。
根据第二方面的第一种实现方式， 提供第二种实现方式， 所述四层转发设 备通过所述数据通道向所述七层转发设备发送所述第二报文之后， 还包括： 所述四层转发设备接收所述控制器发送的第三转发表项， 所述第三转发表 项包括所述第一关键字和所述第一关键字对应的第三处理策略； 所述第三转发 表项用于指示所述四层转发设备接收到匹配所述第一关键字的第四报文时根据 所述第三处理策略处理所述第四报文， 省略向所述七层转发设备发送报文。
根据第二方面或者第二方面的上述任何一种实现方式， 提供第三种实现方 式， ， 所述四层转发设备提供防火墙业务， 所述七层转发设备提供负载均衡业 第三方面， 提供一种网络业务处理方法， 应用于包括四层转发设备和第一 七层转发设备的网络业务处理系统， 所述系统中还包括控制器， 所述四层转发 设备和所述第一七层转发设备分别与所述控制器通信， 且所述四层转发设备和 所述第一七层转发设备之间存在用于传输报文的数据通道； 所述网络业务处理 方法包括：
所述控制器接收所述第一七层转发设备发送的业务统计信息；
所述控制器根据所述业务统计信息， 增加第二七层转发设备， 所述第二七 层转发设备和所述四层转发设备之间存在用于传输报文的数据通道。
根据第三方面， 提供第一种实现方式， 所述控制器根据所述业务统计信息， 增加所述第二七层转发设备， 包括：
所述控制器根据所述业务统计信息， 确定需要增加所述第二七层转发设备; 所述控制器在所述系统中增加所述第二七层转发设备， 并向所述四层转发 设备发送转发表项， 所述转发表项包括关键字和所述关键字对应的处理策略； 所述关键字包括报文的四层信息， 所述转发表项用于指示所述四层转发设备接 收到匹配所述关键字的第一报文时， 根据所述处理策略向所述第二七层转发设 备发送第二报文。
第四方面， 提供一种控制器， 包括：
处理单元， 用于生成第一转发表项， 所述第一转发表项包括第一关键字和 所述第一关键字对应的第一处理策略； 所述第一关键字包括报文的四层信息； 通信单元， 用于向四层转发设备发送所述第一转发表项， 所述第一转发表 项用于指示所述四层转发设备接收到匹配所述第一关键字的第一报文时， 根据 所述第一处理策略向所述七层转发设备发送第二报文；
所述处理单元还用于生成控制规则， 所述控制规则用于指导所述七层转发 设备处理报文；
所述通信单元还用于向所述七层设备发送所述控制规则， 使得所述七层转 发设备根据所述控制规则处理所述第二报文。
根据第四方面， 提供第一种实现方式， 所述处理单元还用于生成第二转发 表项， 所述第二转发表项包括第二关键字和所述第二关键字对应的第二处理策 略； 所述第二关键字包括报文的四层信息；
所述通信单元还用于向所述四层转发设备发送所述第二转发表项， 所述第 二转发表项用于指示所述四层转发设备接收到匹配所述第二关键字的第三报文 时， 根据所述第二处理策略处理所述第三报文， 省略向所述七层转发设备发送 报文。
根据第四方面或者第四方面的第一种实现方式， 提供第二种实现方式， 所 述通信单元还用于接收所述七层转发设备发送的报文解析结果， 所述报文解析 结果是所述七层转发设备通过解析所述第二报文得到；
所述处理单元还用于根据所述报文解析结果生成第三转发表项， 所述第三 转发表项包括所述第一关键字和所述第一关键字对应的第三处理策略；
所述通信单元还用于向所述四层转发设备发送所述第三转发表项， 所述第 三转发表项用于指示所述四层转发设备接收到匹配所述第一关键字的第四报文 时根据所述第三处理策略处理所述第四报文， 省略向所述七层转发设备发送报 文。
第五方面， 提供一种控制器， 应用于包括四层转发设备和第一七层转发设 备的网络业务处理系统， 所述系统中还包括控制器， 所述四层转发设备和所述 第一七层转发设备分别与所述控制器通信， 且所述四层转发设备和所述第一七 层转发设备之间存在用于传输报文的数据通道， 所述控制器包括：
通信单元， 用于接收所述第一七层转发设备发送的业务指示信息； 处理单元， 用于根据所述业务统计信息， 增加第二七层转发设备， 所述第 二七层转发设备和所述四层转发设备之间存在用于传输报文的数据通道。
根据第五方面， 提供第一种实现方式， 所述处理单元具体用于根据所述业 务统计信息， 确定需要增加所述第二七层转发设备， 在所述系统中增加所述第 二七层转发设备， 并向所述四层转发设备发送转发表项， 所述转发表项包括关 键字和所述关键字对应的处理策略； 所述关键字包括报文的四层信息， 所述转 发表项用于指示所述四层转发设备接收到匹配所述关键字的第一报文时， 根据 所述处理策略向所述第二七层转发设备发送第二报文。
第六方面， 提供一种四层转发设备， 包括： 接收单元和发送单元； 所述接收单元用于接收控制器发送的第一转发表项， 所述第一转发表项包 括第一关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包括报 文的四层信息， 所述第一转发表项用于指示所述四层转发设备接收到匹配所述 第一关键字的第一报文时， 根据所述第一处理策略向七层转发设备发送第二报 文； 所述接收单元还用于接收所述第一报文；
所述发送单元用于在所述接收单元接收到到所述第一报文后根据所述第一 转发表项， 通过数据通道向所述七层转发设备发送所述第二报文。
根据第六方面， 提供第一种实现方式， 所述接收单元还用于接收所述控制 器发送的第二转发表项， 所述第二转发表项包括第二关键字和所述第二关键字 对应的第二处理策略； 所述第二关键字包括报文的四层信息， 所述第二转发表 项用于指示所述四层转发设备接收到匹配所述第二关键字的第三报文时， 根据 所述第二处理策略处理所述第三报文， 省略向所述七层转发设备发送报文。 第七方面， 提供一种网络业务处理系统， 包括： 上面描述的四层转发设备、 上 述控制器、 以及七层转发设备； 所述四层转发设备和七层转发设备分别与所述 控制器通信， 且所述四层转发设备和七层转发设备之间存在用于传输网络业务 报文的数据通道。
上述第一方面、 第二方面、 第四方面、 第六方面和第七方面提供的方案中， 四层转发设备接收控制器发送的第一转发表项， 解析接收到的报文的四层信息， 匹配控制器下发的第一转发表项， 向七层转发设备发送报文。 这样一来， 四层 转发设备处理报文的四层信息， 七层转发设备处理报文的七层信息。 有利于提 高四层转发设备的处理能力， 从而也使得整体的业务处理能力提升。
上述第三方面、 第五方面提供的方案， 可以灵活提高七层转发设备的业务 处理能力。 附图说明 图 1为本发明一个实施例中网络业务处理方法的应用架构图；
图 2为本发明报文处理方法一实施例的流程示意图；
图 3为本发明报文处理方法另一实施例的流程示意图；
图 4为本发明网络业务处理方法一实施例的应用系统图；
图 5为本发明网络业务处理方法一实施例的报文发送信令图一；
图 6为本发明网络业务处理方法一实施例的报文发送信令图二；
图 7为本发明网络业务处理方法另一实施例的应用系统图；
图 8为本发明网络业务处理方法另一实施例的报文发送信令图；
图 9为本发明网络业务处理方法又一实施例的应用系统图；
图 10为本发明网络业务处理方法又一实施例的应用系统图； 图 11为本发明网络业务处理方法又一实施例的应用系统图；
图 12为本发明控制器一实施例的结构示意图；
图 13为本发明控制器一实施例的结构示意图；
图 14为本发明四层转发设备实施例的结构示意图；
图 15为本发明四层转发设备实施例的结构示意图。 具体实施方式
网络中存在着各种各样的网络业务， 例如， 负载均衡业务、 防火墙业务等， 不同的网络业务在具体处理时需要处理不同网络层次的信息， 比如， 对于某种 网络业务， 在处理该业务时， 对这种业务对应的报文需要处理四层信息， 或者 需要处理七层信息。 这里的四层或七层， 指的是根据 OSI模型划分的网络分层， 即通常的第七层 - 应用层 (Application Layer) 、 第 6层 - 表示层 (Presentation Layer)、第 5层 - 会话层 ( Session Layer)、第四层 - 传输层 ( Transport Layer)、 第 3层 - 网络层 （Network Layer) 、 第 2层 - 数据链路层 （Data Link Layer) 和 第 1层 - 物理层 (Physical Layer) 。
本实施例中， 将四层业务（处理四层及以下层信息的业务）和七层业务（处 理七层及以下层信息的业务） 解耦， 这两类业务不在同一设备处理， 而是分别 由不同的设备处理； 比如， 将处理四层业务的设备称为四层转发设备， 将处理 七层业务的设备称为七层转发设备。 图 1为本发明一个实施例中网络业务处理方 法的应用架构图， 如图 1所示， 该架构中包括控制器、 四层转发设备和七层转发 设备； 该四层转发设备和七层转发设备分别与控制器通信， 并且四层转发设备 与控制器之间可以是直接连接或者通过其他设备相连接， 七层转发设备与控制 器之间也可以是直接连接或者通过其他设备相连接， 本发明实施例不做限制。
其中， 有些网络业务可能只需要控制器和四层转发设备配合实现， 此时不 需要七层转发设备； 有些网络业务可能会用到控制器、 四层转发设备和七层转 发设备三者配合实现。 该四层转发设备和七层转发设备可以用于处理某个特定 的网络层次业务的， 比如四层转发设备处理的是四层业务， 七层转发设备处理 的是七层业务。
所述的四层转发设备与控制器之间可以设置四层控制接口， 七层转发设备 与控制器之间可以设置七层控制接口。 四层转发设备与七层转发设备之间可以 设置用于传输报文的数据通道， 该数据通道可以是独立的物理通道， 或者也可 以是所述的四层控制接口和七层控制接口之间连接的通道。 控制器可以调度和 控制报文在四层转发设备和七层转发设备之间的处理。
实施例一
图 2为本发明报文处理方法一实施例的流程示意图， 该方法是在图 1的系统 架构下， 由控制器执行， 如图 2所示， 该方法可以包括如下处理， 需要说明的是， 本实施例中的 201、 202等歩骤并不限制其执行顺序。
201、 控制器向所述四层转发设备发送第一转发表项；
例如， 控制器通过上述的四层控制接口向四层转发设备发送第一转发表项， 所述第一转发表项包括第一关键字和所述第一关键字对应的第一处理策略； 所 述第一关键字包括报文的四层信息， 所述第一转发表项用于指示所述四层转发 设备接收到匹配所述第一关键字的第一报文时， 根据所述第一处理策略向所述 七层转发设备发送第二报文。
可选的， 控制器可以通过中间控制设备向所述四层转发设备发送所述第一 转发表项。
202、 控制器向所述七层转发设备发送用于指导所述七层转发设备处理报文 的控制规则；
例如， 控制器还可以通过七层控制接口向七层转发设备发送用于指导所述 七层转发设备处理报文的控制规则， 使得所述七层转发设备根据所述控制规则 处理所述第二报文。 四层转发设备可以根据第一转发表项， 七层转发设备可以 根据控制规则， 来处理报文， 处理的动作例如是， 转发、 丢弃、 复制和计数等， 比如将报文转发至某个服务器， 或者转发至另一个转发设备等。
进一歩的， 所述控制器还可以向所述四层转发设备发送第二转发表项， 所 述第二转发表项包括第二关键字和所述第二关键字对应的第二处理策略； 所述 第二关键字包括报文的四层信息， 所述第二转发表项用于指示所述四层转发设 备接收到匹配所述第二关键字的第三报文时， 根据所述第二处理策略处理所述 第三报文， 省略向所述七层转发设备发送报文。
进一歩的， 在所述控制器向所述七层转发设备发送控制规则之后， 还包括： 所述控制器接收所述七层转发设备发送的报文解析结果， 所述报文解析结果是 所述七层转发设备通过解析所述第二报文得到。 所述控制器根据所述报文解析 结果， 向所述四层转发设备发送第三转发表项， 所述第三转发表项包括所述第 一关键字和所述第一关键字对应的第三处理策略； 所述第三转发表项用于指示 所述四层转发设备接收到匹配所述第一关键字的第四报文时根据所述第三处理 策略处理所述第四报文， 省略向七层转发设备发送报文。
如上所述的， 本发明实施例分别设置了四层转发设备和七层转发设备， 还 设置了用于控制这两个设备处理报文的控制器， 这几个设备之间的工作配合方 式可以是， 报文首先到达四层转发设备， 可以由四层转发设备将报文转发至七 层转发设备， 七层转发设备对该报文进行解析得到报文解析结果。 举例来说， 该报文解析结果可以是报文中包括的四层信息、 七层协议信息等。 七层转发设 备还可以获取业务统计信息， 该业务统计信息主要用于表示七层转发设备自身 的业务处理负荷， 比如业务量、 CPU负载等。 七层转发设备可以将上述的业务 统计信息和 /或报文解析结果上报至控制器， 控制器就可以根据这些信息分别对 四层转发设备和 /或七层转发设备进行业务控制。
例如， 控制器如果根据报文解析结果， 判断出该报文后续可以不再需要七 层转发设备参与处理， 即只四层转发设备处理就可以， 那么控制器可以向四层 转发设备发送第三转发表项， 该第三转发表项用于指示所述四层转发设备接收 到匹配所述第一关键字的第四报文时根据所述第三处理策略处理所述第四报 文， 省略向所述七层转发设备发送报文。
进一歩的， 在所述控制器接收所述七层转发设备发送的报文解析结果之前， 还包括： 所述控制器向所述七层转发设备发送条件七层信息， 所述条件七层信 息用于指示所述七层转发设备在解析所述第二报文得到所述条件七层信息时发 送所述报文解析结果。
可选的， 所述控制器向所述四层转发设备发送所述第三转发表项之前， 还 包括： 所述控制器接收所述七层转发设备发送的消息， 所述消息用于通知所述 控制器向所述四层转发设备发送所述第三转发表项。
可选的， 所述控制器向所述七层转发设备发送控制规则， 包括： 所述控制 器向所述七层转发设备发送第五处理策略或者第四转发表项， 所述第四转发表 项包括： 第四关键字和所述第四关键字对应的第四处理策略。
可选的， 所述控制器向所述七层转发设备发送第五处理策略或者第四转发 表项， 包括： 所述控制器在接收到所述七层转发设备发送的所述报文解析结果 之后， 向所述七层转发设备发送所述第五处理策略或者第四转发表项。
现有的各层次网络业务都由同一个设备来处理， 比如某个设备既处理四层 业务又处理七层业务， 七层业务需要处理七层信息时本身处理效率就较慢， 这 样会降低四层业务的处理效率。 而本发明实施例单独设置了四层转发设备， 并 且还设置控制器， 四层转发设备接收控制器发送的第一转发表项， 解析接收到 的报文的四层信息， 匹配控制器下发的第一转发表项， 向七层转发设备发送报 文。 这样一来， 四层转发设备处理报文的四层信息， 七层转发设备处理报文的 七层信息。 四层转发设备专用于处理四层业务， 使得业务处理量和处理效率都 会得到提升， 业务安排非常灵活。
此外， 本发明实施例的系统架构中， 可以包括分别属于不同业务的转发设 备； 例如， 四层转发设备提供防火墙业务， 所述七层转发设备提供负载均衡业 本实施例将四层业务和七层业务分别由不同的设备处理， 这样四层转发设 备专用于处理四层业务， 业务处理的效率就得到提高， 而七层转发设备只在需 要处理四层以上的业务时才使用， 实现了较高的灵活性。
实施例二
图 3为本发明报文处理方法另一实施例的流程示意图， 该方法是在图 1的系 统架构下， 由四层转发设备执行， 如图 3所示， 该方法可以包括如下处理， 需要 说明的是， 本实施例中的各歩骤并不限制其执行顺序； 并且， 由于方法与实施 例一类似， 本实施例简单描述。
301、 四层转发设备接收所述控制器发送的第一转发表项；
其中， 所述第一转发表项包括第一关键字和所述第一关键字对应的第一处 理策略； 所述第一关键字包括报文的四层信息， 所述第一转发表项用于指示所 述四层转发设备接收到匹配所述第一关键字的第一报文时， 根据所述第一处理 策略向所述七层转发设备发送第二报文。
302、 四层转发设备接收所述第一报文；
303、 四层转发设备根据所述第一转发表项， 通过所述数据通道向所述七层 转发设备发送所述第二报文。
进一歩的， 该四层转发设备还可以接收所述控制器发送的第二转发表项， 所述第二转发表项包括第二关键字和所述第二关键字对应的第二处理策略； 所 述第二关键字包括报文的四层信息， 所述第二转发表项用于指示所述四层转发 设备接收到匹配所述第二关键字的第三报文时， 根据所述第二处理策略处理所 述第三报文， 省略向所述七层转发设备发送报文。
进一歩的， 所述四层转发设备通过所述数据通道向所述七层转发设备发送 所述第二报文之后， 还包括： 所述四层转发设备接收所述控制器发送的第三转 发表项， 所述第三转发表项包括所述第一关键字和所述第一关键字对应的第三 处理策略； 所述第三转发表项用于指示所述四层转发设备接收到匹配所述第一 关键字的第四报文时根据所述第三处理策略处理所述第四报文， 省略向所述七 层转发设备发送报文。
下面将结合几个具体的网络业务来对本发明实施例的方法进行说明： 实施例三
本实施例以负载均衡业务为例， 处理负载均衡业务的控制器可以称为负载 均衡控制器， 参见图 4， 图 4为本发明网络业务处理方法一实施例的应用系统图。 本实施例假设存在四层转发设备和七层转发设备 （当然， 七层转发设备在需要 时使用， 不需要时可以不使用或者不设置该设备） 。
其中， 示例性地， 本实施例中包括三个服务器和一个客户端， 该三个服务 器例如是服务器 1、 服务器 2和服务器 3， 客户端可以向这三个服务器中的某一个 发送报文， 由负载均衡控制器和所示的转发设备共同实现负载均衡的控制。 服 务器也可以向客户端发送报文， 经过负载均衡控制器和所示的转发设备共同实 现报文的转发。 图 5为本发明网络业务处理方法一实施例的报文发送信令图一， 该图 5示出的是以客户端向服务器发送报文为例， 包括：
501、 负载均衡控制器向四层转发设备发送第一转发表项；
其中， 负载均衡控制器生成该第一转发表项， 例如可以是根据服务器信息、 负载均衡算法等， 获取服务器负载、 以及服务器与转发设备之间的链路状态等 信息， 综合得到第一转发表项。 而上述的服务器负载等信息的获取， 可以是负 载均衡控制器与服务器之间设置管理接口， 通过该管理接口来获取。 负载均衡 控制器与服务器之间的通讯方式有多种， 比如， 网络地址转换（Network Address Translation, 简称： NAT) 方式、 隧道方式或直接路由方式等。 上述的服务器负 载等信息的获取也可以通过负载均衡控制器指示与服务器直接连接的四层转发 设备来收集并上报至负载均衡控制器实现。 负载均衡控制器向四层转发设备发送的第一转发表项包括第一关键字、 以 及第一关键字对应的第一处理策略； 所述的第一关键字包括报文的四层信息。 该四层信息例如是源 IP地址、 目的 IP地址、 源端口、 目的端口、 源 MAC地址、 目的 MAC地址、 协议号、 VLAN ID中的至少一种。 该第一转发表项用于指示所 述四层转发设备接收到匹配所述第一关键字的第一报文时， 根据所述第一处理 策略向所述七层转发设备发送第二报文； 该第一转发表项可以是流表项的形式。 举例来说， 该流表项包括： 符合四层信息 1的报文转发给服务器 1 (该四层信息 1 可以称为第一关键字， 该转发给服务器 1即是所述的与四层信息 1对应的报文处 理策略） ； 符合四层信息 2的报文转发给服务器 2; 符合四层信息 3的报文转发给 服务器 3。 进一歩的， 上述流表项还可以包括： 符合四层信息 4的报文转发至七 层转发设备。
可选的， 负载均衡控制器可以通过 open flow协议来下发上述流表项， 或者 也可以通过超文本传输协议 （Hypertext transfer protocol, 简称： HTTP) 、 可扩 展通讯禾口表示协议 ( The Extensible Messaging and Presence Protocol , 简称： XMPP) 等协议的扩展来实现下发。
502、 负载均衡控制器向七层转发设备发送控制规则， 所述控制规则用于指 导七层转发设备处理报文；
其中， 负载均衡控制器向七层转发设备发送的控制规则具体例如是第五处 理策略或者第四转发表项； 该第四转发表项可以包括第四关键字、 以及所述第 四关键字对应的第四处理策略， 所述的第四关键字可以包括报文的七层信息。 该第四转发表项可以是流表项的形式， 例如包括： 符合七层信息 1的报文转发给 服务器 1 (其中的七层信息 1可以称为第四关键字， 该转发给服务器 1即是所述的 与七层信息 1对应的第四处理策略） ； 符合七层信息 2的报文转发给服务器 2; 符 合七层信息 3的报文转发给服务器 3。 这里的七层信息包括七层及以下层的信息。
可选地， 四层转发设备一般可以由高性能的转发硬件实现， 比如是交换机 或路由器， 这类设备根据预先下发的转发表， 例如流表项， 进行报文转发比较 方便实现。 而七层转发设备一般是根据网络业务的需求对需要的协议层进行识 别解析， 提取关键信息等并处理， 这类设备的控制方式更为灵活， 比如， 可以 向七层转发设备下发控制规则， 该控制规则的发送时间和方式也较为灵活。
举例来说， 负载均衡控制器向七层转发设备发送控制规则的时间： 可以在 七层转发设备接收报文之前， 向七层转发设备发送所述控制规则； 比如在四层 转发设备将报文转发至七层转发设备之前， 就发送了上述的"符合七层信息 1的 报文转发给服务器 1 "等流表项， 那么当七层转发设备接收到报文时， 解析报文 并根据解析得到的七层信息按照控制规则进行处理即可。 或者， 七层转发设备 可以先接收到报文， 并在解析报文得到报文解析结果后， 将所述报文解析结果 发送至负载均衡控制器， 负载均衡控制器在接收到该结果后， 根据所述报文解 析结果确定控制规则并下发给七层转发设备， 即向七层转发设备发送所述第五 处理策略或者第四转发表项。
可选地， 如果是后一种方式， 即负载均衡控制器在接收到报文解析结果后 再下发控制规则， 则负载均衡控制器可以在之前向七层转发设备发送信息上报 条件， 所述信息上报条件包括： 解析报文得到的条件七层信息， 这里的条件七 层信息指的是， 作为将报文解析结果上报负载均衡控制器的上报条件的七层信 息， 所述条件七层信息用于指示所述七层转发设备在解析所述第二报文得到所 述条件七层信息时发送所述报文解析结果； 即当对报文进行解析得到的七层信 息是该条件七层信息时， 就将报文解析结果上报负载均衡控制器。 例如该条件 七层信息可以包括：符合七层信息 4的报文向负载均衡控制器进一歩请求；此时， 所述的七层信息 4就相当于条件七层信息， 是七层转发设备请求负载均衡控制器 下发转发表的条件。
如上所述的， 负载均衡控制器发送给七层转发设备的控制规则可以是第五 处理策略或者第四转发表项； 其中的第四转发表项是负载均衡控制器已经定好 的转发策略， 例如符合七层信息 1的报文发送给服务器 1。 第四转发表项是负载 均衡控制器根据负载均衡算法、 服务器信息等得到的， 并可以用例如流表项的 方式下发给七层转发设备， 七层转发设备根据第四转发表项处理接收到的报文。 而第五处理策略指的是， 负载均衡控制器将得到第四转发表项所依据的负载均 衡算法等信息告知七层转发设备， 比如是 "按照负载均衡算法 a、当服务器负载小 于 b时将报文转发至该服务器"， 由七层转发设备按照负载均衡控制器下发的第 五处理策略确定接收到的报文应该转发给哪个服务器。 本实施例以第四转发表 项为例。
503、 四层转发设备接收客户端发送的第一报文；
其中， 从图 4可以看到， 客户端发送的报文将直接发送给四层转发设备。 504、 四层转发设备根据第一报文和第一转发表项， 向七层转发设备发送第 二报文；
其中， 四层转发设备在接收到第一报文后， 将根据在 501接收到的第一转发 表项进行报文转发； 例如， 如果解析报文得到的四层信息是四层信息 1， 则将报 文转发给服务器 1 ; 如果解析报文得到的四层信息是四层信息 2， 则将报文转发 给服务器 2等。 本实施例中， 假设解析报文得到的四层信息是四层信息 4， 贝泗 层转发设备据此将向七层转发设备发送第二报文， 该第二报文例如可以是四层 转发设备将第一报文进行复制得到的报文。
505、 七层转发设备解析第二报文得到报文解析结果；
其中， 七层转发设备在接收到四层转发设备发送的第二报文后， 缓存并解 析该报文。 报文解析结果， 例如包含七层信息 4， 该七层信息 4可以包括： 四层 信息 4 (例如， 网络五元组信息） ； 七层协议信息， 例如， HTTP的 Cookie头部信 息， 会话发起协议 ( Session Initiation Protocol, 简称： SIP) 的 Call— ID (呼叫标 识）。七层转发设备根据解析结果查询在 302中接收到的流表项， 根据流表项"符 合七层信息 4的报文向负载均衡控制器进一歩请求"七层转发
设备需要将报文解析结果上报至负载均衡控制器。
506、 七层转发设备向负载均衡控制器上报报文解析结果；
其中， 七层转发设备可以将报文解析结果上报至负载均衡控制器， 向负载 均衡控制器请求下一歩的处理策略。
例如， 七层转发设备发送上述信息的格式和内容可以与特定的网络业务相 关， 以七层负载均衡业务为例， 可以包括{网络五元组信息， 希望选择的服务器， 七层协议信息 （比如， HTTP的 Cookie头部信息， SIP的 Call_ID头部信息） }。
507、 负载均衡控制器根据解析结果选择服务器；
其中， 负载均衡控制器根据七层转发设备上报的报文解析结果， 选择合适 的服务器， 本实施例假设选择的是服务器 1 ; 当然， 负载均衡控制器也可以综合 其他信息一块进行服务器的选择， 例如根据报文解析结果和服务器状态等信息。
508、 负载均衡控制器向七层转发设备下发第四转发表项；
其中， 负载均衡控制器在 507选择好服务器后， 可以生成第四转发表项下发 至七层转发设备， 该第四转发表项可以包括： 符合七层信息 4的报文转发给服务 器 1。 例如，下发第四转发表项的基本格式可以为{编号，状态（比如，是否有效）， 优先级， 七层网络业务特定的流表项内容 }。 七层网络业务特定的流表项内容的 格式和内容可以与特定的业务相关； 以七层负载均衡业务为例， 可以包括{服务 器信息， 动作 （比如， 转发该流的报文， 把报文上送给控制器， 上报业务统计 信息等） }。
509、 七层转发设备根据七层流表项将第二报文转发至服务器 1；
其中， 七层转发设备向服务器 1转发第二报文， 可以是通过四层转发设备中 转完成， 具体可以通过七层转发设备与四层转发设备之间的数据通道进行转发， 再通过四层转发设备发送至服务器 1。 图 5中示出了 509a和 509b组成的报文中转 路径。
进一歩的， 在 507中， 负载均衡控制器根据报文解析结果， 也可以确定七层 转发设备后续就不再需要处理该报文了， 即下次四层转发设备接收到该报文后， 七层转发设备可以不用再参与处理。 那么这种情况下， 负载均衡控制器还可以 执行 510; 该 510的歩骤在 507之后执行即可， 与 508和 509的时间顺序不做限定。
510、 负载均衡控制器向四层转发设备发送第三转发表项；
其中， 负载均衡控制器直接向四层转发设备发送第三转发表项； 所述第三 转发表项包括所述第一关键字和所述第一关键字对应的第三处理策略； 所述第 三转发表项用于指示所述四层转发设备接收到匹配所述第一关键字的第四报文 时根据所述第三处理策略处理所述第四报文， 省略向所述七层转发设备发送报 文。 例如， 在 504歩骤中， 四层转发设备根据流表项中的"符合四层信息 4的报文 转发至七层转发设备"， 将报文转发至七层转发设备； 那么此时发送的流表项可 以包括"符合四层信息 4的报文转发至服务器 1"，这样四层转发设备下次在接收到 503的客户端发送的第一报文时， 将直接执行 511。
511、 四层转发设备将接收到的匹配第一关键字的第四报文发送至服务器 1。 此时， 四层转发设备不再向七层转发设备发送报文， 而是直接将接收到的 匹配所述第一关键字的第四报文发送给服务器 1。
此外， 即使负载均衡控制器向四层转发设备发送第四转发表项， 后续不需 要七层转发设备参与处理， 但是负载均衡控制器还是要执行 508， 告知七层转发 设备还是要将本次报文的转发处理完成； 下次四层转发设备也不会再向七层转 发设备转发报文， 七层转发设备也不会参与了。 上述图 5的例子是以客户端向服务器发送报文为例， 下面的图 6是以服务器 向客户端发送报文为例， 并且是假设在某些情况之下 （比如， HTTP的七层会话 保持需要提取服务器的响应消息中的 Coolae信息）需要将服务器发给客户端的报 文交由七层转发设备处理。 图 6为本发明网络业务处理方法一实施例的报文发送 信令图二， 该方法可以包括：
601、 负载均衡控制器向四层转发设备发送第一转发表项；
其中， 该第一转发表可以包括第一关键字、 以及第一关键字对应的第一处 理策略； 所述的第一关键字包括报文的四层信息， 该四层信息例如是源 IP地址、 目的 IP地址、源端口、 目的端口、源 MAC地址、 目的 MAC地址、协议号、 VLAN ID中的至少一种。
本实施例中， 该第一转发表项的形式可以是流表项， 该流表项例如包括： 符合四层信息 5的报文转发至七层转发设备。 其中， 四层信息 5可以称为第一关 键字， 所述的转发至七层转发设备可以称为第一关键字对应的第一处理策略。
602、 负载均衡控制器向七层转发设备发送控制规则， 所述控制规则用于指 导七层转发设备处理报文；
举例来说， 该控制规则也可以采用转发表的形式发送， 例如可以是第四转 发表项， 该第四转发表项包括第四关键字、 以及所述第四关键字对应的第四处 理策略， 所述的第四关键字可以包括报文的七层信息。
该第四转发表项也可以是流表项的形式， 该流表项例如可以包括： 符合七 层信息 5的报文向负载均衡控制器进一歩请求。 该七层信息 5是条件七层信息， 当七层转发设备解析报文得到的七层信息满足该条件七层信息时， 向负载均衡 控制器请求指示进一歩如何处理该报文。
603、 四层转发设备接收服务器 1发送的第一报文；
604、 四层转发设备根据第一报文和第一转发表项， 向七层转发设备发送第 二报文；
例如， 本实施例假设四层转发设备解析报文得到的是四层信息 5， 所以根据 第一转发表项中的第一处理策略向七层转发设备发送第二报文， 举例来说， 该 第二报文可以由四层转发设备复制第一报文得到。
605、 七层转发设备解析第二报文得到报文解析结果；
本实施例假设七层转发设备解析第二报文， 得到的报文解析结果是七层信 606、 七层转发设备向负载均衡控制器上报报文解析结果；
其中， 七层转发设备根据在 602中接收到的控制器下发的流表项， 得知在解 析得到七层信息 5时需要向负载均衡控制器请求如何处理该报文， 七层转发设备 则将报文解析结果上报至负载均衡控制器。
607、 负载均衡控制器根据报文解析结果做相应处理， 并选择客户端； 其中， 负载均衡控制器根据接收到的报文解析结果做相应处理， 比如， 对 于 HTTP的七层会话保持，控制器所做的处理可以是建立服务器 1与 Coolae信息的 关联。 并且， 负载均衡控制器还确定下一歩将报文发送给哪个客户端， 本实施 例是假设只有一个客户端。 可选地， 客户端也可以有多个， 本歩骤例如可以选 择其中一个。
608、 负载均衡控制器向七层转发设备下发流表项；
其中， 该流表项可以包括： 符合七层信息 5的报文转发给客户端。
609、 七层转发设备根据控制器下发的流表项将报文转发至客户端； 其中， 七层转发设备向客户端转发报文， 可以是通过四层转发设备中转完 成， 具体可以通过七层转发设备与四层转发设备之间的数据通道进行转发， 再 通过四层转发设备发送至客户端。 图 6中示出了 609a和 609b组成的报文中转路 径。
可选地， 负载均衡控制器根据报文解析结果， 也可以确定七层转发设备后 续就不再需要处理该报文了， 即下次四层转发设备接收到该报文后， 七层转发 设备可以不用再参与处理。 那么这种情况下， 负载均衡控制器还可以执行 610;
610、 负载均衡控制器向四层转发设备发送第三转发表项；
其中， 负载均衡控制器直接向四层转发设备发送第三转发表项； 所述第三 转发表项包括所述第一关键字和所述第一关键字对应的第三处理策略； 所述第 三转发表项用于指示所述四层转发设备接收到匹配所述第一关键字的第四报文 时根据所述第三处理策略处理所述第四报文， 省略向所述七层转发设备发送报 文。
例如， 在 604中， 四层转发设备根据第一转发表项中的"符合四层信息 5的报 文转发至七层转发设备"， 根据第一报文生成第二报文发送至七层转发设备； 那 么此时发送的第三转发表项可以包括"符合四层信息 5的报文转发至客户端"， 这 样四层转发设备下次在接收到匹配所述第一关键字的第四报文时， 将直接执行
611。
611、 四层转发设备将匹配第一关键字的第四报文发送至客户端。
需要说明的是， 如果七层转发设备向负载均衡控制器上报报文解析结果， 并使得负载均衡控制器向四层转发设备发送第三转发表项， 可以有多种方式。 举例来说， 当七层转发设备上报报文解析结果之后， 负载均衡控制器可以根 据该报文解析结果判断得到在后续接收到报文时， 可以不再需要七层转发设 备处理该报文， 仅由四层转发设备处理即可， 则负载均衡控制器向四层转发 设备发送上述的第三转发表项。 又举例来说， 当七层转发设备判断报文不需要 由七层转发设备处理时， 七层转发设备不仅向负载均衡控制器可以发送报文解 析结果， 还可以发送消息， 所述消息用于通知所述控制器向所述四层转发设备 发送所述第三转发表项， 从而使得负载均衡控制器根据该指示向四层转发设备 发送第三转发表项。
实施例四
本实施例以防火墙业务为例， 处理防火墙业务的控制器可以称为防火墙控 制器， 参见图 7， 图 7为本发明网络业务处理方法另一实施例的应用系统图。 该 系统的架构与图 4类似， 图 4中服务器与客户端之间发送报文， 图 7中攻击者与主 机之间发送报文。 攻击者发送的是攻击报文， 防火墙控制器和所示的转发设备 共同实现对攻击报文的处理，保证网络安全。网络攻击中有些攻击（比如， Fraggle 攻击） 只需要四层转发设备和防火墙控制器配合完成对该攻击报文的处理。 而 有些攻击（比如， TCP标志位畸形攻击）需要四层转发设备、 七层转发设备和防 火墙控制器三者配合完成对该攻击报文的处理。
图 8为本发明网络业务处理方法另一实施例的报文发送信令图， 由于实现防 火墙业务时， 控制器与四层转发设备、 七层转发设备之间的配合处理方式与实 现负载均衡业务时类似， 只是不同的业务获取的解析报文信息以及对应报文信 息的处理有所区别， 所以本实施例的方法简单描述。 如图 8所示， 该方法可以包 括：
801、 防火墙控制器向四层转发设备发送第一转发表项；
其中， 该第一转发表项包括第一关键字、 以及第一关键字对应的第一处理 策略； 所述的第一关键字包括报文的四层信息， 该四层信息例如是源 IP地址、 目 的 IP地址、源端口、 目的端口、源 MAC地址、 目的 MAC地址、协议号、 VLAN ID 中的至少一种。
本实施例中， 该第一转发表项的形式可以是流表项， 该流表项可以是根据 网络攻击的特征生成的； 例如， 对于防范 Fraggle攻击的流表项可以描述为： 若 报文的目的 IP地址为广播地址并且目的端口为 UDP的 7或 19号端口则将其丢弃； 其中， 该防范 Fraggle攻击的流表项中， "广播地址" 和" UDP的 7或 19号端口 "是第 一关键字， 丢弃则是第一关键字对应的报文处理策略。对于防范 TCP标志位畸形 攻击的流表项可以描述为： 若为 TCP报文则转发给七层转发设备。
802、 防火墙控制器向七层转发设备发送控制规则， 所述控制规则用于指导 七层转发设备处理报文。
其中， 该控制规则也可以采用转发表的形式发送， 例如可以是第四转发表 项， 该第四转发表项包括第四关键字、 以及所述第四关键字对应的第四处理策 略， 所述的第四关键字可以包括报文的七层信息； 举例来说， 该七层信息可以 是 TCP标志位， 比如对于防范 TCP标志位畸形攻击的流表项可以描述为： 若报文 的 TCP标志位全为 0或者全为 1则将其丢弃； 否则，将报文解析结果上报防火墙控 制器处理。以此为例，上述的 "TCP标志位全为 0或者全为 1 "是第四关键字，而"丢 弃"是该第四关键字对应的第四处理策略。
803、 所述四层转发设备接收到攻击者发送的第一报文。
其中， 四层转发设备接收到该第一报文， 但是在进行后续的处理和判断之 前， 可能该四层转发设备并不知道该报文是否是攻击者发送的， 对于四层转发 设备来说， 该报文相当于是某个客户端发送的， 经过后续的判断处理后， 才能 确定该第一报文是普通报文或者是攻击者发送的攻击报文。
804、 所述四层转发设备根据第一报文和第一转发表项， 向所述七层转发设 备发送第二报文；
其中， 所述四层转发设备根据 801中所述第一转发表项对接收到的第一报文 进行处理。例如，如果所述接收到的第一报文的目的 IP地址为广播地址并且目的 端口为 UDP的 7或 19号端口， 则表明是 Fmggle攻击报文， 所述四层转发设备将所 述接收到的第一报文丢弃。如果所述第一报文是 TCP报文， 则所述四层转发设备 根据所述第一转发表将接收到的所述第一报文转发至七层转发设备。 本实施例 假设接收到的所述第一报文是 TCP报文，所述四层转发设备将根据所述第一报文 向所述七层转发设备发送第二报文， 举例来说， 该第二报文可以由四层转发设 备复制第一报文得到。
805、 所述七层转发设备解析第二报文得到解析结果。
其中， 七层转发设备缓存并解析第二报文。 解析结果包含七层信息。 例如， 当需要判断报文是否是 TCP标志位畸形攻击时， 该七层信息可以包括： 网络五元 组信息， TCP标志位信息等。
806、 所述七层转发设备根据控制规则将解析结果上报至防火墙控制器； 其中， 所述七层转发设备根据得到的报文解析结果， 结合上述 602中接收到 的控制规则来处理报文。例如，七层转发设备根据在 602中接收到的控制规则 "如 果解析报文发现 TCP标志位全为 0或者全为 1，则表明该报文是 TCP标志位畸形攻 击， 丢弃报文； 否则， 将解析结果上报至防火墙控制器"； 本实施例假设七层转 发设备解析报文得到的解析结果， TCP标志位没有全为 0或者全为 1， 则七层转发 设备根据控制规则将解析结果上报至防火墙控制器， 请求防火墙控制器下发进 一歩的报文处理信息。
807、 防火墙控制器根据解析结果做出决策。
其中， 防火墙控制器分析解析结果并作出相应处理。 例如， 如果发现报文 可疑， 比如， 发现 TCP标志位同时把 SY 和 FIN位置 1， 则该决策可以是将报文 丢弃、 记录或者统计等处理； 如果发现报文正常， 则该决策可以是指示七层转 发设备正常转发报文。
808、 防火墙控制器向七层转发设备下发新的流表项。
其中，防火墙控制器在 807中做出决策之后，根据该决策生成并下发流表项， 使得七层转发设备根据接收到的流表项对报文做相应的处理。 也就是说， 该七 层转发设备在之前的 802中接收到过防火墙下发的控制规则， 该控制规则本实施 例也是以流表项的形式为例，但是在 802中的流表项中包括上述的"若报文的 TCP 标志位不是全为 0或者全为 1， 则将报文解析结果上报防火墙控制器处理。 "， 也 就是说， 当 TCP标志位不是全为 0或者全为 1时， 防火墙控制器需要根据七层转发 设备上报的解析结果才能够做出进一歩判断， 比如判断该报文是否是攻击报文 以及如何处理等。 因此在 806中七层转发设备将解析结果上报， 防火墙根据解析 结果得到决策并下发新的流表项给七层转发设备以指导七层转发设备下一歩如 何处理该报文。 例如， 当第二报文可疑时， 七层转发设备可以根据 708中防火墙下发的流表 项， 将报文丢弃、 记录、 统计等； 当第二报文正常时， 七层转发设备可以根据 防火墙下发的流表项， 正常转发报文， 例如， 将报文转发至主机 2 (可以通过四 层转发设备中转） 。
809、 防火墙控制器向四层转发设备下发第三转发表项；
其中， 防火墙控制器在 807中根据解析结果， 如果确定后续可以不再需要七 层转发设备参与处理， 可以向四层转发设备下发第三转发表项。 所述第三转发 表项用于指示所述四层转发设备接收到匹配所述第一关键字的第四报文时根据 所述第三处理策略处理所述第四报文， 省略向所述七层转发设备发送报文。 举 例来说， 可以用于指示四层转发设备， 对于符合攻击报文五元组信息 （该五元 组信息例如是 805中七层转发设备解析得到的网络五元组信息） 的报文可以直接 丢弃， 那么此时五元组信息相当于第一转发表项中的第一关键字， 而丢弃相当 于该第一关键字对应的第一处理策略。 这样四层转发设备在再次接收到报文时， 可以直接执行 810。
810、 四层转发设备丢弃报文。
由上述的几个实施例可以看到， 在本发明实施例的网络业务处理方法中， 四层业务是由四层转发设备处理， 七层业务是由七层转发设备处理， 这样四层 转发设备可以专用于处理四层业务， 业务处理的能力和效率都会得到提高； 并 且该方案也具有很大的灵活性， 当有七层业务需要处理时， 四层转发设备可以 将其转发至七层转发设备， 能够实现七层业务的处理。 可选地， 当控制器判断 七层转发设备后续可以不需要再参与报文处理时， 控制器还可以向四层转发设 备下发第一转发表， 使得后续四层转发设备可以直接处理报文， 报文处理方式 的转变非常灵活， 也有助于提高处理效率。
实施例五
在前边几个实施例中， 控制器和转发设备实现的都是一个业务， 比如实现 的是防火墙业务、 或者负载均衡业务； 本实施例中， 控制器和多个转发设备组 成的系统可以处理多个网络业务串接起来的网络业务链， 例如， 某网络业务链 的业务执行顺序是： 报文先经过防火墙然后经过负载均衡器， 即报文既要经过 防火墙业务的安全防范又要经过负载均衡处理。 此时， 可以由控制器和多个转 发设备组成系统来实现该网络业务链。 并且， 在这种网络业务链的架构中， 控 制器向四层转发设备或者七层转发设备下发的报文转发表 （可以称为第五转发 表） ， 可以用于指示四层转发设备或者七层转发设备将报文转发至另一个网络 业务对应的转发设备， 实现报文在处理不同业务的转发设备之间进行转发处理。
图 9为本发明网络业务处理方法又一实施例的应用系统图， 如图 9所示， 本 实施例的控制器可以包含负载均衡控制器和防火墙控制器， 当然也可以是由一 个控制器负责控制负载均衡和防火墙两个业务； 同时， 控制器还负责把整个网 络业务链串接起来。 此外， 七层转发设备 1是执行防火墙业务的七层转发设备， 七层转发设备 2是执行负载均衡业务的七层转发设备； 四层转发设备 1是防火墙 业务的四层转发设备， 四层转发设备 2是负载均衡业务的四层转发设备。
本实施例中， 控制器通过图中所示的四层控制接口和七层控制接口向四层 转发设备和七层转发设备下发流表项。 通过流表项处理报文时的流向有如下几 种可能： 四层转发设备 1->四层转发设备 2 (报文在防火墙业务和负载均衡业务中 均进行四层处理， 然后就发送至服务器） ； 四层转发设备 1->七层转发设备 1-> 四层转发设备 2 (报文在防火墙业务经过了四层处理和七层处理， 在负载均衡业 务中进行四层处理） ； 四层转发设备 1->四层转发设备 2->七层转发设备 2 (报文 在防火墙业务经过四层处理， 在负载均衡业务中经过了四层处理和七层处理） ； 四层转发设备 1->七层转发设备 1->四层转发设备 2->七层转发设备 2 (报文在防火 墙业务和负载均衡业务中都进行了四层处理和七层处理） 。
其中， 在这种网络业务链的结构中， 控制器向转发设备发送的报文处理信 息， 包括了用于指示所述转发设备将报文转发至另一个网络业务对应的转发设 备； 比如， 在四层转发设备 1->四层转发设备 2的路径中， 控制器发送给四层转发 设备 1的流表项， 就是用于指示四层转发设备 1将报文转发至另一个业务即负载 均衡业务的四层转发设备 2。 此外， 各转发设备之间设置有数据通道， 报文转发 是通过数据通道转发的， 例如，在四层转发设备 1->七层转发设备 1->四层转发设 备 2->七层转发设备 2的路径中，报文从七层转发设备 1至四层转发设备 2，可以是 七层转发设备 1->四层转发设备 1->四层转发设备 2这样的路径， 即通过四层转发 设备 1来中转。
在网络业务链的结构中， 对于每种业务的控制器与转发设备之间的报文处 理控制， 与前述实施例的方式类似， 不再赘述。
实施例六 现有的各层次网络业务都由同一个设备来处理， 当某个层次的业务量变化 时， 无法动态快速的适应这种变化， 比如如果七层业务量大幅增加时， 实际上 是需要提升七层业务的处理能力， 那么现有技术可能只有整体更换高能力处理 设备或者增加处理设备的数量， 既成本高又效率低； 而本发明实施例的控制器 可以根据七层转发设备上报的业务统计信息， 单独针对七层设备进行业务控制， 例如创建新的七层转发设备， 即扩充七层转发设备的数量。 这种方式不会涉及 到四层转发设备的变化， 而且可以根据七层转发设备实时上报的业务统计信息 对七层转发设备的处理能力进行实时扩充， 对业务的适应能力较强， 灵活地提 高系统对业务的处理能力。
具体的， 本发明实施例中， 网络业务处理系统包括四层转发设备和第一七 层转发设备， 控制器接收所述第一七层转发设备发送的业务统计信息； 控制器 根据所述业务统计信息， 增加第二七层转发设备， 所述第二七层转发设备和所 述四层转发设备之间存在用于传输报文的数据通道。
图 10为本发明网络业务处理方法又一实施例的应用系统图， 本实施例中， 控制器可以根据七层转发设备所处理的业务量的变化， 实时扩充七层转发设备 的数量， 以适应业务量的变化。 该方法包括：
1001、 第一七层转发设备向控制器上报业务统计信息；
例如， 该业务统计信息可以包括， 网络流量、 七层转发设备的 CPU、 内存 消耗等。 图 10中的方框 B中所包括的四个第一七层转发设备是当前存在的设备。
1002、 控制器根据业务统计信息确定需要增加第二七层转发设备， 向计算 资源管理器请求新的计算资源；
例如， 控制器根据第一七层转发设备上报的业务统计信息， 确定当前第一 七层转发设备侧的业务量增加较大， 使得第一七层转发设备的负荷较重， 则控 制器确定需要扩充七层转发设备的数量， 则向计算资源管理器请求新的计算资 源， 准备增加第二七层转发设备。
1003、 计算资源管理器创建新的计算资源；
其中， 这里创建新的计算资源就是在创建第二七层转发设备， 即图 10中所 示的方框 A中包括的四个第二七层转发设备；本实施例是假设增加四个第二七层 转发设备。
1004、 计算资源管理器回复控制器其所创建的计算资源的信息； 例如， 计算资源管理器回复的计算资源即第二七层转发设备的信息可以包 括： 这些第二七层转发设备的 IP地址、计算能力等， 告知控制器已经创建完成第 二七层转发设备。
1005、 控制器启动第二七层转发设备；
例如， 控制器还可以向该第二七层转发设备下发七层流表项， 使得第二七 层转发设备根据该七层流表项进行后续接收报文的转发处理。
1006、 控制器向四层转发设备发送转发表项；
其中， 该转发表项包括关键字和所述关键字对应的处理策略； 所述关键字 包括报文的四层信息， 所述转发表项用于指示所述四层转发设备接收到匹配所 述关键字的第一报文时， 根据所述处理策略向所述第二七层转发设备发送第二 报文。即此时可以将一部分原来发送至方框 B中的第一七层转发设备的流量分流 到第二七层转发设备， 减轻原第一七层转发设备的负担。
1007、 四层转发设备接收到匹配所述关键字的第一报文时， 根据所述处理 策略向所述第二七层转发设备发送第二报文。
本实施例的网络业务处理方法， 可以实现七层转发设备的动态扩充， 动态 适应业务量的变化。
实施例七
图 11为本发明网络业务处理方法又一实施例的应用系统图， 如图 11所示， 本实施例主要用于说明控制器可以不直接控制四层转发设备， 而是通过中间控 制设备对四层转发设备进行控制。
参见图 11， 例如所述的中间控制设备可以是 Openflow控制器或者网管系统， 控制器可以通过 Openflow控制器或者网管系统间接控制四层转发设备。 控制器 与所述的 Openflow控制器或者网管系统之间可以通过四层控制接口通信， 并通 过该四层控制接口将第四转发表发送至 Openflow控制器或者网管系统， 再由 Openflow控制器或者网管系统将该第四转发表发送至四层转发设备。
其中， 控制器与 Openflow控制器或者网管系统之间传输的信息的格式， 可 以按照两者协议的规定格式进行； 以及 Openflow控制器或者网管系统分别与四 层转发设备之间传输的信息的格式， 同样可以按照两者协议的规定格式进行。
实施例八
图 12为本发明控制器一实施例的结构示意图， 如图 12所示， 该控制器可以 包括： 处理单元 1201和通信单元 1202。
所述处理单元 1201， 用于生成第一转发表项， 所述第一转发表项包括第一 关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包括报文的四 层信息。
所述通信单元 1202， 用于向四层转发设备发送所述第一转发表项， 所述第 一转发表项用于指示所述四层转发设备接收到匹配所述第一关键字的第一报文 时， 根据所述第一处理策略向所述七层转发设备发送第二报文。
所述处理单元 1201还用于生成控制规则， 所述控制规则用于指导所述七层 转发设备处理报文。
所述通信单元 1202还用于向所述七层设备发送所述控制规则， 使得所述七 层转发设备根据所述控制规则处理所述第二报文。
可选地， 所述处理单元 1201还用于生成第二转发表项， 所述第二转发表项 包括第二关键字和所述第二关键字对应的第二处理策略； 所述第二关键字包括 报文的四层信息。 所述通信单元 1202还用于向所述四层转发设备发送所述第二 转发表项， 所述第二转发表项用于指示所述四层转发设备接收到匹配所述第二 关键字的第三报文时， 根据所述第二处理策略处理所述第三报文， 省略向所述 七层转发设备发送报文。
可选地， 所述通信单元 1202还用于接收所述七层转发设备发送的报文解析 结果， 所述报文解析结果是所述七层转发设备通过解析所述第二报文得到。 所 述处理单元 1201还用于根据所述报文解析结果生成第三转发表项， 所述第三转 发表项包括所述第一关键字和所述第一关键字对应的第三处理策略。 所述通信 单元 1202还用于向所述四层转发设备发送所述第三转发表项， 所述第三转发表 项用于指示所述四层转发设备接收到匹配所述第一关键字的第四报文时根据所 述第三处理策略处理所述第四报文， 省略向所述七层转发设备发送报文。
图 12所示的实施例的实现细节请参考上面方法实施例的描述， 此处不再赘 述。
图 13为本发明控制器一实施例的结构示意图， 如图 13所示， 该控制器可以 包括： 处理器 1301和收发器 1302。
所述处理器 1301， 用于生成第一转发表项， 所述第一转发表项包括第一关 键字和所述第一关键字对应的第一处理策略； 所述第一关键字包括报文的四层 自
所述收发器 1302， 用于向四层转发设备发送所述第一转发表项， 所述第一 转发表项用于指示所述四层转发设备接收到匹配所述第一关键字的第一报文 时， 根据所述第一处理策略向所述七层转发设备发送第二报文。
所述处理器 1301还用于生成控制规则， 所述控制规则用于指导所述七层转 发设备处理报文。
所述收发器 1302还用于向所述七层设备发送所述控制规则， 使得所述七层 转发设备根据所述控制规则处理所述第二报文。
可选地， 所述处理器 1301还用于生成第二转发表项， 所述第二转发表项包 括第二关键字和所述第二关键字对应的第二处理策略； 所述第二关键字包括报 文的四层信息。 所述收发器 1302还用于向所述四层转发设备发送所述第二转发 表项， 所述第二转发表项用于指示所述四层转发设备接收到匹配所述第二关键 字的第三报文时， 根据所述第二处理策略处理所述第三报文， 省略向所述七层 转发设备发送报文。
可选地， 所述收发器 1302还用于接收所述七层转发设备发送的报文解析结 果， 所述报文解析结果是所述七层转发设备通过解析所述第二报文得到。 所述 处理器 1301还用于根据所述报文解析结果生成第三转发表项， 所述第三转发表 项包括所述第一关键字和所述第一关键字对应的第三处理策略。 所述收发器 1302还用于向所述四层转发设备发送所述第三转发表项， 所述第三转发表项用 于指示所述四层转发设备接收到匹配所述第一关键字的第四报文时根据所述第 三处理策略处理所述第四报文， 省略向所述七层转发设备发送报文。
图 13所示的实施例的实现细节请参考上面方法实施例中对控制器执行的操 作的描述， 此处不再赘述。
实施例九
图 14为本发明四层转发设备实施例的结构示意图， 如图 14所示， 该四层转 发设备可以包括： 接收单元 1401和发送单元 1402。
所述接收单元 1401用于接收控制器发送的第一转发表项， 所述第一转发表 项包括第一关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包 括报文的四层信息， 所述第一转发表项用于指示所述四层转发设备接收到匹配 所述第一关键字的第一报文时， 根据所述第一处理策略向七层转发设备发送第 二报文；
所述接收单元 1401还用于接收所述第一报文；
所述发送单元 1402用于在所述接收单元 1401接收到到所述第一报文后根据 所述第一转发表项， 通过数据通道向所述七层转发设备发送所述第二报文。
可选地， 所述接收单元 1401还用于接收所述控制器发送的第二转发表项， 所述第二转发表项包括第二关键字和所述第二关键字对应的第二处理策略； 所 述第二关键字包括报文的四层信息， 所述第二转发表项用于指示所述四层转发 设备接收到匹配所述第二关键字的第三报文时， 根据所述第二处理策略处理所 述第三报文， 省略向所述七层转发设备发送报文。
图 15为本发明四层转发设备实施例的结构示意图， 如图 15所示， 该四层转 发设备可以包括： 接收器 1501和发送器 1502。
所述接收器 1501用于接收控制器发送的第一转发表项， 所述第一转发表项 包括第一关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包括 报文的四层信息， 所述第一转发表项用于指示所述四层转发设备接收到匹配所 述第一关键字的第一报文时， 根据所述第一处理策略向七层转发设备发送第二 报文；
所述接收器 1501还用于接收所述第一报文；
所述发送器 1502用于在所述接收器 1501接收到到所述第一报文后根据所述 第一转发表项， 通过数据通道向所述七层转发设备发送所述第二报文。
可选地， 所述接收器 1501还用于接收所述控制器发送的第二转发表项， 所 述第二转发表项包括第二关键字和所述第二关键字对应的第二处理策略； 所述 第二关键字包括报文的四层信息， 所述第二转发表项用于指示所述四层转发设 备接收到匹配所述第二关键字的第三报文时， 根据所述第二处理策略处理所述 第三报文， 省略向所述七层转发设备发送报文。
图 14和 15所示的实施例的实现细节请参考上面方法实施例中对四层转发设 备执行的操作的描述， 此处不再赘述。
实施例十
本发明实施例还提供了一种控制器， 应用于包括四层转发设备和第一七层 转发设备的网络业务处理系统， 所述系统中还包括控制器， 所述四层转发设备 和所述第一七层转发设备分别与所述控制器通信， 且所述四层转发设备和所述 第一七层转发设备之间存在用于传输报文的数据通道。 所述控制器包括： 通信单元， 用于接收所述第一七层转发设备发送的业务指示信息； 处理单元， 用于根据所述业务统计信息， 增加第二七层转发设备， 所述第 二七层转发设备和所述四层转发设备之间存在用于传输报文的数据通道。
可选地， 所述处理单元具体用于根据所述业务统计信息， 确定需要增加所 述第二七层转发设备， 在所述系统中增加所述第二七层转发设备， 并向所述四 层转发设备发送转发表项， 所述转发表项包括关键字和所述关键字对应的处理 策略； 所述关键字包括报文的四层信息， 所述转发表项用于指示所述四层转发 设备接收到匹配所述关键字的第一报文时， 根据所述处理策略向所述第二七层 转发设备发送第二报文。
实施例十一
本实施例提供一种网络业务处理系统， 包括前面描述的四层转发设备、 控 制器以及七层转发设备。 所述四层转发设备和七层转发设备分别与所述控制器 通信。 所述四层转发设备和七层转发设备之间存在用于传输网络业务报文的数 据通道。
举例来说， 该系统包括控制器和用于处理第一网络层次业务的转发设备。 该系统的结构例如可以是图 1所示的结构。 其中， 该网络业务处理系统中， 可以 仅包括控制器和四层转发设备， 或者， 也可以包括控制器、 四层转发设备和七 层转发设备。
进一歩的， 四层转发设备与控制器之间可以通过四层控制接口连接， 控制 器通过所述四层控制接口向四层转发设备发送报文处理信息。 同样， 七层转发 设备与控制器之间可以通过七层控制接口连接， 控制器通过所述七层控制接口 向七层转发设备发送报文处理信息。 七层转发设备与四层转发设备之间可以设 置用于转发网络业务报文的数据通道。
进一歩的， 七层转发设备可以包括： 分别对应不同七层协议的多个七层转 发设备， 或者分别对应不同网络业务的多个七层转发设备。 比如， 根据七层业 务的不同可以有不同的七层转发设备。 比如， 七层负载均衡转发设备， 七层防 火墙转发设备。 七层负载均衡转发设备根据支持的七层协议不同还可以再细分， 比如， 七层 HTTP负载均衡转发设备， 七层 SIP负载均衡转发设备。 可选的， 由 于七层协议较多， 可以一个七层转发设备对应一个七层协议的处理， 也可以一 个七层转发设备对应多个七层协议的处理。
进一歩的， 转发设备可以包括： 分别对应不同网络业务的多个转发设备， 比如在图 7中所示的网络业务处理系统中， 就包括了网络业务链中的多个业务的 转发设备， 不同业务的转发设备可以共同组成处理系统实现多个业务的串接完 成。
进一歩的， 当系统中存在分别对应不同业务的转发设备时， 属于不同网络 业务的转发设备， 可以分别由对应所述网络业务的控制器控制； 或者由同一控 制器控制。 比如在图 7中所示的防火墙业务和负载均衡业务的转发设备， 可以是 分别由各自业务的控制器控制， 比如防火墙业务的转发设备由防火墙控制器控 制， 负载均衡业务的转发设备由负载均衡控制器控制； 或者， 防火墙业务和负 载均衡业务的转发设备都由同一个控制器控制。 一个控制器可以控制一个或多 个四层转发设备。 一个控制器也可以控制一个或多个七层转发设备。 相应的， 为了可靠性一个 4转发设备或 7转发设备可以由主备多个控制器来控制。 根据网 络业务的不同可以有不同的控制器。 比如， 负载均衡控制器， 防火墙控制器， IPSec/SSL VPN网关控制器。
进一歩的， 本发明实施例提供了七层转发设备与控制器之间的一种交互流 程实现方式， 包括：
注册流程： 用于七层转发设备向控制器进行注册。 注册请求中可以包含七 层转发设备标识、 认证信息， 协议版本号和七层业务类型 （比如， 负载均衡业 务， 防火墙业务等） 等信息。 控制器回复注册响应来指示注册成功或失败。
能力交换流程： 用于双方进行业务能力协商。 可以交换的能力包括七层业 务协议 （比如， HTTP, FTP等） 和七层业务处理能力 （比如， 最大并发， 每秒 新建连接数等） }等。
请求七层处理流程： 用于七层转发设备向控制器请求获取流表项。
下发七层处理流程： 用于控制器向七层转发设备下发流表项， 可以是控制 器主动下发也可以是收到七层转发设备的请求后下发。 这里的请求七层处理流 程和下发七层处理流程， 在前边的方法实施例中已经描述过， 不再详述。
本领域普通技术人员可以理解： 实现上述各方法实施例的全部或部分歩骤 可以通过程序指令相关的硬件来完成。 前述的程序可以存储于一计算机可读取 存储介质中。 该程序在执行时， 执行包括上述各方法实施例的歩骤； 而前述的 存储介质包括： ROM、 RAM, 磁碟或者光盘等各种可以存储程序代码的介质。 最后应说明的是： 以上各实施例仅用以说明本发明的技术方案， 而非对其 限制； 尽管参照前述各实施例对本发明进行了详细的说明， 本领域的普通技术 人员应当理解： 其依然可以对前述各实施例所记载的技术方案进行修改， 或者 对其中部分或者全部技术特征进行等同替换； 而这些修改或者替换， 并不使相 应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims

权 利 要 求 书
1、 一种报文处理方法， 其特征在于， 应用于包括四层转发设备、 七层转发 设备和控制器的系统， 所述四层转发设备和七层转发设备分别与所述控制器通 信， 且所述四层转发设备和七层转发设备之间存在用于传输报文的数据通道； 所述方法包括：
所述控制器向所述四层转发设备发送第一转发表项， 所述第一转发表项包 括第一关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包括报 文的四层信息， 所述第一转发表项用于指示所述四层转发设备接收到匹配所述 第一关键字的第一报文时， 根据所述第一处理策略向所述七层转发设备发送第 二报文；
所述控制器向所述七层转发设备发送用于指导所述七层转发设备处理报文 的控制规则， 使得所述七层转发设备根据所述控制规则处理所述第二报文。
2、 根据权利要求 1所述的方法， 其特征在于， 还包括：
所述控制器向所述四层转发设备发送第二转发表项， 所述第二转发表项包 括第二关键字和所述第二关键字对应的第二处理策略； 所述第二关键字包括报 文的四层信息， 所述第二转发表项用于指示所述四层转发设备接收到匹配所述 第二关键字的第三报文时， 根据所述第二处理策略处理所述第三报文， 省略向 所述七层转发设备发送报文。
3、 根据权利要求 1或 2所述的方法， 其特征在于， 在所述控制器向所述七层 转发设备发送控制规则之后， 还包括：
所述控制器接收所述七层转发设备发送的报文解析结果， 所述报文解析结 果是所述七层转发设备通过解析所述第二报文得到；
所述控制器根据所述报文解析结果， 向所述四层转发设备发送第三转发表 项， 所述第三转发表项包括所述第一关键字和所述第一关键字对应的第三处理 策略； 所述第三转发表项用于指示所述四层转发设备接收到匹配所述第一关键 字的第四报文时根据所述第三处理策略处理所述第四报文， 省略向所述七层转 发设备发送报文。
4、 根据权利要求 3所述的方法， 其特征在于， 在所述控制器接收所述七层 转发设备发送的报文解析结果之前， 还包括： 所述控制器向所述七层转发设备发送条件七层信息， 所述条件七层信息用 于指示所述七层转发设备在解析所述第二报文得到所述条件七层信息时发送所 述报文解析结果。
5、 根据权利要求 3或 4所述的方法， 其特征在于， 所述控制器向所述四层转 发设备发送所述第三转发表项之前， 还包括：
所述控制器接收所述七层转发设备发送的消息， 所述消息用于通知所述控 制器向所述四层转发设备发送所述第三转发表项。
6、 根据权利要求 3~5任一所述的方法， 其特征在于， 所述控制器向所述七 层转发设备发送控制规则， 包括：
所述控制器向所述七层转发设备发送第五处理策略或者第四转发表项， 所 述第四转发表项包括： 第四关键字和所述第四关键字对应的第四处理策略。
7、 根据权利要求 6所述的方法， 其特征在于， 所述控制器向所述七层转发 设备发送第五处理策略或者第四转发表项， 包括：
所述控制器在接收到所述七层转发设备发送的所述报文解析结果之后， 向 所述七层转发设备发送所述第五处理策略或者所述第四转发表项。
8、 根据权利要求 1~7任一所述的方法， 其特征在于， 所述控制器向所述四 层转发设备发送第一转发表项， 包括：
所述控制器通过中间控制设备向所述四层转发设备发送所述第一转发表 项。
9、 根据权利要求 1~8任一所述的方法， 其特征在于， 所述四层转发设备提 供防火墙业务， 所述七层转发设备提供负载均衡业务。
10、 一种报文处理方法， 其特征在于， 应用于包括四层转发设备、 七层转 发设备和控制器的系统， 所述四层转发设备和七层转发设备分别与所述控制器 通信， 且所述四层转发设备和七层转发设备之间存在用于传输报文的数据通道; 所述方法包括：
所述四层转发设备接收所述控制器发送的第一转发表项， 所述第一转发表 项包括第一关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包 括报文的四层信息， 所述第一转发表项用于指示所述四层转发设备接收到匹配 所述第一关键字的第一报文时， 根据所述第一处理策略向所述七层转发设备发 送第二报文； 所述四层转发设备接收所述第一报文；
所述四层转发设备根据所述第一转发表项， 通过所述数据通道向所述七层 转发设备发送所述第二报文。
11、 根据权利要求 10所述的方法， 其特征在于， 还包括：
所述四层转发设备接收所述控制器发送的第二转发表项， 所述第二转发表 项包括第二关键字和所述第二关键字对应的第二处理策略； 所述第二关键字包 括报文的四层信息， 所述第二转发表项用于指示所述四层转发设备接收到匹配 所述第二关键字的第三报文时， 根据所述第二处理策略处理所述第三报文， 省 略向所述七层转发设备发送报文。
12、 根据权利要求 11所述的方法， 其特征在于， 所述四层转发设备通过所 述数据通道向所述七层转发设备发送所述第二报文之后， 还包括：
所述四层转发设备接收所述控制器发送的第三转发表项， 所述第三转发表 项包括所述第一关键字和所述第一关键字对应的第三处理策略； 所述第三转发 表项用于指示所述四层转发设备接收到匹配所述第一关键字的第四报文时根据 所述第三处理策略处理所述第四报文， 省略向所述七层转发设备发送报文。
13、 根据权利要求 10~12任一所述的方法， 其特征在于， 所述四层转发设备 提供防火墙业务， 所述七层转发设备提供负载均衡业务。
14、 一种网络业务处理方法， 其特征在于， 应用于包括四层转发设备和第 一七层转发设备的网络业务处理系统， 所述系统中还包括控制器， 所述四层转 发设备和所述第一七层转发设备分别与所述控制器通信， 且所述四层转发设备 和所述第一七层转发设备之间存在用于传输报文的数据通道； 所述网络业务处 理方法包括：
所述控制器接收所述第一七层转发设备发送的业务统计信息；
所述控制器根据所述业务统计信息， 增加第二七层转发设备， 所述第二七 层转发设备和所述四层转发设备之间存在用于传输报文的数据通道。
15、 根据权利要求 14所述的方法， 其特征在于， 所述控制器根据所述业务 统计信息， 增加所述第二七层转发设备， 包括：
所述控制器根据所述业务统计信息， 确定需要增加所述第二七层转发设备; 所述控制器在所述系统中增加所述第二七层转发设备， 并向所述四层转发 设备发送转发表项， 所述转发表项包括关键字和所述关键字对应的处理策略； 所述关键字包括报文的四层信息， 所述转发表项用于指示所述四层转发设备接 收到匹配所述关键字的第一报文时， 根据所述处理策略向所述第二七层转发设 备发送第二报文。
16、 一种控制器， 其特征在于， 包括：
处理单元， 用于生成第一转发表项， 所述第一转发表项包括第一关键字和 所述第一关键字对应的第一处理策略； 所述第一关键字包括报文的四层信息； 通信单元， 用于向四层转发设备发送所述第一转发表项， 所述第一转发表 项用于指示所述四层转发设备接收到匹配所述第一关键字的第一报文时， 根据 所述第一处理策略向所述七层转发设备发送第二报文；
所述处理单元还用于生成控制规则， 所述控制规则用于指导所述七层转发 设备处理报文；
所述通信单元还用于向所述七层设备发送所述控制规则， 使得所述七层转 发设备根据所述控制规则处理所述第二报文。
17、 根据权利要求 16所述的控制器， 其特征在于，
所述处理单元还用于生成第二转发表项， 所述第二转发表项包括第二关键 字和所述第二关键字对应的第二处理策略； 所述第二关键字包括报文的四层信 息；
所述通信单元还用于向所述四层转发设备发送所述第二转发表项， 所述第 二转发表项用于指示所述四层转发设备接收到匹配所述第二关键字的第三报文 时， 根据所述第二处理策略处理所述第三报文， 省略向所述七层转发设备发送 报文。
18、 根据权利要求 16或 17所述的控制器， 其特征在于，
所述通信单元还用于接收所述七层转发设备发送的报文解析结果， 所述报 文解析结果是所述七层转发设备通过解析所述第二报文得到；
所述处理单元还用于根据所述报文解析结果生成第三转发表项， 所述第三 转发表项包括所述第一关键字和所述第一关键字对应的第三处理策略；
所述通信单元还用于向所述四层转发设备发送所述第三转发表项， 所述第 三转发表项用于指示所述四层转发设备接收到匹配所述第一关键字的第四报文 时根据所述第三处理策略处理所述第四报文， 省略向所述七层转发设备发送报 文。
19、 一种控制器， 其特征在于， 应用于包括四层转发设备和第一七层转发 设备的网络业务处理系统， 所述系统中还包括控制器， 所述四层转发设备和所 述第一七层转发设备分别与所述控制器通信， 且所述四层转发设备和所述第一 七层转发设备之间存在用于传输报文的数据通道， 所述控制器包括：
通信单元， 用于接收所述第一七层转发设备发送的业务指示信息； 处理单元， 用于根据所述业务统计信息， 增加第二七层转发设备， 所述第 二七层转发设备和所述四层转发设备之间存在用于传输报文的数据通道。
20、 根据权利要求 19所述的控制器， 其特征在于，
所述处理单元具体用于根据所述业务统计信息， 确定需要增加所述第二七 层转发设备， 在所述系统中增加所述第二七层转发设备， 并向所述四层转发设 备发送转发表项， 所述转发表项包括关键字和所述关键字对应的处理策略； 所 述关键字包括报文的四层信息， 所述转发表项用于指示所述四层转发设备接收 到匹配所述关键字的第一报文时， 根据所述处理策略向所述第二七层转发设备 发送第二报文。
21、 一种四层转发设备， 其特征在于， 包括： 接收单元和发送单元； 所述接收单元用于接收控制器发送的第一转发表项， 所述第一转发表项包 括第一关键字和所述第一关键字对应的第一处理策略； 所述第一关键字包括报 文的四层信息， 所述第一转发表项用于指示所述四层转发设备接收到匹配所述 第一关键字的第一报文时， 根据所述第一处理策略向七层转发设备发送第二报 文；
所述接收单元还用于接收所述第一报文；
所述发送单元用于在所述接收单元接收到到所述第一报文后根据所述第一 转发表项， 通过数据通道向所述七层转发设备发送所述第二报文。
22、 根据权利要求 21所述的四层转发设备， 其特征在于，
所述接收单元还用于接收所述控制器发送的第二转发表项， 所述第二转发 表项包括第二关键字和所述第二关键字对应的第二处理策略； 所述第二关键字 包括报文的四层信息， 所述第二转发表项用于指示所述四层转发设备接收到匹 配所述第二关键字的第三报文时， 根据所述第二处理策略处理所述第三报文， 省略向所述七层转发设备发送报文。
23、 一种网络业务处理系统， 其特征在于， 包括： 如权利要求 21或 22所述 的四层转发设备、 权利要求 16~18任一所述的控制器、 以及七层转发设备； 所述 四层转发设备和七层转发设备分别与所述控制器通信， 且所述四层转发设备和 七层转发设备之间存在用于传输网络业务报文的数据通道。
PCT/CN2014/079802 2013-06-14 2014-06-13 报文处理方法、设备和系统 WO2014198229A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP14811596.7A EP2996291B1 (en) 2013-06-14 2014-06-13 Packet processing method, device, and system
US14/966,943 US20160099891A1 (en) 2013-06-14 2015-12-11 Packet processing method, apparatus and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310236338.2A CN104243338B (zh) 2013-06-14 2013-06-14 报文处理方法、设备和系统
CN201310236338.2 2013-06-14

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/966,943 Continuation US20160099891A1 (en) 2013-06-14 2015-12-11 Packet processing method, apparatus and system

Publications (1)

Publication Number Publication Date
WO2014198229A1 true WO2014198229A1 (zh) 2014-12-18

Family

ID=52021668

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/079802 WO2014198229A1 (zh) 2013-06-14 2014-06-13 报文处理方法、设备和系统

Country Status (4)

Country Link
US (1) US20160099891A1 (zh)
EP (1) EP2996291B1 (zh)
CN (1) CN104243338B (zh)
WO (1) WO2014198229A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106302456A (zh) * 2016-08-15 2017-01-04 浙江宇视科技有限公司 会话保持方法及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106936707A (zh) * 2015-12-29 2017-07-07 北界创想（北京）软件有限公司 路由方法及装置
US10432531B2 (en) * 2016-06-28 2019-10-01 Paypal, Inc. Tapping network data to perform load balancing
US10791092B2 (en) * 2018-02-14 2020-09-29 Nicira, Inc. Firewall rules with expression matching

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1599351A (zh) * 2003-12-17 2005-03-23 浪潮电子信息产业股份有限公司 构建高性价比机群网络负载均衡转发器的方法
CN101030947A (zh) * 2007-04-29 2007-09-05 华为技术有限公司 一种报文发送的方法和装置
WO2008101227A1 (en) * 2007-02-15 2008-08-21 Slacker, Inc. Methods for satellite augmented wireless communication networks
CN101599887A (zh) * 2008-06-05 2009-12-09 华为技术有限公司 对等网络中数据的传输方法和设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6804711B1 (en) * 1997-10-06 2004-10-12 Mci, Inc. Method and apparatus for managing call processing services in an intelligent telecommunication network
US6286052B1 (en) * 1998-12-04 2001-09-04 Cisco Technology, Inc. Method and apparatus for identifying network data traffic flows and for applying quality of service treatments to the flows
US7088718B1 (en) * 2002-03-19 2006-08-08 Cisco Technology, Inc. Server load balancing using IP option field approach to identify route to selected server
US7315541B1 (en) * 2002-04-03 2008-01-01 Cisco Technology, Inc. Methods and apparatus for routing a content request
US7990847B1 (en) * 2005-04-15 2011-08-02 Cisco Technology, Inc. Method and system for managing servers in a server cluster
EP2659629A1 (en) * 2010-12-28 2013-11-06 Citrix Systems Inc. Systems and methods for policy based routing for multiple next hops

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1599351A (zh) * 2003-12-17 2005-03-23 浪潮电子信息产业股份有限公司 构建高性价比机群网络负载均衡转发器的方法
WO2008101227A1 (en) * 2007-02-15 2008-08-21 Slacker, Inc. Methods for satellite augmented wireless communication networks
CN101030947A (zh) * 2007-04-29 2007-09-05 华为技术有限公司 一种报文发送的方法和装置
CN101599887A (zh) * 2008-06-05 2009-12-09 华为技术有限公司 对等网络中数据的传输方法和设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2996291A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106302456A (zh) * 2016-08-15 2017-01-04 浙江宇视科技有限公司 会话保持方法及装置
CN106302456B (zh) * 2016-08-15 2020-01-14 浙江宇视科技有限公司 会话保持方法及装置

Also Published As

Publication number Publication date
CN104243338A (zh) 2014-12-24
US20160099891A1 (en) 2016-04-07
EP2996291B1 (en) 2017-04-26
CN104243338B (zh) 2017-12-22
EP2996291A1 (en) 2016-03-16
EP2996291A4 (en) 2016-03-23

Similar Documents

Publication Publication Date Title
US10616379B2 (en) Seamless mobility and session continuity with TCP mobility option
US20230239241A1 (en) Systems, Apparatuses and Methods for Network Packet Management
US11570098B2 (en) Systems, apparatuses and methods for cooperating routers
US9497125B2 (en) Congestion control enforcement in a virtualized environment
US10181977B2 (en) Cross-stratum optimization protocol
US10135956B2 (en) Hardware-based packet forwarding for the transport layer
US7835285B2 (en) Quality of service, policy enhanced hierarchical disruption tolerant networking system and method
US9237132B2 (en) Load balancing in a network with session information
US9571382B2 (en) Method, controller, and system for processing data packet
US20140269319A1 (en) Network per-flow rate limiting
WO2021098425A1 (zh) 配置业务的服务质量策略方法、装置和计算设备
US20160099891A1 (en) Packet processing method, apparatus and system
CN115766605A (zh) 网络拥塞控制方法、装置及系统
EP3539235B1 (en) Systems, apparatuses and methods for cooperating routers
US20130275552A1 (en) Virtual desktop system
US20230171191A1 (en) Systems, Apparatuses and Methods for Cooperating Routers
US11805071B2 (en) Congestion control processing method, packet forwarding apparatus, and packet receiving apparatus
WO2010081321A1 (zh) 实现上送速率动态联动的方法、装置和系统
Nikitinskiy et al. A stateless transport protocol in software defined networks
Karrakchou et al. EP4: An application-aware network architecture with a customizable data plane
Rajput et al. Comparing stream control and datagram congestion control with traditional transmission control protocol
Agarwal et al. Lattice: A Scalable Layer-Agnostic Packet Classification Framework
Seo et al. Design of sctp-scf

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14811596

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2014811596

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014811596

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE