WO2017063578A1

WO2017063578A1 - Data packet processing method and apparatus

Info

Publication number: WO2017063578A1
Application number: PCT/CN2016/102045
Authority: WO
Inventors: 龙裕
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-10-15
Filing date: 2016-10-13
Publication date: 2017-04-20
Also published as: CN106603468A

Abstract

Disclosed are a data packet processing method and apparatus. The method comprises: configuring an aging-skipping function for a dynamic media control access (MAC) entry of a pre-determined port, the aging-skipping function is skipping aging processing for the MAC entry; and processing a data packet according to the configuration of the port. In this way, the problem in the related art that a MAC learning function cannot restrict user access after a MAC entry of a specified port ages is resolved, and the user access after the MAC entry ages is effectively restricted.

Description

Data message processing method and device

Technical field

The present invention relates to the field of communications, and in particular to a data packet processing method and apparatus.

Background technique

With the popularity of broadband networks, operators are also providing services to users while also preventing malicious users from attacking the system and illegal users accessing the network, resulting in system security problems or loss of operating revenue.

Currently, access devices or switching devices have developed a number of port security/user security technologies, such as MAC (Media Access Control or Medium Access Control) addresses, translated into media access control, or called physical addresses, hardware addresses, and bindings. (MAC whitelist/blacklist), IP binding (IP whitelist/blacklist), MAC learning restriction, TCP connection limit, etc.

These technologies have different characteristics, as follows:

MAC binding/IP binding needs to design a special binding table. After the service receives a specific port data stream and obtains the MAC/IP address used by the port, it sets its MAC/IP address to the relevant binding table, and Prevents subsequent data forwarding of MAC/IP addresses in (whitelisted) or not (blacklisted) binding tables.

The MAC learning restriction function can be based on a port or a VLAN. After the number of MAC entries learned from a specified port or VLAN reaches a limit, the new MAC address is no longer learned, and the data stream containing the new source MAC address is discarded.

The TCP connection limit technology analyzes the number of TCP connections established by the user. After the number of connections is reached, the new connection data packet is discarded.

Some of the above mentioned technologies require more resources to implement and may reduce system performance, such as MAC/IP binding technology; some require upper layer protocols to participate more, such as MAC/IP binding technology and TCP connection limit technology; After the learning limit function is enabled, a malicious user, an illegal user, or a new device of the user can access the MAC address entry of a specific port.

For the problem that the MAC learning function in the related art cannot limit the access of the user after the MAC entry of the specific port is aged, an effective solution has not been proposed.

Summary of the invention

The embodiment of the invention provides a data forwarding method and device, which can solve at least the problem that the MAC learning function in the related art cannot restrict user access after the MAC address entry of a specific port is aged.

According to an aspect of the embodiments of the present invention, a data packet processing method is provided, including: configuring a non-aging function for a dynamic media access control MAC entry of a predetermined port, where the non-aging function is to the MAC table. The item is not aged. The data packet is processed according to the configuration of the port.

Further, processing the data packet according to the configuration of the port includes: learning the source MAC address of the data packet according to the configuration of the port;

If the MAC address entry corresponding to the source MAC address is learned, the data packet is forwarded; or the data packet is discarded if the MAC address entry corresponding to the source MAC address is not learned.

Further, before learning the MAC address of the data packet according to the configuration of the port, the method further includes: configuring the number of MAC entry entries allowed to learn for the dynamic MAC address of the predetermined port.

Further, the learning of the MAC address of the data packet according to the configuration of the port includes: determining, if the number of learned MAC entry entries is less than the number of MAC entry entries allowed to learn, determining whether the learned MAC entry is If the result of the determination is negative, it is determined that the MAC entry corresponding to the source MAC address is learned; if the determination result is yes, the data packet is directly forwarded; the number of MAC entry entries learned is learned. If the number of MAC entry entries that are allowed to learn is greater than that, the MAC entry corresponding to the source MAC address is not learned.

Further, configuring the non-aging function for the dynamic MAC entry of the predetermined port by: retaining all bit positions 1 of the MAC entry aging time field; and/or The no aging field is set to 1.

According to another aspect of the present invention, a data packet processing apparatus is provided, including: a configuration module, configured to configure a non-aging function for a dynamic media access control MAC entry of a predetermined port, where the non-aging function The function is that the MAC entry is not aged; the processing module is configured to process the data packet according to the configuration of the port.

Further, the processing module includes: a learning unit configured to learn the source MAC address of the data packet according to the configuration of the port; and the forwarding unit is configured to forward the MAC address entry corresponding to the source MAC address. And the data packet; or the discarding unit is configured to discard the data packet if the MAC entry corresponding to the source MAC address is not learned.

Further, the apparatus further includes: a first configuration unit configured to configure a number of MAC entry entries allowed to learn for the dynamic MAC address of the predetermined port.

Further, the learning unit includes: a determining subunit, configured to determine whether the learned MAC entry already exists if the number of learned MAC entry entries is less than the number of MAC entry entries allowed to learn, If the judgment result is negative, it is determined that the MAC entry corresponding to the source MAC address is learned; if the judgment result is yes, the data packet is directly forwarded; the subunit is determined, and the MAC address is set to be learned. If the number of entry entries is greater than the number of MAC entry entries allowed to learn, it is determined that the MAC entry corresponding to the source MAC address is not learned.

Further, the apparatus further includes: a second configuration unit, configured to configure, by using the following manner, the non-aging function for the dynamic MAC entry of the predetermined port, including: retaining all bit positions 1 of the MAC entry aging time field; and/or, Set the dynamic non-aging field to 1.

According to still another embodiment of the present invention, a storage medium is also provided. The storage medium is arranged to store program code for performing the following steps:

The dynamic media access control MAC address entry of the predetermined port is configured to perform the non-aging function, wherein the non-aging function does not perform aging processing on the MAC entry; and processes the data packet according to the configuration of the port.

According to the embodiment of the present invention, the dynamic media access control MAC entry for the predetermined port is configured to not perform the aging function, wherein the non-aging function does not perform aging processing on the MAC entry; and the data packet is configured according to the configuration of the port. The problem is that the MAC learning function in the related art cannot limit the access of the user after the aging of the MAC address entry of the specific port, which effectively limits the access of the user after the MAC entry is aged.

DRAWINGS

The drawings are intended to provide a further understanding of the embodiments of the present invention, and are intended to be a part of the present invention, and the description of the present invention is not intended to limit the invention. In the drawing:

1 is a flowchart of a data packet processing method according to an embodiment of the present invention;

2 is a block diagram of a data message processing apparatus according to an embodiment of the present invention;

3 is a block diagram 1 of a data message processing apparatus in accordance with a preferred embodiment of the present invention;

4 is a block diagram 2 of a data message processing apparatus in accordance with a preferred embodiment of the present invention;

Figure 5 is a block diagram 3 of a data message processing apparatus in accordance with a preferred embodiment of the present invention;

6 is a block diagram 4 of a data message processing apparatus in accordance with a preferred embodiment of the present invention;

7 is a flowchart of processing a data message message by a MAC entry processing module according to an embodiment of the present invention;

FIG. 8 is a flowchart of aging of a MAC entry according to an embodiment of the present invention;

FIG. 9 is a schematic diagram showing the result of a data message processing apparatus according to an embodiment of the present invention.

detailed description

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

The embodiment of the present invention provides a data packet processing method. FIG. 1 is a flowchart of a data packet processing method according to an embodiment of the present invention.

Step S102: Configure a non-aging function for the dynamic media access control MAC address entry of the predetermined port, where the non-aging function does not perform aging processing on the MAC entry.

Step S104, processing the data packet according to the configuration of the port.

Through the above steps, the dynamic media access control MAC address entry of the predetermined port is not aged; the data packet is processed according to the configuration of the port, and the MAC learning function in the related art cannot limit the user after the MAC address entry of the specific port is aged. The access problem effectively limits the access of users after the MAC entry is aged.

Further, the processing of the data packet according to the configuration of the port may include: learning the source MAC address of the data packet according to the configuration of the port; and forwarding the datagram if the MAC entry corresponding to the source MAC address is learned. Or, if the MAC entry corresponding to the source MAC address is not learned, the data packet is discarded.

Further, before learning the MAC address of the data packet according to the configuration of the port, the number of MAC entry entries allowed for learning is configured for the dynamic MAC address of the predetermined port, and is prepared for learning the MAC address.

Further, the learning of the MAC address of the data packet according to the configuration of the port may include: determining, if the number of learned MAC entry entries is less than the number of MAC entry entries allowed to learn, determining whether the learned MAC entry is If the result of the determination is negative, it is determined that the MAC entry corresponding to the source MAC address is learned; if the judgment result is yes, the data packet is directly forwarded; the number of learned MAC entry entries is greater than In the case where the number of MAC entry entries allowed to be learned is determined, it is determined that the MAC entry corresponding to the source MAC address is not learned.

Further, configuring the non-aging function for the dynamic MAC entry of the predetermined port by: retaining all bit positions 1 of the MAC entry aging time field; and/or setting the dynamic non-aging field to 1.

The embodiment of the present invention further provides a data packet processing apparatus. FIG. 2 is a block diagram of a data packet processing apparatus according to an embodiment of the present invention. As shown in FIG. 2, the method includes:

The configuration module 22 is configured to configure a dynamic media access control MAC entry for the predetermined port. The aging function does not perform aging processing on MAC entries.

The processing module 24 is configured to process the data packet according to the configuration of the port.

FIG. 3 is a block diagram of a data message processing apparatus according to a preferred embodiment of the present invention. As shown in FIG. 3, the processing module 24 includes:

The learning unit 32 is configured to learn the source MAC address of the data packet according to the configuration of the port;

The forwarding unit 34 is configured to forward the data packet if the MAC entry corresponding to the source MAC address is learned; or

The discarding unit 36 is configured to discard the data packet if the MAC entry corresponding to the source MAC address is not learned.

4 is a block diagram 2 of a data message processing apparatus according to a preferred embodiment of the present invention. As shown in FIG. 4, the apparatus further includes:

The first configuration unit 42 is configured to configure the number of MAC entry entries allowed to learn for the dynamic MAC address of the predetermined port.

FIG. 5 is a block diagram 3 of a data message processing apparatus according to a preferred embodiment of the present invention. As shown in FIG. 5, the learning unit 32 includes:

The determining sub-unit 52 is configured to determine whether the learned MAC entry already exists if the number of learned MAC entry entries is less than the number of learned MAC entry entries, and if the determination result is negative, Determining to learn the MAC entry corresponding to the source MAC address; if the judgment result is yes, directly forwarding the data packet;

The determining sub-unit 54 is configured to determine that the MAC entry corresponding to the source MAC address is not learned if the number of learned MAC entry entries is greater than the number of learned MAC entry entries.

FIG. 6 is a block diagram 4 of a data message processing apparatus according to a preferred embodiment of the present invention. As shown in FIG. 6, the apparatus further includes:

The second configuration unit 62 is configured to be a dynamic MAC entry of the predetermined port by the following manner The configuration of the non-aging function includes: retaining all bit positions 1 of the MAC entry aging time field; and/or setting the dynamic non-aging field to 1.

The embodiments of the present invention are further described below in conjunction with specific embodiments.

On the basis of the existing MAC learning restriction technology, the MAC entry that is learned by a specific port does not age, so that the user can no longer add or replace it after determining that it wants to connect to the access network device. Its equipment, thus achieving system security. It only involves the Layer 2 processing of the data stream, and does not require the upper layer protocol processing. The related implementation hardly increases the system resource consumption and does not reduce the system processing performance.

First, the user port attribute table is set, wherein the user attribute table describes various attributes of the user port, and a dynamic MAC address non-aging function switch field is added to the attribute table. The MAC address table is used as the basis for data packet exchange. The maximum value of the dynamic aging time field or the aging time field is added to the table. The aging time maximum value indicates that the entry is not aged. This value is not used for general purposes. ). The MAC entry processing module, the MAC entry restriction function module, and the MAC address entry aging module can work together to complete MAC address entry processing, MAC entry restriction, and aging. The specific limitation of the user access of the present invention includes: configuring a dynamic MAC address non-aging function switch of a specific user port, and the number of MAC entry entries that the port is allowed to learn. After the data packet message arrives at the MAC address entry processing module, the MAC processing module determines whether to learn the MAC address of the packet according to the port configuration, and whether the MAC entry is dynamically aged or not, and forwards or discards the data packet according to the result. When the MAC address entry aging module polls the MAC entry, it determines whether the MAC entry is aged according to the aging time field of the MAC entry and/or the dynamic aging field.

Compared with the prior art, the upper layer protocol processing is not required, and only two simple configurations are required. When the system resources are hardly increased, and the system processing performance is not lowered, the user is determined to be determined by the user. After connecting the devices connected to the network, you can no longer add or replace devices at any time to achieve system security.

FIG. 7 is a flowchart of processing a data packet message by a MAC entry processing module according to an embodiment of the present invention. As shown in FIG. 7, a MAC entry is added by adding one 1-bit bit. The switch field, the other implementation method includes the maximum value of the aging time field. The value indicates that the entry is a dynamic unaged MAC entry, and the dynamic MAC address does not age the function switch of the specific user port, and the port allows learning. The number of MAC entry entries. The method for processing data packet messages includes the following steps:

Step S702, after the data packet enters the MAC entry processing module, it is determined whether the MAC address entry corresponding to the source MAC address of the packet exists, if yes, step S704 is performed, otherwise step S706 is performed;

Step S704: If the MAC entry is a static MAC entry, the entry is not operated, and the packet is forwarded. If the MAC entry is a dynamic MAC address entry, the aging time of the entry is updated, and the packet is forwarded.

Step S706, it is determined whether the number of MAC entries learned by the packet entry port has reached the limit value, if yes, step S708 is performed, otherwise step S710 is performed;

Step S708, discarding the message.

In step S710, it is determined whether the dynamic non-aging switch of the packet entering the port is opened, if yes, step S712 is performed; otherwise, step S714 is performed;

Step S712, learning the MAC entry, and setting the dynamic non-aging field in the MAC entry to 1, and proceeding to step S716;

Step S714, learning the MAC entry, and setting the dynamic non-aging field in the MAC entry to 0, and then proceeding to step S716;

In step S716, the number of MAC entries learned by the port is increased by 1, and the packet is forwarded.

FIG. 8 is a flowchart of aging of a MAC entry according to an embodiment of the present invention. As shown in FIG. 8 , if the MAC address entry that is polled is a dynamic entry, and the dynamic non-aging field of the entry is 1, no deal with. The other processing flow is consistent with the original process of the MAC entry. Includes the following steps:

In step S802, it is determined whether the MAC entry is a dynamic entry, if the determination result is yes, step S804 is performed, and if the determination result is negative, step S808 is performed;

Step S804, determining whether the dynamic non-aging field of the MAC entry is 1, and the result of the determination is If yes, go to step S808, and if the result of the determination is no, go to step S806;

Step S808, accessing the next MAC entry.

The aging time field described in the embodiment of the present invention is a plurality of bits, and can express a relatively fine aging time. A part of the access device or the switching device may also use only one bit for indicating aging. If the secondary aging mechanism needs to apply the technique of the present invention, the 1-bit dynamic non-aging switch field must be added.

Embodiments of the present invention also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

In the step S1, the dynamic media access control MAC address entry of the predetermined port is not aged, and the non-aging function does not perform aging processing on the MAC entry.

In step S2, the data packet is processed according to the configuration of the port.

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

FIG. 9 is a schematic diagram showing the result of a data packet processing apparatus according to an embodiment of the present invention. As shown in FIG. 9, the data packet processing apparatus may be an access device or a switching device, and the data packet processing apparatus includes a memory 92 and processing. The memory 92 is configured to store an instruction, and the processor 94 executes the instruction, so that the dynamic media access control MAC entry configuration of the predetermined port of the data packet processing device is not aged, wherein the non-aging function is a pair of MAC addresses. The entry is not processed by the aging process; the processor 94 is further configured to process the data packet according to the configuration of the port.

In the embodiment of the present invention, the processor 94 is further configured to: learn the source MAC address of the data packet according to the configuration of the port; and, in the case of learning the MAC entry corresponding to the source MAC address, forward the The data packet is discarded; or the data packet is discarded if the MAC entry corresponding to the source MAC address is not learned.

In the embodiment of the present invention, the processor 94 is further configured to configure the number of MAC entry entries allowed to learn for the dynamic MAC address of the predetermined port.

In the embodiment of the present invention, optionally, the processor 94 is further configured to learn, according to the configuration of the port, the MAC address of the data packet, where the number of learned MAC entry entries is smaller than the MAC table that is allowed to learn. In the case of the number of item entries, it is determined whether the learned MAC entry already exists. If the result of the determination is negative, it is determined to learn the MAC entry corresponding to the source MAC address; if the determination result is yes, the direct forwarding is performed. The data packet is determined to have not learned the MAC entry corresponding to the source MAC address if the number of learned MAC entry entries is greater than the number of MAC entry entries allowed to learn.

In the embodiment of the present invention, optionally, the processor 94 is further configured to: configure the non-aging function for the dynamic MAC entry of the predetermined port by: retaining all bit positions 1 of the MAC entry aging time field; and Or, set the dynamic non-aging field to 1.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

The embodiment of the present invention is applicable to the communication field, and solves the problem that the MAC learning function in the related art cannot limit the access of the user after the aging of the MAC address entry of the specific port, and effectively limits the access of the user after the MAC entry is aged.

Claims

A data packet processing method includes:

Configuring a non-aging function for the dynamic media access control MAC address entry of the predetermined port, where the non-aging function does not perform aging processing on the MAC entry;

Data packets are processed according to the configuration of the port.
The method of claim 1, wherein processing the data message according to the configuration of the port comprises:

Learning the source MAC address of the data packet according to the configuration of the port;

If the MAC address entry corresponding to the source MAC address is learned, the data packet is forwarded; or

If the MAC entry corresponding to the source MAC address is not learned, the data packet is discarded.
The method of claim 2, wherein before the learning of the MAC address of the data packet according to the configuration of the port, the method further comprises:

Configure the number of MAC entry entries allowed to learn for the dynamic MAC address of the predetermined port.
The method of claim 3, wherein learning the MAC address of the data packet according to the configuration of the port comprises:

If the number of learned MAC entry entries is smaller than the number of MAC entry entries allowed to learn, it is determined whether the learned MAC entry already exists, and if the determination result is negative, it is determined to learn the source MAC address. The MAC entry corresponding to the address; if the judgment result is yes, the data packet is directly forwarded;

If the number of learned MAC entry entries is greater than the number of MAC entry entries allowed to learn, it is determined that the MAC entry corresponding to the source MAC address is not learned.
The method according to any one of claims 1 to 4, wherein configuring the non-aging function for the dynamic MAC entry of the predetermined port by:

All bit positions 1 of the MAC entry aging time field are reserved; and/or,

Set the dynamic non-aging field to 1.
A data message processing apparatus includes:

The configuration module is configured to configure a non-aging function for the dynamic media access control MAC address entry of the predetermined port, where the non-aging function does not perform aging processing on the MAC entry.

The processing module is configured to process data packets according to the configuration of the port.
The apparatus of claim 6 wherein said processing module comprises:

The learning unit is configured to learn the source MAC address of the data packet according to the configuration of the port;

The forwarding unit is configured to forward the data packet when the MAC entry corresponding to the source MAC address is learned; or

The discarding unit is configured to discard the data packet if the MAC entry corresponding to the source MAC address is not learned.
The apparatus of claim 7 wherein said apparatus further comprises:

The first configuration unit is configured to configure the number of MAC entry entries allowed to learn for the dynamic MAC address of the predetermined port.
The apparatus of claim 8 wherein said learning unit comprises:

Judging the subunit, setting the number of MAC entry entries learned to be less than the allowable If the number of MAC entry entries is learned, it is determined whether the learned MAC entry already exists. If the result of the determination is negative, it is determined to learn the MAC entry corresponding to the source MAC address; In case, the data packet is directly forwarded;

The determining sub-unit is configured to determine that the MAC entry corresponding to the source MAC address is not learned if the number of learned MAC entry entries is greater than the number of learned MAC entry entries.
The device according to any one of claims 6 to 9, wherein the device further comprises:

The second configuration unit is configured to configure the non-aging function for the dynamic MAC entry of the predetermined port by: retaining all bit positions 1 of the MAC entry aging time field; and/or setting the dynamic non-aging field to 1.