WO2016095440A1 - 报文的发送处理方法、装置及一种网络设备 - Google Patents

报文的发送处理方法、装置及一种网络设备 Download PDF

Info

Publication number
WO2016095440A1
WO2016095440A1 PCT/CN2015/080063 CN2015080063W WO2016095440A1 WO 2016095440 A1 WO2016095440 A1 WO 2016095440A1 CN 2015080063 W CN2015080063 W CN 2015080063W WO 2016095440 A1 WO2016095440 A1 WO 2016095440A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
packet
back pressure
specified type
specified
Prior art date
Application number
PCT/CN2015/080063
Other languages
English (en)
French (fr)
Inventor
施玮
洪创业
郭金辉
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016095440A1 publication Critical patent/WO2016095440A1/zh

Links

Images

Definitions

  • the present invention relates to the field of communications, and in particular, to a packet processing method and apparatus, and a network device.
  • Network device security is an important technical parameter in the live network application.
  • network devices are also affected by traffic from control planes such as routing protocols and application protocols. Some of these traffic are legitimate traffic, and some belong to Illegal traffic, but if the traffic is too large or a large number of bursts, the network device control plane processing overload will cause the network processor to crash, making the device unavailable.
  • network equipment vendors provide some means to protect the security of the device, such as attack detection and suppression, black and white lists, security logs, and access control lists.
  • Commonly used protection measures use the operating system network processor mode to calculate the rate limit of the unit time access request packet to prevent attacks. The excess part will not discriminate between legitimate and illegal access requests, and will be discarded when a large number of access requests are attacked. The access circuit is closed and no access request message is received.
  • the device network processor needs to determine whether each type of access request packet is legal, and puts the packet into a different queue according to the packet attribute.
  • the queue scheduling strategy includes strict priority scheduling and round-robin scheduling.
  • the network operating system needs to reserve enough processing queues and scheduling resources. When an illegal user initiates a large number of attacks, the packets need to be stored first, and analyzed according to the network processor. As a result, the policy is further processed. If the device is shut down, the device will not receive or process any such access request packet, including the legal request packet of the normal user, and discard the high-priority protocol packet unconditionally. It can be seen that the method of sending all the data transmission packets to the network processor for analysis and processing first cannot effectively solve the problem of efficient forwarding, and can not fully utilize the network processor resources and affect the normal use of the network devices.
  • the embodiment of the invention provides a method and a device for processing a packet, and a network device, which at least solves the problem that the network processor analyzes and processes all the packets first, which results in low packet forwarding efficiency. problem.
  • a method for transmitting a message is provided, which is implemented by a back pressure device located between an interface board and a forwarding chip in a network device, the method comprising: receiving, by the back pressure device The packet sent by the interface board; the backpressure device backpressures the packet of the specified type in the packet; the backpressure device sends the backpressured packet to the forwarding chip.
  • the backpressure device performs backpressure on the packet of the specified type in the packet, and the backpressure device determines whether the type of the specified packet in the packet exists in the local packet feature. If the result of the determination is yes, the specified packet whose traffic is greater than the predetermined threshold is used as the specified type of packet, and the specified type of packet is back pressured; if the determination result is negative And the specified packet is used as the specified type of packet, and the specified type of packet is backpressured.
  • the local message feature table is set by a general device language.
  • the method before the back pressure device performs backpressure on the packet of the specified type in the packet, the method includes: assigning a signature to the packet, and carrying the signature in the packet The feature code is used to indicate the type of the message.
  • the method before the back pressure device determines whether the type of the specified packet in the packet exists in the local packet feature table, the method further includes: according to the location of the network device in the network. And selecting the local message feature table corresponding to the location.
  • the back pressure device performs backpressure on the specified type of message in the packet, and the back pressure device performs multi-level backpressure on the specified type of message.
  • the back pressure device includes: a unit device and a unit device group, wherein the unit device is a minimum unit that backpressures the specified type of message, and the unit device group is of the same type
  • the unit device is composed of: the back pressure device performs multi-level back pressure on the specified type of message, and the back pressure device sequentially reverses the specified type of message through the unit device and the unit device group. Pressure.
  • the granularity of the feature code includes one of the following: a port and a bus.
  • a network device including an interface board and a forwarding chip, and a back pressure device is disposed between the interface board and the forwarding chip: the back pressure device receives the interface board And the backpressure device sends a backpressured packet to the forwarding chip.
  • the backpressure device performs a backpressure on the packet of the specified type in the packet.
  • a message processing device for a message, the device being applied to a back pressure device, wherein the back pressure device is located between an interface board and a forwarding chip, the device comprising: The receiving module is configured to receive the packet sent by the interface board, and the back pressure module is configured to perform backpressure on the specified type of the packet, and the sending module is configured to send the backpressured packet to the packet The forwarding chip.
  • the back pressure module includes: a determining unit, configured to determine whether the type of the specified packet in the packet exists in the local packet feature table; and the back pressure unit is set to be in the judgment result If yes, the back pressure device uses the specified packet whose traffic is greater than the predetermined threshold as the specified type of packet, and backpressures the specified type of packet; if the determination result is negative, The back pressure device uses the specified packet as the specified type of packet, and backpressures the specified type of packet.
  • the packet sent by the interface board is received by the back pressure device located between the interface board and the forwarding chip in the network device; the back pressure device backpressures the specified type of message in the packet; the back pressure device passes The back pressured message is sent to the forwarding chip.
  • FIG. 1 is a flowchart of a method for processing a message according to an embodiment of the present invention
  • FIG. 2 is a structural block diagram of a network device according to an embodiment of the present invention.
  • FIG. 3 is a structural block diagram of a message transmission processing apparatus according to an embodiment of the present invention.
  • FIG. 4 is a structural block diagram (1) of a message transmission processing apparatus according to an embodiment of the present invention.
  • Figure 5 is a schematic view showing the position of a back pressure device in a device according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of device feature code operation according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a secondary back pressure of a device according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of docking a device with different operating system products according to an embodiment of the invention.
  • FIG. 9 is a schematic diagram of linkage linkage between backpressure and different network layer devices according to an embodiment of the present invention.
  • FIG. 10 is a flow chart of an embodiment of an interface independent chip backpressure device in accordance with an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for processing a packet according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:
  • Step S102 the back pressure device located between the interface board and the forwarding chip receives the packet sent by the interface board
  • Step S104 The back pressure device backpressures the packet of the specified type in the packet
  • Step S106 The back pressure device sends the backpressured packet to the forwarding chip.
  • the back pressure device located between the interface board and the forwarding chip backpressures the specified type of packet from the interface board, and sends the back pressured packet to the forwarding chip, wherein the back pressure device is independent.
  • the chip is run and the general machine language is used. It can be grafted for different device manufacturers and different network location devices.
  • all the data transmission packets are analyzed and processed by the network processor, and the above steps are completed by the chip backpressure device, which requires the network processor to analyze and post-process, and effectively release the operating system queue. And scheduling resources to improve data forwarding efficiency.
  • the back pressure device forwards the packets of the specified type, and the other types of packets, such as legal packets, can pass through the backpressure device without back pressure processing.
  • the backpressure device determines whether the type of the specified packet in the packet exists in the local packet feature table, and if the determination result is yes, and the traffic of the specified packet is greater than a predetermined threshold.
  • the specified message is back pressured.
  • the back pressure device uses the designated message as the specified type of message, and backpressures the specified type of message.
  • the local message feature table is set by a generic device language.
  • the back buffer first assigns the signature to the packet, and carries the signature in the packet.
  • the feature code is used to indicate the type of the message. The message is thus classified by assigning a signature to the message.
  • the selection of the local packet feature table is consistent with a certain rule.
  • the local packet feature table corresponding to the location is selected according to the location of the network device in the network.
  • the above step S104 involves the back pressure device counter-pressing the specified type of message in the message.
  • the back pressure device can backpressure the message in multiple ways, for example, the back pressure device pairs the specified type of message. It can perform one-stage back pressure or multi-stage back pressure.
  • the back pressure device comprises: a unit device and a unit device group, wherein the unit device is a minimum unit that backpressures a specified type of message, and the unit device group is composed of the unit device of the same type;
  • the pressure device performs multi-level back pressure on the specified type of message, including: the back pressure device sequentially presses the specified type of message step by step through the unit device and the unit device group.
  • a unit type counter and a unit device group can perform a secondary backpressure on a message of a specified type.
  • the granularity of the signature includes a port or a bus.
  • FIG. 2 is a structural block diagram of a network device according to an embodiment of the present invention.
  • the network device includes an interface board 22 and a forwarding chip 24, and the interface board 22
  • a back pressure device 26 is disposed between the forwarding chip 24 and the forwarding device 24: the back pressure device 26 receives the message sent by the interface board 22; the back pressure device 26 backpressures the specified type of message in the message; the back pressure device 26 is back pressure The subsequent message is sent to the forwarding chip 24.
  • a packet processing device is also provided, which is used to implement the foregoing embodiments and preferred embodiments, and is not described herein again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 3 is a structural block diagram of a message transmission processing apparatus according to an embodiment of the present invention.
  • the device is applied to a back pressure device, wherein the back pressure device is located between an interface board and a forwarding chip, and the device includes: receiving The module 32 is configured to receive the packet sent by the interface board; the back pressure module 34 is configured to backpressure the packet of the specified type in the packet; and the sending module 36 is configured to send the backpressured packet to the forwarding chip.
  • the back pressure module 34 includes: a determining unit 342, configured to determine a type of a specified message in the message. Whether it exists in this In the local message feature table, the back pressure unit 344 is configured to, when the determination result is yes, use the specified packet whose traffic is greater than the predetermined threshold as the specified type of message, and backpressure the specified type of message. If the judgment result is negative, the specified packet is used as the specified type of packet, and the specified type of packet is backpressured.
  • a determining unit 342 configured to determine a type of a specified message in the message. Whether it exists in this In the local message feature table, the back pressure unit 344 is configured to, when the determination result is yes, use the specified packet whose traffic is greater than the predetermined threshold as the specified type of message, and backpressure the specified type of message. If the judgment result is negative, the specified packet is used as the specified type of packet, and the specified type of packet is backpressured.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are respectively located.
  • the first processor, the second processor, and the third processor In the first processor, the second processor, and the third processor.
  • the main purpose of this alternative embodiment is to provide a chip back-pressure device, which is interposed between the interface board hardware and the forwarding chip. As shown in FIG. 5, the device is connected to the interface board high-speed link to perform data before delivery.
  • the traffic characteristic check and back pressure achieve the purpose of separating the protection measures from the network processor resources.
  • the stand-alone chip provides built-in general machine language recognition traffic characteristics, providing a versatile security solution for network devices of different network locations and different operating systems.
  • the present embodiment provides a method for designing a chip device, which includes:
  • FIG. 6 is a schematic diagram of device feature code operation according to an embodiment of the present invention. As shown in FIG. 6, the device sets a local message feature table by machine language, and the feature table sets key feature positions of various messages. Define and set the threshold to provide a basis for signature recognition back pressure;
  • Step B Identification of the feature code, as shown in FIG. 6, the device performs the classification of the message feature code by querying the local message feature table, and identifies the packet feature, such as a Layer 2 data link layer message and a Layer 3 network layer message. ;
  • Step C The feature code operation, as shown in FIG. 6 , the device performs an operation on each of the packets that are classified and identified, and performs backpressure marking on the data exceeding the set threshold value per unit time;
  • FIG. 7 is a schematic diagram of the secondary back pressure of the device according to an embodiment of the present invention. As shown in FIG. 7, the device performs secondary back pressure control on the feature data.
  • the first stage back pressure is back pressured by the unit device. Through this stage of back pressure, the unit devices can be made to have no influence on each other; the second stage is back pressure, and the back pressure is performed by the unit group. Mark multiple units as the same unit group, enabling multiple units to be safely managed and back pressured in groups.
  • the foregoing method may further have the following feature: in the step A, the feature code is encoded in a common device language, separated from the network device operating system, and can be independently operated.
  • FIG. 8 is a schematic diagram of docking a device with different operating system products according to an embodiment of the present invention.
  • the device as shown in FIG. 8, can interface with different operating systems. Products, products from different equipment manufacturers.
  • FIG. 9 is a schematic diagram of linkage linkage between back pressure and different network layer devices according to an embodiment of the present invention.
  • the device as shown in FIG.
  • Network products, network product processing performance set different initial values, and linkage with the device.
  • the foregoing method may further have the following feature: in the step B, the feature code identification performed by the device on the packet stream may be based on a port level or may be performed based on a forwarding bus.
  • the foregoing method may further have the following features: in the step B, the device may be installed according to different interface and line card resource granularity; and support linkage between interfaces and line cards.
  • the foregoing method may further have the following feature: in the step C, according to the flow feature code and the feature trust degree, the information is divided into different back pressure levels, and the information may be output and displayed through the operation channel.
  • the foregoing method may further have the following feature: in the step D, the feature code back pressure can prevent the feature flows between the physical interfaces from affecting each other, and different feature flows on the same interface do not affect each other. .
  • the device of the alternative embodiment is a low-level interface-level chip back-pressure device, and the device is between the interface board hardware and the forwarding chip, and belongs to the board level; the device does not depend on the network device operating system platform, and uses a general machine language to implement data. Analysis.
  • FIG. 10 is a flow chart of an embodiment of an interface independent chip backpressure device according to an embodiment of the present invention.
  • FIG. 10 is a flowchart of an embodiment of an interface independent chip back pressure device according to the alternative embodiment. The method requires the following steps:
  • Step S1002 The device sets a local message feature table by using a machine language, and the feature table defines key feature positions of various messages, and sets a threshold value to provide a basis for the feature code identification back pressure.
  • the default initialization class ifies the feature table into three categories; the first class is a three-layer sub-publication: it is identified according to the feature information of the transport layer; the second class is a bi-layer sub-distribution; the second-level sub-distribution is based on the link layer feature information; Published for exceptions: Data other than the transport layer and link layer messages need to be treated specially for exception classification. If the compilation is passed, step S1004 is performed;
  • Step S1004 Enable the corresponding feature table switch according to the location of the network of the accessory device, and deploy a separate chip back pressure device.
  • the device is deployed between the network device interface board and the forwarding microcode, and is connected to the underlying forwarding channel. If successful, step S1006 is performed;
  • Step S1006 The device classifies different types of feature data by using different feature codes according to the feature code classification enabled in step S1004 by querying the local message feature table to perform feature classification. If the classification is successful, step S1008 is performed, if the classification is unsuccessful, step S1010 is performed;
  • Step S1008 The device performs calculation on the message for performing feature recognition, and enables the backpressure flag for the feature data exceeding the set threshold value per unit time; meanwhile, according to the output result of the calculation channel, it is determined whether the initial setting is to be performed. Make adjustments, if necessary, go back to step S1002, re-set; if no adjustment is needed, go to step S1012;
  • Step S1010 If the feature data classification is unsuccessful, the feature data will be classified into the abnormality sub-publishing, and the abnormal sub-publishing data directly enables the backpressure flag, and step S1012 is performed;
  • Step S1012 The device performs secondary back pressure control on the message.
  • Back pressure requires dead loop detection and deadlock detection; back pressure is performed by intelligent time sharing mechanism, and multiple channels work simultaneously.
  • the first stage back pressure is back pressured by the unit device. If the feature data of a unit device exceeds the standard, the unit device carries the flow enable back pressure flag in step S1008, and the device further processes the flow to implement a flow control back pressure for the marking unit.
  • the second stage back pressure is back pressured by the unit device group.
  • the plurality of cells are marked as the same cell group, and the back pressure results of the various cell devices are group-accumulated, and the flow control back pressure for the tag cell group is implemented by comparing with the preset value of the cell group. The process ends.
  • the technology for implementing back pressure through the interface independent chip introduced by the present invention has the characteristics of more flexible predefined and more flexible deployment modes.
  • each back-pressure chip has a total of 16 high-speed link back pressure links, of which 12 high-speed back pressure links are extracted in the present invention.
  • Each feature table is calculated corresponding to the feature back pressure table, and each feature back pressure table is encoded by a feature table of 16x16.
  • Each back-pressure chip supports 16 pairs of high-speed serial link technology. When docked with multiple buses, 1+1 load sharing can be achieved, and each pair of serial link rates can be as high as 100G.
  • the independent chip backpressure device supports dynamic creation of different feature tables.
  • the traffic type is characterized based on the location of the network device, and the feature stream can be subdivided.
  • the Border Gateway Protocol (BGP) protocol can be subdivided into three sub-types: bgp-default, bgp-cfg-peer, and bgp-known. among them:
  • Bgp-default is the default type, with the lowest priority assigned to it, such as BGP port 179 listening entries.
  • Bgp-cfg-peer is a configuration entry.
  • the trust relationship is not established.
  • the priority of the configuration is slightly higher. For example, after BGP is configured with the neighbor, the entry generated by the connection is initiated.
  • Bgp-known is a neighbor trust relationship that has been established with the highest priority. After the configuration of the BGP peer is successful, the priority of the packet corresponding to the neighbor dynamically increases from the lowest to the highest.
  • the backpressure device synchronizes the trusted information to the feature table, which protects the normal operation of the existing service when the attack occurs.
  • the packets matching the feature table protocol are controlled by the preset backpressure policy. This ensures the reliability and stability of the neighbor related services.
  • the backpressure device deletes the information from the feature table.
  • the feature table corresponding to the BGP packet cannot be created. Under this condition, any BGP packets received by the network device are subjected to backpressure processing because they cannot be matched with the feature table.
  • the independent chip backpressure device protects the application layer data and network layer data of the device through the feature table feature, and determines the legal data or the high priority data that is determined to be used as a reasonable feature table and initial value definition, and the message without the matching feature table It will be put into an abnormality and published for back pressure processing.
  • the independent chip back pressure device performs feature table linkage and dynamic back pressure control according to different network location devices.
  • the feature table linkage is to associate the feature table library file with the network device location selection switch, and start different selection switches for the back pressure device in different network devices, and the device does not have the feature entry that is not enabled, and the device processes the exception feature table by default. This minimizes the attack range of attackers at different locations, increases the cost of attacks, and reduces the security risks of devices.
  • the back-pressure device of the independent chip supports the omnidirectional, multi-level flow control back pressure function.
  • the flow characteristic back pressure behavior can be based on a two-stage back pressure strategy of a unit chip and a unit chipset, and the back pressure signature can be flexibly defined according to the location of the network device.
  • the independent chip anti-voltage device can effectively improve the anti-attack and anti-impact ability of network devices in different locations and network devices of different platforms, and enhance the stability and enhancement of the equipment.
  • the equipment continues to work and improve the service quality of operators.
  • the present invention is a low-level interface-level chip back-pressure device.
  • the chip is a layer between the interface board hardware and the forwarding chip, and belongs to the board level.
  • the main purpose is to protect the network device operating system.
  • the chip backpressure device will require the network processor to analyze and post-process the work at the bottom layer, effectively release the operating system queue and scheduling resources, improve data forwarding efficiency, and the device adopts a common device language, which can be independently encoded and grafted in different network devices. Compatible with multi-vendor devices.
  • the chip device does not rely on the network device operating system platform, uses a general machine language to achieve data parsing, and is compatible with different operating system platforms.
  • a storage medium is further provided, wherein the software includes the above-mentioned software, including but not limited to: an optical disk, a floppy disk, a hard disk, an erasable memory, and the like.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the technical solution provided by the foregoing embodiment of the present invention can be applied to the process of sending a packet, and receiving, by the backpressure device located between the interface board and the forwarding chip in the network device, the packet sent by the interface board;
  • the specified type of message is back pressured; the back pressure device sends the backpressured message to the forwarding chip.

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种报文的发送处理方法、装置及一种网络设备，其中，该方法包括：通过网络设备内位于接口板和转发芯片之间的反压装置接收接口板发送的报文；反压装置对报文中指定类型报文进行反压；反压装置将经过反压后的报文发送给转发芯片。通过本发明解决了相关技术中由网络处理器对所有报文先进行分析再进行处理，导致报文转发效率低的问题，从而有效释放操作系统队列及调度资源，提升了数据转发效率。

Description

报文的发送处理方法、装置及一种网络设备 技术领域
本发明涉及通信领域，具体而言，涉及报文的发送处理方法、装置及一种网络设备。
背景技术
网络设备安全性在现网应用中属于重要的技术参数，除了常见的二层攻击之外，网络设备也受到路由协议、应用协议等控制平面的流量冲击，这些流量有些属于合法的流量，有些属于非法流量，但是若流量过大或大量突发，网络设备控制平面处理负荷过重就会导致网络处理器瘫痪，致使设备不可用。
因此网络设备厂商都提供一些用于保护本设备安全的手段，例如攻击发现并抑制、黑白名单、安全日志、访问控制列表等措施。常用保护措施采用操作系统网络处理器方式运算单位时间接入请求报文的限速来防范攻击，超过部分将不区分合法或非法的接入请求被全部丢弃，在受到持续大量接入请求攻击时关闭接入电路，不接收任何接入请求报文。
以上所述方法在实际应用中存在较大局限性，比如，设备网络处理器对于每种接入请求报文均需判断是否合法，根据报文属性将报文放入不同的队列，需支持各种队列调度策略，包括严格优先级调度和轮转调度，网络操作系统需预留足够的处理队列及调度资源；而在非法用户发起大量攻击时，需先将报文进行存储，依据网络处理器分析结果决定进一步处理策略；采取关闭电路方式，设备将不接收和处理任何此类接入请求报文，包括正常用户的合法请求报文，对于高优先级协议报文无条件丢弃。可以看出，将数据传输所有报文送至网络处理器先进行分析再进行处理的方式，不能有效解决高效转发问题，无法充分利用网络处理器资源，影响网络设备的正常使用。
针对相关技术中，由网络处理器对所有报文先进行分析再进行处理，导致报文转发效率低的问题，还没有提出有效的解决方案。
发明内容
本发明实施例提供了一种报文的发送处理方法、装置及一种网络设备，以至少解决相关技术中由网络处理器对所有报文先进行分析再进行处理，导致报文转发效率低的问题。
根据本发明的一个实施例，提供了一种报文的发送处理方法，该方法通过网络设备内位于接口板和转发芯片之间的反压装置实现，所述方法包括：所述反压装置接收所述接口板发送的报文；所述反压装置对所述报文中指定类型报文进行反压；所述反压装置将经过反压后的报文发送给所述转发芯片。
在本发明实施例中，所述反压装置对所述报文中指定类型报文进行反压包括：所述反压装置判断所述报文中指定报文的类型是否存在于本地报文特征表中；在判断结果为是的情况下，将流量大于预定阈值的所述指定报文作为所述指定类型报文，并对所述指定类型报文进行反压；在判断结果为否的情况下，将所述指定报文作为所述指定类型报文，并对所述指定类型报文进行反压。
在本发明实施例中，所述本地报文特征表通过通用设备语言设定。
在本发明实施例中，所述反压装置对所述报文中指定类型报文进行反压之前包括：为所述报文分配特征码，并将所述特征码携带于所述报文中，其中，所述特征码用于指示所述报文的类型。
在本发明实施例中，所述反压装置判断所述报文中指定报文的类型是否存在于本地报文特征表中之前，所述方法还包括：根据所述网络设备在网络中的位置，选择与所述位置对应的所述本地报文特征表。
在本发明实施例中，所述反压装置对所述报文中指定类型报文进行反压包括：所述反压装置对所述指定类型报文进行多级反压。
在本发明实施例中，所述反压装置包括：单元装置和单元装置组，其中，所述单元装置为对所述指定类型报文进行反压的最小单元，所述单元装置组由类型相同的所述单元装置组成；所述反压装置对所述指定类型报文进行多级反压包括：所述反压装置通过单元装置和单元装置组依次对所述指定类型报文进行逐级反压。
在本发明实施例中，所述特征码的粒度包括以下之一：端口、总线。
根据本发明的一个实施例，提供了一种网络设备，包括接口板和转发芯片，在所述接口板和所述转发芯片之间设置有反压装置：所述反压装置接收所述接口板发送的报文；所述反压装置对所述报文中指定类型报文进行反压；所述反压装置将经过反压后的报文发送给所述转发芯片。
根据本发明的另一个实施例，还提供了一种报文的发送处理装置，所述装置应用于反压装置，其中所述反压装置位于接口板和转发芯片之间，所述装置包括：接收模块，设置为接收所述接口板发送的报文；反压模块，设置为对所述报文中指定类型报文进行反压；发送模块，设置为将经过反压后的报文发送给所述转发芯片。
在本发明实施例中，所述反压模块包括：判断单元，设置为判断所述报文中指定报文的类型是否存在于本地报文特征表中；反压单元，设置为在判断结果为是的情况下，所述反压装置将流量大于预定阈值的所述指定报文作为所述指定类型报文，并对所述指定类型报文进行反压；在判断结果为否的情况下，所述反压装置将所述指定报文作为所述指定类型报文，并对所述指定类型报文进行反压。
通过本发明实施例，通过网络设备内位于接口板和转发芯片之间的反压装置接收接口板发送的报文；反压装置对报文中指定类型报文进行反压；反压装置将经过反压后的报文发送给转发芯片。解决了相关技术中由网络处理器对所有报文先进行分析再进行处理，导致报文转发效率低的问题，从而有效释放操作系统队列及调度资源，提升了数据转发效率。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的报文的发送处理方法的流程图；
图2是根据本发明实施例的网络设备的结构框图；
图3是根据本发明实施例的报文的发送处理装置的结构框图；
图4是根据本发明实施例的报文的发送处理装置的结构框图(1)；
图5是根据本发明实施例的反压装置在设备中位置示意图；
图6是根据本发明实施例的装置特征码运算示意图；
图7是根据本发明实施例的装置二级反压示意图；
图8是根据本发明实施例的装置与不同操作系统产品对接示意图；
图9是根据本发明实施例的反压与不同网络层设备联动对接示意图；
图10是根据本发明实施例的接口独立芯片反压装置实施例流程图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
在本实施例中提供了一种报文的发送处理方法，图1是根据本发明实施例的报文的发送处理方法的流程图，如图1所示，该流程包括如下步骤：
步骤S102，位于接口板和转发芯片之间的反压装置接收接口板发送的报文；
步骤S104，反压装置对报文中指定类型报文进行反压；
步骤S106，反压装置将经过反压后的报文发送给转发芯片。
通过上述步骤，位于接口板和转发芯片之间的反压装置对来自接口板的指定类型报文进行反压，并将经过反压后的报文发送给转发芯片，其中，反压装置是独立运行芯片，采用通用机器语言，可以为不同设备厂商、不同网络位置设备使用嫁接。相比于相关技术中，数据传输所有报文均由网络处理器先进行分析再进行处理，上述步骤通过芯片反压装置将需要网络处理器分析后处理的工作在底层完成，有效释放操作系统队列及调度资源，提升数据转发效率。
反压装置是对指定类型的报文进行转发，而对于其他类型的报文例如合法报文可以直接通过反压装置，而不对其进行反压处理。在一个可选实施例中，反压装置判断该报文中指定报文的类型是否存在于本地报文特征表中，在判断结果为是的情况下，并且该指定报文的流量大于预定阈值的情况下，反压装置对该指定报文进行反压。在另一个可选实施例中，在判断结果为否的情况下，反压装置将指定报文作为指定类型报文，并对指定类型报文进行反压。
在一个可选实施例中，本地报文特征表通过通用设备语言设定。
对于指定类型报文的判断，在一个可选实施例中，反压装置对报文中指定类型报文进行反压之前，首先为报文分配特征码，并将特征码携带于报文中，其中，特征码用于指示报文的类型。从而通过为报文分配特征码将报文进行了分类。
对于本地报文特征表的选取需要符合一定的规则，在一个可选实施例中，根据网络设备在网络中的位置，选择与位置对应的本地报文特征表。
上述步骤S104涉及到反压装置对报文中指定类型报文进行反压，需要说明的是，反压装置可以通过多种方式对报文进行反压，例如，反压装置对指定类型报文可以进行一级反压或者多级反压。
在一个可选实施例中，反压装置包括：单元装置和单元装置组，其中，单元装置为对指定类型报文进行反压的最小单元，单元装置组由类型相同的该单元装置组成；反压装置对指定类型报文进行多级反压包括：反压装置通过单元装置和单元装置组依次对指定类型报文进行逐级反压。例如，可以通过单元装置和单元装置组对指定类型的报文进行二级反压。
在一个可选实施例中，特征码的粒度包括端口或者总线。
在另一个实施例中提供了一种网络设备，图2是根据本发明实施例的网络设备的结构框图，如图2所示，该网络设备包括接口板22和转发芯片24，在接口板22和转发芯片24之间设置有反压装置26：反压装置26接收接口板22发送的报文；反压装置26对报文中指定类型报文进行反压；反压装置26将经过反压后的报文发送给转发芯片24。
在本实施例中还提供了一种报文的发送处理装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图3是根据本发明实施例的报文的发送处理装置的结构框图，如图3所示，该装置应用于反压装置，其中反压装置位于接口板和转发芯片之间，装置包括：接收模块32，设置为接收该接口板发送的报文；反压模块34，设置为对报文中指定类型报文进行反压；发送模块36，设置为将经过反压后的报文发送给转发芯片。
图4是根据本发明实施例的报文的发送处理装置的结构框图(1)，如图4所示，反压模块34包括：判断单元342，设置为判断该报文中指定报文的类型是否存在于本 地报文特征表中；反压单元344，设置为在判断结果为是的情况下，将流量大于预定阈值的该指定报文作为该指定类型报文，并对该指定类型报文进行反压；在判断结果为否的情况下，将指定报文作为该指定类型报文，并对该指定类型报文进行反压。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述各个模块均位于同一处理器中；或者，上述各个模块分别位于第一处理器、第二处理器和第三处理器…中。
本可选实施例的主要目的是提供一种芯片反压装置，装置介于接口板硬件和转发芯片之间，如图5所示，装置与接口板高速链路连接，对投递前的数据进行流量特征检查及反压，达到将保护措施与网络处理器资源分离的目的。独立芯片提供内置通用机器语言识别流量特征，为不同网络位置，不同操作系统的网络设备提供了通用性的安全解决方案。
为解决相关技术中存在的上述技术问题，本可选实施例提供了一种芯片装置的设计方法，该方法包括：
步骤A.特征码编码，图6是根据本发明实施例的装置特征码运算示意图，如图6所示，装置通过机器语言设定本地报文特征表，特征表对各种报文关键特征位置进行定义，并设定阙值，为特征码识别反压提供依据；
步骤B.特征码识别，如图6所示，装置通过查询本地报文特征表，进行报文特征码分类，识别报文特征，如二层数据链路层报文、三层网络层报文；
步骤C.特征码运算，如图6所示，装置对每一个进行分类识别的报文进行运算，对于单位时间内超出设定阙值的数据进行反压标记；
步骤D.特征码反压，图7是根据本发明实施例的装置二级反压示意图，如图7所示，装置对特征数据进行二级反压控制。第一级反压，通过单元装置进行反压。通过该级反压，可以使单元装置之间相互不影响；第二级反压，通过单元组进行反压。将多个单元标记为相同单元组，实现多单元以组为单位进行安全管理及反压。
可选地，上述方法还可具有以下特点：所述步骤A中，特征码编码采用通用设备语言，与网络设备操作系统分离，可独立运行。
可选地，上述方法还可具有以下特点：所述步骤A中，图8是根据本发明实施例的装置与不同操作系统产品对接示意图，该装置，如图8所示，可对接不同操作系统产品，不同设备厂商产品。
可选地，上述方法还可具有以下特点：所述步骤A中，图9是根据本发明实施例的反压与不同网络层设备联动对接示意图，该装置，如图9所示，可依据不同网络产品，网络产品处理性能设定不同初始值，与设备进行联动。
在本发明实施例中，上述方法还可具有以下特点：所述步骤B中，该装置对报文流进行的特征码识别可基于端口级，也可基于转发总线进行。
在本发明实施例中，上述方法还可具有以下特点：所述步骤B中，装置可以按照不同接口、线卡资源粒度进行安装；支持接口间、线卡间的联动。
在本发明实施例中，上述方法还可具有以下特点：所述步骤C中，按照流特征码以及特征信任度划分为不同的反压级别，可以将信息通过运算通道输出显示。
在本发明实施例中，上述方法还可具有以下特点：所述步骤D中，特征码反压可以使物理接口之间的特征流相互不影响，同一接口下不同的特征流之间相互不影响。
本可选实施例的装置是一种底层接口级芯片反压装置，装置介于接口板硬件和转发芯片之间，属于板卡级；装置不依赖网络设备操作系统平台，采用通用机器语言实现数据解析。图10是根据本发明实施例的接口独立芯片反压装置实施例流程图，如图10所示，本可选实施例的接口独立芯片反压装置实施例流程图，该方法需要进行以下步骤：
步骤S1002：装置通过机器语言设定本地报文特征表，特征表对各种报文关键特征位置进行定义，并设定阙值，为特征码识别反压提供依据。默认初始化将特征表归为三类；第一类，为三层分发表：根据传输层的特征信息识别；第二类，为二层分发表；根据链路层特征信息识别；第三类，为异常分发表：除了传输层和链路层的报文外的数据都需要做异常分类的特殊处理。如果编译通过，执行步骤S1004；
步骤S1004：根据配套设备网络放置位置，启用对应特征表开关，并部署独立芯片反压装置。装置部署在网络设备接口板与转发微码间，衔接底层转发通道，如果成功，执行步骤S1006；
步骤S1006：装置通过查询本地报文特征表，根据步骤S1004中启用的特征码分类，将不同类型特征数据打上不同特征码，进行特征分类。如果分类成功，执行步骤S1008，如果分类不成功，执行步骤S1010；
步骤S1008：装置对进行特征识别的报文进行运算，对于单位时间内超出设定阙值的特征数据，使能反压标记；同时，根据运算通道输出结果，判断是否要对初始设 定进行调整，如需调整，返回步骤S1002，重新进行设定；如果不需要进行调整，执行步骤S1012；
步骤S1010：对于特征数据分类如果不成功，特征数据将归入异常分发表，异常分发表数据直接使能反压标记，执行步骤S1012；
步骤S1012：装置对报文进行二级反压控制。反压需要进行死循环检测，死锁检测；反压采用智能分时机制进行，多通道同时工作。
第一级反压，通过单元装置进行反压。如果某个单元装置的特征数据超标，步骤S1008会将该单元装置携带流量使能反压标记，装置对流量进行进一步处理，实施对于标记单元的流控反压。
第二级反压，通过单元装置组进行反压。将多个单元标记为相同单元组，将各种单元装置反压结果进行组累加，并以此为粒度，与单元组预设值进行比较，实施对于标记单元组的流控反压。流程结束。
与通过网络处理器进行业务控制的技术相比,本发明介绍的通过接口独立芯片实现反压的技术具有更加灵活的预定义、更加灵活的部署方式等特点。
如图6所示，每个反压芯片，一共有16各高速链路反压链路，其中在本发明中共引出12条高速反压链路。每张特征表对应特征反压表计算，每张特征反压表采用16x16的特征表编码。每片反压芯片支持16对高速串行链路技术，当与多总线对接时，可实现1+1负荷分担，每对串行链路速率高达百G。
如图8，图9所示，独立芯片反压装置支持动态创建不同特征表。基于网络设备位置对业务流量类型进行特征标记，并且可以对特征流进行细分。以边界网关协议(Border Gateway Protocol，简称为BGP)协议为例，可以细分为bgp-default、bgp-cfg-peer、bgp-known三种sub-type。其中：
bgp-default是缺省情况下的类型，为其分配的优先级最低，例如BGP的179端口侦听条目。
bgp-cfg-peer是配置生成表项，还没有建立邻居的信任关系，分配的优先级稍高，例如BGP配置了neighbor后，通过发起connect生成的表项。
bgp-known是已建立邻居信任关系，分配优先级最高。从BGP邻居的配置到建立成功，该邻居对应的报文优先级会动态的从最低升至最高。
对于位于核心层、接入层部署的设备，反压装置会将此受信任的信息同步到特征表中，特征表可以保护已有业务在攻击发生时的正常运行。后续匹配特征表协议的报文会被采用预先设置的反压策略进行流量控制，由此保证了此邻居相关业务的运行可靠性、稳定性。
而对于位于汇聚层的设备，反压装置会将此信息从特征表中删除，BGP报文对应的特征表将无法创建。在此条件下，网络设备收到的任何BGP报文，因为无法匹配特征表被放入异常分发表，进行反压处理。
独立芯片反压装置通过特征表特性保护设备的应用层数据、网络层数据，将确定为正常使用的合法数据或者是高优先级数据做合理特征表及初始值定义，没有匹配特征表的报文会被放入异常分发表进行反压处理。
如图8，图9所示，独立芯片反压装置根据不同网络位置设备进行特征表联动，动态反压控制。特征表联动是通过将特征表库文件与网络设备位置选用开关关联起来，对于不同网络设备中的反压装置启动不同的选用开关，没有开启的特征表项，装置默认以异常特征表方式处理，这样就将不同位置攻击者的攻击范围尽可能缩小，增加了攻击的成本，减少了设备的安全风险。
如图10所示，独立芯片的反压装置支持全方位、多层次的流控反压功能。仅以流量特征反压行为为例，可以基于单元芯片、单元芯片组的两级反压策略、并且反压特征码可以根据网络设备位置灵活定义配置。
独立芯片反压装置作为一种多维度、细分、可控的技术保护手段，能有效的提高不同位置网络设备，不同平台网络设备的抗攻击、防冲击的能力，增强设备的稳定性，提升设备持续工作时间，提高运营商的服务质量。
综上所示，本发明通过是一种底层接口级芯片反压装置，芯片介于接口板硬件和转发芯片之间的一层，属于板卡级，主要目的用于保护网络设备操作系统。芯片反压装置将需要网络处理器分析后处理的工作在底层完成，有效释放操作系统队列及调度资源，提升数据转发效率，并且装置采用通用设备语言，可独立编码嫁接在不同的网络设备中，可兼容多厂商设备。芯片装置不依赖网络设备操作系统平台，采用通用机器语言实现数据解析，兼容不同操作系统平台。
在另外一个实施例中，还提供了一种软件，该软件用于执行上述实施例及优选实施方式中描述的技术方案。
在另外一个实施例中，还提供了一种存储介质，该存储介质中存储有上述软件，该存储介质包括但不限于：光盘、软盘、硬盘、可擦写存储器等。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
本发明实施例上述提供的技术方案，可以应用于报文的发送处理过程中，通过网络设备内位于接口板和转发芯片之间的反压装置接收接口板发送的报文；反压装置对报文中指定类型报文进行反压；反压装置将经过反压后的报文发送给转发芯片。解决了相关技术中由网络处理器对所有报文先进行分析再进行处理，导致报文转发效率低的问题，从而有效释放操作系统队列及调度资源，提升了数据转发效率。

Claims (11)

  1. 一种报文的发送处理方法，该方法通过网络设备内位于接口板和转发芯片之间的反压装置实现，所述方法包括：
    所述反压装置接收所述接口板发送的报文；
    所述反压装置对所述报文中指定类型报文进行反压；
    所述反压装置将经过反压后的报文发送给所述转发芯片。
  2. 根据权利要求1所述的方法，其中，所述反压装置对所述报文中指定类型报文进行反压包括：
    所述反压装置判断所述报文中指定报文的类型是否存在于本地报文特征表中；
    在判断结果为是的情况下，所述反压装置将流量大于预定阈值的所述指定报文作为所述指定类型报文，并对所述指定类型报文进行反压；
    在判断结果为否的情况下，所述反压装置将所述指定报文作为所述指定类型报文，并对所述指定类型报文进行反压。
  3. 根据权利要求2所述的方法，其中，所述本地报文特征表通过通用设备语言设定。
  4. 根据权利要求2所述的方法，其中，所述反压装置对所述报文中指定类型报文进行反压之前包括：
    为所述报文分配特征码，并将所述特征码携带于所述报文中，其中，所述特征码用于指示所述报文的类型。
  5. 根据权利要求2所述的方法，其中，所述反压装置判断所述报文中指定报文的类型是否存在于本地报文特征表中之前，所述方法还包括：
    根据所述网络设备在网络中的位置，选择与所述位置对应的所述本地报文特征表。
  6. 根据权利要求1所述的方法，其中，所述反压装置对所述报文中指定类型报文进行反压包括：
    所述反压装置对所述指定类型报文进行多级反压。
  7. 根据权利要求6所述的方法，其中，所述反压装置包括：单元装置和单元装置组，其中，所述单元装置为对所述指定类型报文进行反压的最小单元，所述单元装置组由类型相同的所述单元装置组成；所述反压装置对所述指定类型报文进行多级反压包括：
    所述反压装置通过单元装置和单元装置组依次对所述指定类型报文进行逐级反压。
  8. 根据权利要求4所述的方法，其中，所述特征码的粒度包括以下之一：
    端口、总线。
  9. 一种网络设备，包括接口板和转发芯片，在所述接口板和所述转发芯片之间设置有反压装置：
    所述反压装置接收所述接口板发送的报文；
    所述反压装置对所述报文中指定类型报文进行反压；
    所述反压装置将经过反压后的报文发送给所述转发芯片。
  10. 一种报文的发送处理装置，所述装置应用于反压装置，其中所述反压装置位于接口板和转发芯片之间，所述装置包括：
    接收模块，设置为接收所述接口板发送的报文；
    反压模块，设置为对所述报文中指定类型报文进行反压；
    发送模块，设置为将经过反压后的报文发送给所述转发芯片。
  11. 根据权利要求10所述的装置，其中，所述反压模块包括：
    判断单元，设置为判断所述报文中指定报文的类型是否存在于本地报文特征表中；
    反压单元，设置为在判断结果为是的情况下，将流量大于预定阈值的所述指定报文作为所述指定类型报文，并对所述指定类型报文进行反压；在判断结果为否的情况下，将所述指定报文作为所述指定类型报文，并对所述指定类型报文进行反压。
PCT/CN2015/080063 2014-12-19 2015-05-28 报文的发送处理方法、装置及一种网络设备 WO2016095440A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410802409.5 2014-12-19
CN201410802409.5A CN105791140A (zh) 2014-12-19 2014-12-19 报文的发送处理方法、装置及一种网络设备

Publications (1)

Publication Number Publication Date
WO2016095440A1 true WO2016095440A1 (zh) 2016-06-23

Family

ID=56125779

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/080063 WO2016095440A1 (zh) 2014-12-19 2015-05-28 报文的发送处理方法、装置及一种网络设备

Country Status (2)

Country Link
CN (1) CN105791140A (zh)
WO (1) WO2016095440A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112398911A (zh) * 2020-10-22 2021-02-23 成都中讯创新科技股份有限公司 一种基于fc网络的多通道网络调度方法

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106302242B (zh) * 2016-09-28 2019-05-17 南京中新赛克科技有限责任公司 一种基于fpga实现报文处理系统及方法
CN107770090B (zh) * 2017-10-20 2020-05-01 深圳市楠菲微电子有限公司 用于控制流水线中寄存器的方法和装置
CN111526097B (zh) * 2020-07-03 2020-10-30 新华三半导体技术有限公司 一种报文调度方法、装置及网络芯片
CN114124839B (zh) * 2021-09-07 2023-06-06 中国联合网络通信集团有限公司 接口板和数据处理方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101257456A (zh) * 2008-03-31 2008-09-03 华为技术有限公司 提高压缩报文转发性能的方法及装置
CN103701710A (zh) * 2013-12-20 2014-04-02 杭州华为数字技术有限公司 一种数据传输方法、核心转发设备以及端点转发设备
US8885480B2 (en) * 2011-10-20 2014-11-11 Cavium, Inc. Packet priority in a network processor

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1297098C (zh) * 2003-05-09 2007-01-24 华为技术有限公司 一种系统流量控制方法
CN101022414B (zh) * 2007-03-08 2010-11-03 华为技术有限公司 一种报文转发的方法和装置
CN100581140C (zh) * 2007-10-10 2010-01-13 杭州华三通信技术有限公司 实现转发能力动态检测的方法和装置
US8130649B2 (en) * 2007-10-18 2012-03-06 Alcatel Lucent Ingress traffic flow control in a data communications system
CN102025617B (zh) * 2010-11-26 2015-04-01 中兴通讯股份有限公司 以太网拥塞控制方法及装置
CN103763204B (zh) * 2013-12-31 2017-03-08 华为技术有限公司 一种流量控制方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101257456A (zh) * 2008-03-31 2008-09-03 华为技术有限公司 提高压缩报文转发性能的方法及装置
US8885480B2 (en) * 2011-10-20 2014-11-11 Cavium, Inc. Packet priority in a network processor
CN103701710A (zh) * 2013-12-20 2014-04-02 杭州华为数字技术有限公司 一种数据传输方法、核心转发设备以及端点转发设备

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112398911A (zh) * 2020-10-22 2021-02-23 成都中讯创新科技股份有限公司 一种基于fc网络的多通道网络调度方法
CN112398911B (zh) * 2020-10-22 2022-07-15 成都中讯创新科技股份有限公司 一种基于fc网络的多通道网络调度方法

Also Published As

Publication number Publication date
CN105791140A (zh) 2016-07-20

Similar Documents

Publication Publication Date Title
WO2016095440A1 (zh) 报文的发送处理方法、装置及一种网络设备
US8782787B2 (en) Distributed packet flow inspection and processing
CN1943210B (zh) 基于源/目的地操作系统类型的ids虚拟化
US10187422B2 (en) Mitigation of computer network attacks
KR101812403B1 (ko) SDN에서의 DoS공격 방어시스템 및 이의 구현방법
US20060191008A1 (en) Apparatus and method for accelerating intrusion detection and prevention systems using pre-filtering
US8060927B2 (en) Security state aware firewall
AU2015331596A1 (en) Systems and methods for threat analysis of computer data
JP5305045B2 (ja) スイッチングハブ及び検疫ネットワークシステム
CA2887428C (en) A computer implemented system and method for secure path selection using network rating
WO2008131667A1 (fr) Procédé, dispositif d'identification des flux de services et procédé, système de protection contre une attaque par déni de service
US20090240804A1 (en) Method and apparatus for preventing igmp packet attack
WO2016127555A1 (zh) 控制应用程序权限的方法及控制器
US10313238B2 (en) Communication system, communication method, and non-transitiory computer readable medium storing program
Abaid et al. MalwareMonitor: An SDN-based framework for securing large networks
EP2321934B1 (en) System and device for distributed packet flow inspection and processing
CN104067558A (zh) 具有控制模块和网络访问模块的网络访问装置
CN117376032B (zh) 安全服务调度方法和系统、电子设备、存储介质
CN104601578B (zh) 一种攻击报文识别方法、装置及核心设备
CN107210969B (zh) 一种基于软件定义网络的数据处理方法及相关设备
CN106027405B (zh) 数据流的分流方法及装置
US20100157806A1 (en) Method for processing data packet load balancing and network equipment thereof
EP3672184B1 (en) System and detecting and defending method for edge network
WO2023273843A1 (zh) 安全防御方法、装置、设备及存储介质
US10812505B2 (en) System and detecting and defending method for edge network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15868952

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15868952

Country of ref document: EP

Kind code of ref document: A1