WO2018006654A1 - FlowSpec消息的处理方法和装置以及系统 - Google Patents

FlowSpec消息的处理方法和装置以及系统 Download PDF

Info

Publication number
WO2018006654A1
WO2018006654A1 PCT/CN2017/084379 CN2017084379W WO2018006654A1 WO 2018006654 A1 WO2018006654 A1 WO 2018006654A1 CN 2017084379 W CN2017084379 W CN 2017084379W WO 2018006654 A1 WO2018006654 A1 WO 2018006654A1
Authority
WO
WIPO (PCT)
Prior art keywords
interface
forwarding device
rule
flowspec
controller
Prior art date
Application number
PCT/CN2017/084379
Other languages
English (en)
French (fr)
Inventor
梁乾灯
庄顺万
吴楠
尤建洁
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17823466.2A priority Critical patent/EP3462688B1/en
Publication of WO2018006654A1 publication Critical patent/WO2018006654A1/zh
Priority to US16/240,242 priority patent/US10791059B2/en
Priority to US17/023,790 priority patent/US11290386B2/en
Priority to US17/683,778 priority patent/US12010030B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/33—Flow control; Congestion control using forward notification

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method, device, and system for processing a flow specification (English name: Flow Specification, English abbreviation: FlowSpec).
  • Border Gateway Protocol (English name: Border Gateway Protocol, English abbreviation: BGP) is a dynamic routing protocol used between autonomous systems (English abbreviation: Autonomous System, English abbreviation: AS). Referred to as BGP, it is widely used in the network (English name: Internet) to transmit routing information between ASs and between intra-AS routers.
  • the routing information that is transmitted includes: network protocol (English full name: Internet Protocol, IP for short) routing, media access control (English full name: Media Access Control, MAC) routing and FlowSpec rules, etc.
  • Network Layer Reachability Information referred to as NLRI
  • the BGP FlowSpec rule is one of centralized traffic scheduling technologies based on a Software Defined Network (SDN) architecture.
  • SDN Software Defined Network
  • the controller sends a flow rule by using the FlowSpec message, and the traffic rule is preferentially installed on the forwarding device, and the traffic that is accessed by all device interfaces of the forwarding device tries to match the flow rule.
  • the control granularity of the flow rule is too large and not fine enough.
  • the embodiment of the invention provides a method, a device and a system for processing a FlowSpec message, which are used to implement fine control of a service flow of a forwarding device according to a forwarding device interface.
  • the embodiment of the present invention provides the following technical solutions:
  • an embodiment of the present invention provides a method for processing a FlowSpec message, including:
  • the controller receives the forwarding device interface information reported by the forwarding device
  • the controller selects, from the received forwarding device interface information, at least one forwarding device interface that needs to apply a FlowSpec rule;
  • the controller generates an application interface rule according to the at least one forwarding device interface that needs to apply the FlowSpec rule, where the application interface rule is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule;
  • the controller sends a FlowSpec message to the forwarding device, where the FlowSpec message includes the application interface rule and the FlowSpec rule.
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller, so the controller can perform the forwarding device that applies the FlowSpec rule according to the received forwarding device interface information when the FlowSpec rule is sent.
  • Interface configuration so that the controller can configure which forwarding device interface or Which forwarding device interfaces may need to apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control a flow spec rule to be applied to the flexibly designated forwarding device interface in the forwarding device, so as to automatically and flexibly specify the scope of the flow rule application according to the user requirement, and achieve fine control of the service.
  • the forwarding device interface information includes: an interface identifier of a forwarding device interface
  • the controller generates an application interface rule according to the at least one forwarding device interface that needs to apply the FlowSpec rule, including:
  • the controller generates an application interface rule, where the application interface rule includes: an interface identifier set, where the interface identifier set includes: at least one interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the controller may include an interface identifier set in the application interface rule, and the interface identifier set is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the controller generates an application interface rule according to the at least one forwarding device interface that needs to apply the FlowSpec rule, including:
  • the controller generates an application interface rule, where the application interface rule includes: the interface group identifier.
  • the controller may include the interface group identifier in the application interface rule, and the interface group identifier is used to instruct the forwarding device to determine the forwarding device interface that can apply the FlowSpec rule.
  • the controller determines that the interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule belongs to Before the interface group, the method further includes:
  • the controller creates an interface group identifier and an interface identifier of the forwarding device interface included in the interface group;
  • the controller sends the created interface group identifier and the interface identifier of the forwarding device interface included in the interface group to the forwarding device.
  • the controller generates an application interface rule according to the at least one forwarding device interface that needs to apply the FlowSpec rule, including:
  • the controller generates an application interface rule, where the application interface rule includes: a service screening condition, where the service screening condition is used to filter out at least one forwarding device interface that needs to apply a FlowSpec rule from the forwarding device interface information.
  • the controller may include a service screening condition in the application interface rule, and the service screening condition is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the controller Sending a FlowSpec message to the forwarding device, including:
  • the controller sends a FlowSpec message to the forwarding device by using BGP routing attribute information, where the BGP routing attribute information carries the application interface rule.
  • the controller may carry the application interface rule by using the BGP route attribute information, so as to complete the sending of the FlowSpec message by extending the BGP route attribute information.
  • the controller Receives the forwarding device interface information reported by the forwarding device, including:
  • the controller receives the forwarding device interface information reported by the forwarding device by using the border gateway protocol link state BGP-LS protocol.
  • the controller and the forwarding device can communicate through the BGP-LS protocol, and complete the transmission of the interface information of the forwarding device in the BGP-LS scenario.
  • the BGP routing attribute information includes at least one of the following information: a flow extended attribute, The extended community attribute ECA information and the service filter attribute information of the interface group Interface Group.
  • an embodiment of the present invention further provides a method for processing information, including
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller;
  • the forwarding device applies the FlowSpec rule to the at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller, so the controller can perform the forwarding device that applies the FlowSpec rule according to the received forwarding device interface information when the FlowSpec rule is sent.
  • the interface is configured such that the controller can specifically configure which forwarding device interface or which forwarding device interfaces can apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control a flow spec rule to be applied to the flexibly designated forwarding device interface in the forwarding device, so as to automatically and flexibly specify the scope of the flow rule application according to the user requirement, and achieve fine control of the service.
  • the forwarding device determines, according to the application interface rule, a forwarding device interface of the forwarding device Is there at least one forwarding device interface that needs to apply the FlowSpec rule, including:
  • the forwarding device obtains an interface identifier from the interface identifier set
  • the forwarding device searches for an interface identifier in the interface identifier set from the interface identifier corresponding to the forwarding device interface of the forwarding device.
  • the controller may include an interface identifier set in the application interface rule, and the interface identifier set is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the forwarding device determines, according to the application interface rule, a forwarding device interface of the forwarding device Is there at least one forwarding device interface that needs to apply the FlowSpec rule, including:
  • the forwarding device acquires an interface group according to the interface group identifier
  • the forwarding device searches for a forwarding device interface included in the interface group from the forwarding device interface of the forwarding device.
  • the controller may include the interface group identifier in the application interface rule, and the interface group identifier is used to instruct the forwarding device to determine the forwarding device interface that can apply the FlowSpec rule.
  • the forwarding device determines, according to the application interface rule, whether there is a need in the forwarding device interface of the forwarding device Before applying at least one forwarding device interface of the FlowSpec rule, the method further includes:
  • the forwarding device receives an interface group identifier issued by the controller and an interface identifier of a forwarding device interface included in the interface group;
  • the forwarding device filters the forwarding device interface of the forwarding device according to the interface group identifier issued by the controller and the interface identifier of the forwarding device interface included in the interface group, and maintains the forwarding device interface between the forwarding device and the interface group. connection relation.
  • the forwarding device determines, according to the application interface rule, a forwarding device interface of the forwarding device Is there at least one forwarding device interface that needs to apply the FlowSpec rule, including:
  • the forwarding device searches for the forwarding device interface that meets the service screening condition from the forwarding device interface of the forwarding device, and if there is a forwarding device interface that meets the service screening condition in the forwarding device interface of the forwarding device, Determining that the forwarding device has the at least one forwarding device interface that needs to apply the FlowSpec rule, and if the forwarding device interface of the forwarding device does not have a forwarding device interface that meets the service screening condition, determining the forwarding device The at least one forwarding device interface that needs to apply the FlowSpec rule does not exist in the forwarding device interface.
  • the controller may include a service screening condition in the application interface rule, and the service screening condition is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the forwarding device includes at least one of the following information: interface identifier Interface Identifier information, interface description Interface Description information, interface service Interface Service information, and interface group Interface Group information.
  • the forwarding device interface information of the forwarding device itself is reported to the controller, including:
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller through the border gateway protocol link state BGP-LS.
  • the controller and the forwarding device can communicate through the BGP-LS protocol, and complete the transmission of the interface information of the forwarding device in the BGP-LS scenario.
  • the forwarding device interface information includes: interface information of the forwarding device, and/or device information of the forwarding device .
  • the device information of the forwarding device includes: a BGP identifier Identifier.
  • the type of the Interface Service information is one of the following information: virtual private local area network service VPLS information, virtual private line service VPWS information, Ethernet virtual private network EVPN information, and three-layer virtual private network L3VPN information.
  • the interface service information includes at least one of the following information: a virtual private network instance name VPN Instance name information, a virtual private network instance identifier VPN Instance ID information, a route specifier RD information, a routing entry destination Import RT, and a route exit destination.
  • Export RT and Ethernet segment identifier ESI export RT and Ethernet segment identifier ESI.
  • an embodiment of the present invention further provides a controller, including:
  • a receiving module configured to receive forwarding device interface information reported by the forwarding device
  • An interface configuration module configured to select, from the received forwarding device interface information, at least one forwarding device interface that needs to apply a FlowSpec rule
  • An application interface rule generating module configured to generate an application interface rule according to the at least one forwarding device interface that needs to apply a FlowSpec rule, where the application interface rule is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule ;
  • a sending module configured to send a FlowSpec message to the forwarding device, where the FlowSpec message includes the application interface rule and the FlowSpec rule.
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller, so the controller can perform the forwarding device that applies the FlowSpec rule according to the received forwarding device interface information when the FlowSpec rule is sent.
  • the interface is configured such that the controller can specifically configure which forwarding device interface or which forwarding device interfaces can apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control a flow spec rule to be applied to the flexibly designated forwarding device interface in the forwarding device, so as to automatically and flexibly specify the scope of the flow rule application according to the user requirement, and achieve fine control of the service.
  • the forwarding device interface information includes: an interface identifier of a forwarding device interface
  • the application interface rule generating module is configured to obtain at least one interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule, and generate an application interface rule, where the application interface rule includes: an interface identifier set, the interface The identifier set includes: at least one interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the controller may include an interface identifier set in the application interface rule, and the interface identifier set is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the application interface rule generating module is specifically configured to determine an interface group to which the at least one forwarding device interface that needs to apply the FlowSpec rule belongs;
  • the interface group identifier corresponding to the interface group to which the at least one forwarding device interface to which the FlowSpec rule is applied is generated; the application interface rule is generated, and the application interface rule includes: the interface group identifier.
  • the controller may include the interface group identifier in the application interface rule, and the interface group identifier is used to instruct the forwarding device to determine the forwarding device interface that can apply the FlowSpec rule.
  • the controller further includes: an interface group processing module, configured to create an interface group identifier, and the interface group includes The interface identifier of the forwarding device interface; the forwarding device sends the created interface group identifier and the interface identifier of the forwarding device interface included in the interface group.
  • the application interface rule generating module is specifically configured to generate an application interface rule, where the application interface rule includes: a service screening condition, and the service screening The condition is used to filter out, from the forwarding device interface information, the at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the controller may include a service screening condition in the application interface rule, and the service screening condition is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the sending module Specifically, the method is configured to send a FlowSpec message to the forwarding device by using BGP route attribute information, where the BGP route attribute information carries the application interface rule.
  • the controller may carry the application interface rule by using the BGP route attribute information, so as to complete the sending of the FlowSpec message by extending the BGP route attribute information.
  • the receiving module The device is configured to receive the forwarding device interface information reported by the forwarding device by using the border gateway protocol link state BGP-LS protocol.
  • the controller and the forwarding device can communicate through the BGP-LS protocol, and complete the transmission of the interface information of the forwarding device in the BGP-LS scenario.
  • the embodiment of the present invention further provides a forwarding device, including:
  • a sending module configured to report, to the controller, forwarding device interface information of the forwarding device itself;
  • a receiving module configured to receive a FlowSpec message sent by the controller, and obtain an application interface rule and a FlowSpec rule from the FlowSpec message;
  • An interface identification module configured to determine, according to the application interface rule, whether at least one forwarding device interface that needs to apply a FlowSpec rule exists in a forwarding device interface of the forwarding device;
  • a flow spec rule application module configured to apply the FlowSpec rule to the at least one forwarding device that needs to apply a FlowSpec rule when the forwarding device interface of the forwarding device has the at least one forwarding device interface that needs to apply a FlowSpec rule. On the interface.
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller, so the controller can perform the forwarding device that applies the FlowSpec rule according to the received forwarding device interface information when the FlowSpec rule is sent.
  • the interface is configured such that the controller can specifically configure which forwarding device interface or which forwarding device interfaces can apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control a flow spec rule to be applied to the flexibly designated forwarding device interface in the forwarding device, so as to automatically and flexibly specify the scope of the flow rule application according to the user requirement, and achieve fine control of the service.
  • the interface identifier module is specifically configured to obtain an interface from the interface identifier set. And identifying, by the interface identifier corresponding to the forwarding device interface of the forwarding device, whether the interface identifier in the interface identifier set exists.
  • the controller may include an interface identifier set in the application interface rule, and the interface identifier set is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the interface identification module is specifically configured to obtain an interface group according to the interface group identifier. Finding from the forwarding device interface of the forwarding device whether there is a forwarding device interface included in the interface group.
  • the controller may include the interface group identifier in the application interface rule, and the interface group identifier is used to instruct the forwarding device to determine the forwarding device interface that can apply the FlowSpec rule.
  • the forwarding device further includes: an interface group processing module, configured to: before the interface identification module determines, according to the application interface rule, whether there is at least one forwarding device interface that needs to apply a FlowSpec rule in the forwarding device interface of the forwarding device, The interface group identifier issued by the controller and the interface identifier of the forwarding device interface included in the interface group; the interface of the forwarding device of the forwarding device is filtered according to the interface group identifier issued by the controller and the interface identifier of the forwarding device interface included in the interface group. And maintaining an association relationship between the forwarding device interface of the forwarding device and the interface group.
  • the interface identifying module is specifically configured to be used in a forwarding device interface of the forwarding device. Determining whether there is a forwarding device interface that meets the service screening condition, and if there is a forwarding device interface that meets the service screening condition in the forwarding device interface of the forwarding device, determining that the flow device rule needs to be applied in the forwarding device At least one forwarding device interface, if there is no forwarding device interface that meets the service screening condition in the forwarding device interface of the forwarding device, it is determined that the forwarding device interface of the forwarding device does not have the need to apply the FlowSpec rule. At least one forwarding device interface.
  • the controller may include a service screening condition in the application interface rule, and the service screening condition is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the forwarding device includes at least one of the following information: interface identifier Interface Identifier information, interface description Interface Description information, interface service Interface Service information, and interface group Interface Group information.
  • the sending module Specifically, the BGP-LS reports the forwarding device interface information of the forwarding device itself to the controller through the border gateway protocol link state BGP-LS.
  • the controller and the forwarding device can communicate through the BGP-LS protocol, and complete the transmission of the interface information of the forwarding device in the BGP-LS scenario.
  • the embodiment of the present invention further provides a processing system for a FlowSpec message, comprising: the controller according to any one of the preceding aspects, and the forwarding device according to any of the foregoing fourth aspects.
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller, so the controller can perform the forwarding device that applies the FlowSpec rule according to the received forwarding device interface information when the FlowSpec rule is sent.
  • the interface is configured such that the controller can specifically configure which forwarding device interface or which forwarding device interfaces can apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control a flow spec rule to be applied to the flexibly designated forwarding device interface in the forwarding device, so as to automatically and flexibly specify the scope of the flow rule application according to the user requirement, and achieve fine control of the service.
  • FIG. 1 is a schematic diagram of a system framework of a method for processing a FlowSpec message according to an embodiment of the present invention
  • FIG. 2 is a schematic block diagram of a method for processing a FlowSpec message according to an embodiment of the present invention
  • FIG. 3 is a schematic block diagram showing another method for processing a FlowSpec message according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of a data structure of an interface NLRI according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of a data structure of an extended node description Sub-TLVs according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of a data structure of another extended interface description Sub-TLVs according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of a data structure of an interface service Sub-TLVs according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of a data structure of another extended service Sub-TLVs according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a data structure of a border interface Sub-TLVs according to an embodiment of the present disclosure
  • FIG. 5-a is a schematic structural diagram of a controller according to an embodiment of the present invention.
  • FIG. 5-b is a schematic structural diagram of another controller according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a forwarding device according to an embodiment of the present disclosure.
  • 6-b is a schematic structural diagram of another forwarding device according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of another controller according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of another forwarding device according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a processing system of a FlowSpec message according to an embodiment of the present invention.
  • the embodiment of the present invention provides a method, a device, and a system for processing a flow of a message, which are used to implement fine control of a service flow of a forwarding device according to a forwarding device interface.
  • FIG. 1 is a schematic diagram of a system framework of a method for processing a FlowSpec message according to an embodiment of the present invention.
  • the controller can perform information control interaction with the forwarding device.
  • the controller and the forwarding device can communicate through BGP.
  • N forwarding devices are taken as an example, and N is a non-zero natural number.
  • the forwarding device 1, the forwarding device 2, and the forwarding device N can apply the L2/L3 virtual private network (English name: Virtual Private Network, VPN for short) service under the service control of the controller.
  • L2/L3 virtual private network English name: Virtual Private Network, VPN for short
  • the controller may collect the forwarding device interface information of the forwarding device, for example, the external interface of the network edge forwarding device, for example, an L2 or L3 service interface, so that the controller can centrally deploy the forwarding device interface of the designated forwarding device.
  • the traffic policy is deployed on the interface of the access circuit (English name: Access Circuit, English abbreviation: AC) of all the specified Ethernet virtual private network (English name: EVPN).
  • the policy is implemented to further extend the BGP FlowSpe message.
  • the application interface rule is carried in the FlowSpec rule, so that the forwarding device can select a local suitable forwarding device interface to apply the FlowSpec rule.
  • the method for processing the FlowSpec message provided by the embodiment of the present invention is described in detail from the perspective of the controller and the forwarding device.
  • a method for processing a FlowSpec message may include the following steps:
  • the controller receives the forwarding device interface information reported by the forwarding device.
  • the controller is a control plane device, and the controller can perform information interaction with the forwarding device.
  • the controller can be a device that is configured independently in the control network, or a control module that is configured in the forwarding device. That is, a forwarding device can be configured in a forwarding device to implement service control on the forwarding device.
  • the controller of the embodiment of the present invention may be a route reflector (English name: Route reflector, RR: RR).
  • the controller may also be implemented after the RR extends the FlowSpec message processing function of the embodiment of the present invention.
  • the forwarding device provided by the embodiment of the present invention may be a device that supports the BGP protocol and establishes a BGP protocol session with other devices.
  • the forwarding device may be a provider edge (English full name: Provider Edge, English abbreviation: PE) device, and the forwarding device may also be a customer edge (English name: Customer Edge, English abbreviation: CE) device.
  • a BGP session can be established between the controller and the forwarding device, and the forwarding device reports the forwarding device interface information of the forwarding device to the controller through the BGP session, and the forwarding device interface reported by the forwarding device can refer to the physical interface. , can also refer to the logical interface.
  • the forwarding device may be a PE device, and the PE device reports the AC interface identifier of the PE device to the controller (English name: Identifier, English abbreviation: ID).
  • ID the controller can receive the forwarding device interface information reported by the forwarding device through the BGP session.
  • the controller can establish a BGP session with multiple forwarding devices, so that the controller can receive the forwarding device interface information reported by multiple forwarding devices.
  • the forwarding device interface information reported by the forwarding device to the controller may be implemented in multiple manners, and the application scenario is used to determine which type of forwarding device interface information is reported by the forwarding device.
  • the type of forwarding device interface information may be determined by the forwarding device, or may be determined by the controller, or may be negotiated and determined by the controller and the forwarding device, which is not limited herein, and then the implementation manner of the device interface information is performed. for example.
  • the forwarding device interface information that is reported by the forwarding device to the controller may include: forwarding interface information of the device and device information of the forwarding device.
  • the forwarding device may report the interface information of the forwarding device of the forwarding device to the controller.
  • the forwarding device reports the forwarding device interface information of the forwarding device of the forwarding device and the device information of the forwarding device to the controller.
  • the forwarding device interface information of the forwarding device refers to the information describing the forwarding device interface of the forwarding device, and the device information of the forwarding device refers to Describe the device information of the forwarding device.
  • the device information of the forwarding device includes: a BGP identifier (English name: Identifier). Its value can be expressed as a router ID, which is used to uniquely identify a forwarding device in the entire network. In subsequent embodiments, the device information of the forwarding device is described in detail. If there are multiple forwarding devices, each forwarding device can report the BGP identifier of the forwarding device to the controller.
  • a BGP identifier English name: Identifier
  • the interface information of the forwarding device may include at least one of the following information: an interface identifier (English name: Interface Identifier) information, an interface description (English name: Interface Description) information, and an interface.
  • Service English name: Interface Service
  • interface group English name: Interface Group
  • the interface information of the forwarding device (English name: Interface Descriptors) is defined in IEEE802.1AB, and the interface information is an additional description about the interface, for example, describing the current service usage of the interface.
  • the interface identifier information is used to identify the forwarding device interface of the forwarding device
  • the interface description information is information describing the forwarding device interface of the forwarding device
  • the interface service information is a service type describing the interface, for example, the interface service information may be L3VPN. Or L2VPN or EVPN.
  • the value of the interface group information can be the interface group ID, which can be a 32.
  • the value of the bit (English name: bit) bit can also be a universally unique identifier (English full name: Universally Unique Identifier, English abbreviation: UUID).
  • the interface information of the forwarding device is described in detail in the following embodiments.
  • the type of interface service information is one of the following information: virtual private LAN service (English name: Virtual Private LAN Service, English abbreviation: VPLS) information, virtual private line service (English) Full name: Virtual Private Wire Service, English abbreviation: VPWS) Information, EVPN information and Layer 3 Virtual Private Network (L3VPN) information, which can be combined with application scenarios to determine the specific type of interface service information.
  • the interface service information may include at least one of the following: a virtual private network instance name (English name: VPN Instance name) information, and a virtual private network instance identifier (English name: VPN Instance) ID) information, route distinguisher (English name: Route Distinguisher, English abbreviation: RD) information, routing entry target (English name: Import Route Target, English abbreviation: Import RT), routing export target (English full name: Export Route Target, English abbreviation: Export RT) and Ethernet segment identifier (English full name: Ethernet Segment Identifier, English abbreviation: ESI).
  • a virtual private network instance name English name: VPN Instance name
  • a virtual private network instance identifier English name: VPN Instance ID
  • the controller of step 201 receives the forwarding device interface information reported by the forwarding device, including:
  • the controller receives the forwarding device interface information reported by the forwarding device through the border gateway protocol-link state (English name: BGP-LS).
  • Border gateway protocol-link state English name: BGP-LS
  • BGP-LS refers to a protocol mechanism based on the state of BGP-spreading links.
  • the BGP-LS is defined to collect internal gateway protocols (English name: Internal Gateway Protocol, English abbreviation: IGP), BGP protocol, and statically configured topology information (such as nodes, links, prefixes, and whether to carry bandwidth information, etc.) are mainly used to provide topology information for the control device of the centralized computing path such as PCE, for which the path is calculated. Optimize network routing.
  • the current BGP-LS cannot implement fine-grained control over the service flow of the device.
  • the controller and the forwarding device can be applied to the BGP-LS application scenario, and the controller can receive the L2 layer forwarding device interface information of the forwarding device by using the BGP-LS protocol.
  • the BGP-LS can only collect the L3 layer interface information.
  • the BGP-LS expands the collection interface information, and in particular, can collect the L2 layer forwarding device interface information.
  • the controller selects, from the received forwarding device interface information, at least one forwarding device interface that needs to apply a FlowSpec rule.
  • the controller creates a flow specification (English name: Flow Specification, FlowSpec), which may also be called a FlowSpec route, or a BGP FlowSpec rule.
  • FlowSpec rule has multiple implementation modes, which can be defined by the user or defined by the controller.
  • the user can configure the FlowSpec rule on the controller, or the controller and the network traffic analysis device are linked to automatically generate a denial of service (English name: Denial of Service, English abbreviation: DoS) and distributed denial of service (English full name: Distributed) Denial of Service, English abbreviation: DDoS) FlowSpec rules for attacks.
  • BGP FlowSpec is a standard routing protocol that provides a mechanism to mitigate DDoS attacks when the routing infrastructure is properly integrated with the local DDoS solution.
  • the controller may determine, according to the forwarding device interface information of the forwarding device acquired in step 201, which one or which forwarding device interfaces are required in the FlowSpec rule, and the controller
  • the determined forwarding device interface that needs to apply the FlowSpec rule can be a The forwarding device interface or multiple forwarding device interfaces are not limited here.
  • the current BGP FlowSpec can support the delivery of a fine flow policy or route similar to an access control list (English name: Access Control List, English abbreviation: ACL) or policy routing (English name: Policy Based Routing, English abbreviation: PBR).
  • the BGP FlowSpec cannot implement the interface of the forwarding device that accurately specifies the application of the FlowSpec.
  • the forwarding device can report the forwarding device interface information to the controller, and the controller can use the received forwarding device interface information when configuring the FlowSpec rule.
  • the forwarding device interface of the FlowSpec rule application is configured, so that the controller determines which forwarding device interfaces can use the FlowSpec rule on the control plane, so that fine control of the FlowSpec rule can be achieved.
  • the controller generates an application interface rule according to at least one forwarding device interface that needs to apply a FlowSpec rule.
  • the application interface rule is used to instruct the forwarding device to determine a forwarding device interface that can apply the FlowSpec rule.
  • the application interface rule may be generated by using the FlowSpec message to the forwarding device, and the controller generates the The application interface rule may be used to indicate that the forwarding device determines the forwarding device interface to which the FlowSpec rule can be applied.
  • the application interface rule may be implemented in multiple manners, and then the controller further implements at least one application of the FlowSpec rule by applying the interface rule. An indication of the forwarding device interface.
  • the controller sends a FlowSpec message to the forwarding device.
  • the FlowSpec message includes an application interface rule and a FlowSpec rule.
  • the controller may generate an application interface rule, and the controller sends a FlowSpec message to the forwarding device, for example, the controller may pass the BGP session.
  • the FlowSpec message is sent to the forwarding device, and the forwarding device can determine, by using the application interface rule carried in the FlowSpec message, the at least one forwarding device interface that needs to be applied to the FlowSpec rule.
  • the forwarding device interface information includes: an interface identifier of the forwarding device interface, that is, the forwarding device sends the forwarding device interface identifier of the forwarding device to the controller.
  • the controller may The specific implementation manner of the application interface rule is determined in the following manner.
  • the controller generates an application interface rule according to the at least one forwarding device interface that needs to be applied with the FlowSpec rule, which may include the following steps:
  • the controller acquires at least one interface identifier corresponding to at least one forwarding device interface that needs to apply a FlowSpec rule.
  • the controller interface generates an application interface rule, where the application interface rule includes: an interface identifier set, where the interface identifier set includes at least one interface identifier corresponding to at least one forwarding device interface to which the FlowSpec rule needs to be applied.
  • the controller receives the interface identifier sent by the forwarding device, and the controller can configure the interface identifier that uses the FlowSpec rule.
  • the interface identifies the interface with the forwarding device through the interface identifier.
  • the controller obtains at least one interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule, and the controller generates an application interface rule, where the application interface rule includes: an interface identifier set, where the application needs to be applied in the interface identifier set. At least one interface identifier corresponding to at least one forwarding device interface of the FlowSpec rule.
  • the controller determines that the application interface rule is an interface identifier set, and the controller sends a FlowSpec message carrying the interface identifier set to the forwarding device, and the forwarding device can identify the set from the interface after receiving the FlowSpec rule. Acquiring at least one interface identifier corresponding to the at least one forwarding device interface to which the FlowSpec rule is to be applied, so that the forwarding device can determine whether at least one forwarding device interface corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule exists in the forwarding device interface corresponding to the local device Interface identifier.
  • the forwarding device interface is assigned to a different interface group according to a pre-configuration of the controller.
  • the controller may determine the specific implementation manner of the application interface rule in the following manner: Step 203: The controller generates an application interface rule according to the at least one forwarding device interface that needs to apply the FlowSpec rule, which may include the following steps:
  • the controller determines an interface group to which at least one forwarding device interface to which the FlowSpec rule needs to be applied belongs;
  • the controller obtains the interface group identifier corresponding to the interface group to which the at least one forwarding device interface to which the FlowSpec rule is applied belongs;
  • the controller generates an application interface rule, and the application interface rule includes: an interface group identifier.
  • the controller receives the interface identifier of the forwarding device sent by the forwarding device, and the controller can configure the interface identifier of the forwarding device that uses the FlowSpec rule.
  • the interface passes the interface.
  • the mapping between the group identifier and the interface identifier the controller obtains the interface group identifier corresponding to the interface group to which the at least one forwarding device interface to which the FlowSpec rule is applied, and the controller determines that the application interface rule is implemented by using the interface group identifier, if the controller determines The interface group corresponding to the interface group to which the at least one forwarding device interface to which the FlowSpec rule belongs is required to belong to multiple interface group identifiers.
  • the controller needs to determine the interface group identifier corresponding to each interface group.
  • the controller After the controller generates the application interface rule, the controller sends a FlowSpec message carrying the interface group identifier to the forwarding device. After receiving the FlowSpec message, the forwarding device can obtain the interface group identifier from the FlowSpec message, and obtain the interface group identifier through the interface group identifier. At least one interface identifier corresponding to the at least one forwarding device interface of the FlowSpec rule is required, so that the forwarding device can determine whether there is at least one forwarding device interface that needs to apply the FlowSpec rule in the forwarding device interface corresponding to the local device.
  • the method for processing the FlowSpec message may further include the following steps. :
  • the controller creates an identifier of the interface group and/or an interface identifier of the forwarding device interface included in the interface group.
  • the controller sends the identifier of the interface group and/or the interface identifier of the forwarding device interface included in the interface group to the forwarding device.
  • the controller can pre-configure the interface group identifier and configure which forwarding device interfaces are included in the interface group.
  • the controller can be configured with two interface groups: interface group A and interface group B.
  • A includes the interface identifier 1 and the interface identifier 2
  • the interface group B includes the interface identifier 1 and the interface identifier 3.
  • the forwarding device interface identifier 1 of the forwarding device can belong to the two interface groups at the same time.
  • An interface group is not limited here.
  • the controller can issue the interface group information configured in the step D1 to the forwarding device, so that the forwarding device can obtain the mapping relationship between the interface group and the interface identifier.
  • the step 203 is configured to generate an application interface rule according to the at least one forwarding device interface that needs to apply the FlowSpec rule, and specifically includes the following steps:
  • the controller generates an application interface rule, and the application interface rule includes: a service screening condition, and a service screening condition.
  • the at least one forwarding device interface that needs to apply the FlowSpec rule is filtered out from the device interface information.
  • the controller may configure a service screening condition according to at least one forwarding device interface that needs to apply a FlowSpec rule, and the controller determines that the application interface rule can be a service screening condition.
  • the service screening condition may also be referred to as an interface filtering rule, where the service screening condition is used to filter out at least one forwarding device interface that needs to apply the FlowSpec rule, that is, the controller can filter out at least one forwarding device interface that needs to apply the FlowSpec rule.
  • Conditions to configure business filter criteria are also be referred to as an interface filtering rule, where the service screening condition is used to filter out at least one forwarding device interface that needs to apply the FlowSpec rule, that is, the controller can filter out at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the controller generates an application interface rule, and the application interface rule includes: a service screening condition, the controller sends a FlowSpec message carrying the service screening condition to the forwarding device, and after the forwarding device receives the FlowSpec message, the forwarding device can match the forwarding device according to the service screening condition.
  • a local forwarding device interface such that the forwarding device can determine whether there is at least one forwarding device interface in the local forwarding device interface that needs to apply a FlowSpec rule.
  • the step 204 sends a FlowSpec message to the forwarding device, which may include the following steps:
  • the F1 sends a FlowSpec message to the forwarding device through the BGP route attribute information, and the BGP route attribute information carries the application interface rule.
  • the controller may specifically use the BGP route attribute information to carry the application interface rule. For example, you can add an application interface rule to an existing field in the BGP route attribute information. You can also add a new field to the BGP route attribute information to add an application interface rule. For details, see the following examples.
  • the BGP route attribute information includes at least one of the following information: a flow extension attribute (English name: Flow Extended Attribute) information, and an extension group of an interface group (English name: Interface Group) Attribute (English full name: Extended Communities Attribute, English abbreviation: ECA) information and business filter condition attribute Service filter Attribute information.
  • a flow extension attribute English name: Flow Extended Attribute
  • an extension group of an interface group English name: Interface Group
  • Attribute English full name: Extended Communities Attribute, English abbreviation: ECA
  • the forwarding device can report the forwarding device interface information of the forwarding device to the controller. Therefore, when the FlowSpec rule is sent, the controller can apply the FlowSpec according to the received forwarding device interface information.
  • the forwarding device interface configuration of the rule so that the controller can specifically configure which forwarding device interface or which forwarding device interfaces can apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control a FlowSpec rule to be applied to the flexibly designated forwarding device interface in the forwarding device, so as to automatically and flexibly specify the scope of the flow rule application according to the user requirement, so that the controller can implement the service of the FlowSpec rule. Fine-grained control solves the problem that the current service flow control of the forwarding device is not fine enough.
  • a method for processing a FlowSpec message provided by an embodiment may include the following steps:
  • the forwarding device reports, to the controller, the forwarding device interface information of the forwarding device itself.
  • the controller is a control plane device, and the controller can perform information interaction with the forwarding device.
  • the controller can communicate through BGP and the forwarding device.
  • the forwarding device provided by the embodiment of the present invention may be a device that supports the BGP protocol and establishes a BGP protocol session with other devices.
  • the forwarding device may be a PE device, and the forwarding device may also be a CE device.
  • a BGP session can be established between the controller and the forwarding device, and the forwarding device reports the forwarding device interface information of the forwarding device to the controller through the BGP session, and the forwarding device interface reported by the forwarding device can refer to the physical interface. , can also refer to the logical interface.
  • the forwarding device may be a PE device, and the PE device reports the AC interface identifier of the PE device itself to the controller.
  • the controller can receive the forwarding device interface information reported by the forwarding device through the BGP session.
  • the controller can establish a BGP session with multiple forwarding devices, and each forwarding device can independently perform the foregoing step 301.
  • the forwarding device interface information that is reported by the forwarding device to the controller may include: forwarding interface information of the device and device information of the forwarding device.
  • the forwarding device may report the interface information of the forwarding device and the device information of the forwarding device to the controller.
  • the interface information of the forwarding device refers to the information of the forwarding device interface of the forwarding device
  • the device information of the forwarding device refers to the description of the forwarding device.
  • the device information of the forwarding device includes: a BGP identifier. Its value can be expressed as a router ID, which is used to uniquely identify a forwarding device in the entire network. In subsequent embodiments, the device information of the forwarding device is described in detail. If there are multiple forwarding devices, each forwarding device can report the BGP identifier of the forwarding device to the controller.
  • the interface information of the forwarding device includes at least one of the following: interface identifier information, interface description information, interface service information, and interface group information.
  • the interface information of the forwarding device is defined in IEEE802.1AB, and the interface information is an additional description about the interface, for example, describing the current service usage of the interface.
  • the interface identifier information is used to identify the forwarding device interface of the forwarding device
  • the interface description information is information describing the forwarding device interface of the forwarding device
  • the interface service information is a service type describing the interface, for example, the interface service information may be L3VPN. Or L2VPN or EVPN.
  • the value of the interface group information may be an interface group ID, which may be a 32-bit value or a UUID.
  • the type of the interface service information is one of the following information: virtual private local area network service information, virtual private line service information, EVPN information, and three-layer virtual private network information, which may be combined with an application.
  • the scenario determines the specific type of interface service information.
  • the interface service information may include at least one of the following: virtual private network instance name information, virtual private network instance identification information, route specifier information, routing entry target, and route exit destination. And Ethernet segment identifier.
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller, including:
  • the forwarding device reports the forwarding device interface information of the forwarding device itself to the controller through the border gateway protocol link state BGP-LS.
  • BGP-LS refers to a protocol mechanism based on the state of BGP-spreading links.
  • the BGP-LS is defined to collect IGP, BGP, and statically configured topology information (such as nodes, The link, the prefix, and the bandwidth information are used to provide topology information for the control device of the centralized computing path such as the PCE, for calculating the path, thereby optimizing the network route.
  • statically configured topology information such as nodes, The link, the prefix, and the bandwidth information are used to provide topology information for the control device of the centralized computing path such as the PCE, for calculating the path, thereby optimizing the network route.
  • the current BGP-LS cannot implement fine-grained control over the service flow of the device.
  • the controller and the forwarding device can be applied to the BGP-LS application scenario, and the forwarding device can report the L2 layer forwarding device interface information of the forwarding device by using the BGP-LS protocol, thereby solving the current BGP-LS.
  • the problem that only the L3 layer interface information can be collected is in the embodiment of the present invention.
  • BGP-LS expands the information collected on the interface, especially the information about the interface of the L2 layer forwarding device.
  • the forwarding device receives the FlowSpec message sent by the controller, and obtains an application interface rule and a FlowSpec rule from the FlowSpec message.
  • the controller may send a FlowSpec message carrying the application interface rule to the forwarding device through the BGP session.
  • the application interface rule may be used by the forwarding device to determine at least one forwarding device interface that needs to apply a FlowSpec rule.
  • the forwarding device determines, according to the application interface rule, whether at least one forwarding device interface that needs to apply the FlowSpec rule exists in the forwarding device interface of the forwarding device.
  • the forwarding device may further determine the specific content indicated by the application interface rule, where the application interface rule is configured by the controller side, and the forwarding device may be configured according to the controller.
  • the configuration of the application interface rules is used to resolve the application interface rules.
  • the application interface rules can be implemented in multiple manners.
  • the forwarding device implements the acquisition of at least one forwarding device interface to which the FlowSpec rule needs to be applied.
  • the forwarding device reports the forwarding device interface identifier of the forwarding device to the controller.
  • the forwarding device may determine the specific implementation manner of the application interface rule by using the following manner.
  • the forwarding device determines, according to the application interface rule, whether there is at least one forwarding device interface that needs to apply the FlowSpec rule in the forwarding device interface of the forwarding device, which may include the following steps:
  • the forwarding device obtains the interface identifier from the interface identifier set.
  • the forwarding device searches for the interface identifier in the interface identifier set from the interface identifier corresponding to the forwarding device interface of the forwarding device.
  • the forwarding device After the forwarding device receives the FlowSpec message, the forwarding device obtains the interface identifier set from the FlowSpec message, and the forwarding device can obtain the interface identifier from the interface identifier set, so that the forwarding device is in the forwarding device interface identifier corresponding to the local forwarding device interface. Find if there is at least one interface identifier.
  • the forwarding device interface is assigned to an unused interface group according to a pre-configuration of the controller.
  • the forwarding device may determine the specific implementation manner of the application interface rule by using the following manner: When the application interface rule is the interface group identifier, the forwarding device determines, according to the application interface rule, whether the forwarding device interface of the forwarding device exists.
  • the at least one forwarding device interface that needs to apply the FlowSpec rule may include the following steps:
  • the forwarding device obtains the interface group according to the interface group identifier.
  • the forwarding device searches for the forwarding device interface included in the interface group from the forwarding device interface of the forwarding device.
  • the forwarding device After the forwarding device receives the FlowSpec message, the forwarding device obtains the interface group identifier from the FlowSpec message, and the forwarding device can determine from the interface group identifier that the interface group identifier corresponds to the interface group, and which one or which of the interface groups are forwarded.
  • the device interface belongs to at least one forwarding device interface that needs to apply the FlowSpec rule, so that the forwarding device can determine whether there is a forwarding device interface included in the interface group in the local forwarding device interface.
  • the forwarding device determines, according to the application interface rule, whether the forwarding device interface of the forwarding device has at least one forwarding device interface that needs to apply the FlowSpec rule, the FlowSpec message provided by the embodiment of the present invention.
  • the processing methods also include:
  • the forwarding device receives the identifier of the interface group issued by the controller and the interface label of the forwarding device interface included in the interface group. knowledge;
  • the forwarding device filters the forwarding device interface of the forwarding device according to the identifier of the interface group and/or the interface identifier of the forwarding device interface included in the interface group, and maintains the association between the forwarding device interface and the interface group of the forwarding device.
  • the controller can pre-configure the identifier of the interface group and configure which device interfaces are included in the interface group. After the controller completes the pre-configuration of the interface group, the controller can send the configured interface group information to the forwarding device, so that the forwarding device can obtain the mapping relationship between the interface group and the interface identifier.
  • the forwarding device can filter the forwarding device interface of the forwarding device according to the identifier of the interface group and the interface identifier of the forwarding device interface included in the interface group, and maintain the association relationship between the forwarding device interface and the interface group of the forwarding device.
  • the forwarding device After the interface of the forwarding device sends the interface group information, the forwarding device maintains the forwarding device interface that is associated with the interface group information sent by the controller in the forwarding device interface of the forwarding device, so that the forwarding device can perform the query when performing step H1 and step H2.
  • the mapping between the interface group and the interface group ID, and the interface group determines the forwarding device interface included in the interface group.
  • the forwarding device reports the forwarding device interface identifier of the forwarding device to the controller.
  • the forwarding device may determine the specific implementation manner of the application interface rule by using the following manner.
  • the forwarding device determines, according to the application interface rule, whether there is at least one forwarding device interface that needs to apply the FlowSpec rule in the forwarding device interface of the forwarding device, which may include the following steps:
  • the forwarding device determines that the forwarding device needs to be applied. At least one forwarding device interface of the flow spec rule, if there is no forwarding device interface that meets the service screening condition in the forwarding device interface of the forwarding device, it is determined that there is no at least one forwarding device interface that needs to apply the FlowSpec rule in the forwarding device interface of the forwarding device.
  • the service screening condition is configured by the controller. After the forwarding device obtains the service screening condition from the FlowSpec message, the forwarding device may use the service screening condition to filter the forwarding device interface of the forwarding device, thereby determining whether the forwarding device interface of the forwarding device is There is at least one forwarding device interface that needs to apply a FlowSpec rule.
  • the forwarding device installs and applies the FlowSpec rule to at least one forwarding device interface that needs to apply the FlowSpec rule when the forwarding device interface of the forwarding device has at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the forwarding device when there is at least one forwarding device interface that needs to apply the FlowSpec rule in the forwarding device interface of the forwarding device, it is determined that there is a need to apply the FlowSpec in the forwarding device that can match the FlowSpec rule. At least one forwarding device interface of the rule, the FlowSpec rule can then be installed and applied to at least one forwarding device interface in the forwarding device that needs to apply the FlowSpec rule. In the embodiment of the present invention, the forwarding device applies the FlowSpec rule to at least one forwarding device interface that needs to apply the FlowSpec rule, that is, only the at least one forwarding device interface that needs to apply the FlowSpec rule can receive the packet matching the FlowSpec rule. Processing of FlowSpec rules.
  • the controller configures only the at least one forwarding device interface that needs to apply the FlowSpec rule to match the FlowSpec.
  • the rule is that the other forwarding device interfaces in the forwarding device cannot perform the matching processing of the FlowSpec rule, so as to implement the refinement of the FlowSpec rule, and the service can be configured to the interface level, so that the service delivered by the controller can be refined. deal with.
  • step 304 when there is at least one forwarding device interface that needs to apply the FlowSpec rule in the forwarding device, step 304 can be performed, and only the forwarding device is The FlowSpec rule is applied to at least one forwarding device interface that needs to apply the FlowSpec rule, and the packets received by all device interfaces are not matched by the FlowSpec rule.
  • the forwarding device can report the forwarding device interface information to the controller. Therefore, when the FlowSpec rule is sent, the controller can perform the forwarding device interface information according to the received forwarding device interface information.
  • the forwarding device interface configuration of the FlowSpec rule is applied, so that the controller can specifically configure which forwarding device interface or which forwarding device interfaces can apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control a flow spec rule to be applied to the flexibly designated forwarding device interface in the forwarding device, so as to automatically and flexibly specify the scope of the flow rule application according to the user requirement, and achieve fine control of the service.
  • the node and physical interface information of the forwarding device can be distributed in the Layer 2 domain.
  • the network controller is configured through the network.
  • Netconf reads the LLDP management information database (English name: MIB, Management Information Base) on the forwarding device to obtain L2 topology information discovered by LLDP.
  • MIB Management Information Base
  • the transmission efficiency and real-time performance of the method do not meet the performance requirements of the network controller to collect the network topology, and the service information of the Layer 2 logical interface (such as the L2 tunnel interface or the bundle interface) and the interface is not supported.
  • the controller may collect the forwarding device interface information of the network forwarding device (especially the external connection port of the network edge forwarding device, for example, the L2 service interface), so that the network controller can centrally deploy the application to the designated device.
  • the service policy on the interface for example, the traffic policy is deployed on the AC interfaces of all the specified EVPN instances.
  • the implementation of the traffic policy is to further extend the BGP FlowSpe rule. ID or interface filtering rule information.
  • the controller is specifically configured as an extended route reflector.
  • the controller supports the processing method of the FlowSpec message implemented by the controller side in the embodiment.
  • the forwarding device is specifically a BGP router, and the BGP router can indicate according to the application interface rule.
  • the BGP router selects the appropriate local forwarding device interface to apply the FlowSpec rule.
  • the BGP router reports the forwarding device interface information to the network controller through the extended BGP-LS.
  • the forwarding device interface information that the PE can report includes: an interface such as an AC interface (including a logical interface). Information (including interface description, node description), so that network topology information with mounted service information can be formed.
  • the EVPN/L3VPN service is configured on the interface of the device.
  • the interface is the service mount point.
  • the device interface identifier and the service information configured on the interface are defined.
  • the BGP protocol is reported to the controller by the BGP protocol extended by the BGP router. .
  • the controller creates a FlowSpec rule according to the user policy, and specifies a forwarding device interface of the application according to the network topology (that is, the foregoing at least one forwarding device interface that needs to apply the FlowSpec rule), thereby generating an application interface rule.
  • a forwarding device interface of the application according to the network topology (that is, the foregoing at least one forwarding device interface that needs to apply the FlowSpec rule)
  • the controller creates a FlowSpec rule according to the user policy, and specifies a forwarding device interface of the application according to the network topology (that is, the foregoing at least one forwarding device interface that needs to apply the FlowSpec rule), thereby generating an application interface rule.
  • all AC interfaces of VPN1 can generate application interface rules and then carry them in the FlowSpec rules.
  • all AC interfaces that the controller filters the acquisition conditions from the network topology are sent to the client BGP routers as additional attributes of the FlowSpec rules.
  • the BGP router After receiving the FlowSpec message, the BGP router performs at least one of the following checks:
  • the FlowSpec message carries an interface identifier set (which can be carried in a specific path attribute), it checks whether there is a local forwarding device interface in the interface identifier set.
  • An interface group may carry one or more interface identifiers, and the interface identifier may be a UUID or a combination of a device ID and an interface ID.
  • the forwarding device interface of the forwarding device is filtered according to the service attribute filtering condition, and there is a matching service.
  • the forwarding device interface for attribute filtering.
  • the BGP router determines, by using the determining process of any one of the foregoing steps (1), (2), and (3), that the forwarding device interface includes at least one forwarding device interface that needs to apply the FlowSpec rule, and the BGP router verifies that the FlowSpec rule is installed. And specify to apply to at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the FlowSpec rule is applied to at least one forwarding device interface that needs to apply the FlowSpec rule, that is, the packet received by the at least one forwarding device interface that needs to apply the FlowSpec rule is configured to perform the matching processing of the FlowSpec rule. If not applied, the packets received by all interfaces must be matched by the FlowSpec rule.
  • the BGP FlowSpec (RFC5575) defines the legality check mechanism of the FlowSpec rule. The installation is to send the valid and optimized FlowSpec rules to the forwarding plane of the forwarding device, and direct the forwarding device to forward the received packets.
  • Figure 4-a is a schematic diagram of the data structure of the interface NLRI according to the embodiment of the present invention.
  • the value of the protocol-ID (Protocol-ID) is set to 5, indicating the static configuration type (Static configuration).
  • the identifier represents the routing domain of the topology information, which is 64 bits. A specific configuration value can be used for the L2AC interface.
  • Node Descriptors are defined by one or more sub-TLVs (Type, Length, Value), referred to as Sub-TLV in subsequent embodiments, which is an extensible option definition.
  • Node Descriptors and Interface Descriptors are variables. Further, the Node Descriptors must include a sub-TLV of the BGP identifier (Identifier), and its value can be filled in as a router ID for uniquely identifying a BGP router throughout the network.
  • a BGP router is a device that supports the BGP protocol and establishes a BGP protocol session with other devices. For example PE or CE. Referring to FIG. 4-b, FIG.
  • FIG. 4-b is a schematic diagram of a data structure of an Extended Node Descriptor Sub-TLVs according to an embodiment of the present invention.
  • the Extended Node Descriptor Sub-TLVs include the BGP Identifier.
  • the Sub-TLV name is TBD1, which is mandatory (Mandatory) and occupies 4 bits.
  • the interface descriptors are composed of one or more Sub-TLVs, and must include an Interface Identifier (Sub-TLV), and the specific value may be an Interface Identifier value.
  • its value refers to the definition of IEEE802.1AB 8.5.3, which can be an interface name, which uniquely identifies an interface on a BGP router (the interface can be either a physical interface or a logical interface).
  • the value of the interface group Sub-TLV is the ID of the interface group to which the interface belongs. The interface group ID is deployed in the entire network.
  • the optimal configuration can be deployed by the controller in a single AS to avoid cross-domain dissemination. If an Interface NLRI carries multiple Interface Group Sub-TLVs, the interface belongs to multiple interface groups. If the Interface Group Sub-TLV is not carried, the interface does not belong to any interface group.
  • the interface description information is defined in Ref IEEE802.1AB 8.5.5, which is an additional description about the interface, such as describing the current service usage of the interface.
  • FIG. 4-c is an extended interface description (Extended Interface) according to an embodiment of the present invention.
  • Descriptor) Sub-TLVs data structure diagram Extended Interface Descriptor Sub-TLVs include: TBD2 (required), TBD3 optional (optal), TBD4-7 (optional) and TBD14 (optional), TBD2 is Forced to write, can represent the length of the Interface Identifier, TBD3, TBD4 ⁇ 7 and TBD14 are optional, can be determined in combination with the application scenario.
  • TBD3 can represent Interface Description
  • TBD4 ⁇ 7 can represent Interface Service
  • TBD14 can represent Interface Group
  • Interface Identifier and Interface Description can refer to IEEE802.1AB 8.5.3 and IEEE802.1AB 8.5.5.
  • the interface service and the interface group are the value values described in the embodiment of the present invention.
  • the value of the Interface Service can be seen in the Sub TLVs described in Figure 4-e, for example, the value in Figure 4-e.
  • the Interface Group can be a UUID or other integer.
  • FIG. 4-d is a schematic diagram of a data structure of an Interface Service Sub-TLVs according to an embodiment of the present invention, and Interface Service Sub-TLVs.
  • the reference definitions are shown in 4-d.
  • TBD4 indicates L2VPN (VPLS)
  • TBD5 means L2VPN (VPWS)
  • TBD6 means EVPN
  • TBD7 means L3VPN
  • L2VPN VPLS
  • L2VPN VPWS
  • EVPN EVPN
  • L3VPN L3VPN
  • L2VPN VPLS
  • VPWS L2VPN
  • EVPN EVPN
  • L3VPN are optional Can be determined in conjunction with the application scenario.
  • the value of L2VPN (VPLS), L2VPN (VPWS), EVPN, and L3VPN can be seen in the Sub TLVs described in Figure 4-e, for example, the value in Figure 4-e.
  • each of the Interface Service Sub-TLVs may include the following VPN name (name), RD, import (RT) RT, export (Export) RT, ESI, etc.
  • Sub-TLV As shown in Figure 4-e, Figure 4-e is a schematic diagram of the data structure of an Extended Service Sub-TLVs according to an embodiment of the present invention.
  • TBD8 indicates VPN.
  • the length of the name is optional.
  • the value of the VPN name can be the VPN instance name.
  • TBD9 represents RD, which can be an RD value.
  • TBD10 represents Import RT, which can be an RT value.
  • TBD11 (optional) means Export RT, the value can be RT value, RD, Import RT, Export RT can be 8 bits in length, TBD12 (optional) means ESI, its length is optional, it takes The value can be an ESI value.
  • An Interface Service Sub-TLV can contain multiple Import RTs or Export RT Sub-TLVs. Of course, ESI Sub-TLV can only be included in the Sub-TLV of the EVPN Service.
  • the controller applies the FlowSpec rule to one or more interface groups, and delivers the BGP FlowSpec rule to each BGP router, which carries one or more specific types of BGP route attributes, and the BGP route attribute carries the interface identifier applied by the rule. Collection information. For example, the Bound interface sub-TLVs are carried in the Flow Extended Attribute.
  • FIG. 4-f is a schematic diagram of a data structure of a Bound interfac Sub-TLVs according to an embodiment of the present invention.
  • the TBD 15 may be a Bound interface sub-TLV, a Bound interface sub-TLV.
  • the length can be 2 bytes (Octets).
  • Bound interface sub-TLV the definitions of Node Descriptor and Interface Descriptor are the same as those in BGP-LS Interface NLRI.
  • the BGP router After receiving the FlowSpec rule, the BGP router obtains the interface identifier set carried in the FlowSpec rule, checks whether there is a forwarding device interface in the interface identifier set, and applies the FlowSpec rule to these forwarding devices. On the interface, the FlowSpec rule can also be called a FlowSpec route.
  • the controller creates an interface group according to the service policy, and adds a set of interfaces that meet the service requirements (for example, all AC interfaces of the EVPN network) to the corresponding interface group information.
  • This business policy is used to create an interface group.
  • the controller sends the BGP-LS interface NLRI (Interface Group Sub-TLV) to each BGP router.
  • Each BGP router filters the local forwarding device interface and saves the association between the forwarding device interface and the Interface Group ID. For example, the interface
  • the attribute configuration is associated with one or more interface group IDs).
  • the controller applies the FlowSpec rule to one or more interface groups, and delivers the BGP FlowSpec rule to each BGP router, which carries one or more Interface Group's Extended Communities Attributes.
  • the definition of the Interface Group Sub-TLV is the same as the definition of the Interface Group Sub-TLV in the NL-Interface NLRI.
  • the BGP router After receiving the FlowSpec rule, the BGP router obtains the interface group to which the FlowSpec rule is applied, and applies the FlowSpec rule to the forwarding device interface corresponding to the interface group.
  • the controller applies a FlowSpec rule to a service type interface (for example, an EVPN-bound EVI interface), and carries one or more specific types of BGP route attributes (for example, Flow Extended Attribute), which is carried in the BGP route attribute.
  • Service attribute sub-TLV The definition of the Service Filter sub-TLV is the same as the definition of the Interface Service in the NL-Interface NLRI.
  • the BGP router After receiving the FlowSpec rule, the BGP router obtains the service attribute filtering condition carried by the FlowSpec rule, filters the local forwarding device interface according to the service attribute filtering condition, and applies the FlowSpec rule to the forwarding device interface that matches the service attribute filtering condition. on.
  • the controller may include a network controller, an extended PCE device, and the controller collects L2 interface information (for example, an interface ID and a key service attribute) of the forwarding device through the BGP-LS.
  • the controller uses the BGP-FlowSpec to carry the application interface rule to indicate which device interfaces the forwarded BGP router FlowSpec route is applied to. Only the forwarding device interfaces in the selected forwarding device interface install the FlowSpec route, thereby supporting the network edge. Business control.
  • the BGP-LS can collect the internal topology information of the network and collect the outbound interface information of the network edge to form a more complete network topology database for various types.
  • the use of service applications not only supports path calculation within the network, but also supports service control at the edge of the network, and implements fine flow access control policies.
  • the interface group is defined according to the service characteristics, and then the FlowSpec rule is applied to these interface groups. This can perform actions supported by the FlowSpec rule for the specified service and the specified flow, such as redirection and speed limit.
  • the BGP FlowSpec route is applied to the network L2/L3 layer interface to provide interface information support and support FlowSpec routes to carry application interface rule dissemination, thereby implementing fine flow service control based on the device interface.
  • a controller 500 may include: a receiving module 501, an interface configuration module 502, an application interface rule generating module 503, and a sending module 504, where
  • the receiving module 501 is configured to receive forwarding device interface information reported by the forwarding device.
  • the interface configuration module 502 is configured to select, from the received forwarding device interface information, at least one forwarding device interface that needs to apply a FlowSpec rule.
  • the application interface rule generating module 503 is configured to generate an application interface rule according to the at least one forwarding device interface that needs to apply the FlowSpec rule, where the application interface rule is used to instruct the forwarding device to determine a forwarding device that can apply the FlowSpec rule. interface;
  • the sending module 504 is configured to send a FlowSpec message to the forwarding device, where the FlowSpec message includes the application interface rule and the FlowSpec rule.
  • the forwarding device interface information includes: an interface identifier of a forwarding device interface
  • the application interface rule generating module 503 is configured to obtain at least one interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule, and generate an application interface rule, where the application interface rule includes: an interface identifier set, and the interface identifier The set includes: at least one interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule
  • the application interface rule generating module 503 is specifically configured to determine an interface group to which the at least one forwarding device interface that needs to apply the FlowSpec rule belongs, and obtain at least one forwarding that needs to apply the FlowSpec rule.
  • the application interface rule is generated.
  • the application interface rule includes: the interface group identifier.
  • the controller 500 further includes: an interface group processing module 505, configured to create an interface group identifier and an interface of the forwarding device interface included in the interface group. And the forwarding device sends the created interface group identifier and the interface identifier of the forwarding device interface included in the interface group.
  • the application interface rule generating module 503 is specifically configured to generate an application interface rule, where the application interface rule includes: a service screening condition, where the service screening condition is used to interface from the forwarding device The information is filtered out to at least one forwarding device interface that needs to apply a FlowSpec rule.
  • the sending module 503 is specifically configured to send a FlowSpec message to the forwarding device by using BGP routing attribute information, where the BGP routing attribute information carries the application interface rule.
  • the BGP route attribute information includes at least one of the following information: a flow extension attribute, an extended group attribute ECA information of an interface group, an interface group, and a service filter attribute. information.
  • the receiving module 501 is configured to receive, by using a border gateway protocol link state BGP-LS protocol, forwarding device interface information reported by the forwarding device.
  • the forwarding device can report the forwarding device interface information of the forwarding device to the controller. Therefore, when the FlowSpec rule is sent, the controller can apply the FlowSpec according to the received forwarding device interface information.
  • the forwarding device interface configuration of the rule so that the controller can specifically configure which forwarding device interface or which forwarding device interfaces can apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control the flexible application of a FlowSpec rule to the forwarding device.
  • the specified forwarding device interface is used to automatically and flexibly specify the scope of the flow rule application according to user requirements, so as to achieve fine control of the service.
  • a forwarding device 600 may include: a sending module 601, a receiving module 602, an interface identifying module 603, and a FlowSpec rule applying module 604, where
  • the sending module 601 is configured to report, to the controller, forwarding device interface information of the forwarding device itself;
  • the receiving module 602 is configured to receive a FlowSpec message sent by the controller, and obtain an application interface rule and a FlowSpec rule from the FlowSpec message.
  • An interface identification module 603, configured to determine, according to the application interface rule, whether at least one forwarding device interface that needs to apply a FlowSpec rule exists in a forwarding device interface of the forwarding device;
  • the FlowSpec rule application module 604 is configured to apply the FlowSpec rule to the at least one forwarding that needs to apply the FlowSpec rule when the forwarding device interface of the forwarding device has the at least one forwarding device interface that needs to apply the FlowSpec rule. On the device interface.
  • the interface identification module 603 is specifically configured to obtain an interface identifier from the interface identifier set; and forward the forwarding device.
  • the interface identifier corresponding to the device interface is searched for the interface identifier in the interface identifier set.
  • the interface identification module 603 is specifically configured to obtain an interface group according to the interface group identifier; and forward the forwarding device.
  • the device interface searches for the forwarding device interface included in the interface group.
  • the forwarding device 600 further includes: an interface group processing module 605, configured to determine, by the interface identification module 603, the forwarding according to the application interface rule. Before the at least one forwarding device interface of the device is configured, the interface group identifier that is issued by the controller and the interface identifier of the forwarding device interface included in the interface group are received; The group identifier and the interface identifier of the forwarding device interface included in the interface group filter the forwarding device interface of the forwarding device, and maintain the association relationship between the forwarding device interface and the interface group of the forwarding device.
  • the interface identification module 603 is specifically configured to: search for a presence of the service screening condition from the forwarding device interface of the forwarding device. a forwarding device interface, if the forwarding device interface of the forwarding device has a forwarding device interface that satisfies the service screening condition, determining that the forwarding device has at least one forwarding device interface that needs to apply a FlowSpec rule, if The forwarding device interface of the forwarding device does not have the forwarding device interface that meets the service screening condition, and the at least one forwarding device interface that needs to apply the FlowSpec rule does not exist in the forwarding device interface of the forwarding device.
  • the forwarding device interface information includes: interface information of the forwarding device and device information of the forwarding device.
  • the device information of the forwarding device includes: a BGP identifier Identifier.
  • the interface information of the forwarding device includes at least one of the following information:
  • Interface identifier Interface Identifier information interface description Interface Description information, interface service Interface Service information, and interface group Interface Group information.
  • the type of the interface service Interface Service information is one of the following information: virtual private local area network service VPLS information, virtual private line service VPWS information, Ethernet virtual private network EVPN information, and three-layer virtual Private network L3VPN information.
  • the interface service Interface Service information includes at least one of the following: a virtual private network instance name VPN Instance name information, a virtual private network instance identifier VPN Instance ID information, and a route identifier RD. Information, routing entry target Import RT, route exit destination Export RT, and Ethernet segment identifier ESI.
  • the sending module 601 is specifically configured to report the L2 layer device interface information of the forwarding device itself to the controller by using the border gateway protocol link state BGP-LS.
  • the forwarding device can report the forwarding device interface information to the controller. Therefore, when the FlowSpec rule is sent, the controller can perform the forwarding device interface information according to the received forwarding device interface information.
  • the forwarding device interface configuration of the FlowSpec rule is applied, so that the controller can specifically configure which forwarding device interface or which forwarding device interfaces can apply the FlowSpec rule and generate corresponding application interface rules.
  • the controller can control a flow spec rule to be applied to the flexibly designated forwarding device interface in the forwarding device, so as to automatically and flexibly specify the scope of the flow rule application according to the user requirement, and achieve fine control of the service.
  • the embodiment of the present invention further provides a computer storage medium, wherein the computer storage medium stores a program, and the program executes some or all of the steps described in the foregoing method embodiments.
  • the controller 700 includes:
  • the receiver 701, the transmitter 702, the processor 703, and the memory 704 (wherein the number of processors 703 in the controller 700 may be one or more, and one processor in FIG. 7 is taken as an example).
  • the receiver 701, the transmitter 702, the processor 703, and the memory 704 may be connected by a bus or other means, wherein the bus connection is taken as an example in FIG.
  • Memory 704 can include read only memory and random access memory and provides instructions and data to processor 703. A portion of the memory 704 may also include a non-volatile random access memory (English name: Non-Volatile Random Access Memory, English abbreviation: NVRAM).
  • the memory 704 stores operating systems and operational instructions, executable modules or data structures, or a subset thereof, or an extended set thereof, wherein the operational instructions can include various operational instructions for implementing various operations.
  • the operating system can include a variety of system programs for implementing various basic services and handling hardware-based tasks.
  • the processor 703 controls the operation of the controller 700.
  • the processor 703 may also be referred to as a central processing unit (English name: Central Processing Unit, English abbreviation: CPU).
  • CPU Central Processing Unit
  • the various components of the controller 700 are coupled together by a bus system.
  • the bus system may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus.
  • the various buses are referred to as bus systems in the figures.
  • the method disclosed in the foregoing embodiments of the present invention may be applied to the processor 703 or implemented by the processor 703.
  • the processor 703 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 703 or an instruction in a form of software.
  • the processor 703 may be a general-purpose processor, a digital signal processor (English name: digital signal processing, English abbreviation: DSP), an application specific integrated circuit (English name: Application Specific Integrated Circuit, English abbreviation: ASIC), ready-made programmable Gate array (English name: Field-Programmable Gate Array, English abbreviation: FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in memory 704, and processor 703 reads the information in memory 704 and, in conjunction with its hardware, performs the steps of the above method.
  • the receiver 701 can be configured to receive input digital or character information, and generate signal inputs related to the controller's related settings and function control.
  • the transmitter 702 can include a display device such as a display screen, and the transmitter 702 can be used to output digital signals through an external interface. Or character information.
  • the processor 703 is configured to perform the following steps:
  • the FlowSpec message including the application interface rule and the FlowSpec rule.
  • the forwarding device interface information includes: an interface identifier of the forwarding device interface; and the processor 703 is specifically configured to perform the following steps:
  • the application interface rule is generated, and the application interface rule includes: an interface identifier set, where the interface identifier set includes: at least one interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the processor 703 is specifically configured to perform the following steps:
  • An application interface rule is generated, where the application interface rule includes: the interface group identifier.
  • the processor 703 is further configured to: before determining the interface group to which the interface identifier corresponding to the at least one forwarding device interface that needs to apply the FlowSpec rule belongs, create the interface group identifier and the interface group includes Interface identifier of the forwarding device interface;
  • the processor 703 is specifically configured to perform the following steps:
  • the application interface rule is generated, and the application interface rule includes: a service screening condition, where the service filtering condition is used to filter out, by the forwarding device interface information, the at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the processor 703 is specifically configured to perform the following steps:
  • the processor 703 is specifically configured to perform the following steps:
  • the forwarding device interface information reported by the forwarding device is received by the border gateway protocol link state BGP-LS protocol.
  • the forwarding device 800 is provided. include:
  • the receiver 801, the transmitter 802, the processor 803, and the memory 804 (wherein the number of processors 803 in the forwarding device 800 may be one or more, and one processor in FIG. 8 is taken as an example).
  • the receiver 801, the transmitter 802, the processor 803, and the memory 804 may be connected by a bus or other means, wherein the bus connection is taken as an example in FIG.
  • Memory 804 can include read only memory and random access memory and provides instructions and data to processor 803. A portion of the memory 804 may also include an NVRAM.
  • the memory 804 stores operating systems and operational instructions, executable modules or data structures, or a subset thereof, or an extended set thereof, wherein the operational instructions can include various operational instructions for implementing various operations.
  • the operating system can include a variety of system programs for implementing various basic services and handling hardware-based tasks.
  • the processor 803 controls the operation of the forwarding device, which may also be referred to as a CPU.
  • each component of the forwarding device is coupled together by a bus system.
  • the bus system may include a power bus, a control bus, and a status signal bus in addition to the data bus.
  • the various buses are referred to as bus systems in the figures.
  • the method disclosed in the foregoing embodiment of the present invention may be applied to the processor 803 or implemented by the processor 803.
  • the processor 803 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 803 or an instruction in a form of software.
  • the processor 803 described above may be a general purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in memory 804, and processor 803 reads the information in memory 804 and, in conjunction with its hardware, performs the steps of the above method.
  • the processor 803 is configured to perform the following steps:
  • the FlowSpec rule is applied to the at least one forwarding device interface that needs to apply the FlowSpec rule.
  • the processor 803 when the application interface rule is an interface identifier set, the processor 803 is specifically configured to perform the following steps:
  • the interface identifier corresponding to the forwarding device interface of the forwarding device is searched for whether the interface identifier in the interface identifier set exists.
  • the processor 803 when the application interface rule is an interface group identifier, the processor 803 is specifically used. Perform the following steps:
  • the processor 803 is specifically configured to: before determining, according to the application interface rule, whether there is at least one forwarding device interface in the forwarding device interface of the forwarding device that needs to apply a FlowSpec rule, Receiving an interface group identifier issued by the controller and an interface identifier of a forwarding device interface included in the interface group;
  • the processor 803 when the application interface rule is a service screening condition, the processor 803 is specifically configured to perform the following steps:
  • the forwarding device interface of the forwarding device Determining, by the forwarding device interface of the forwarding device, whether there is a forwarding device interface that meets the service screening condition, and if there is a forwarding device interface that meets the service screening condition in the forwarding device interface of the forwarding device, determining the The forwarding device has the at least one forwarding device interface that needs to apply the FlowSpec rule. If the forwarding device interface of the forwarding device does not have a forwarding device interface that meets the service screening condition, the forwarding device interface of the forwarding device is determined. There is no at least one forwarding device interface that needs to apply a FlowSpec rule.
  • the forwarding device interface information stored in the memory 804 includes at least one of the following: interface identifier Interface Identifier information, interface description Interface Description information, interface service Interface Service information, and interface group Interface Group. information.
  • the processor 803 is configured to perform the following steps: reporting the forwarding device interface information of the forwarding device itself to the controller through the border gateway protocol link state BGP-LS.
  • the foregoing embodiment separately describes the controller and the forwarding device provided by the embodiment of the present invention. Referring next to the processing system 900 of the FlowSpec message shown in FIG. 9, the controller 901 as described in the foregoing embodiment and the foregoing Forwarding device 902 as described in the embodiment.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be Physical units can be located in one place or distributed to multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • the connection relationship between the modules indicates that there is a communication connection between them, and specifically, one or more communication buses or signal lines can be realized.
  • the present invention can be implemented by means of software plus necessary general hardware, and of course, dedicated hardware, dedicated CPU, dedicated memory, dedicated memory, Special components and so on.
  • functions performed by computer programs can be easily implemented with the corresponding hardware, and the specific hardware structure used to implement the same function can be various, such as analog circuits, digital circuits, or dedicated circuits. Circuits, etc.
  • software program implementation is a better implementation in more cases.
  • the technical solution of the present invention which is essential or contributes to the prior art, can be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer.
  • U disk mobile hard disk, read-only memory (ROM, Read-Only Memory), a random access memory (RAM), a magnetic disk or an optical disk, etc., including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the embodiments of the present invention. method.
  • a computer device which may be a personal computer, a server, or a network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种FlowSpec消息的处理方法和装置以及系统，用于实现对转发设备的业务流按照转发设备接口进行精细化控制。FlowSpec消息的处理方法可包括：控制器接收转发设备上报的转发设备接口信息；所述控制器从接收到的所述转发设备接口信息中选择出需要应用FlowSpec规则的至少一个转发设备接口；所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，所述应用接口规则用于指示所述转发设备确定出能够应用所述FlowSpec规则的转发设备接口；所述控制器向所述转发设备发送FlowSpec消息，所述FlowSpec消息包括所述应用接口规则和所述FlowSpec规则。

Description

FlowSpec消息的处理方法和装置以及系统
本申请要求于2016年7月7日提交中国专利局、申请号为CN 201610533501.5、发明名称为“FlowSpec消息的处理方法和装置以及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域，尤其涉及一种流规范(英文全称：Flow Specification，英文简称：FlowSpec)消息的处理方法和装置以及系统。
背景技术
边界网关协议(英文全称：Border Gateway Protocol，英文简称：BGP)是一种用于自治系统(英文全称：Autonomous System，英文简称：AS)之间的动态路由协议。简称BGP广泛应用在网络(英文名称：Internet)中，用于在AS之间和AS内边缘路由器间传递路由信息。传递的路由信息包括：网络协议(英文全称：Internet Protocol，英文简称IP)路由、媒体接入控制(英文全称：Media Access Control，简称MAC)路由和FlowSpec规则等网络侧可达信息(Network Layer Reachability Information，简称NLRI)信息。该BGP FlowSpec规则是基于软件定义网络(Software Defined Network，SDN)架构的集中式流量调度技术中的一种。集中式的SDN控制器通过BGP FlowSpec消息向转发设备下发FlowSpec规则，从而可以按照用户的需求，对业务流进行优化调度。
然而，现有技术中控制器通过FlowSpec消息下发一条流规则，在转发设备上会优选安装该流规则后会进行全局生效，即转发设备的所有设备接口接入的流量都会尝试匹配该流规则，造成流规则的控制粒度太大，不够精细。
发明内容
本发明实施例提供了一种FlowSpec消息的处理方法和装置以及系统，用于实现对转发设备的业务流按照转发设备接口进行精细化控制。
为解决上述技术问题，本发明实施例提供以下技术方案：
第一方面，本发明实施例提供一种FlowSpec消息的处理方法，包括：
控制器接收转发设备上报的转发设备接口信息；
所述控制器从接收到的所述转发设备接口信息中选择出需要应用FlowSpec规则的至少一个转发设备接口；
所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，所述应用接口规则用于指示所述转发设备确定出能够应用所述FlowSpec规则的转发设备接口；
所述控制器向所述转发设备发送FlowSpec消息，所述FlowSpec消息包括所述应用接口规则和所述FlowSpec规则。
在本发明实施例中，由于转发设备向控制器上报该转发设备自身的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者 哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，达到对业务的精细化控制。
结合第一方面，在第一方面的第一种可能的实现方式中，所述转发设备接口信息，包括：转发设备接口的接口标识；
所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，包括：
所述控制器获取所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识；
所述控制器生成应用接口规则，所述应用接口规则包括：接口标识集合，所述接口标识集合包括：所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识。
本发明实施例中可以控制器可以在应用接口规则中包括接口标识集合，通过接口标识集合来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第一方面，在第一方面的第二种可能的实现方式中，所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，包括：
所述控制器确定所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组；
所述控制器获取所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组标识；
所述控制器生成应用接口规则，所述应用接口规则包括：所述接口组标识。
本发明实施例中可以控制器可以在应用接口规则中包括接口组标识，通过接口组标识来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，所述控制器确定所述需要应用FlowSpec规则的至少一个转发设备接口对应的接口标识所属的接口组之前，所述方法还包括：
所述控制器创建接口组标识和接口组包括的转发设备接口的接口标识；
所述控制器向所述转发设备发送创建的接口组标识和接口组包括的转发设备接口的接口标识。
结合第一方面，在第一方面的第四种可能的实现方式中，所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，包括：
所述控制器生成应用接口规则，所述应用接口规则包括：业务筛选条件，所述业务筛选条件用于从所述转发设备接口信息中筛选出所述需要应用FlowSpec规则的至少一个转发设备接口。
本发明实施例中可以控制器可以在应用接口规则中包括业务筛选条件，通过业务筛选条件来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第一方面或第一方面的第一种可能或第二种可能或第三种可能或第四种可能的实现方式，在第一方面的第五种可能的实现方式中，所述控制器向所述转发设备发送FlowSpec消息，包括：
所述控制器通过BGP路由属性信息向所述转发设备发送FlowSpec消息，所述BGP路由属性信息承载有所述应用接口规则。
本发明实施例中，控制器可以通过BGP路由属性信息承载应用接口规则，从而通过对BGP路由属性信息的扩展完成FlowSpec消息的发送。
结合第一方面或第一方面的第一种可能或第二种可能或第三种可能或第四种可能的实现方式，在第一方面的第六种可能的实现方式中，所述控制器接收转发设备上报的转发设备接口信息，包括：
所述控制器通过边界网关协议链路状态BGP-LS协议接收转发设备上报的转发设备接口信息。
本发明实施例中，控制器和转发设备可以通过BGP-LS协议进行通信，完成在BGP-LS场景下转发设备接口信息的传输。
结合第一方面的第五种可能的实现方式，在第一方面的第七种可能的实现方式中，所述BGP路由属性信息包括如下信息中的至少一种：流扩展属性Flow Extended Attribute信息、接口组Interface Group的扩展团体属性ECA信息和业务筛选条件属性Service filter Attribute信息。
第二方面，本发明实施例还提供一种信息的处理方法，包括
转发设备向控制器上报该转发设备自身的转发设备接口信息；
所述转发设备接收所述控制器发送的FlowSpec消息，并从所述FlowSpec消息中获取到应用接口规则和FlowSpec规则；
所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口；
当所述转发设备的转发设备接口中存在所述需要应用FlowSpec规则的至少一个转发设备接口时，所述转发设备将所述FlowSpec规则应用到所述需要应用FlowSpec规则的至少一个转发设备接口上。
在本发明实施例中，由于转发设备向控制器上报该转发设备自身的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，达到对业务的精细化控制。
结合第二方面，在第二方面的第一种可能的实现方式中，当所述应用接口规则为接口标识集合时，所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，包括：
所述转发设备从所述接口标识集合中获取到接口标识；
所述转发设备从所述转发设备的转发设备接口对应的接口标识中查找是否存在所述接口标识集合中的接口标识。
本发明实施例中可以控制器可以在应用接口规则中包括接口标识集合，通过接口标识集合来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第二方面，在第二方面的第二种可能的实现方式中，当所述应用接口规则为接口组标识时，所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，包括：
所述转发设备根据所述接口组标识获取到接口组；
所述转发设备从所述转发设备的转发设备接口中查找是否存在所述接口组中包括的转发设备接口。
本发明实施例中可以控制器可以在应用接口规则中包括接口组标识，通过接口组标识来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口之前，所述方法还包括：
所述转发设备接收所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识；
所述转发设备根据所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识筛选所述转发设备的转发设备接口，维护所述转发设备的转发设备接口与接口组之间的关联关系。
结合第二方面，在第二方面的第四种可能的实现方式中，当所述应用接口规则为业务筛选条件时，所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，包括：
所述转发设备从所述转发设备的转发设备接口中查找是否存在满足所述业务筛选条件的转发设备接口，若所述转发设备的转发设备接口中存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备中存在所述需要应用FlowSpec规则的至少一个转发设备接口，若所述转发设备的转发设备接口中不存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备的转发设备接口中不存在所述需要应用FlowSpec规则的至少一个转发设备接口。
本发明实施例中可以控制器可以在应用接口规则中包括业务筛选条件，通过业务筛选条件来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第二方面或第二方面的第一种可能或第二种可能或第三种可能或第四种可能的实现方式，在第二方面的第五种可能的实现方式中，所述转发设备接口信息，包括如下信息中的至少一种：接口标识符Interface Identifier信息、接口描述Interface Description信息、接口服务Interface Service信息和接口组Interface Group信息。
结合第二方面或第二方面的第一种可能或第二种可能或第三种可能或第四种可能的实现方式，在第二方面的第六种可能的实现方式中，所述转发设备向控制器上报该转发设备自身的转发设备接口信息，包括：
所述转发设备通过边界网关协议链路状态BGP-LS向控制器上报该转发设备自身的转发设备接口信息。
本发明实施例中，控制器和转发设备可以通过BGP-LS协议进行通信，完成在BGP-LS场景下转发设备接口信息的传输。
结合第二方面的第五种可能的实现方式，在第二方面的第七种可能的实现方式中，所述转发设备接口信息，包括：转发设备的接口信息，和/或转发设备的设备信息。
所述转发设备的设备信息，包括：BGP标识符Identifier。
所述Interface Service信息的类型是如下信息中的一种：虚拟专用局域网业务VPLS信息、虚拟专线业务VPWS信息、以太网虚拟专用网EVPN信息和三层虚拟专用网L3VPN信息。
所述Interface Service信息，包括如下信息中的至少一种：虚拟专用网实例名称VPN Instance name信息、虚拟专用网实例标识VPN Instance ID信息、路由区分符RD信息、路由入口目标Import RT、路由出口目标Export RT和以太网段标识符ESI。
第三方面，本发明实施例还提供一种控制器，包括：
接收模块，用于接收转发设备上报的转发设备接口信息；
接口配置模块，用于从接收到的所述转发设备接口信息中选择出需要应用FlowSpec规则的至少一个转发设备接口；
应用接口规则生成模块，用于根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，所述应用接口规则用于指示所述转发设备确定出能够应用所述FlowSpec规则的转发设备接口；
发送模块，用于向所述转发设备发送FlowSpec消息，所述FlowSpec消息包括所述应用接口规则和所述FlowSpec规则。
在本发明实施例中，由于转发设备向控制器上报该转发设备自身的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，达到对业务的精细化控制。
结合第三方面，在第三方面的第一种可能的实现方式中，所述转发设备接口信息，包括：转发设备接口的接口标识；
所述应用接口规则生成模块，具体用于获取所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识；生成应用接口规则，所述应用接口规则包括：接口标识集合，所述接口标识集合包括：所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识。
本发明实施例中可以控制器可以在应用接口规则中包括接口标识集合，通过接口标识集合来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第三方面，在第三方面的第二种可能的实现方式中，所述应用接口规则生成模块，具体用于确定所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组；获取所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组标识；生成应用接口规则，所述应用接口规则包括：所述接口组标识。
本发明实施例中可以控制器可以在应用接口规则中包括接口组标识，通过接口组标识来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，所述控制器，还包括：接口组处理模块，用于创建接口组标识和接口组包括的转发设备接口的接口标识；所述转发设备发送创建的接口组标识和接口组包括的转发设备接口的接口标识。
结合第三方面，在第三方面的第四种可能的实现方式中，所述应用接口规则生成模块，具体用于生成应用接口规则，所述应用接口规则包括：业务筛选条件，所述业务筛选条件用于从所述转发设备接口信息中筛选出所述需要应用FlowSpec规则的至少一个转发设备接口。
本发明实施例中可以控制器可以在应用接口规则中包括业务筛选条件，通过业务筛选条件来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第三方面或第三方面的第一种可能或第二种可能或第三种可能或第四种可能的实现方式，在第三方面的第五种可能的实现方式中，所述发送模块，具体用于通过BGP路由属性信息向所述转发设备发送FlowSpec消息，所述BGP路由属性信息承载有所述应用接口规则。
本发明实施例中，控制器可以通过BGP路由属性信息承载应用接口规则，从而通过对BGP路由属性信息的扩展完成FlowSpec消息的发送。
结合第三方面或第三方面的第一种可能或第二种可能或第三种可能或第四种可能的实现方式，在第三方面的第六种可能的实现方式中，所述接收模块，具体用于通过边界网关协议链路状态BGP-LS协议接收转发设备上报的转发设备接口信息。
本发明实施例中，控制器和转发设备可以通过BGP-LS协议进行通信，完成在BGP-LS场景下转发设备接口信息的传输。
第四方面，本发明实施例还提供一种转发设备，包括：
发送模块，用于向控制器上报该转发设备自身的转发设备接口信息；
接收模块，用于接收所述控制器发送的FlowSpec消息，并从所述FlowSpec消息中获取到应用接口规则和FlowSpec规则；
接口识别模块，用于根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口；
FlowSpec规则应用模块，用于当所述转发设备的转发设备接口中存在所述需要应用FlowSpec规则的至少一个转发设备接口时，将所述FlowSpec规则应用到所述需要应用FlowSpec规则的至少一个转发设备接口上。
在本发明实施例中，由于转发设备向控制器上报该转发设备自身的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，达到对业务的精细化控制。
结合第四方面，在第四方面的第一种可能的实现方式中，当所述应用接口规则为接口标识集合时，所述接口识别模块，具体用于从所述接口标识集合中获取到接口标识；从所述转发设备的转发设备接口对应的接口标识中查找是否存在所述接口标识集合中的接口标识。
本发明实施例中可以控制器可以在应用接口规则中包括接口标识集合，通过接口标识集合来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第四方面，在第四方面的第二种可能的实现方式中，当所述应用接口规则为接口组标识时，所述接口识别模块，具体用于根据所述接口组标识获取到接口组；从所述转发设备的转发设备接口中查找是否存在所述接口组中包括的转发设备接口。
本发明实施例中可以控制器可以在应用接口规则中包括接口组标识，通过接口组标识来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第四方面的第二种可能的实现方式，在第四方面的第三种可能的实现方式中，所 述转发设备还包括：接口组处理模块，用于所述接口识别模块根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口之前，接收所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识；根据所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识筛选所述转发设备的转发设备接口，维护所述转发设备的转发设备接口与接口组之间的关联关系。
结合第四方面，在第四方面的第四种可能的实现方式中，当所述应用接口规则为业务筛选条件时，所述接口识别模块，具体用于从所述转发设备的转发设备接口中查找是否存在满足所述业务筛选条件的转发设备接口，若所述转发设备的转发设备接口中存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备中存在所述需要应用FlowSpec规则的至少一个转发设备接口，若所述转发设备的转发设备接口中不存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备的转发设备接口中不存在所述需要应用FlowSpec规则的至少一个转发设备接口。
本发明实施例中可以控制器可以在应用接口规则中包括业务筛选条件，通过业务筛选条件来指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
结合第四方面或第四方面的第一种可能或第二种可能或第三种可能或第四种可能的实现方式，在第四方面的第五种可能的实现方式中，所述转发设备接口信息，包括如下信息中的至少一种：接口标识符Interface Identifier信息、接口描述Interface Description信息、接口服务Interface Service信息和接口组Interface Group信息。
结合第四方面或第四方面的第一种可能或第二种可能或第三种可能或第四种可能的实现方式，在第四方面的第六种可能的实现方式中，所述发送模块，具体用于通过边界网关协议链路状态BGP-LS向控制器上报该转发设备自身的转发设备接口信息。
本发明实施例中，控制器和转发设备可以通过BGP-LS协议进行通信，完成在BGP-LS场景下转发设备接口信息的传输。
第五方面，本发明实施例还提供一种FlowSpec消息的处理系统，包括：如前述第三方面中任一项所述的控制器和如前述第四方面中任一项所述的转发设备。
在本发明实施例中，由于转发设备向控制器上报该转发设备自身的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，达到对业务的精细化控制。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的技术人员来讲，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的FlowSpec消息的处理方法应用的系统框架示意图；
图2为本发明实施例提供的一种FlowSpec消息的处理方法的流程方框示意图；
图3为本发明实施例提供的另一种FlowSpec消息的处理方法的流程方框示意图；
图4-a为本发明实施例提供的接口NLRI的数据结构示意图；
图4-b为本发明实施例提供的一种扩展节点描述Sub-TLVs的数据结构示意图；
图4-c为本发明实施例提供的另一种扩展接口描述Sub-TLVs的数据结构示意图；
图4-d为本发明实施例提供的一种接口服务Sub-TLVs的数据结构示意图；
图4-e为本发明实施例提供的另一种扩展服务Sub-TLVs的数据结构示意图；
图4-f为本发明实施例提供的一种边界接口Sub-TLVs的数据结构示意图；
图5-a为本发明实施例提供的一种控制器的组成结构示意图；
图5-b为本发明实施例提供的另一种控制器的组成结构示意图；
图6-a为本发明实施例提供的一种转发设备的组成结构示意图；
图6-b为本发明实施例提供的另一种转发设备的组成结构示意图；
图7为本发明实施例提供的另一种控制器的组成结构示意图；
图8为本发明实施例提供的另一种转发设备的组成结构示意图；
图9为本发明实施例提供的FlowSpec消息的处理系统的组成结构示意图。
具体实施方式
本发明实施例提供了一种信息的处理方法FlowSpec消息的处理方法和装置以及系统，用于实现对转发设备的业务流按照转发设备接口进行精细化控制。
为使得本发明的发明目的、特征、优点能够更加的明显和易懂，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，下面所描述的实施例仅仅是本发明一部分实施例，而非全部实施例。基于本发明中的实施例，本领域的技术人员所获得的所有其他实施例，都属于本发明保护的范围。
本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，这仅仅是描述本发明的实施例中对相同属性的对象在描述时所采用的区分方式。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，以便包含一系列单元的过程、方法、系统、产品或设备不必限于那些单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它单元。
请参阅图1所示，图1为本发明实施例提供的FlowSpec消息的处理方法应用的系统框架示意图。本发明实施例中控制器可以和转发设备进行信息控制交互，例如控制器和转发设备之间可以通过BGP进行通信。例如图1中以N个转发设备为例，N为非0自然数。转发设备1、转发设备2、…和转发设备N可以在控制器的业务控制下应用L2/L3虚拟专用网络(英文全称：Virtual Private Network，英文简称：VPN)业务，此处只是举例说明。本发明实施例中控制器可以收集转发设备的转发设备接口信息，例如可以是网络边缘转发设备的外连接口，例如L2或L3业务接口，便于控制器集中部署应用在指定转发设备的转发设备接口上的业务策略，例如在所有指定以太网虚拟专用网络(英文全称：Ethernet Virtual Private Network，英文简称：EVPN)实例的接入电路(英文全称：Access Circuit，英文简称：AC)接口上部署导流策略，具体实现表现为进一步扩展BGP FlowSpe消息，在散播FlowSpec规则的同时，在FlowSpec规则中携带应用接口规则，从而转发设备可以选择本地合适的转发设备接口来应用该FlowSpec规则。接下来分别从控制器和转发设备的角度对本发明实施例提供的FlowSpec消息的处理方法进行详细说明。
本发明信息的处理方法的一个实施例，可应用于控制器一侧中，请参阅图2所示，本发明一个实施例提供的FlowSpec消息的处理方法，可以包括如下步骤：
201、控制器接收转发设备上报的转发设备接口信息。
在本发明实施例中，控制器是控制面设备，该控制器可以和转发设备进行信息交互。该控制器可以是在控制网络中独立配置的设备，也可以是转发设备中配置的控制模块，即转发设备中某个转发设备中可以配置控制模块，从而实现对转发设备的业务控制。举例说明，本发明实施例控制器可以是路由反射器(英文全称：Route reflector，英文简称：RR)，该控制器也可以是RR扩展了本发明实施例的FlowSpec消息处理功能后实现。本发明实施例提供的转发设备可以是支持BGP协议并和其他设备建立BGP协议会话的设备。例如该转发设备可以是提供商边缘(英文全称：Provider Edge，英文简称：PE)设备，该转发设备也可以是客户边缘(英文全称：Customer Edge，英文简称：CE)设备。
在本发明实施例中，控制器和转发设备之间可以建立BGP会话，转发设备通过BGP会话向控制器上报该转发设备自身的转发设备接口信息，转发设备上报的转发设备接口可以是指物理接口，也可以指逻辑接口。例如转发设备可以是PE设备，PE设备向控制器上报该PE设备自身的AC接口标识(英文全称：Identifier，英文简称：ID)。控制器通过BGP会话可以接收到转发设备上报的转发设备接口信息。其中，本发明实施例中控制器可以和多个转发设备分别建立BGP会话，从而控制器可以分别接收多个转发设备上报的转发设备接口信息。
需要说明的是，在本发明实施例中转发设备上报给控制器的转发设备接口信息可以有多种实现方式，具体需要结合应用场景来确定转发设备上报哪种类型的转发设备接口信息，上报哪种类型的转发设备接口信息可以由转发设备来确定，也可以由控制器来确定，还可以由控制器和转发设备来协商确定，此处不做限定，接下来对设备接口信息的实现方式进行举例说明。
在本发明的一些实施例中，转发设备上报给控制器的转发设备接口信息，可以包括：转发设备的接口信息和转发设备的设备信息。其中，转发设备可以向控制器上报该转发设备的转发设备的接口信息。转发设备向控制器上报该转发设备的转发设备的转发设备接口信息和转发设备的设备信息，转发设备的转发设备接口信息是指描述转发设备的转发设备接口的信息，转发设备的设备信息是指描述转发设备的设备信息。
在本发明的一些实施例中，转发设备的设备信息，包括：BGP标识符(英文名称：Identifier)。它的值可以表示为Router ID，用于在整个网络中唯一标识一个转发设备，后续实施例中对转发设备的设备信息进行详细举例说明。若有多个转发设备则每个转发设备都可以向控制器上报该转发设备的BGP标识符。
在本发明的一些实施例中，转发设备的接口信息，具体可以包括如下信息中的至少一种：接口标识符(英文名称：Interface Identifier)信息、接口描述(英文名称：Interface Description)信息、接口服务(英文名称：Interface Service)信息和接口组(英文名称：Interface Group)信息。其中，转发设备的接口信息(英文名称：Interface Descriptors)是IEEE802.1AB中定义出的，接口信息是关于接口的附加描述，例如描述接口当前的业务用途等。具体的，接口标识符信息用于标识转发设备的转发设备接口，接口描述信息是指描述转发设备的转发设备接口的信息，接口服务信息是描述接口的服务类型等，例如接口服务信息可以是L3VPN或者L2VPN或者EVPN等。接口组信息的取值可以是接口组ID，可以是一个32 比特(英文名称：bit)位的数值，也可以是通用唯一识别码(英文全称：Universally Unique Identifier，英文简称：UUID)。后续实施例中对转发设备的接口信息进行详细举例说明。
进一步的，在本发明的一些实施例中，接口服务信息的类型是如下信息中的一种：虚拟专用局域网业务(英文全称：Virtual Private LAN Service，英文简称：VPLS)信息、虚拟专线业务(英文全称：Virtual Private Wire Service，英文简称：VPWS)信息、EVPN信息和三层虚拟专用网(英文简称：L3VPN)信息，具体可以结合应用场景来确定接口服务信息的具体类型。
在本发明的另一些实施例中，接口服务信息，可以包括如下信息中的至少一种：虚拟专用网实例名称(英文名称：VPN Instance name)信息、虚拟专用网实例标识(英文名称：VPN Instance ID)信息、路由区分符(英文全称：Route Distinguisher，英文简称：RD)信息、路由入口目标(英文全称：Import Route Target，英文简称：Import RT)、路由出口目标(英文全称：Export Route Target，英文简称：Export RT)和以太网段标识符(英文全称：Ethernet Segment Identifier，英文简称：ESI)。后续实施例中对转发设备的接口服务信息进行详细举例说明。
在本发明的一些实施例中，步骤201控制器接收转发设备上报的转发设备接口信息，包括：
A1、控制器通过边界网关协议链路状态(英文全称：Border Gateway Protocol-Link State，英文简称：BGP-LS)协议接收转发设备上报的转发设备接口信息。
在目前的BGP-LS的相关草案中，BGP-LS特指通过基于BGP散播链路状态的协议机制，该BGP-LS被定义用来收集内部网关协议(英文全称：Internal Gateway Protocol，英文简称：IGP)、BGP协议以及静态配置的拓扑信息(例如节点、链路、前缀、是否携带带宽信息等属性)，主要用于为PCE等集中计算路径的控制设备提供拓扑信息，供其计算路径，从而实现网络路由的优化。但是目前的BGP-LS无法实现对设备的业务流进行精细化控制。本发明实施例中控制器和转发设备可以应用于BGP-LS的应用场景下，则控制器可以通过BGP-LS协议接收转发设备各自上报该转发设备自身的L2层转发设备接口信息，从而解决目前的BGP-LS只能收集L3层接口信息的问题，本发明实施例中对BGP-LS扩展收集接口的信息，尤其是能收集L2层转发设备接口信息。
202、控制器从接收到的转发设备接口信息中选择出需要应用FlowSpec规则的至少一个转发设备接口。
在本发明实施例中，控制器创建有流规范(英文全称：Flow Specification，英文简称：FlowSpec)规则，该FlowSpec规则也可以称为FlowSpec路由，或者BGP FlowSpec规则。其中，FlowSpec规则有多种实现方式，可以由用户自己定义，也可以由控制器来自行定义。例如，用户可以在控制器上配置FlowSpec规则，或者控制器和网络流量分析设备联动，自动生成防止拒绝服务(英文全称：Denial of Service，英文简称：DoS)和分布式拒绝服务(英文全称：Distributed Denial of Service，英文简称：DDoS)攻击的FlowSpec规则。BGP FlowSpec是一种标准路由协议，该协议提供的机制可以在路由基础设施正确地与本地DDoS解决方案相集成的情况下缓解DDoS攻击。
在本发明实施例中，控制器创建有FlowSpec规则之后，控制器可以结合步骤201中获取到的转发设备的转发设备接口信息来确定该FlowSpec规则需要应用中哪个或者哪些转发设备接口，将控制器确定下来的需要应用FlowSpec规则的转发设备接口可以是一个 转发设备接口或者多个转发设备接口，此处不做限定。
目前的BGP FlowSpec可以支持传递类似于接入控制列表(英文全称：Access Control List，英文简称：ACL)或策略路由(英文全称：Policy Based Routing，英文简称：PBR)的精细流的策略或路由。但是BGP FlowSpec无法实现准确指定应用FlowSpec的转发设备接口，本发明实施例中转发设备可以向控制器上报自身的转发设备接口信息，则控制器在配置FlowSpec规则时可以使用接收到的转发设备接口信息来配置该FlowSpec规则应用的转发设备接口，从而控制器在控制面上确定了哪些转发设备接口可以使用FlowSpec规则，因此可以达到对FlowSpec规则的精细化控制。
203、控制器根据需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则。
其中，应用接口规则用于指示转发设备确定出能够应用FlowSpec规则的转发设备接口。
在本发明实施例中，通过步骤202控制器确定需要应用FlowSpec规则的至少一个转发设备接口之后，接下来可以生成应用接口规则，该应用接口规则可以通过FlowSpec消息发送给转发设备，控制器生成的应用接口规则可以指示转发设备确定出能够应用FlowSpec规则的转发设备接口，该应用接口规则的实现方式可以有多种，接下来进行详细说明控制器通过应用接口规则实现对需要应用FlowSpec规则的至少一个转发设备接口的指示。
204、控制器向转发设备发送FlowSpec消息。
其中，该FlowSpec消息包括应用接口规则和FlowSpec规则。
在本发明实施例中，控制器为FlowSpec规则配置出需要应用FlowSpec规则的至少一个转发设备接口之后，控制器可以生成应用接口规则，控制器向转发设备发送FlowSpec消息，例如控制器可以通过BGP会话向转发设备发送FlowSpec消息，转发设备通过FlowSpec消息中携带的应用接口规则可以确定出需要应用到需要应用FlowSpec规则的至少一个转发设备接口。
在本发明的一些实施例中，转发设备接口信息，包括：转发设备接口的接口标识，即转发设备向控制器上报的是转发设备的转发设备接口标识，在这种实现场景下，控制器可以通过如下方式确定应用接口规则的具体实现方式，步骤203控制器根据需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，具体可以包括如下步骤：
B1、控制器获取需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识；
B2、控制器生成应用接口规则，所述应用接口规则包括：接口标识集合，接口标识集合包括：需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识。
其中，控制器接收到转发设备发送的接口标识，则控制器可以配置使用FlowSpec规则的接口标识，当控制器确定出需要应用FlowSpec规则的至少一个转发设备接口之后，通过接口标识与转发设备接口的映射关系，控制器获取到需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识，该控制器生成应用接口规则，应用接口规则包括：接口标识集合，在该接口标识集合中包括需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识。
其中，控制器确定应用接口规则为接口标识集合，则控制器向转发设备发送携带有接口标识集合的FlowSpec消息，转发设备接收该FlowSpec规则之后，可以从接口标识集合 获取到需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识，从而转发设备可以确定在本地设备对应的转发设备接口中是否存在该需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识。
在本发明的一些实施例中，转发设备接口根据控制器的预先配置归属到不同的接口组中。在这种实现场景下，控制器可以通过如下方式确定应用接口规则的具体实现方式，步骤203控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，具体可以包括如下步骤：
C1、控制器确定需要应用FlowSpec规则的至少一个转发设备接口所属的接口组；
C2、控制器获取需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组标识；
C3、控制器生成应用接口规则，应用接口规则包括：接口组标识。
其中，控制器接收到转发设备发送的转发设备的接口标识，则控制器可以配置使用FlowSpec规则的转发设备的接口标识，当控制器确定出需要应用FlowSpec规则的至少一个转发设备接口之后，通过接口组标识与接口标识的映射关系，控制器获取需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组标识，该控制器确定应用接口规则通过接口组标识来实现，若控制器确定出需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组属于多个不同的接口组标识，则控制器需要分别确定每个接口组对应的接口组标识。
控制器生成应用接口规则之后，则控制器向转发设备发送携带有接口组标识的FlowSpec消息，转发设备接收该FlowSpec消息之后，可以从FlowSpec消息获取到接口组标识，再通过该接口组标识获取到需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识，从而转发设备可以确定在本地设备对应的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口。
进一步的，在本发明的一些实施例中，步骤C1控制器确定需要应用FlowSpec规则的至少一个转发设备接口所属的接口组之前，本发明实施例提供的FlowSpec消息的处理方法，还可以包括如下步骤：
D1、控制器创建接口组的标识和/或接口组包括的转发设备接口的接口标识；
D2、控制器向转发设备发送接口组的标识和/或接口组包括的转发设备接口的接口标识。
其中，控制器可以预配置接口组标识，同时配置该接口组包括哪些转发设备接口。举例说明，控制器可以预先配置两个接口组分别为接口组A和接口组B，对于配置好的两个接口组可以分别配置各个接口组具体包括的转发设备接口的接口标识，例如配置接口组A包括接口标识1和接口标识2，配置接口组B包括接口标识1和接口标识3，其中，转发设备的转发设备接口标识1可以同时属于两个接口组，也可以根据实际场景配置其属于某一个接口组，此处不做限定。当控制器完成接口组的预配置之后，控制器可以将步骤D1中配置好的接口组信息发放给转发设备，从而转发设备可以获取到接口组和接口标识的映射关系。
在本发明的一些实施例中，步骤203控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，具体可以包括如下步骤：
E1、控制器生成应用接口规则，应用接口规则包括：业务筛选条件，业务筛选条件用 于从设备接口信息中筛选出需要应用FlowSpec规则的至少一个转发设备接口。
其中，当控制器确定出需要应用FlowSpec规则的至少一个转发设备接口之后，控制器可以根据需要应用FlowSpec规则的至少一个转发设备接口配置业务筛选条件，该控制器确定应用接口规则可以为业务筛选条件，业务筛选条件也可以称为接口过滤规则，在该业务筛选条件用于筛选出需要应用FlowSpec规则的至少一个转发设备接口，即控制器根据能够筛选出需要应用FlowSpec规则的至少一个转发设备接口的条件来配置业务筛选条件。
控制器生成应用接口规则，应用接口规则包括：业务筛选条件，则控制器向转发设备发送携带有业务筛选条件的FlowSpec消息，转发设备接收该FlowSpec消息之后，可以根据业务筛选条件来匹配该转发设备本地的转发设备接口，从而转发设备可以确定在本地转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口。
在本发明的一些实施例中，步骤204控制器向所述转发设备发送FlowSpec消息，具体可以包括如下步骤：
F1、控制器通过BGP路由属性信息向转发设备发送FlowSpec消息，BGP路由属性信息承载有应用接口规则。
具体的，控制器向转发设备发送携带有应用接口规则的FlowSpec消息时，该控制器可以具体使用BGP路由属性信息来承载应用接口规则。例如可以在BGP路由属性信息的已有字段中添加应用接口规则，也可以在BGP路由属性信息中扩展出新的字段来添加应用接口规则，详见后续应用场景的举例说明。
进一步的，在本发明的一些实施例中，BGP路由属性信息包括如下信息中的至少一种：流扩展属性(英文名称：Flow Extended Attribute)信息、接口组(英文名称：Interface Group)的扩展团队属性(英文全称：Extended Communities Attribute，英文简称：ECA)信息和业务筛选条件属性Service filter Attribute信息。后续实施例中对BGP路由属性信息进行详细举例说明。
通过前述实施例对本发明的举例说明可知，由于转发设备向控制器上报该转发设备自身的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，从而控制器可以实现对FlowSpec规则的业务精细化控制，解决目前对转发设备的业务流控制不够精细的问题。
前述实施例从控制器一侧说明了本发明实施例提供的FlowSpec消息的处理方法，接下来从转发设备一侧说明本发明实施例提供的FlowSpec消息的处理方法，请参阅图3所示，本发明一个实施例提供的FlowSpec消息的处理方法，可以包括如下步骤：
301、转发设备向控制器上报该转发设备自身的转发设备接口信息。
在本发明实施例中，控制器是控制面设备，该控制器可以和转发设备进行信息交互。例如控制器可以通过BGP和转发设备进行通信。举例说明，本发明实施例提供的转发设备可以是支持BGP协议并和其他设备建立BGP协议会话的设备。例如该转发设备可以是PE设备，该转发设备也可以是CE设备。
在本发明实施例中，控制器和转发设备之间可以建立BGP会话，转发设备通过BGP会话向控制器上报该转发设备自身的转发设备接口信息，转发设备上报的转发设备接口可以是指物理接口，也可以指逻辑接口。例如转发设备可以是PE设备，PE设备向控制器上报该PE设备自身的AC接口标识。控制器通过BGP会话可以接收到转发设备上报的转发设备接口信息。其中，本发明实施例中控制器可以和多个转发设备分别建立BGP会话，每个转发设备都可以独立执行前述的步骤301。
在本发明的一些实施例中，转发设备上报给控制器的转发设备接口信息，可以包括：转发设备的接口信息和转发设备的设备信息。其中，转发设备可以向控制器上报该转发设备的接口信息和转发设备的设备信息，转发设备的接口信息是指描述转发设备的转发设备接口的信息，转发设备的设备信息是指描述转发设备的设备信息。
在本发明的一些实施例中，转发设备的设备信息，包括：BGP标识符。它的值可以表示为Router ID，用于在整个网络中唯一标识一个转发设备，后续实施例中对转发设备的设备信息进行详细举例说明。若有多个转发设备则每个转发设备都可以向控制器上报该转发设备的BGP标识符。
在本发明的一些实施例中，转发设备的接口信息，包括如下信息中的至少一种：接口标识符信息、接口描述信息、接口服务信息和接口组信息。其中，转发设备的接口信息是IEEE802.1AB中定义出的，接口信息是关于接口的附加描述，例如描述接口当前的业务用途等。具体的，接口标识符信息用于标识转发设备的转发设备接口，接口描述信息是指描述转发设备的转发设备接口的信息，接口服务信息是描述接口的服务类型等，例如接口服务信息可以是L3VPN或者L2VPN或者EVPN等。接口组信息的取值可以是接口组ID，可以是一个32比特位的数值，也可以是UUID。后续实施例中对转发设备的转发设备接口信息进行详细举例说明。
进一步的，在本发明的一些实施例中，接口服务信息的类型是如下信息中的一种：虚拟专用局域网业务信息、虚拟专线业务信息、EVPN信息和三层虚拟专用网信息，具体可以结合应用场景来确定接口服务信息的具体类型。
在本发明的另一些实施例中，接口服务信息，可以包括如下信息中的至少一种：虚拟专用网实例名称信息、虚拟专用网实例标识信息、路由区分符信息、路由入口目标、路由出口目标和以太网段标识符。后续实施例中对转发设备的转发设备接口服务信息进行详细举例说明。
在本发明的一些实施例中，步骤301转发设备向控制器上报该转发设备自身的转发设备接口信息，包括：
转发设备通过边界网关协议链路状态BGP-LS向控制器上报该转发设备自身的转发设备接口信息。
在目前的BGP-LS的相关草案中，BGP-LS特指通过基于BGP散播链路状态的协议机制，该BGP-LS被定义用来收集IGP、BGP协议以及静态配置的拓扑信息(例如节点、链路、前缀、是否携带带宽信息等属性)，主要用于为PCE等集中计算路径的控制设备提供拓扑信息，供其计算路径，从而实现网络路由的优化。但是目前的BGP-LS无法实现对设备的业务流进行精细化控制。本发明实施例中控制器和转发设备可以应用于BGP-LS的应用场景下，则转发设备可以通过BGP-LS协议上报该转发设备自身的L2层转发设备接口信息，从而解决目前的BGP-LS只能收集L3层接口信息的问题，本发明实施例中对 BGP-LS扩展收集接口的信息，尤其是能收集L2层转发设备接口的信息。
302、转发设备接收控制器发送的FlowSpec消息，并从FlowSpec消息中获取到应用接口规则和FlowSpec规则。
在本发明实施例中，控制器可以通过BGP会话向转发设备发送携带有应用接口规则的FlowSpec消息。其中，该应用接口规则可以用于转发设备确定需要应用FlowSpec规则的至少一个转发设备接口。
303、转发设备根据应用接口规则确定转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口。
在本发明实施例中，转发设备从FlowSpec消息获取到应用接口规则之后，转发设备可以进一步确定该应用接口规则所指示的具体内容，应用接口规则由控制器一侧配置，转发设备可以根据控制器采用的应用接口规则的配置方式完成对应用接口规则的解析。该应用接口规则的实现方式可以有多种，接下来进行详细说明转发设备通过应用接口规则实现对需要应用FlowSpec规则的至少一个转发设备接口的获取。
在本发明的一些实施例中，转发设备向控制器上报的是转发设备的转发设备接口标识，在这种实现场景下，转发设备可以通过如下方式确定应用接口规则的具体实现方式，当应用接口规则为接口标识集合时，步骤303转发设备根据应用接口规则确定转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，具体可以包括如下步骤：
G1、转发设备从接口标识集合中获取到接口标识；
G2、转发设备从转发设备的转发设备接口对应的接口标识中查找是否存在接口标识集合中的接口标识。
其中，转发设备接收该FlowSpec消息之后，转发设备从FlowSpec消息中获取到接口标识集合，转发设备可以从接口标识集合获取到接口标识，从而转发设备从本地的转发设备接口对应的转发设备接口标识中查找是否存在至少一个接口标识。
在本发明的一些实施例中，转发设备接口根据控制器的预先配置归属到不用的接口组中。在这种实现场景下，转发设备可以通过如下方式确定应用接口规则的具体实现方式，当应用接口规则为接口组标识时，步骤303转发设备根据应用接口规则确定转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，具体可以包括如下步骤：
H1、转发设备根据接口组标识获取到接口组；
H2、转发设备从转发设备的转发设备接口中查找是否存在接口组中包括的转发设备接口。
其中，转发设备接收该FlowSpec消息之后，转发设备从FlowSpec消息中获取到接口组标识，转发设备可以从接口组标识确定出该接口组标识对应于接口组，则该接口组中的哪个或哪些转发设备接口属于需要应用FlowSpec规则的至少一个转发设备接口，从而转发设备可以确定在本地的转发设备接口中是否存在接口组中包括的转发设备接口。
进一步的，在本发明的一些实施例中，步骤303转发设备根据应用接口规则确定转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口之前，本发明实施例提供的FlowSpec消息的处理方法还包括：
I1、转发设备接收控制器发放的接口组的标识和接口组包括的转发设备接口的接口标 识；
I2、转发设备根据接口组的标识和/或接口组包括的转发设备接口的接口标识筛选转发设备的转发设备接口，维护转发设备的转发设备接口与接口组之间的关联关系。
其中，控制器可以预配置接口组的标识，同时配置该接口组包括哪些设备接口。当控制器完成接口组的预配置之后，控制器可以将配置好的接口组信息发放给转发设备，从而转发设备可以获取到接口组和接口标识的映射关系。转发设备可以根据接口组的标识和接口组包括的转发设备接口的接口标识筛选转发设备的转发设备接口，维护转发设备的转发设备接口与接口组之间的关联关系。转发设备在控制器下发接口组信息后，对于转发设备的转发设备接口中与控制器下发的接口组信息有关联关系的转发设备接口进行维护，从而可以在执行步骤H1和步骤H2时查询接口组和接口组标识的映射关系，并通过接口组确定该接口组包括的转发设备接口。
在本发明的一些实施例中，转发设备向控制器上报的是转发设备的转发设备接口标识，在这种实现场景下，转发设备可以通过如下方式确定应用接口规则的具体实现方式，当应用接口规则为业务筛选条件时，步骤303转发设备根据应用接口规则确定转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，具体可以包括如下步骤：
J1、转发设备从转发设备的转发设备接口中查找是否存在满足业务筛选条件的转发设备接口，若转发设备的转发设备接口中存在满足业务筛选条件的转发设备接口，则确定转发设备中存在需要应用FlowSpec规则的至少一个转发设备接口，若转发设备的转发设备接口中不存在满足业务筛选条件的转发设备接口，则确定转发设备的转发设备接口中不存在需要应用FlowSpec规则的至少一个转发设备接口。
其中，业务筛选条件由控制器配置，转发设备从FlowSpec消息中获取到业务筛选条件之后，转发设备可以使用业务筛选条件来筛选该转发设备的转发设备接口，从而确定转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口。
304、当转发设备的转发设备接口中存在需要应用FlowSpec规则的至少一个转发设备接口时，转发设备将FlowSpec规则安装并应用到需要应用FlowSpec规则的至少一个转发设备接口上。
在本发明实施例中，通过步骤303中的判断过程，当转发设备的转发设备接口中存在需要应用FlowSpec规则的至少一个转发设备接口时，说明在转发设备中存在可以匹配FlowSpec规则的需要应用FlowSpec规则的至少一个转发设备接口，接下来可以将FlowSpec规则安装并应用到转发设备中的需要应用FlowSpec规则的至少一个转发设备接口上。本发明实施例中，转发设备将FlowSpec规则应用到需要应用FlowSpec规则的至少一个转发设备接口上，即限定只有需要应用FlowSpec规则的至少一个转发设备接口才能收到匹配FlowSpec规则的报文，才能进行FlowSpec规则的处理。本发明实施例中，若转发设备中还存在除需要应用FlowSpec规则的至少一个转发设备接口以外的其他转发设备接口，由于控制器配置的是只有需要应用FlowSpec规则的至少一个转发设备接口才能匹配FlowSpec规则，因此转发设备中的其它转发设备接口不能进行FlowSpec规则的匹配处理，从而实现对FlowSpec规则的精细化处理，具体可以将业务配置到接口层面，因此可以实现对控制器下发业务的精细化处理。需要说明的是，本发明实施例中转发设备中存在需要应用FlowSpec规则的至少一个转发设备接口时才能执行步骤304，并且转发设备中只 有需要应用FlowSpec规则的至少一个转发设备接口应用了FlowSpec规则，而并不是应用则所有设备接口收到的报文都要进行FlowSpec规则的匹配处理。
通过前述实施例对本发明的举例说明可知，由于本发明实施例中转发设备可以向控制器上报各自的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，达到对业务的精细化控制。
为便于更好的理解和实施本发明实施例的上述方案，下面举例相应的应用场景来进行具体说明。
在目前的链路层发现协议(英文全称：Link Layer Discovery Protocol，英文简称：LLDP)中，虽然可以在二层域内散播转发设备的节点和物理接口信息，网络控制器通过网络配置(英文名称：Netconf)读取转发设备上LLDP的管理信息库(英文全称：MIB，英文简称：Management Information Base)，获取LLDP发现的L2拓扑信息。但是该方法的传输效率和实时性不满足网络控制器收集网络拓扑的性能要求，也不支持发现二层逻辑接口(例如L2隧道接口或捆绑接口)和接口上挂载的业务信息。
本发明提供的实施例中，控制器可以收集网络转发设备的转发设备接口信息(尤其是网络边缘转发设备的外连接口，例如L2业务接口)的方法，便于网络控制器集中部署应用在指定设备接口上的业务策略，例如在所有指定EVPN实例的AC接口上部署导流策略，具体实现表现为进一步扩展BGP FlowSpe规则，在散播FlowSpec消息的同时，携带应用接口规则，例如接口标识集合、接口组ID或接口过滤规则信息。接下来以控制器具体为扩展的路由反射器，例如控制器支持本实施例中描述的控制器一侧实现的FlowSpec消息的处理方法，转发设备具体为BGP路由器，BGP路由器可以根据应用接口规则指示BGP路由器选择本地合适的转发设备接口来应用该FlowSpec规则。
本发明实施例的一种应用场景下，可以包括如下的具体实施步骤：
1、在L2/L3VPN网络中BGP路由器(例如PE)通过扩展的BGP-LS将转发设备接口信息上报给网络控制器，例如PE可以上报的转发设备接口信息包括：AC接口等接口(包括逻辑接口)信息(包括接口描述、节点描述)，从而可以形成带挂载业务信息的网络拓扑信息。其中，设备接口上配置EVPN/L3VPN业务，该接口就是业务挂载点，这个就是设备接口标识和接口上配置的业务信息定义出来，由BGP路由器通过本发明实施例扩展的BGP协议报给控制器。
2、控制器根据用户策略创建FlowSpec规则，并且根据网络拓扑指定应用的转发设备接口(即前述的需要应用FlowSpec规则的至少一个转发设备接口)，从而生成应用接口规则。例如VPN1的所有AC接口，控制器可以生成应用接口规则，然后携带在FlowSpec规则，例如控制器从网络拓扑中筛选获取条件的所有AC接口作为FlowSpec规则的附加属性下发给其客户端BGP路由器。
3、BGP路由器收到FlowSpec消息后，做如下至少一种检查：
(1)如果该FlowSpec消息携带了接口标识集合(可以在特定的路径属性中携带)，就检查该接口标识集合中是否有本地的转发设备接口。
(2)如果该FlowSpec消息携带了接口组ID，就检查转发设备的转发设备接口是否有该接口组ID对应的转发设备接口。其中，一个接口组中可能携带一个或多个接口标识，接口标识可以是某个UUID，或者是设备ID和接口ID的组合。
(3)如果该FlowSpec消息携带了应用接口的业务筛选条件(也可以称为业务属性过滤条件、接口过滤规则等)，就根据该业务属性过滤条件筛选转发设备的转发设备接口，是否有匹配业务属性过滤条件的转发设备接口。
BGP路由器通过上述步骤(1)、(2)、(3)中任一种的判断过程，在确定转发设备接口包括需要应用FlowSpec规则的至少一个转发设备接口，BGP路由器就校验安装该FlowSpec规则，并指定应用到需要应用FlowSpec规则的至少一个转发设备接口上。将FlowSpec规则应用到需要应用FlowSpec规则的至少一个转发设备接口上，即限定只有需要应用FlowSpec规则的至少一个转发设备接口收到的报文才进行FlowSpec规则的匹配处理。不应用则所有接口收到的报文都要进行FlowSpec规则的匹配处理。其中，BGP FlowSpec(RFC5575)自己定义了FlowSpec规则的合法性校验机制，安装就是把合法并优化出来的FlowSpec规则下发到转发设备的转发面，指导转发设备转发面处理接到的报文。
接下来对扩展BGP-LS的实现方式进行说明，请参阅图4-a所示，图4-a为本发明实施例提供的接口NLRI的数据结构示意图，扩展BGP-LS支持接口网络层可达信息(英文全称：Network Layer Reachability Information，英文简称：NLRI)，其中，预定义(英文全称：To Be Determined，英文简称：TBD)NLRI Type＝5，具体定义如图4-a所示。其中，协议-标识(Protocol-ID)的数值设置为5，表示静态配置类型(Static configuration)。标识符(Identifier)表示拓扑信息的路由域，占64bits，对于L2AC接口可以使用特定配置的值。节点描述符(Node Descriptors)由一个或多个子TLV(Type，Length，Value)，后续实施例中称为Sub-TLV，这是一种可扩展的选项定义方式。Node Descriptors和Interface Descriptors是变量(variable)。进一步的，Node Descriptors必须要包括BGP标识符(Identifier)这个Sub-TLV，它的值可以填成为Router ID，用于在整个网络中唯一标识一个BGP路由器。BGP路由器是支持BGP协议并和其他设备建BGP协议会话的设备。例如PE或者CE。请参阅图4-b所示，图4-b为本发明实施例提供的一种扩展节点描述(Extended Node Descriptor)Sub-TLVs的数据结构示意图。Extended Node Descriptor Sub-TLVs中包括BGP Identifier，Sub-TLV名称为TBD1是必选(Mandatory)的，占用4个比特。
在本发明的一些实施例中，接口描述符(Interface Descriptors)由一个或多个Sub-TLV组成，必须要包括接口标识符(Interface Identifier)这个Sub-TLV，具体取值可以为Interface Identifier值，例如它的值参考IEEE802.1AB 8.5.3章节的定义，可以是接口名称，在一个BGP路由器上唯一标识一个接口(该接口可以是物理接口，也可以是逻辑接口)。可选携带其他接口描述信息(Interface Description)、接口服务(Interface Service)和接口组(Interface Group)等Sub-TLV。Interface Group Sub-TLV的值为该接口归属的接口组ID，接口组ID全网统一部署配置，最佳的，可以为由控制器在单个AS部署，避免跨域散播。如果一个Interface NLRI携带多个Interface Group Sub-TLV，则该接口归属多个的接口组，如果不携带Interface Group Sub-TLV，则该接口不属于任何接口组。其中，接口描述信息是Ref IEEE802.1AB 8.5.5中的定义，就是关于接口的附加描述，例如描述接口当前的业务用途等。
请参阅图4-c所示，图4-c为本发明实施例提供的一种扩展接口描述(Extended Interface  Descriptor)Sub-TLVs的数据结构示意图，Extended Interface Descriptor Sub-TLVs共包括：TBD2(必选)、TBD3可选((Optional))、TBD4～7(可选)和TBD14(可选)，TBD2是强制写入的，可表示Interface Identifier，TBD3、TBD4～7和TBD14的长度都可选的，可结合应用场景来确定。具体的，TBD3可表示Interface Description，TBD4～7可表示Interface Service，TBD14可表示Interface Group，Interface Identifier和Interface Description的取值都可以参考IEEE802.1AB 8.5.3和IEEE802.1AB 8.5.5中的定义，Interface Service和Interface Group为本发明实施例中记载的取值方式，例如，Interface Service的取值可以详见后续图4-e中描述的Sub TLVs，例如图4-e中的值(value)，Interface Group可以是UUID或者其它的整型数。
在本发明的一些实施例中，请参阅图4-d所示，图4-d为本发明实施例提供的一种接口服务(Interface Service)Sub-TLVs的数据结构示意图，Interface Service Sub-TLVs的参考定义如4-d所示，Interface Service Sub-TLVs包括：TBD4(可选)、TBD5(可选)、TBD6(可选)和TBD7(可选)，其中，TBD4(可选)表示L2VPN(VPLS)，TBD5(可选)表示L2VPN(VPWS)，TBD6(可选)表示EVPN，TBD7(可选)表示L3VPN，L2VPN(VPLS)、L2VPN(VPWS)、EVPN和L3VPN的长度都可选的，可结合应用场景来确定。另外，L2VPN(VPLS)、L2VPN(VPWS)、EVPN和L3VPN取值可以详见后续图4-e中描述的Sub TLVs，例如图4-e中的值(value)。
进一步的，在本发明的一些实施例中，在每种Interface Service Sub-TLV都可以包含如下VPN名称(name)、RD、入口(Import)RT、出口(Export)RT、ESI等Sub-TLV，如图4-e所示，图4-e为本发明实施例提供的一种扩展服务(Extended Service)Sub-TLVs的数据结构示意图，在Extended Service Sub-TLVs中，TBD8(必选)表示VPN name，其长度是可选的，VPN name的取值可以是VPN实例名称。TBD9(可选)表示RD，其取值可以是RD值。TBD10(可选)表示Import RT，其取值可以是RT值。TBD11(可选)表示Export RT，其取值可以是RT值，RD、Import RT、Export RT的长度都可以是8个bits，TBD12(可选)表示ESI，其长度是可选的，其取值可以是ESI值。一个Interface Service Sub-TLV可以包含多个Import RT或Export RT Sub-TLV。当然ESI Sub-TLV仅能包含在EVPN Service的Sub-TLV中。
前述内容描述了转发设备的转发设备接口信息的实现场景，接下来对携带应用接口规则的FlowSpec规则进行说明，至少存在如下的3种可实现的方案。
在第一种可实现方案中，主要包括如下步骤：
1、控制器往一个或多个接口组上应用FlowSpec规则，下发BGP FlowSpec规则给各个BGP路由器，携带一个或多个特定类型的BGP路由属性，该BGP路由属性中携带该规则应用的接口标识集合信息。例如在Flow Extended Attribute中携带Bound interface sub-TLVs。
请参阅图4-f所示，图4-f为本发明实施例提供的一种边界接口(Bound interfac)Sub-TLVs的数据结构示意图，TBD15可以为Bound interface sub-TLV，Bound interface sub-TLV的长度可以是2个字节(Octets)，在Bound interface sub-TLV的定义中，Node Descriptor和Interface Descriptor的定义和BGP-LS的Interface NLRI中对应的定义相同。
2、BGP路由器收到该FlowSpec规则后，获取该FlowSpec规则携带的接口标识集合，检查该接口标识集合中是否有转发设备接口，将FlowSpec规则安装应用到这些转发设备 接口上，FlowSpec规则也可以被称作FlowSpec路由。
在第二种可实现方案中，主要包括如下步骤：
1、控制器根据业务策略创建接口组，将一组符合业务需求(例如EVPN网络的所有AC接口)接口加入到对应的接口组信息。该业务策略用于创建接口组。
2、控制器下发BGP-LS的Interface NLRI(携带Interface Group Sub-TLV)给各个BGP路由器，各个BGP路由器筛选本地的转发设备接口，保存转发设备接口和Interface Group ID的关联关系，例如在接口属性配置关联的1个或多个接口组ID)。
3、控制器往一个或多个接口组上应用FlowSpec规则，下发BGP FlowSpec规则给各个BGP路由器，携带一个或多个Interface Group的扩展团队属性(Extended Communities Attribute)，可以使用flowspec interface-set ECA，或者携带一个或多个特定类型的BGP路由属性(例如Flow Extended Attribute)，该BGP路由属性中携带一个或多个Interface Group Sub-TLV。该Interface Group Sub-TLV的定义和BGP-LS的Interface NLRI中Interface Group Sub-TLV的定义相同。
4、BGP路由器收到该FlowSpec规则后，获得该FlowSpec规则应用到的接口组，将FlowSpec规则安装应用到这些接口组对应的转发设备接口上。
在第三种可实现方案中，主要包括如下步骤：
1、控制器往一种业务类型的接口(例如EVPN指定EVI绑定的接口)上应用FlowSpec规则，携带一个或多个特定类型的BGP路由属性(例如Flow Extended Attribute)，该BGP路由属性中携带业务属性过滤条件(Servicefilter sub-TLV)。Service filter sub-TLV的定义和BGP-LS的Interface NLRI中Interface Service的定义相同。
2、BGP路由器收到该FlowSpec规则后，获取该FlowSpec规则携带的业务属性过滤条件，根据该业务属性过滤条件筛选本地的转发设备接口，将FlowSpec规则安装应用到匹配业务属性过滤条件的转发设备接口上。
在本发明前述的实施例中，控制器可以包括网络控制器、扩展的PCE设备，控制器通过BGP-LS收集转发设备的L2接口信息(例如包括接口ID和关键业务属性)。控制器通过BGP-FlowSpec携带应用接口规则，指示转发的BGP路由器FlowSpec路由应用到哪些设备接口上，只有这些选中的转发设备接口中有转发设备接口时才安装该FlowSpec路由，从而能够支持网络边缘的业务控制。
通过前述对本发明实施例的举例说明可知，本发明实施例中不仅可以通过BGP-LS收集网络内部的拓扑信息，同时收集网络边缘的外联接口信息，形成更完整的网络拓扑数据库，供各种业务应用使用，不仅仅支持网络内部的路径计算，同时支持网络边缘的业务控制，可以实现精细流接入控制策略。根据业务特性定义接口组，然后定义FlowSpec规则应用到这些接口组上，这种可以针对指定的业务和指定流做FlowSpec规则支持的动作，例如重定向、限速。为BGP FlowSpec路由应用到网络L2/L3层接口上，提供接口信息支撑和支持FlowSpec路由携带应用接口规则散播，从而实现基于设备接口的精细流业务控制。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为依据本发明，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一 定是本发明所必须的。
为便于更好的实施本发明实施例的上述方案，下面还提供用于实施上述方案的相关装置。
请参阅图5-a所示，本发明实施例提供的一种控制器500，可以包括：接收模块501、接口配置模块502、应用接口规则生成模块503和发送模块504，其中，
接收模块501，用于接收转发设备上报的转发设备接口信息；
接口配置模块502，用于从接收到的所述转发设备接口信息中选择出需要应用FlowSpec规则的至少一个转发设备接口；
应用接口规则生成模块503，用于根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，所述应用接口规则用于指示所述转发设备确定出能够应用所述FlowSpec规则的转发设备接口；
发送模块504，用于向所述转发设备发送FlowSpec消息，所述FlowSpec消息包括所述应用接口规则和所述FlowSpec规则。
在本发明的一些实施例中，所述转发设备接口信息，包括：转发设备接口的接口标识；
应用接口规则生成模块503，具体用于获取所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识；生成应用接口规则，所述应用接口规则包括：接口标识集合，所述接口标识集合包括：所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识
在本发明的一些实施例中，所述应用接口规则生成模块503，具体用于确定所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组；获取所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组标识；生成应用接口规则，所述应用接口规则包括：所述接口组标识。
进一步的，在本发明的一些实施例中，请参阅图5-b所示，控制器500，还包括:接口组处理模块505，用于创建接口组标识和接口组包括的转发设备接口的接口标识；所述转发设备发送创建的接口组标识和接口组包括的转发设备接口的接口标识。
在本发明的一些实施例中，所述应用接口规则生成模块503，具体用于生成应用接口规则，所述应用接口规则包括：业务筛选条件，所述业务筛选条件用于从所述转发设备接口信息中筛选出所述需要应用FlowSpec规则的至少一个转发设备接口。
在本发明的一些实施例中，所述发送模块503，具体用于通过BGP路由属性信息向所述转发设备发送FlowSpec消息，所述BGP路由属性信息承载有所述应用接口规则。
在本发明的一些实施例中，所述BGP路由属性信息包括如下信息中的至少一种：流扩展属性Flow Extended Attribute信息、接口组Interface Group的扩展团队属性ECA信息和业务筛选条件属性Service filter Attribute信息。
在本发明的一些实施例中，所述接收模块501，具体用于通过边界网关协议链路状态BGP-LS协议接收转发设备上报的转发设备接口信息。
通过前述实施例对本发明的举例说明可知，由于转发设备向控制器上报该转发设备自身的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活 指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，达到对业务的精细化控制。
请参阅图6-a所示，本发明实施例提供的一种转发设备600，可以包括：发送模块601、接收模块602、接口识别模块603和FlowSpec规则应用模块604，其中，
发送模块601，用于向控制器上报该转发设备自身的转发设备接口信息；
接收模块602，用于接收所述控制器发送的FlowSpec消息，并从所述FlowSpec消息中获取到应用接口规则和FlowSpec规则；
接口识别模块603，用于根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口；
FlowSpec规则应用模块604，用于当所述转发设备的转发设备接口中存在所述需要应用FlowSpec规则的至少一个转发设备接口时，将所述FlowSpec规则应用到所述需要应用FlowSpec规则的至少一个转发设备接口上。
在本发明的一些实施例中，当所述应用接口规则为接口标识集合时，所述接口识别模块603，具体用于从所述接口标识集合中获取到接口标识；从所述转发设备的转发设备接口对应的接口标识中查找是否存在所述接口标识集合中的接口标识。
在本发明的一些实施例中，当所述应用接口规则具体为接口组标识时，所述接口识别模块603，具体用于根据所述接口组标识获取到接口组；从所述转发设备的转发设备接口中查找是否存在所述接口组中包括的转发设备接口。
在本发明的一些实施例中，请参阅图6-b所示，所述转发设备600还包括：接口组处理模块605，用于所述接口识别模块603根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口之前，接收所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识；根据所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识筛选所述转发设备的转发设备接口，维护所述转发设备的转发设备接口与接口组之间的关联关系。
在本发明的一些实施例中，当所述应用接口规则为业务筛选条件时，所述接口识别模块603，具体用于从所述转发设备的转发设备接口中查找是否存在满足所述业务筛选条件的转发设备接口，若所述转发设备的转发设备接口中存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备中存在所述需要应用FlowSpec规则的至少一个转发设备接口，若所述转发设备的转发设备接口中不存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备的转发设备接口中不存在所述需要应用FlowSpec规则的至少一个转发设备接口。
在本发明的一些实施例中，所述转发设备接口信息，包括：转发设备的接口信息和转发设备的设备信息。
在本发明的一些实施例中，所述转发设备的设备信息，包括：BGP标识符Identifier。
在本发明的一些实施例中，转发设备的接口信息，包括如下信息中的至少一种：
接口标识符Interface Identifier信息、接口描述Interface Description信息、接口服务Interface Service信息和接口组Interface Group信息。
在本发明的一些实施例中，所述接口服务Interface Service信息的类型是如下信息中的一种：虚拟专用局域网业务VPLS信息、虚拟专线业务VPWS信息、以太网虚拟专用网EVPN信息和三层虚拟专用网L3VPN信息。
在本发明的一些实施例中，所述接口服务Interface Service信息，包括如下信息中的至少一种：虚拟专用网实例名称VPN Instance name信息、虚拟专用网实例标识VPN Instance ID信息、路由区分符RD信息、路由入口目标Import RT、路由出口目标Export RT和以太网段标识符ESI。
在本发明的一些实施例中，所述发送模块601，具体用于通过边界网关协议链路状态BGP-LS向控制器上报该转发设备自身的L2层设备接口信息。
需要说明的是，上述装置各模块/单元之间的信息交互、执行过程等内容，由于与本发明方法实施例基于同一构思，其带来的技术效果与本发明方法实施例相同，具体内容可参见本发明前述所示的方法实施例中的叙述，此处不再赘述。
通过前述实施例对本发明的举例说明可知，由于本发明实施例中转发设备可以向控制器上报各自的转发设备接口信息，因此控制器在下发FlowSpec规则时可以根据接收到的转发设备接口信息来进行应用该FlowSpec规则的转发设备接口配置，从而控制器可以具体配置哪个转发设备接口或者哪些转发设备接口可以需要应用该FlowSpec规则，并生成相应的应用接口规则。本发明实施例中控制器可以控制一条FlowSpec规则应用到转发设备中灵活指定的转发设备接口上，从而实现按照用户需求自动、灵活指定流规则应用的范围，达到对业务的精细化控制。
本发明实施例还提供一种计算机存储介质，其中，该计算机存储介质存储有程序，该程序执行包括上述方法实施例中记载的部分或全部步骤。
接下来介绍本发明实施例提供的另一种控制器，请参阅图7所示，控制器700包括：
接收器701、发射器702、处理器703和存储器704(其中控制器700中的处理器703的数量可以一个或多个，图7中以一个处理器为例)。在本发明的一些实施例中，接收器701、发射器702、处理器703和存储器704可通过总线或其它方式连接，其中，图7中以通过总线连接为例。
存储器704可以包括只读存储器和随机存取存储器，并向处理器703提供指令和数据。存储器704的一部分还可以包括非易失性随机存取存储器(英文全称：Non-Volatile Random Access Memory，英文缩写：NVRAM)。存储器704存储有操作系统和操作指令、可执行模块或者数据结构，或者它们的子集，或者它们的扩展集，其中，操作指令可包括各种操作指令，用于实现各种操作。操作系统可包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
处理器703控制控制器700的操作，处理器703还可以称为中央处理单元(英文全称：Central Processing Unit，英文简称：CPU)。具体的应用中，控制器700的各个组件通过总线系统耦合在一起，其中总线系统除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都称为总线系统。
上述本发明实施例揭示的方法可以应用于处理器703中，或者由处理器703实现。处理器703可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器703中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器703可以是通用处理器、数字信号处理器(英文全称：digital signal processing，英文缩写：DSP)、专用集成电路(英文全称：Application Specific Integrated Circuit，英文缩写：ASIC)、现成可编程门阵列(英文全称：Field-Programmable Gate Array，英文缩写：FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执 行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器704，处理器703读取存储器704中的信息，结合其硬件完成上述方法的步骤。
接收器701可用于接收输入的数字或字符信息，以及产生与控制器的相关设置以及功能控制有关的信号输入，发射器702可包括显示屏等显示设备，发射器702可用于通过外接接口输出数字或字符信息。
本发明实施例中，处理器703，用于执行如下步骤：
接收转发设备上报的转发设备接口信息；
从接收到的所述转发设备接口信息中选择出需要应用FlowSpec规则的至少一个转发设备接口；
根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，所述应用接口规则用于指示所述转发设备确定出能够应用所述FlowSpec规则的转发设备接口；
向所述转发设备发送FlowSpec消息，所述FlowSpec消息包括所述应用接口规则和所述FlowSpec规则。
本发明一些实施例中，所述转发设备接口信息，包括：转发设备接口的接口标识；处理器703，具体用于执行如下步骤：
获取所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识；
生成应用接口规则，所述应用接口规则包括：接口标识集合，所述接口标识集合包括：所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识。
本发明的一些实施例中，处理器703，具体用于执行如下步骤：
确定所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组；
获取所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组标识；
生成应用接口规则，所述应用接口规则包括：所述接口组标识。
本发明的一些实施例中，处理器703，还用于执行如下步骤：确定所述需要应用FlowSpec规则的至少一个转发设备接口对应的接口标识所属的接口组之前，创建接口组标识和接口组包括的转发设备接口的接口标识；
向所述转发设备发送创建的接口组标识和接口组包括的转发设备接口的接口标识。
本发明的一些实施例中，处理器703，具体用于执行如下步骤：
生成应用接口规则，所述应用接口规则包括：业务筛选条件，所述业务筛选条件用于从所述转发设备接口信息中筛选出所述需要应用FlowSpec规则的至少一个转发设备接口。
本发明的一些实施例中，处理器703，具体用于执行如下步骤：
通过BGP路由属性信息向所述转发设备发送FlowSpec消息，所述BGP路由属性信息承载有所述应用接口规则。
本发明的一些实施例中，处理器703，具体用于执行如下步骤：
通过边界网关协议链路状态BGP-LS协议接收转发设备上报的转发设备接口信息。
接下来介绍本发明实施例提供的另一种转发设备，请参阅图8所示，转发设备800包 括：
接收器801、发射器802、处理器803和存储器804(其中转发设备800中的处理器803的数量可以一个或多个，图8中以一个处理器为例)。在本发明的一些实施例中，接收器801、发射器802、处理器803和存储器804可通过总线或其它方式连接，其中，图8中以通过总线连接为例。
存储器804可以包括只读存储器和随机存取存储器，并向处理器803提供指令和数据。存储器804的一部分还可以包括NVRAM。存储器804存储有操作系统和操作指令、可执行模块或者数据结构，或者它们的子集，或者它们的扩展集，其中，操作指令可包括各种操作指令，用于实现各种操作。操作系统可包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
处理器803控制转发设备的操作，处理器803还可以称为CPU。具体的应用中，转发设备的各个组件通过总线系统耦合在一起，其中总线系统除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都称为总线系统。
上述本发明实施例揭示的方法可以应用于处理器803中，或者由处理器803实现。处理器803可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器803中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器803可以是通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器804，处理器803读取存储器804中的信息，结合其硬件完成上述方法的步骤。
本发明实施例中，处理器803，用于执行如下步骤：
向控制器上报该转发设备自身的转发设备接口信息；
接收所述控制器发送的FlowSpec消息，并从所述FlowSpec消息中获取到应用接口规则和FlowSpec规则；
根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口；
当所述转发设备的转发设备接口中存在所述需要应用FlowSpec规则的至少一个转发设备接口时，将所述FlowSpec规则应用到所述需要应用FlowSpec规则的至少一个转发设备接口上。
本发明的一些实施例中，当所述应用接口规则为接口标识集合时，处理器803，具体用于执行如下步骤：
从所述接口标识集合中获取到接口标识；
从所述转发设备的转发设备接口对应的接口标识中查找是否存在所述接口标识集合中的接口标识。
本发明的一些实施例中，当所述应用接口规则为接口组标识时，处理器803，具体用 于执行如下步骤：
根据所述接口组标识获取到接口组；
从所述转发设备的转发设备接口中查找是否存在所述接口组中包括的转发设备接口。
在本发明的一些实施例中，处理器803，具体用于执行如下步骤：根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口之前，接收所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识；
根据所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识筛选所述转发设备的转发设备接口，维护所述转发设备的转发设备接口与接口组之间的关联关系。
在本发明的一些实施例中，当所述应用接口规则为业务筛选条件时，处理器803，具体用于执行如下步骤：
从所述转发设备的转发设备接口中查找是否存在满足所述业务筛选条件的转发设备接口，若所述转发设备的转发设备接口中存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备中存在所述需要应用FlowSpec规则的至少一个转发设备接口，若所述转发设备的转发设备接口中不存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备的转发设备接口中不存在所述需要应用FlowSpec规则的至少一个转发设备接口。
在本发明的一些实施例中，存储器804存储的转发设备接口信息，包括如下信息中的至少一种：接口标识符Interface Identifier信息、接口描述Interface Description信息、接口服务Interface Service信息和接口组Interface Group信息。
在本发明的一些实施例中，处理器803，具体用于执行如下步骤：通过边界网关协议链路状态BGP-LS向控制器上报该转发设备自身的转发设备接口信息。
前述实施例分别描述了本发明实施例提供的控制器和转发设备，接下来请参阅图9所示的FlowSpec消息的处理系统900，包括：如前述实施例中所述的控制器901和如前述实施例中所述的转发设备902。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本发明提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本发明而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、 随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
综上所述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照上述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对上述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (29)

  1. 一种流规范FlowSpec消息的处理方法，其特征在于，包括：
    控制器接收转发设备上报的转发设备接口信息；
    所述控制器从接收到的所述转发设备接口信息中选择出需要应用FlowSpec规则的至少一个转发设备接口；
    所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，所述应用接口规则用于指示所述转发设备确定出能够应用所述FlowSpec规则的转发设备接口；
    所述控制器向所述转发设备发送FlowSpec消息，所述FlowSpec消息包括所述应用接口规则和所述FlowSpec规则。
  2. 根据权利要求1所述的方法，其特征在于，所述转发设备接口信息，包括：转发设备接口的接口标识；
    所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，包括：
    所述控制器获取所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识；
    所述控制器生成应用接口规则，所述应用接口规则包括：接口标识集合，所述接口标识集合包括：所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识。
  3. 根据权利要求1所述的方法，其特征在于，所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，包括：
    所述控制器确定所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组；
    所述控制器获取所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组标识；
    所述控制器生成应用接口规则，所述应用接口规则包括：所述接口组标识。
  4. 根据权利要求3所述的方法，其特征在于，所述控制器确定所述需要应用FlowSpec规则的至少一个转发设备接口对应的接口标识所属的接口组之前，所述方法还包括：
    所述控制器创建接口组标识和接口组包括的转发设备接口的接口标识；
    所述控制器向所述转发设备发送创建的接口组标识和接口组包括的转发设备接口的接口标识。
  5. 根据权利要求1所述的方法，其特征在于，所述控制器根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，包括：
    所述控制器生成应用接口规则，所述应用接口规则包括：业务筛选条件，所述业务筛选条件用于从所述转发设备接口信息中筛选出所述需要应用FlowSpec规则的至少一个转发设备接口。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述控制器向所述转发设备发送FlowSpec消息，包括：
    所述控制器通过BGP路由属性信息向所述转发设备发送FlowSpec消息，所述BGP路由属性信息承载有所述应用接口规则。
  7. 根据权利要求1至5中任一项所述的方法，其特征在于，所述控制器接收转发设 备上报的转发设备接口信息，包括：
    所述控制器通过边界网关协议链路状态BGP-LS协议接收转发设备上报的转发设备接口信息。
  8. 一种流规范FlowSpec消息的处理方法，其特征在于，包括：
    转发设备向控制器上报该转发设备自身的转发设备接口信息；
    所述转发设备接收所述控制器发送的FlowSpec消息，并从所述FlowSpec消息中获取到应用接口规则和FlowSpec规则；
    所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口；
    当所述转发设备的转发设备接口中存在所述需要应用FlowSpec规则的至少一个转发设备接口时，所述转发设备将所述FlowSpec规则应用到所述需要应用FlowSpec规则的至少一个转发设备接口上。
  9. 根据权利要求8所述的方法，其特征在于，当所述应用接口规则为接口标识集合时，所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，包括：
    所述转发设备从所述接口标识集合中获取到接口标识；
    所述转发设备从所述转发设备的转发设备接口对应的接口标识中查找是否存在所述接口标识集合中的接口标识。
  10. 根据权利要求8所述的方法，其特征在于，当所述应用接口规则为接口组标识时，所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，包括：
    所述转发设备根据所述接口组标识获取到接口组；
    所述转发设备从所述转发设备的转发设备接口中查找是否存在所述接口组中包括的转发设备接口。
  11. 根据权利要求10所述的方法，其特征在于，所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口之前，所述方法还包括：
    所述转发设备接收所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识；
    所述转发设备根据所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识筛选所述转发设备的转发设备接口，维护所述转发设备的转发设备接口与接口组之间的关联关系。
  12. 根据权利要求8所述的方法，其特征在于，当所述应用接口规则为业务筛选条件时，所述转发设备根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口，包括：
    所述转发设备从所述转发设备的转发设备接口中查找是否存在满足所述业务筛选条件的转发设备接口，若所述转发设备的转发设备接口中存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备中存在所述需要应用FlowSpec规则的至少一个转发设备接口，若所述转发设备的转发设备接口中不存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备的转发设备接口中不存在所述需要应用FlowSpec规则的至少一个转 发设备接口。
  13. 根据权利要求8至12中任一项所述的方法，其特征在于，所述转发设备接口信息，包括如下信息中的至少一种：接口标识符Interface Identifier信息、接口描述Interface Description信息、接口服务Interface Service信息和接口组Interface Group信息。
  14. 根据权利要求8至12中任一项所述的方法，其特征在于，所述转发设备向控制器上报该转发设备自身的转发设备接口信息，包括：
    所述转发设备通过边界网关协议链路状态BGP-LS向控制器上报该转发设备自身的转发设备接口信息。
  15. 一种控制器，其特征在于，包括：
    接收模块，用于接收转发设备上报的转发设备接口信息；
    接口配置模块，用于从接收到的所述转发设备接口信息中选择出需要应用FlowSpec规则的至少一个转发设备接口；
    应用接口规则生成模块，用于根据所述需要应用FlowSpec规则的至少一个转发设备接口生成应用接口规则，所述应用接口规则用于指示所述转发设备确定出能够应用所述FlowSpec规则的转发设备接口；
    发送模块，用于向所述转发设备发送FlowSpec消息，所述FlowSpec消息包括所述应用接口规则和所述FlowSpec规则。
  16. 根据权利要求15所述的控制器，其特征在于，所述转发设备接口信息，包括：转发设备接口的接口标识；
    所述应用接口规则生成模块，具体用于获取所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识；生成应用接口规则，所述应用接口规则包括：接口标识集合，所述接口标识集合包括：所述需要应用FlowSpec规则的至少一个转发设备接口对应的至少一个接口标识。
  17. 根据权利要求15所述的控制器，其特征在于，所述应用接口规则生成模块，具体用于确定所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组；获取所述需要应用FlowSpec规则的至少一个转发设备接口所属的接口组对应的接口组标识；生成应用接口规则，所述应用接口规则包括：所述接口组标识。
  18. 根据权利要求17所述的控制器，其特征在于，所述控制器，还包括：接口组处理模块，用于创建接口组标识和接口组包括的转发设备接口的接口标识；所述转发设备发送创建的接口组标识和接口组包括的转发设备接口的接口标识。
  19. 根据权利要求15所述的控制器，其特征在于，所述应用接口规则生成模块，具体用于生成应用接口规则，所述应用接口规则包括：业务筛选条件，所述业务筛选条件用于从所述转发设备接口信息中筛选出所述需要应用FlowSpec规则的至少一个转发设备接口。
  20. 根据权利要求15至19中任一项所述的控制器，其特征在于，所述发送模块，具体用于通过BGP路由属性信息向所述转发设备发送FlowSpec消息，所述BGP路由属性信息承载有所述应用接口规则。
  21. 根据权利要求15至19中任一项所述的控制器，其特征在于，所述接收模块，具体用于通过边界网关协议链路状态BGP-LS协议接收转发设备上报的转发设备接口信息。
  22. 一种转发设备，其特征在于，包括：
    发送模块，用于向控制器上报该转发设备自身的转发设备接口信息；
    接收模块，用于接收所述控制器发送的FlowSpec消息，并从所述FlowSpec消息中获取到应用接口规则和FlowSpec规则；
    接口识别模块，用于根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口；
    FlowSpec规则应用模块，用于当所述转发设备的转发设备接口中存在所述需要应用FlowSpec规则的至少一个转发设备接口时，将所述FlowSpec规则应用到所述需要应用FlowSpec规则的至少一个转发设备接口上。
  23. 根据权利要求22所述的转发设备，其特征在于，当所述应用接口规则为接口标识集合时，所述接口识别模块，具体用于从所述接口标识集合中获取到接口标识；从所述转发设备的转发设备接口对应的接口标识中查找是否存在所述接口标识集合中的接口标识。
  24. 根据权利要求22所述的转发设备，其特征在于，当所述应用接口规则为接口组标识时，所述接口识别模块，具体用于根据所述接口组标识获取到接口组；从所述转发设备的转发设备接口中查找是否存在所述接口组中包括的转发设备接口。
  25. 根据权利要求24所述的转发设备，其特征在于，所述转发设备还包括：接口组处理模块，用于所述接口识别模块根据所述应用接口规则确定所述转发设备的转发设备接口中是否存在需要应用FlowSpec规则的至少一个转发设备接口之前，接收所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识；根据所述控制器发放的接口组标识和接口组包括的转发设备接口的接口标识筛选所述转发设备的转发设备接口，维护所述转发设备的转发设备接口与接口组之间的关联关系。
  26. 根据权利要求22所述的转发设备，其特征在于，当所述应用接口规则为业务筛选条件时，所述接口识别模块，具体用于从所述转发设备的转发设备接口中查找是否存在满足所述业务筛选条件的转发设备接口，若所述转发设备的转发设备接口中存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备中存在所述需要应用FlowSpec规则的至少一个转发设备接口，若所述转发设备的转发设备接口中不存在满足所述业务筛选条件的转发设备接口，则确定所述转发设备的转发设备接口中不存在所述需要应用FlowSpec规则的至少一个转发设备接口。
  27. 根据权利要求22至26中任一项所述的转发设备，其特征在于，所述转发设备接口信息，包括如下信息中的至少一种：接口标识符Interface Identifier信息、接口描述Interface Description信息、接口服务Interface Service信息和接口组Interface Group信息。
  28. 根据权利要求22至26中任一项的所述的转发设备，其特征在于，所述发送模块，具体用于通过边界网关协议链路状态BGP-LS向控制器上报该转发设备自身的转发设备接口信息。
  29. 一种流规范FlowSpec消息的处理系统，其特征在于，包括：如权利要求15至21中任一项所述的控制器和如权利要求22至28中任一项所述的转发设备。
PCT/CN2017/084379 2016-07-07 2017-05-15 FlowSpec消息的处理方法和装置以及系统 WO2018006654A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP17823466.2A EP3462688B1 (en) 2016-07-07 2017-05-15 Method, apparatus and system for processing flowspec message
US16/240,242 US10791059B2 (en) 2016-07-07 2019-01-04 FlowSpec message processing method and system, and apparatus
US17/023,790 US11290386B2 (en) 2016-07-07 2020-09-17 FlowSpec message processing method and system, and apparatus
US17/683,778 US12010030B2 (en) 2016-07-07 2022-03-01 FlowSpec message processing method and system, and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610533501.5 2016-07-07
CN201610533501.5A CN107592270B (zh) 2016-07-07 2016-07-07 FlowSpec消息的处理方法和装置以及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/240,242 Continuation US10791059B2 (en) 2016-07-07 2019-01-04 FlowSpec message processing method and system, and apparatus

Publications (1)

Publication Number Publication Date
WO2018006654A1 true WO2018006654A1 (zh) 2018-01-11

Family

ID=60901773

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/084379 WO2018006654A1 (zh) 2016-07-07 2017-05-15 FlowSpec消息的处理方法和装置以及系统

Country Status (4)

Country Link
US (2) US10791059B2 (zh)
EP (1) EP3462688B1 (zh)
CN (2) CN114095452A (zh)
WO (1) WO2018006654A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10454715B1 (en) 2018-05-03 2019-10-22 At&T Intellectual Property I, L.P. Virtual private wire service interworking
US10944783B2 (en) 2018-07-12 2021-03-09 At&T Intellectual Property I, L.P. Dynamic denial of service mitigation system

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107665427A (zh) 2017-08-22 2018-02-06 阿里巴巴集团控股有限公司 一种离线支付、业务处理、支付处理的方法及装置
WO2019135249A1 (en) * 2018-01-05 2019-07-11 Telefonaktiebolaget Lm Ericsson (Publ) Data center failure management in an sdn deployment using border gateway node control
EP3738273A4 (en) 2018-01-12 2021-08-18 Telefonaktiebolaget LM Ericsson (publ) DATA CENTER FAILURE MANAGEMENT IN AN SDN DEPLOYMENT USING SWITCH NODE CONTROL
JP6805194B2 (ja) * 2018-02-15 2020-12-23 日本電信電話株式会社 経路情報転送装置、経路情報転送方法および経路情報転送プログラム
CN108924049B (zh) * 2018-06-27 2020-12-25 新华三技术有限公司合肥分公司 流规格路由调度方法及装置
CN112751814B (zh) * 2019-10-31 2022-04-12 华为技术有限公司 一种信息上报方法、数据处理方法及装置
US11930037B2 (en) * 2020-10-08 2024-03-12 Charter Communications Operating, Llc Validation and implementation of flow specification (Flowspec) rules
CN114760165A (zh) 2020-12-25 2022-07-15 华为技术有限公司 报文传输方法、设备及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104012052A (zh) * 2011-11-10 2014-08-27 博科通讯系统有限公司 用于软件定义网络中的流管理的系统和方法
CN104348724A (zh) * 2013-07-31 2015-02-11 华为技术有限公司 一种支持多租户的数据转发方法和装置
CN105072085A (zh) * 2015-07-03 2015-11-18 北京航空航天大学 一种软件定义网络下的流规则合法性认证方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPWO2011083780A1 (ja) * 2010-01-05 2013-05-13 日本電気株式会社 通信システム、制御装置、処理規則の設定方法、パケットの送信方法およびプログラム
US8787203B2 (en) * 2010-01-27 2014-07-22 Nippon Telegraph And Telephone Corporation Virtual network control method and system based on fluctuations
JP2015511074A (ja) * 2012-03-23 2015-04-13 日本電気株式会社 通信のためのシステム及び方法
US20160182300A1 (en) * 2014-12-17 2016-06-23 Cisco Technology, Inc., A Corporation Of California Selective Configuring of Throttling Engines for Flows of Packet Traffic

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104012052A (zh) * 2011-11-10 2014-08-27 博科通讯系统有限公司 用于软件定义网络中的流管理的系统和方法
CN104348724A (zh) * 2013-07-31 2015-02-11 华为技术有限公司 一种支持多租户的数据转发方法和装置
CN105072085A (zh) * 2015-07-03 2015-11-18 北京航空航天大学 一种软件定义网络下的流规则合法性认证方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3462688A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10454715B1 (en) 2018-05-03 2019-10-22 At&T Intellectual Property I, L.P. Virtual private wire service interworking
US10944783B2 (en) 2018-07-12 2021-03-09 At&T Intellectual Property I, L.P. Dynamic denial of service mitigation system

Also Published As

Publication number Publication date
CN107592270B (zh) 2021-10-15
CN114095452A (zh) 2022-02-25
US10791059B2 (en) 2020-09-29
US11290386B2 (en) 2022-03-29
EP3462688B1 (en) 2022-10-26
US20190140960A1 (en) 2019-05-09
EP3462688A4 (en) 2019-05-15
US20220263764A1 (en) 2022-08-18
CN107592270A (zh) 2018-01-16
US20210067454A1 (en) 2021-03-04
EP3462688A1 (en) 2019-04-03

Similar Documents

Publication Publication Date Title
WO2018006654A1 (zh) FlowSpec消息的处理方法和装置以及系统
US11888651B2 (en) Virtual private network VPN service optimization method and device
US10757008B2 (en) Flow specification protocol-based communications method, device, and system
US8955100B2 (en) Routing device having integrated MPLS-aware firewall
US8316435B1 (en) Routing device having integrated MPLS-aware firewall with virtual security system support
CN111865796B (zh) 用于网络业务的路径计算单元中央控制器（pcecc）
EP2963866B1 (en) Service chaining across multiple networks
US10063432B2 (en) Method and system of supporting service chaining in a data network
WO2014166247A1 (zh) 一种虚拟网络管理的实现方法和系统
CN112468398B (zh) 一种vpn的处理方法和pe设备以及系统
WO2014176989A1 (zh) 网络管理方法及系统、虚拟网络实体、网络设备
EP3796601A1 (en) Method and apparatus for managing virtual private network
US9838337B1 (en) Automatic virtual local area network (VLAN) provisioning in data center switches
WO2023082779A1 (zh) 报文转发方法、电子设备及存储介质
US12010030B2 (en) FlowSpec message processing method and system, and apparatus
US20230261963A1 (en) Underlay path discovery for a wide area network
WO2014173116A1 (zh) 一种虚拟网络管理方法和系统
WO2023158959A1 (en) Underlay path discovery for a wide area network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17823466

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017823466

Country of ref document: EP

Effective date: 20181228