WO2017097026A1 - 数据报文的识别处理方法及装置、存储介质 - Google Patents

数据报文的识别处理方法及装置、存储介质 Download PDF

Info

Publication number
WO2017097026A1
WO2017097026A1 PCT/CN2016/101455 CN2016101455W WO2017097026A1 WO 2017097026 A1 WO2017097026 A1 WO 2017097026A1 CN 2016101455 W CN2016101455 W CN 2016101455W WO 2017097026 A1 WO2017097026 A1 WO 2017097026A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
matching
compared
offset value
stored
Prior art date
Application number
PCT/CN2016/101455
Other languages
English (en)
French (fr)
Inventor
傅斌
Original Assignee
深圳市中兴微电子技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市中兴微电子技术有限公司 filed Critical 深圳市中兴微电子技术有限公司
Publication of WO2017097026A1 publication Critical patent/WO2017097026A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/04—Processing captured monitoring data, e.g. for logfile generation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04Q—SELECTING
    • H04Q11/00—Selecting arrangements for multiplex systems
    • H04Q11/0001—Selecting arrangements for multiplex systems using optical switching
    • H04Q11/0062—Network aspects
    • H04Q11/0067—Provisions for optical access or distribution networks, e.g. Gigabit Ethernet Passive Optical Network (GE-PON), ATM-based Passive Optical Network (A-PON), PON-Ring

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a data packet identification processing method and apparatus, and a storage medium.
  • GPON Gigabit-capable Passive Optical Networks
  • ONU network terminal equipment--Optical Network Unit
  • the detection and processing of the Ethernet packets of the chip is a very important part. It is necessary to identify various kinds of messages in the network, and different processing methods for different messages.
  • TCAM Ternary Content Addressable Memory
  • the embodiment of the present invention is to provide a method and a device for identifying and processing data packets, and a storage medium, to flexibly identify and process data packets, and improve processing performance.
  • a first aspect of the embodiments of the present invention provides a data packet identification processing method, where the method includes:
  • the protocol code of the data message is identified.
  • the data to be compared is extracted from the received data packet according to the pre-stored extraction offset value and the mask, including:
  • the data to be compared and the matching data are matched according to a pre-stored matching mode, including:
  • the matching mode When the matching mode is greater than the matching data, compare the size of the data to be compared with the matching data, and when the data to be compared is greater than the matching data, the processing result is a match;
  • the matching mode When the matching mode is smaller than the matching data, compare the size of the data to be compared with the matching data, and when the data to be compared is smaller than the matching data, the processing result is a match;
  • the matching mode When the matching mode is equal to the matching data, compare the size of the data to be compared with the matching data, and when the data to be compared is equal to the matching data, the processing result is a match.
  • the method further includes:
  • the method further includes: before acquiring the data to be compared from the received data packet, according to the pre-stored extraction offset value and the mask, the method further includes:
  • the protocol identification parameters are obtained and stored, and the protocol identification parameters include the extracted offset value, a mask, a matching mode, and matching data.
  • a second aspect of the embodiments of the present invention provides a data packet identification processing apparatus, where the apparatus includes:
  • Obtaining a module configured to extract, according to the pre-stored extraction offset value and the mask, the data to be compared from the received data packet;
  • a matching module configured to perform matching processing on the to-be-compared data and pre-stored matching data according to a pre-stored matching mode
  • the identification module is configured to identify a protocol code of the data packet when the processing result of the matching module is a match.
  • the obtaining module is further configured to:
  • the matching module is further configured to:
  • the matching mode When the matching mode is greater than the matching data, compare the size of the data to be compared with the matching data, and when the data to be compared is greater than the matching data, the processing result is a match;
  • the matching mode When the matching mode is smaller than the matching data, compare the size of the data to be compared with the matching data, and when the data to be compared is smaller than the matching data, the processing result is a match;
  • the device further includes: an output module configured to output offset value information of the data packet.
  • the obtaining module is further configured to: acquire and store a protocol identification parameter, where the protocol identification parameter includes the extracted offset value, a mask, a matching mode, and matching data.
  • the method and device for identifying and processing data packets provided by the embodiments of the present invention, and the storage medium, according to the pre-stored extraction offset value and the mask, obtain the data to be compared from the received data packet; according to the pre-stored matching mode
  • the comparison data is compared with the pre-stored matching data; when the processing result is a match, the protocol code of the data message and the corresponding processing action are identified.
  • the data packet is not extracted to the CPU for software processing, but the data packet is sent to the network through the forwarding path, which is superior to the extraction to the CPU. the way.
  • FIG. 1 is a flowchart of a method for identifying and processing a data packet according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of a method for identifying and processing a data packet according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic diagram of an unknown format message according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a method for identifying an unknown format message shown in FIG. 3 according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a data packet identification processing apparatus according to an embodiment of the present invention.
  • the identification condition for identifying the newly added message is dynamically added to the ONU chip as needed; after receiving the data message, the matching condition is used for matching processing; if the matching is successful, the data is obtained.
  • the protocol code of the message and the corresponding processing action and output the offset value information of the data message for subsequent processing.
  • the recognition condition includes greater than, equal to, small In the logical relationship, the mask is included, so that the matching condition can be adapted to more situations; after the matching, the corresponding protocol encoding is output; the processing action corresponding to the data packet is obtained according to the protocol encoding, and the offset value required for the packet processing is output.
  • Information in this way, after the data message is identified, the data message is not extracted to the CPU for software processing, but the data message can be sent to the network through the forwarding path, which is much better than the method of extracting to the CPU. .
  • FIG. 1 is a flowchart of a method for identifying and processing a data packet according to Embodiment 1 of the present invention.
  • the method for identifying a data packet provided by this embodiment may be performed by an ONU chip, as shown in FIG. Methods can include:
  • Step 101 Extract the data to be compared from the received data message according to the pre-stored extraction offset value and the mask.
  • the ONU chip may extract corresponding byte data from the data packet according to the extracted offset value, and perform the AND operation on the byte data and the mask to obtain the to-be-processed Compare the data.
  • the content of the packet can be obtained according to the extracted offset value.
  • the offset value is 2 bytes
  • the 2 bytes in the data packet can be extracted each time, and the number of extractions can be selected. 1 to 10 times; specifically, identifying a message can match up to 20 bytes, and then using the mask to process the extracted message content to obtain the data to be compared that needs to be compared; the data to be compared and the matching data Perform a matching comparison to get a matching result.
  • Step 102 Perform matching processing on the to-be-compared data and the pre-stored matching data according to the pre-stored matching mode.
  • the matching mode when the matching mode is greater than the matching data, compare the size of the data to be compared with the matching data, and when the data to be compared is greater than the matching data, the processing result is a match.
  • the matching mode is smaller than the matching data, compare the size of the data to be compared with the matching data, and when the data to be compared is smaller than the matching data, the processing result is a match;
  • the matching mode is equal to the matching data, compare the The size of the data to be compared and the size of the matching data.
  • the processing result is a match.
  • the ONU chip Before performing step 101 and step 102, acquires and stores a protocol identification parameter, where the protocol identification parameter includes the extracted offset value, a mask, a matching mode, and matching data; specifically, the protocol identification parameter may pass through a CPU. Write to the ONU chip.
  • Step 103 When the processing result is a match, identify a protocol code of the data message.
  • the hardware processing may be performed separately. After identifying the protocol encoding of the data packet and the corresponding processing action, the data obtained from the data packet may also be output.
  • the offset value information of the data packet the offset value information can be directly provided to the packet processing and the packet modification, that is, the extended packet format packet can be completely handed to the hardware processing, thereby avoiding the identification only after the packet is recognized.
  • the software extracted to the CPU is processed in such a manner that the processing performance is greatly improved while the data message is flexibly recognized and processed.
  • the data packet when the data packet is identified and processed, the data packet may match multiple protocol rules at the same time.
  • the protocol code may be preferentially selected as the result output.
  • the data packet is matched with two protocol rules as an example.
  • the extended protocol rule module 1 and the extended protocol rule module 2 simultaneously identify and process the data packet; specifically, the extended protocol rule module 1 receives the received offset value and the mask according to its own pre-stored offset value and mask. Extracting the data to be compared, the data to be compared 2 and the data to be compared 3 in the data packet; deleting the bits (bits) that are not concerned in the data to be compared, and then performing the data to be compared with the pre-stored matching data according to the pre-stored matching pattern.
  • the matching process that is, the matching action of greater than, less than, equal to the same domain as the protocol, obtains a matching result; similarly, the extended protocol rule module 2 also extracts the data packet according to the pre-stored extracted offset value and mask. Wait Compare data 1, data to be compared 2, and data to be compared 3; then perform matching operations greater than, less than, equal to the same domain as the protocol to obtain a matching result.
  • the matching result obtained by the extended protocol rule module 1 or the extended protocol rule module 2 is a match, that is, the data packet only matches one protocol, the corresponding protocol code is output, and the offset value information of the data packet is output; If the matching result obtained by the extended protocol rule module 1 and the extended protocol rule module 2 is matched, the protocol code with a small protocol code is output, and the offset value information of the data packet is output.
  • one of the global configurations may be selected as the final result output, which is not specifically limited in this embodiment.
  • the D1 data after the a byte of the start of the message is between the values [X1..X5], that is, greater than X1 and less than X5.
  • the next byte of the D2 data offset by b bytes is equal to the value X2
  • the two bytes are the DATA1 net core that the packet processing needs to care about
  • the D3 net core is shifted backward by c bytes to obtain the D3 data.
  • the previous byte is greater than the value X3.
  • D4 after shifting d bytes further is equal to X4.
  • extension package identification Based on the recognition condition and the fields that need to be concerned. We can configure extension package identification accordingly:
  • OFFSET indicates the offset
  • mask is the mask
  • mode is the matching mode
  • the specific identification process of the message is: when the message is input, the four conditions are matched at the same time.
  • the first matching condition first extracts the a and a+1 byte messages in the message, that is, the D1 data, and performs the AND process on the D1 and mask1 values to filter out some bits that do not need to be concerned.
  • the third matching condition is matched, and the message a+2+b+4+c and the a+2+b+4+c+1 byte message are extracted, that is, D3, D3 and mask3 are operated together to obtain D3', and it is judged whether D3' is greater than X3. If not, it is judged that the protocol is not matched; and the fourth matching condition is matched, and the message a+2+b is extracted.
  • the data packet is identified as a new protocol packet, and the corresponding protocol code is output; and since the traffic classification (packet processing) needs to be processed based on DATA1 and DATA2, Synchronize the offset addresses corresponding to D2 and D4.
  • this embodiment can flexibly configure matching conditions like software.
  • This method matches the matching conditions of unknown messages, including not only masks, but also multiple patterns, such as greater than, less than, etc., which can easily complete multiple matching methods such as exact matching, fuzzy matching, range matching, etc. , so that the extension package format is very easy to recognize.
  • the data packet identification processing method provided in this embodiment can flexibly identify and process data packets, and improve processing performance.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores a computer program, and the computer program is used to execute the method shown in FIG. 1 in the embodiment of the present invention.
  • Data packet identification processing method is used to execute the method shown in FIG. 1 in the embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a data packet identification processing apparatus according to an embodiment of the present invention. As shown in FIG. 5, the apparatus provided in this embodiment includes: an obtaining module 11, a matching module 12, and an identification module 13.
  • the obtaining module 11 is configured to extract the data to be compared from the received data packet according to the pre-stored extraction offset value and the mask.
  • the matching module 12 is configured to perform matching processing on the to-be-compared data and the pre-stored matching data according to the pre-stored matching mode;
  • the identification module 13 is configured to identify a protocol code of the data message when the processing result of the matching module 12 is a match.
  • the obtaining module 11 is further configured to extract corresponding byte data from the data packet according to the extracted offset value, and perform the AND operation on the byte data and the mask to obtain the to-be-compared data.
  • the matching module 12 is further configured to compare the size of the data to be compared with the matching data when the matching mode is greater than the matching data, when the data to be compared is greater than the matching data, The processing result is a match; when the matching mode is smaller than the matching data, comparing the size of the data to be compared with the matching data, when the data to be compared is smaller than the matching data, the processing result And matching, when the matching mode is equal to the matching data, comparing the size of the data to be compared with the matching data, and when the data to be compared is equal to the matching data, the processing result is a match.
  • the device further includes: an output module configured to output offset value information of the data packet.
  • the obtaining module 11 is further configured to acquire and store a protocol identification parameter, where the protocol identification parameter includes the extracted offset value, a mask, a matching mode, and matching data.
  • the data packet identification processing device provided in this embodiment may be used to implement the foregoing method implementation.
  • the technical solution of the example has similar implementation principles and technical effects, and will not be further described herein.
  • the acquisition module 11, the matching module 12 and the identification module 13 may be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array located on the ONU chip. (FPGA) and other device implementations.
  • CPU central processing unit
  • MPU microprocessor
  • DSP digital signal processor
  • FPGA field programmable gate array
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions are provided to implement the work specified in one or more blocks of a flow or a flow and/or a block diagram of the flowchart The steps that can be made.
  • the embodiment of the present invention can obtain the data to be compared from the received data packet according to the pre-stored offset value and the mask; and match the data to be compared with the pre-stored matching data according to the pre-stored matching mode; When the processing result is a match, the protocol code of the data message and the corresponding processing action are identified.
  • the data packet is not extracted to the CPU for software processing, but the data packet is sent to the network through the forwarding path, which is superior to the extraction to the CPU. the way.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Mining & Analysis (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例提供一种数据报文的识别处理方法，根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据；根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理；在处理结果为匹配时，识别所述数据报文的协议编码。本发明实施例同时还提供一种数据报文的识别处理装置和存储介质。

Description

数据报文的识别处理方法及装置、存储介质 技术领域
本发明涉及通信技术领域，尤其涉及一种数据报文的识别处理方法及装置、存储介质。
背景技术
千兆无源光网络(Gigabit-capable Passive Optical Networks，GPON)是PON技术中架构最完备、标准内容最完整的网络技术，现已大量使用于接入网中。GPON的网络终端设备--光网络单元(Optical Network Unit，ONU)是GPON套片的核心芯片之一。芯片的以太网报文的探测和处理是非常重要的环节，需要识别网络中形形色色的各种报文，针对不同的报文有不同的处理方式。
现有的未知报文格式的识别方式主要有两种：一是基于软件实现以太网报文的检测和处理；二是基于三态内容寻址存储器(Ternary Content Addressable Memory，TCAM)实现以太网报文的检测和处理。
但是，基于软件实现依赖于中央处理器(Central Processing Unit，CPU)的处理性能，需要使用多个CPU核结构，会增加功耗；而基于TCAM实现时，只能用于等值匹配，无法进行不等值以及范围匹配，并且对于扩展包格式，最多只能输出一个报文类型，然后提取给CPU进行处理，无法得到更多的信息，让硬件完整的对报文进行处理。
发明内容
有鉴于此，本发明实施例期望提供一种数据报文的识别处理方法及装置、存储介质，以灵活识别并处理数据报文，且提升处理性能。
本发明实施例的技术方案是这样实现的：
本发明实施例第一方面提供了一种数据报文的识别处理方法，所述方法包括：
根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据；
根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理；
在处理结果为匹配时，识别所述数据报文的协议编码。
上述方案中，根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据，包括：
根据所述提取偏移值从所述数据报文中提取相应的字节数据，将所述字节数据与所述掩码进行与操作，得到所述待比较数据。
上述方案中，根据预存的匹配模式将所述待比较数据与所述匹配数据进行匹配处理，包括：
当所述匹配模式为大于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据大于所述匹配数据时，所述处理结果为匹配；
当所述匹配模式为小于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据小于所述匹配数据时，所述处理结果为匹配；
当所述匹配模式为等于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据等于所述匹配数据时，所述处理结果为匹配。
上述方案中，所述识别所述数据报文的协议编码之后，所述方法还包括：
输出所述数据报文的偏移值信息。
上述方案中，所述根据预存的提取偏移值和掩码，从接收到的数据报文中获取待比较数据之前，所述方法还包括：
获取协议识别参数并存储，所述协议识别参数包括所述提取偏移值、掩码、匹配模式及匹配数据。
本发明实施例第二方面提供了一种数据报文的识别处理装置，所述装置包括：
获取模块，配置为根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据；
匹配模块，配置为根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理；
识别模块，配置为在所述匹配模块的处理结果为匹配时，识别所述数据报文的协议编码。
上述方案中，所述获取模块还配置为：
根据所述提取偏移值从所述数据报文中提取相应的字节数据，将所述字节数据与所述掩码进行与操作，得到所述待比较数据。
上述方案中，所述匹配模块还配置为：
当所述匹配模式为大于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据大于所述匹配数据时，所述处理结果为匹配；
当所述匹配模式为小于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据小于所述匹配数据时，所述处理结果为匹配；
当所述匹配模式为等于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据等于所述匹配数据时，所述处理结果 为匹配。
上述方案中，所述装置还包括：输出模块，配置为输出所述数据报文的偏移值信息。
上述方案中，所述获取模块还配置为：获取协议识别参数并存储，所述协议识别参数包括所述提取偏移值、掩码、匹配模式及匹配数据。
本发明实施例提供的数据报文的识别处理方法及装置、存储介质，根据预存的提取偏移值和掩码，从接收到的数据报文中获取待比较数据；根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理；在处理结果为匹配时，识别所述数据报文的协议编码及对应的处理动作。本发明实施例在对数据报文识别后，不是将该数据报文提取给CPU进行软件处理，而是将该数据报文通过转发通路发送到网络中，在性能上大大优于提取给CPU的方式。
附图说明
图1为本发明实施例一提供的数据报文的识别处理方法的流程图；
图2为本发明实施例二提供的数据报文的识别处理方法的流程图；
图3为本发明实施例中未知格式报文的示意图；
图4为本发明实施例中图3所示未知格式报文的识别处理方法的流程图；
图5为本发明实施例提供的数据报文的识别处理装置的结构示意图。
具体实施方式
在本发明的各实施例中，根据需要将识别新增报文的识别条件动态添加到ONU芯片中；接收到数据报文后，用识别条件进行匹配处理；如果匹配成功，则获取到该数据报文的协议编码和对应的处理动作，并输出该数据报文的偏移值信息用于后续处理。其中，识别条件包含大于、等于、小 于等逻辑关系，包含掩码，使得匹配条件可以适应更多的情况；匹配后，输出相应的协议编码；根据协议编码得到该数据报文对应的处理动作，并输出包处理需要的偏移值信息；这样，识别数据报文后，不是将该数据报文提取给CPU进行软件处理，而是可以将该数据报文通过转发通路发送到网络中，在性能上大大优于提取给CPU的方式。
图1为本发明实施例一提供的数据报文的识别处理方法的流程图，本实施例提供的数据报文的识别处理方法可以由ONU芯片执行，如图1所示，本实施例提供的方法可以包括：
步骤101、根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据。
本步骤中，具体的，ONU芯片可以根据所述提取偏移值从所述数据报文中提取相应的字节数据，将所述字节数据与所述掩码进行与操作，得到所述待比较数据。
例如，在接收到数据报文后，可以根据提取偏移值获得报文内容，例如，提取偏移值为2字节，则可以每次提取数据报文中的2字节，提取次数可以选择1到10次不等；具体的，识别一个报文最多可以匹配20字节，然后使用掩码对提取的报文内容进行处理，得到最终需要比较的待比较数据；将待比较数据与匹配数据进行匹配比较，得到是否匹配的结果。
步骤102、根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理。
可选的，当所述匹配模式为大于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据大于所述匹配数据时，所述处理结果为匹配；当所述匹配模式为小于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据小于所述匹配数据时，所述处理结果为匹配；当所述匹配模式为等于所述匹配数据时，比较所述 待比较数据与所述匹配数据的大小，在所述待比较数据等于所述匹配数据时，所述处理结果为匹配。
当在一个数据报文中提取多个待比较数据时，只有在所有待比较数据的处理结果均为匹配时，才表明该数据报文匹配该协议，输出该协议的协议编码。
在执行步骤101和步骤102之前，ONU芯片获取协议识别参数并存储，所述协议识别参数包括所述提取偏移值、掩码、匹配模式及匹配数据；具体的，该协议识别参数可以通过CPU写入ONU芯片。
步骤103、在处理结果为匹配时，识别所述数据报文的协议编码。
进一步地，为了便于后续包处理模块的包处理和包修改能够单独由硬件完成，在识别所述数据报文的协议编码及对应的处理动作之后，还可以输出从所述数据报文中获得的所述数据报文的偏移值信息，这些偏移值信息可以直接提供给包处理、包修改使用，即：扩展包格式报文可以完全交给硬件处理，避免了在报文识别后只能提取给CPU的软件进行处理这种方式，从而在灵活识别并处理数据报文的同时大大提升了处理性能。
实际应用中，在对数据报文进行识别处理时，数据报文可能会同时匹配上多个协议规则，此时，可以优先选择协议编码小的作为结果输出。如图2所示，对数据报文同时匹配两个协议规则为例进行说明。
数据报文输入后，扩展协议规则模块1和扩展协议规则模块2同时对该数据报文进行识别处理；具体的，扩展协议规则模块1根据自身预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据1、待比较数据2和待比较数据3；删除待比较数据中不关心的比特(bit)，然后根据预存的匹配模式将待比较数据与预存的匹配数据进行匹配处理，即，与协议相同域进行大于、小于、等于的匹配动作，得到匹配结果；同样的，扩展协议规则模块2也根据自身预存的提取偏移值和掩码，从数据报文中提取待 比较数据1、待比较数据2和待比较数据3；然后与协议相同域进行大于、小于、等于的匹配动作，得到匹配结果。
如果扩展协议规则模块1或扩展协议规则模块2得到的匹配结果为匹配，即表明该数据报文仅匹配一种协议，则输出相应的协议编码，并输出数据报文的偏移值信息；如果扩展协议规则模块1和扩展协议规则模块2得到的匹配结果均为匹配，则输出协议编码小的协议编码，并输出数据报文的偏移值信息。
进一步地，如果该数据报文同时匹配了现有协议，则可以根据全局配置选择其中一种作为最终结果输出，本实施例对此不做具体限定。
如图3所示的一种未知包格式，根据预存的协议识别参数，在报文起始的a字节后的D1数据在值[X1..X5]之间，即大于X1，小于X5，且D1后偏移b字节的D2数据中后一个字节等于值X2，然后两字节为包处理需要关心的DATA1净核，D3净核往后偏移c个字节后得到D3数据的前一个字节大于值X3。再往后偏移d个字节后的D4等于X4。紧跟D4为包修改需要关心的DATA2净核。
基于该识别条件和需要关心的字段。我们可以相应配置扩展包识别：
1)OFFSET1＝a，mask1＝0xffff，mode1为大于，匹配值为X1；
2)OFFSET1＝a，mask1＝0xffff，mode1为小于，匹配值为X5；
3)OFFSET2＝(a+2+b)，mask2＝0x00ff，mode2为等于，匹配值为X2；
4)OFFSET3＝(a+2+b+4+c)，mask3＝0xff00，mode3为大于，匹配值为X3；
5)OFFSET＝(a+2+b+4+c+2+d)，mask＝0xffff，mode4为等于，匹配值为X4。
其中，OFFSET表示偏移量，mask为掩码，mode为匹配模式。
如图4所示，该报文的具体识别流程为：当报文输入后，同时与这4个条件进行匹配。比如第一个匹配条件，先提取报文中的第a个和第a+1个字节报文，即D1数据，将D1与mask1值进行“与”处理，过滤掉一些不需要关心的比特(bit)，得到D1’，然后判断D1’的值是否在[X1...X5]的区间范围内，若否，判断为不匹配该协议；与第二个匹配条件进行匹配，先提取报文中第a+2+b个和第a+2+b+1个字节报文，即D2，将D2与mask2进行与操作，得到D2’，判断D2’是否等于X2，若否，则判断为不匹配该协议；与第三个匹配条件进行匹配，提取报文第a+2+b+4+c个和第a+2+b+4+c+1个字节报文，即D3，将D3与mask3进行与操作，得到D3’，判断D3’是否大于X3，若否，则判断为不匹配该协议；与第四个匹配条件进行匹配，提取报文第a+2+b+4+c+2+d个和第a+2+b+4+c+2+d+1个字节报文，即D4，将D4与mask4进行与操作，得到D4’，判断D4’是否大于X4，若否，则判断为不匹配该协议。
若上述四个匹配条件的匹配结果均为匹配时，则识别该数据报文为新增协议报文，输出相应的协议编码；同时由于流分类(包处理)需要基于DATA1和DATA2进行处理，故同步输出D2和D4对应的偏移地址。
从以上的描述中可以看出，对于图3这样一个复杂的未知报文，本实施例可以像软件一样灵活地配置匹配条件。这种方法对于未知报文的匹配条件，不仅包含掩码，还有大于、小于等多种模式匹配，这样可以非常方便地完成多个字段的精确匹配、模糊匹配、范围匹配等多种匹配方式，从而非常容易地识别出扩展包格式。
本实施例提供的数据报文的识别处理方法，能够灵活识别并处理数据报文，且提升处理性能。
本发明实施例还提供了一种计算机存储介质，所述计算机存储介质中存储有计算机程序，所述计算机程序用于执行本发明实施例中图1所示的 数据报文的识别处理方法。
图5为本发明实施例提供的数据报文的识别处理装置的结构示意图，如图5所示，本实施例提供的装置包括：获取模块11、匹配模块12和识别模块13。
其中，获取模块11，配置为根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据；
匹配模块12，配置为根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理；
识别模块13，配置为在所述匹配模块12的处理结果为匹配时，识别所述数据报文的协议编码。
所述获取模块11，还配置为根据所述提取偏移值从所述数据报文中提取相应的字节数据，将所述字节数据与所述掩码进行与操作，得到所述待比较数据。
所述匹配模块12，还配置为当所述匹配模式为大于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据大于所述匹配数据时，所述处理结果为匹配；当所述匹配模式为小于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据小于所述匹配数据时，所述处理结果为匹配；当所述匹配模式为等于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据等于所述匹配数据时，所述处理结果为匹配。
进一步地，所述装置还包括：输出模块，配置为输出所述数据报文的偏移值信息。
进一步地，所述获取模块11还配置为获取协议识别参数并存储，所述协议识别参数包括所述提取偏移值、掩码、匹配模式及匹配数据。
本实施例提供的数据报文的识别处理装置，可用于执行上述方法实施 例的技术方案，其实现原理和技术效果类似，此处不再赘述。
在实际应用中，该获取模块11、匹配模块12和识别模块13可由位于ONU芯片上的中央处理器(CPU)、微处理器(MPU)、数字信号处理器(DSP)或现场可编程门阵列(FPGA)等器件实现。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功 能的步骤。
以上所述，仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。
工业实用性
本发明实施例能够根据预存的提取偏移值和掩码，从接收到的数据报文中获取待比较数据；根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理；在处理结果为匹配时，识别所述数据报文的协议编码及对应的处理动作。本发明实施例在对数据报文识别后，不是将该数据报文提取给CPU进行软件处理，而是将该数据报文通过转发通路发送到网络中，在性能上大大优于提取给CPU的方式。

Claims (11)

  1. 一种数据报文的识别处理方法，包括：
    根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据；
    根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理；
    在处理结果为匹配时，识别所述数据报文的协议编码。
  2. 根据权利要求1所述的方法，其中，根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据，包括：
    根据所述提取偏移值从所述数据报文中提取相应的字节数据，将所述字节数据与所述掩码进行与操作，得到所述待比较数据。
  3. 根据权利要求2所述的方法，其中，根据预存的匹配模式将所述待比较数据与所述匹配数据进行匹配处理，包括：
    当所述匹配模式为大于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据大于所述匹配数据时，所述处理结果为匹配；
    当所述匹配模式为小于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据小于所述匹配数据时，所述处理结果为匹配；
    当所述匹配模式为等于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据等于所述匹配数据时，所述处理结果为匹配。
  4. 根据权利要求1所述的方法，其中，所述识别所述数据报文的协议编码之后，所述方法还包括：
    输出所述数据报文的偏移值信息。
  5. 根据权利要求1至4任一所述的方法，其中，所述根据预存的提取偏移值和掩码，从接收到的数据报文中获取待比较数据之前，所述方法还包括：
    获取协议识别参数并存储，所述协议识别参数包括所述提取偏移值、掩码、匹配模式及匹配数据。
  6. 一种数据报文的识别处理装置，包括：
    获取模块，配置为根据预存的提取偏移值和掩码，从接收到的数据报文中提取待比较数据；
    匹配模块，配置为根据预存的匹配模式将所述待比较数据与预存的匹配数据进行匹配处理；
    识别模块，配置为在所述匹配模块的处理结果为匹配时，识别所述数据报文的协议编码。
  7. 根据权利要求6所述的装置，其中，所述获取模块还配置为：
    根据所述提取偏移值从所述数据报文中提取相应的字节数据，将所述字节数据与所述掩码进行与操作，得到所述待比较数据。
  8. 根据权利要求7所述的装置，其中，所述匹配模块还配置为：
    当所述匹配模式为大于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据大于所述匹配数据时，所述处理结果为匹配；
    当所述匹配模式为小于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据小于所述匹配数据时，所述处理结果为匹配；
    当所述匹配模式为等于所述匹配数据时，比较所述待比较数据与所述匹配数据的大小，在所述待比较数据等于所述匹配数据时，所述处理结果 为匹配。
  9. 根据权利要求6所述的装置，其中，所述装置还包括：输出模块，配置为输出所述数据报文的偏移值信息。
  10. 根据权利要求6至9任一所述的装置，其中，所述获取模块还配置为：获取协议识别参数并存储，所述协议识别参数包括所述提取偏移值、掩码、匹配模式及匹配数据。
  11. 一种计算机存储介质，所述计算机存储介质中存储有计算机程序，所述计算机程序用于执行前述权利要求1至5任一项所述的数据报文的识别处理方法。
PCT/CN2016/101455 2015-12-10 2016-10-08 数据报文的识别处理方法及装置、存储介质 WO2017097026A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510916959.4 2015-12-10
CN201510916959.4A CN106878098A (zh) 2015-12-10 2015-12-10 数据报文的识别处理方法及装置

Publications (1)

Publication Number Publication Date
WO2017097026A1 true WO2017097026A1 (zh) 2017-06-15

Family

ID=59012659

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101455 WO2017097026A1 (zh) 2015-12-10 2016-10-08 数据报文的识别处理方法及装置、存储介质

Country Status (2)

Country Link
CN (1) CN106878098A (zh)
WO (1) WO2017097026A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111683036A (zh) * 2020-02-29 2020-09-18 新华三信息安全技术有限公司 数据存储方法、装置以及报文识别方法和装置
CN112187583A (zh) * 2020-09-30 2021-01-05 绿盟科技集团股份有限公司 动作信息在私有工控协议中识别的方法、装置及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110311835B (zh) * 2019-07-09 2021-05-14 国网甘肃省电力公司电力科学研究院 一种基于内容模板的电力iec协议符合性验证方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1642167A (zh) * 2004-01-08 2005-07-20 华为技术有限公司 主节点支持从节点上不同协议类型从单元设备的方法
US7420975B1 (en) * 2002-12-20 2008-09-02 Cypress Semiconductor Corporation Method and apparatus for a high-speed frame tagger
CN101409677A (zh) * 2008-11-27 2009-04-15 福建星网锐捷网络有限公司 一种接入控制方法及装置
CN102195977A (zh) * 2011-04-13 2011-09-21 北京恒光创新科技股份有限公司 一种网络协议识别方法及装置
CN104753885A (zh) * 2013-12-30 2015-07-01 杭州华为数字技术有限公司 一种流表匹配的方法、装置和OpenFlow交换系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7420975B1 (en) * 2002-12-20 2008-09-02 Cypress Semiconductor Corporation Method and apparatus for a high-speed frame tagger
CN1642167A (zh) * 2004-01-08 2005-07-20 华为技术有限公司 主节点支持从节点上不同协议类型从单元设备的方法
CN101409677A (zh) * 2008-11-27 2009-04-15 福建星网锐捷网络有限公司 一种接入控制方法及装置
CN102195977A (zh) * 2011-04-13 2011-09-21 北京恒光创新科技股份有限公司 一种网络协议识别方法及装置
CN104753885A (zh) * 2013-12-30 2015-07-01 杭州华为数字技术有限公司 一种流表匹配的方法、装置和OpenFlow交换系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111683036A (zh) * 2020-02-29 2020-09-18 新华三信息安全技术有限公司 数据存储方法、装置以及报文识别方法和装置
CN111683036B (zh) * 2020-02-29 2022-05-27 新华三信息安全技术有限公司 数据存储方法、装置以及报文识别方法和装置
CN112187583A (zh) * 2020-09-30 2021-01-05 绿盟科技集团股份有限公司 动作信息在私有工控协议中识别的方法、装置及存储介质

Also Published As

Publication number Publication date
CN106878098A (zh) 2017-06-20

Similar Documents

Publication Publication Date Title
US10063474B2 (en) Parallel match processing of network packets to identify packet data for masking or other actions
US9256831B2 (en) Match engine for detection of multi-pattern rules
CN106790170B (zh) 一种数据包过滤方法及装置
MY195917A (en) Blockchain-Based Data Processing Method And Device
WO2017097026A1 (zh) 数据报文的识别处理方法及装置、存储介质
WO2019080660A1 (zh) 一种模型训练方法、检测url的方法及装置
KR20170060280A (ko) 탐지 규칙 자동 생성 장치 및 방법
CN106161479B (zh) 一种支持特征跨包的编码攻击检测方法和装置
US11647032B2 (en) Apparatus and method for classifying attack groups
US20160277547A1 (en) Packet monitoring device and packet monitoring method for communication packet
JP2019110513A (ja) 異常検知方法、学習方法、異常検知装置、および、学習装置
CN105100023B (zh) 数据包特征提取方法及装置
WO2016201876A1 (zh) 一种加密流量的业务识别方法、装置和计算机存储介质
US20170279639A1 (en) Bridge port extender
KR102386287B1 (ko) 비정상 데이터 탐지를 위한 시그널 허브
JP6590545B2 (ja) パケットからデータを抽出する方法およびその装置
CN116915519B (zh) 数据流溯源的方法、装置、设备以及存储介质
JP2015106914A (ja) マルウェア通信解析装置、及びマルウェア通信解析方法
CN112822204A (zh) 一种nat的检测方法、装置、设备及介质
CN105049437A (zh) 一种网络应用层数据过滤方法
JP6096084B2 (ja) トラヒック走査装置及び方法
CN105072104B (zh) 具有防ieee1588篡改功能的交换机系统及处理方法
KR102081492B1 (ko) 사이버 위협 정보에 대한 통합 표현 규격 데이터 생성 방법 및 장치
JP6280018B2 (ja) ルール逸脱アプリケーション発見装置、ルール逸脱アプリケーション発見システム及びルール逸脱アプリケーション発見方法
JP5302360B2 (ja) 信号処理装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16872220

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16872220

Country of ref document: EP

Kind code of ref document: A1