WO2015085850A1

WO2015085850A1 - Application identification method and device

Info

Publication number: WO2015085850A1
Application number: PCT/CN2014/091494
Authority: WO
Inventors: 段海峰
Original assignee: 华为技术有限公司
Priority date: 2013-12-10
Filing date: 2014-11-19
Publication date: 2015-06-18
Also published as: CN103685601A

Abstract

An application identification method and device, the method comprising: receiving a service packet carrying an internet protocol (IP) address of an application server; determining the target domain name corresponding to the IP address of the application server according to a mapping relation between the IP address of the application server and the domain name; determining the application corresponding to the target domain name according to the mapping relation between a preset application and the domain name. An embodiment of the present invention determines an application corresponding to the IP address of the application server according to the IP address of the application server carried in the service packet, the mapping relation between the IP address of the application server and the domain name, and the mapping relation between an application and the domain name, thus identifying the application communicating using a private protocol or an encryption protocol.

Description

Application identification method and device

Technical field

Embodiments of the present invention relate to communication technologies, and in particular, to an application identification method and apparatus.

Background technique

With the rise of the mobile Internet, more and more Internet companies and e-commerce platforms will use Application (APP) as one of the main battlefields for sales. The facts show that the tilt of major e-commerce platforms to mobile apps is also very obvious. The reason is not only the increased traffic every day, but more importantly, because of the convenience of mobile terminals, more users are accumulated for enterprises, and some users have better experience. The app has greatly improved the loyalty and activity of users, which has played a key role in the company's revenue generation and future development.

In the prior art, the network access server (NAS) or the service gateway (SGW) receives the service request message sent by the terminal, or the service response message sent by the application server. Because some types of applications usually use the encryption protocol or the private protocol to process the packets sent between the terminal and the APP server, the NAS device or the SGW device cannot identify the service request packet or the service response packet, and thus cannot identify the packets. The application corresponding to the text cannot control and charge these applications.

Summary of the invention

The embodiment of the invention provides an application identification method and device to solve the problem that the NAS device or the SGW device cannot identify certain applications.

In a first aspect, an embodiment of the present invention provides an application identification method, including:

Receiving a service packet, where the service packet carries a network protocol IP address of the application server;

Determining, according to the mapping relationship between the IP address of the application server and the domain name, the target domain name corresponding to the IP address of the application server;

The application corresponding to the target domain name is determined according to a preset mapping relationship between the application and the domain name.

With reference to the first aspect, in a first possible implementation manner of the first aspect, before the receiving the service packet, the method further includes:

Receiving a DNS response message sent by the domain name service DNS server, where the DNS response message carries at least a domain name corresponding to the application and an application server IP address;

Establish a mapping relationship between the application server IP address and the domain name.

With the first possible implementation of the first aspect, in a second possible implementation manner of the first aspect, after receiving the DNS response packet sent by the domain name service DNS server, the method further includes:

Determining whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name;

If yes, the mapping relationship between the application server IP address and the domain name is established and saved.

In conjunction with the second possible implementation of the first aspect, in a third possible implementation manner of the first aspect, the DNS response packet further carries an IP address of the DNS server, where the determining the DNS Before the domain name carried in the response packet is included in the mapping between the preset application and the domain name, the method further includes:

Determining, according to the IP address of the DNS server, whether the DNS server is an authorization server;

If yes, it is determined whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name.

With reference to the first aspect, any one of the first to the third possible implementation manners of the first aspect, in the fourth possible implementation manner of the first aspect, the service packet is: the terminal The service request packet sent or the service response packet sent by the application server.

With reference to the first aspect, any one of the first to fourth possible implementation manners of the first aspect, in a fifth possible implementation manner of the first aspect, The mapping relationship between the domain name and the application corresponding to the target domain name include:

The determined application corresponding to the target domain name is charged, and/or the determined application corresponding to the target domain name is controlled.

In a second aspect, an embodiment of the present invention provides an application identification apparatus, including:

a receiving module, configured to receive a service packet, where the service packet carries a network protocol IP address of the application server;

a processing module, configured to determine, according to a mapping relationship between an application server IP address and a domain name, a target domain name corresponding to the IP address of the application server; and, according to a mapping relationship between the preset application and the domain name, determine an application corresponding to the target domain name .

In conjunction with the second aspect, in a first possible implementation manner of the second aspect, the receiving module is further configured to:

Before receiving the service packet, receiving a DNS response packet sent by the domain name service DNS server, where the DNS response packet carries at least a domain name corresponding to the application and an application server IP address;

The processing module is further configured to establish a mapping relationship between the application server IP address and the domain name.

In conjunction with the first possible implementation of the second aspect, in a second possible implementation of the second aspect, the processing module is further configured to:

Determining whether the domain name carried in the DNS response packet received by the receiving module is included in the mapping relationship between the preset application and the domain name; if yes, establishing a mapping relationship between the IP address and the domain name of the application server, and save.

With the second possible implementation of the second aspect, in a third possible implementation manner of the second aspect, the DNS response packet further carries an IP address of the DNS server, and the processing module further uses to:

Before determining whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name, determining whether the DNS server is an authorization server according to an IP address of the DNS server; And determining whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name.

With reference to the second aspect, the first to the third possible implementation manner of the second aspect, in the fourth possible implementation manner of the second aspect, the service packet is: the terminal The service request packet sent or the service response packet sent by the application server.

With reference to the second aspect, any one of the first to fourth possible implementation manners of the second aspect, in a fifth possible implementation manner of the second aspect, the processing module is further configured to:

After the mapping between the application and the domain name is retrieved according to the preset domain name, and the application corresponding to the target domain name is determined, the determined application corresponding to the target domain name is charged, and/or the determined location is determined. The application corresponding to the target domain name is controlled.

In the embodiment of the present invention, the mapping between the IP address of the application server and the domain name is queried according to the IP address of the application server carried in the service packet, and the target domain name corresponding to the IP address of the application server is determined; and then the application is queried according to the target domain name. The mapping relationship between the domain names determines the application corresponding to the target domain name, thereby effectively identifying the application.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a flowchart of Embodiment 1 of an application identification method according to the present invention;

2 is a flowchart of Embodiment 2 of an application identification method according to the present invention;

FIG. 3 is a schematic structural diagram of Embodiment 1 of an application identification device according to the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Embodiment 1

1 is a flowchart of Embodiment 1 of an application identification method according to the present invention. The method is implemented by an application identification device, and the device may be integrated in a NAS device or an SGW device, and the NAS device may be a fixed network broadband access server (Broadband Remote Access). Server, abbreviation: BRAS) or a mobile network device, e.g., gateway GPRS support node (gateway GPRS support node, abbreviation: GGSN) and a packet data serving node (packet data serving node, abbreviation: PDSN), etc., which in the execution means The specifics can be implemented by software, or hardware, or a combination of software and hardware. The method specifically includes:

S101. Receive a service packet.

The service packet carries an Internet Protocol (IP) address of the application server. The service packet can be sent by the service request packet sent by the terminal or the application server. The service response message sent.

S102. Determine a target domain name corresponding to the IP address of the application server according to the mapping relationship between the IP address of the application server and the domain name.

Each application may correspond to multiple domain names. For example, the domain name corresponding to the Taobao application may be taobao.com or taobao.com.uk and so on. The configuration of domain names usually follows certain rules. For example, domain name configuration needs to support wildcards and regular expressions. Optionally, the NAS device or the SGW device establishes a mapping relationship between the application server IP address and the domain name according to the domain name authentication table. The domain name authentication table is preset by the operator according to the operational requirements. For example, the domain name of the mainstream social application is set to facebook.com or whatspp.com.

A domain name may correspond to multiple application server IP addresses. The physical database and memory cache of the above device (for example, a NAS device or an SGW device) may simultaneously store a domain name and a corresponding plurality of application server IP addresses.

The IP address of the application server may be retrieved in the mapping relationship between the application server IP address and the domain name, so as to determine the target domain name corresponding to the IP address of the application server.

S103. Determine, according to a mapping relationship between the preset application and the domain name, an application corresponding to the target domain name.

Domain names are generally named according to the domain name naming rules, that is, domain names can be divided into different levels, including top-level domains and second-level domain names. Among them, the top-level domain name includes the country code and the international domain name, the country code, for example, the domain name of China is .cn; the international domain name, for example, the domain name of the business enterprise is .com, the domain name of the non-profit organization is .org, etc.; The domain name refers to the domain name under the top-level domain name. Under the international top-level domain name, it refers to the online name of the domain name registrant, such as ibm, yahoo, microsoft, etc. Under the national top-level domain name, it is a symbol indicating the registered enterprise category. For example, com, edu, gov, net, etc.

Based on the above-mentioned domain name naming rules, the operator pre-sets the applications of interest and the domain names corresponding to the applications according to the operational requirements, and establishes a mapping relationship between the application and the domain name, and stores them in, for example, a NAS device or an SGW device.

And searching, according to the target domain name determined in step S102, the target domain name in the mapping relationship between the application and the domain name to determine an application corresponding to the target domain name.

In the embodiment of the present invention, the mapping between the IP address and the domain name of the application server is queried according to the IP address of the application server carried in the service packet, and the target domain name corresponding to the IP address of the application server is determined; and then the application and the domain name are queried according to the target domain name. The mapping relationship determines an application corresponding to the target domain name, thereby realizing identification of an application that communicates using a private protocol or an encryption protocol.

Embodiment 2

FIG. 2 is a flowchart of Embodiment 2 of an application identification method according to the present invention. As shown in FIG. 2, this embodiment is used to install an application terminal, a NAS device, or an SGW device (the mapping relationship between the preset application and the domain name and the DNS authentication table, that is, the IP address list of the authorized DNS server) and the domain name. The interaction process between the server (Domain Name Service, DNS for short) server and the application server illustrates a specific implementation process of the application identification method provided by the present invention, wherein S201-S207 is a mapping relationship between the application server IP address and the domain name. The process is established (or stored), S208-S210 is the process of determining the application, and S211 is the charging and/or control of the application. Specifically include:

S201. The terminal sends a DNS request packet to the NAS device or the SGW device.

The terminal can send a DNS request message through an application client installed by itself. Specifically, when the user accesses, for example, a social service through the application client, the terminal first sends a DNS request message carrying the domain name corresponding to the application to the NAS device or the SGW device, and the NAS device or the SGW device forwards the message to the DNS server; After the device or the SGW device receives the DNS request packet, S202 is performed.

S202. The NAS device or the SGW device forwards the DNS request packet to the DNS server.

After receiving the DNS request packet, the DNS server assembles the DNS response packet according to the domain name carried in the DNS request packet and the IP address of the application server corresponding to the domain name pre-stored by the DNS server, and sends the response packet to the NAS device or SGW device.

S203. The NAS device or the SGW device receives the DNS response packet sent by the DNS server.

The DNS response packet carries at least the domain name corresponding to the application and the IP address of the application server.

S204. The NAS device or the SGW device determines whether the DNS server is an authorization server according to the IP address of the DNS server in the DNS response packet.

Specifically, the NAS device or the SGW device determines whether the source address of the DNS response packet is an IP address of an authorized DNS server configured in the DNS authentication table, and if yes, the DNS response packet Performing parsing, and executing S205 according to the parsed domain name; if not, executing S207 directly.

Since the DNS servers corresponding to different sites or different applications may be different, the DNS authentication table may be used to authenticate the DNS server. The IP address of the DNS server existing in the DNS authentication table may be deemed to be authorized. , thereby improving the reliability of the domain name and application server IP address obtained by parsing. The DNS server IP address in the DNS authentication table can be maintained according to the requirements of the operator.

S205. The NAS device or the SGW device determines whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name.

The NAS device or the SGW device determines, according to the domain name obtained by the DNS response packet, whether the domain name matches the domain name configured in the mapping relationship between the preset application and the domain name. If yes, execute S206; if not, go to step 207.

In this step, only the domain name that needs to be managed by the domain name and the IP address needs to continue to resolve the DNS response packet to obtain the IP address of the application server. Therefore, the system performance caused by the mapping between the IP address and the domain name of all application servers is avoided. Reduced and enhanced system performance stability.

The S206, the NAS device, or the SGW device establishes a mapping relationship between the IP address and the domain name of the application server, and saves the relationship.

The mapping between the IP address and the domain name of the application server is established according to the domain name and the IP address of the application server, and the mapping relationship between the IP address and the domain name of the application server is stored in the physical database.

Optionally, in order to quickly obtain the mapping relationship between the application server IP address and the domain name, the mapping relationship between the application server IP address and the domain name may be cached in the memory.

S207. The NAS device or the SGW device forwards the DNS response packet to the terminal.

S208. The NAS device or the SGW device receives the service packet.

Specifically, those skilled in the art can understand the step as two specific scenarios, and one of them can be satisfied:

S2081: The NAS device or the SGW device receives the service request packet sent by the terminal.

S2082: The NAS device or the SGW device receives the service response packet sent by the application server.

The service request packet or the service response packet carries the IP address of the application server.

After receiving the service packet initiated by the terminal, the NAS device or the SGW device checks the IP address and domain name of the application server through the IP address of the application server carried in the service packet (where the uplink is the destination IP address and the downlink is the source IP address). Mapping relationship.

S209. Determine a target domain name corresponding to the IP address of the application server according to the mapping relationship between the IP address of the application server and the domain name.

S210. Search for a mapping relationship between the application and the domain name according to the preset domain name, and determine an application corresponding to the target domain name.

S209 and S210 are the same as S102 and S103 in the first embodiment, and are not described herein again.

S211. Perform charging on an application corresponding to the determined target domain name, and/or control an application corresponding to the determined target domain name.

It should be noted that the control may be to block, release, redirect, control Gating control or bandwidth control of the service packets of the application; the charging may be the traffic accounting and duration charging of the application. , event billing or superimposed billing for the above types of billing.

In the embodiment of the present invention, the NAS device or the SGW device parses the DNS response packet, and obtains a mapping relationship between the domain name of the application and the IP address of the application server, and then the domain name and the destination IP address according to the destination IP address or the source IP address in the service packet. The application server IP address mapping relationship and the preset mapping relationship between the application and the domain name are used to determine the application corresponding to the destination IP address or the source IP address, thereby improving the recognition rate and accuracy of the application using the private protocol or the encryption protocol communication in the data service. There is no need to dynamically track changes in the IP address of the application server, reduce system maintenance complexity, and thereby enable billing and/or control of the application.

In addition, in order to ensure the accuracy and timeliness of the mapping relationship between the application server IP address and the domain name, and to reduce the occupation of memory resources by long-term unused data, optionally, the cached data in the memory and the physical database are periodically The data in the data is synchronized, and the aging data and the long-term unused garbage data are regularly cleaned up.

FIG. 3 is a schematic structural diagram of Embodiment 1 of an application identification device according to the present invention. The apparatus of this embodiment may be integrated in a NAS device or an SGW device, which may be a BRAS or a mobile network device, for example, a gateway GGSN, a PDSN, or the like. As shown in FIG. 3, the apparatus of this embodiment includes a receiving module 31 and a processing module 32.

The receiving module 31 is configured to receive a service packet, where the service packet carries an application server. The processing module 32 is configured to determine a target domain name corresponding to the IP address of the application server according to the mapping relationship between the IP address and the domain name of the application server, and determine the target domain name corresponding according to the mapping relationship between the preset application and the domain name. Applications.

The application identification device of this embodiment may be used to implement the technical solution of the application identification method embodiment shown in FIG. 1 and FIG. 2, and the implementation principle and the technical effect are similar, and details are not described herein again.

On the basis of the foregoing, the receiving module 32 may be further configured to: before receiving the service packet, receive a DNS response packet sent by the DNS server, where the DNS response packet carries at least the domain name corresponding to the application and the IP address of the application server; The processing module 31 can also be used to establish a mapping relationship between the application server IP address and the domain name.

Optionally, the processing module 32 is further configured to determine whether the domain name carried in the foregoing DNS response packet received by the receiving module 31 is included in the mapping relationship between the preset application and the domain name; if yes, establishing an application server IP address and The mapping relationship of the domain name is saved.

Further, the foregoing DNS response packet may further carry an IP address of the DNS server, and the processing module 32 may be further configured to determine whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name. The IP address of the DNS server is used to determine whether the DNS server is an authorization server. If yes, it is determined whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name.

The service packet may be: a service request packet sent by the terminal or a service response packet sent by the application server.

The processing module 32 may be further configured to: after determining the mapping relationship between the application and the domain name according to the preset domain name, determine the application corresponding to the target domain name, and then perform charging on the determined application corresponding to the target domain name, and/or The determined application corresponding to the target domain name is controlled.

One of ordinary skill in the art will appreciate that all or part of the steps to implement the various method embodiments described above may be accomplished by hardware associated with the program instructions. The aforementioned program can be stored in a computer readable storage medium. The program, when executed, performs the steps including the various method embodiments described above; The foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. range.

Claims

An application identification method, comprising:

Receiving a service packet, where the service packet carries a network protocol IP address of the application server;

Determining, according to the mapping relationship between the IP address of the application server and the domain name, the target domain name corresponding to the IP address of the application server;

The application corresponding to the target domain name is determined according to a preset mapping relationship between the application and the domain name.
The method according to claim 1, wherein before receiving the service message, the method further includes:

Receiving a DNS response message sent by the domain name service DNS server, where the DNS response message carries at least a domain name corresponding to the application and an application server IP address;

Establish a mapping relationship between the application server IP address and the domain name.
The method according to claim 2, wherein after receiving the DNS response message sent by the domain name service DNS server, the method further includes:

Determining whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name;

If yes, the mapping relationship between the application server IP address and the domain name is established and saved.
The method according to claim 3, wherein the DNS response message further carries an IP address of the DNS server, and the determining whether the domain name carried in the DNS response message is included in the preset Before the application and domain name mapping relationship, it also includes:

Determining, according to the IP address of the DNS server, whether the DNS server is an authorization server;

If yes, it is determined whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name.
The method according to any one of claims 1-4, wherein the service message is: a service request message sent by the terminal or a service response message sent by the application server.
The method according to any one of claims 1-5, wherein after the mapping of the mapping between the application and the domain name is performed according to the preset domain name, and the application corresponding to the target domain name is determined, the method further includes:

Accounting for the determined application corresponding to the target domain name, and/or, for the determined The application corresponding to the target domain name is controlled.
An application identification device, comprising:

a receiving module, configured to receive a service packet, where the service packet carries a network protocol IP address of the application server;

a processing module, configured to determine, according to a mapping relationship between an application server IP address and a domain name, a target domain name corresponding to the IP address of the application server; and, according to a mapping relationship between the preset application and the domain name, determine an application corresponding to the target domain name .
The device according to claim 7, wherein the receiving module is further configured to:

Before receiving the service packet, receiving a DNS response packet sent by the domain name service DNS server, where the DNS response packet carries at least a domain name corresponding to the application and an application server IP address;

The processing module is further configured to establish a mapping relationship between the application server IP address and the domain name.
The device according to claim 8, wherein the processing module is further configured to:

Determining whether the domain name carried in the DNS response packet received by the receiving module is included in the mapping relationship between the preset application and the domain name; if yes, establishing a mapping relationship between the IP address and the domain name of the application server, and save.
The device according to claim 9, wherein the DNS response message further carries an IP address of the DNS server, and the processing module is further configured to:

Before determining whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name, determining whether the DNS server is an authorization server according to an IP address of the DNS server; And determining whether the domain name carried in the DNS response packet is included in the mapping relationship between the preset application and the domain name.
The device according to any one of claims 7 to 10, wherein the service message is: a service request message sent by the terminal or a service response message sent by the application server.
The device according to any one of claims 7 to 11, wherein the processing module is further configured to:

After the mapping between the application and the domain name is retrieved according to the preset domain name, and the application corresponding to the target domain name is determined, the determined application corresponding to the target domain name is charged, and/or the determined location is determined. The application corresponding to the target domain name is controlled.