WO2020043107A1 - 报文处理的方法、装置及相关设备 - Google Patents

报文处理的方法、装置及相关设备 Download PDF

Info

Publication number
WO2020043107A1
WO2020043107A1 PCT/CN2019/102899 CN2019102899W WO2020043107A1 WO 2020043107 A1 WO2020043107 A1 WO 2020043107A1 CN 2019102899 W CN2019102899 W CN 2019102899W WO 2020043107 A1 WO2020043107 A1 WO 2020043107A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
message
autonomous domain
flow filtering
filtering rule
Prior art date
Application number
PCT/CN2019/102899
Other languages
English (en)
French (fr)
Inventor
吴红
朱建波
曹瑞卿
李振斌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to KR1020217008398A priority Critical patent/KR102536676B1/ko
Priority to KR1020237017259A priority patent/KR102586898B1/ko
Priority to BR112021003695-4A priority patent/BR112021003695A2/pt
Priority to MX2021002287A priority patent/MX2021002287A/es
Priority to JP2021510854A priority patent/JP7193619B2/ja
Priority to EP19853800.1A priority patent/EP3832963A4/en
Publication of WO2020043107A1 publication Critical patent/WO2020043107A1/zh
Priority to US17/186,385 priority patent/US11575606B2/en
Priority to JP2022196008A priority patent/JP2023036647A/ja
Priority to US18/156,175 priority patent/US20230179523A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/12—Avoiding congestion; Recovering from congestion
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/44—Distributed routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service

Definitions

  • the present application relates to the field of network communications, and in particular, to a method, device, and related equipment for message processing.
  • packets can be forwarded through forwarding devices such as routers or switches.
  • forwarding devices such as routers or switches.
  • the router can use the information of the packet, such as the source Internet protocol (IP) Address and destination IP address, look up the routing and forwarding table (forwarding information base, FIB) to determine the next hop information corresponding to the message, and forward the message to the corresponding other routers, terminals or servers and other network equipment.
  • IP Internet protocol
  • FIB routing information base
  • the forwarding device relies on network resources to forward packets.
  • Network resources such as bandwidth, cache space, and processing capabilities of the forwarding device can cause network congestion when the required network resources exceed the currently available network resources. To prevent network congestion.
  • the control device can analyze the traffic of the forwarding device to obtain the flow filtering rules, and then issue the flow filtering rules to the forwarding device.
  • the forwarding device processes the packets according to the flow filtering rules, for example, re-enables the packets Directing or discarding to control traffic.
  • the control device configures a flow filtering rule for each pair of network devices that use the forwarding device to communicate.
  • the number of flow filtering rules configured is also large, so it needs to occupy more. Network resources to send flow filtering rules from the control device to the forwarding device, which further causes the forwarding device to occupy a large amount of storage resources.
  • the embodiments of the present application provide a message processing method, device, and related equipment, which are used to solve the problem that a large number of flow filtering rules are issued, which occupies more network resources.
  • the embodiment of the present application provides a message processing method, which is applied to a first device, and specifically includes the following steps: first, generating a flow filtering rule, and then sending the flow filtering rule to a second device.
  • the flow filtering rule includes a match item and an action item, and the match item includes an Internet Protocol IP address and an autonomous domain identifier.
  • the action item is used to instruct the second device to match packets matching the match item according to The message processing manner indicated by the action item processes the message.
  • the first device may be a control device for generating and issuing a flow filtering rule, and may be a server, a terminal, or a router. Specifically, a border gateway protocol traffic specification server may be set as the first device.
  • the second device may be a forwarding device, such as a router, a switch, a bridge, or a gateway.
  • the embodiment of the present application aggregates the IP addresses of the network devices in the autonomous domain corresponding to the autonomous domain identifier, and generates a flow filtering rule with the autonomous domain identifier as a unit. For example, when the IP address in the match is the source IP address of the received packet, the autonomous domain is the autonomous domain to which the device corresponding to the destination address of the received packet belongs, so that all network devices in the autonomous domain only need to be Generate a filter rule. It is no longer necessary to generate a filtering policy for each device in the autonomous domain. The number of generated flow filtering rules is reduced, and the network resources required for delivery to the second device are reduced.
  • the IP address may be a source IP address of the message, and accordingly, the autonomous domain identifier is an identifier of an autonomous domain to which a device corresponding to a destination IP address of the message belongs.
  • the IP address may be a destination IP address of the message, and accordingly, the autonomous domain identifier is an identifier of an autonomous domain to which a device corresponding to a source IP address of the message belongs.
  • the autonomous domain identifier is used to distinguish different autonomous domains.
  • the autonomous domain identifier of telecommunications can be AS1000, and the autonomous autonomous domain identifier can be AS2000.
  • the autonomous domain identifier is an autonomous domain identifier to which the second device belongs. If the second device and the network device corresponding to the source IP address belong to the same autonomous domain, when generating the flow filtering rule, the autonomous domain of the device corresponding to the source IP address can be obtained by obtaining the autonomous domain identifier of the autonomous domain to which the second device belongs. Autonomous domain ID. If the network device corresponding to the second device and the destination IP address belongs to the same autonomous domain, the identity of the autonomous domain to which the destination IP address belongs can also be obtained by obtaining the identity of the autonomous domain to which the second device belongs.
  • the embodiment of the present application further provides a message processing method, which is applied to a second device, and specifically includes the following steps: the second device receives a flow filtering rule sent by the first device, and the flow filtering rule includes a matching item and an action item The match includes an Internet Protocol IP address and an autonomous domain identifier.
  • the second device receives the message, and determines a routing and forwarding entry according to the first address in the message, where the routing and forwarding entry includes an autonomous domain identifier.
  • the second device determines that the second address of the packet matches the IP address in the flow filtering rule, and the autonomous domain identifier in the routing and forwarding entry matches the autonomous domain identifier in the flow filtering rule
  • the message is processed according to the message processing mode indicated by the action item.
  • the embodiment of the present application aggregates the IP addresses of the network devices in the autonomous domain corresponding to the autonomous domain identifier, and generates a flow filtering rule with the autonomous domain identifier as a unit. For example, when the IP address in the match is the destination IP address of the received packet, the autonomous domain is the autonomous domain to which the device corresponding to the source IP address of the message belongs, so all network devices in the autonomous domain only need to be generated A filtering rule. It is no longer necessary to separately generate filtering rules for each device in the autonomous domain, reducing the number of flow filtering rules generated, and greatly reducing the filtering rules stored by the second device, which saves the storage resources of the second device.
  • the first address may be a destination IP address of the message, and accordingly, the second address is a source IP address of the message.
  • the first address may be a source IP address of the message, and accordingly, the second address is a destination IP address of the message.
  • the message processing method indicated by the action item includes one or more of the following processing methods:
  • Packets are discarded, packets are redirected, and packets are marked for traffic.
  • discarding a message means not forwarding the message and deleting the message; and redirecting a message means changing the next hop information corresponding to the message in order to change the message.
  • the forwarding path implements control of the traffic on the network. Traffic marking of packets refers to marking packets for subsequent processing, such as traffic statistics.
  • the method further includes:
  • An access control table is generated according to the flow filtering rule.
  • the access control table stores the IP address, an autonomous domain index, and an action item, and the autonomous domain index corresponds to the autonomous domain identifier. Because the access control list can usually store a small number of characters, an autonomous domain index with a small number of characters is stored in the access control list instead of the autonomous domain identifier, and the autonomous domain index and the autonomous domain identifier can be established. Mapping relationship between them so that the autonomous domain index can be found later based on the autonomous domain identifier.
  • processing the packet according to the packet processing mode indicated by the action item includes:
  • the second device determines that the second address of the message is the same as the IP address in the access control table, and the autonomous domain identifier in the routing and forwarding entry is the same as the autonomous domain index in the access control table
  • the message is processed according to a message processing mode indicated by an action item stored in the access control table.
  • An embodiment of the present application further provides a message processing apparatus, which is applied to a first device and includes:
  • a rule generating unit configured to generate a flow filtering rule, where the flow filtering rule includes a match item and an action item, and the match item includes an Internet protocol IP address and an autonomous domain identifier;
  • a rule sending unit configured to send the flow filtering rule to a second device, and the action item is used to instruct the second device to process a message matching the match item according to the message indicated by the action item Processing the message.
  • the IP address is a source IP address of the message
  • the autonomous domain identifier is an identifier of an autonomous domain to which a device corresponding to a destination IP address of the message belongs.
  • the IP address is a destination IP address of the message
  • the autonomous domain identifier is an identifier of an autonomous domain to which a device corresponding to a source IP address of the message belongs.
  • the autonomous domain identifier is an autonomous domain identifier to which the second device belongs.
  • An embodiment of the present application further provides a message processing apparatus, which is applied to a second device and includes:
  • a rule receiving unit configured to receive a flow filtering rule sent by the first device, where the flow filtering rule includes a match item and an action item, and the match item includes an Internet protocol IP address and an autonomous domain identifier;
  • a message receiving unit configured to receive a message, and determine a routing and forwarding entry according to a first address in the message, where the routing and forwarding entry includes an autonomous domain identifier;
  • a message processing unit configured to: when it is determined that the second address of the message matches the IP address in the flow filtering rule, and the autonomous domain identifier in the routing and forwarding entry matches the autonomy in the flow filtering rule When the domain identifiers are the same, the message is processed according to the message processing mode indicated by the action item.
  • the first address is a destination IP address of the message
  • the second address is a source IP address of the message
  • the first address is a source IP address of the message
  • the second address is a destination IP address of the message.
  • the message processing method indicated by the action item includes one or more of the following processing methods:
  • Packets are discarded, packets are redirected, and packets are marked for traffic.
  • the device further includes:
  • a table generating unit configured to generate an access control table according to the flow filtering rule, where the access control table stores the IP address, an autonomous domain index, and an action item, and the autonomous domain index corresponds to the autonomous domain identifier;
  • a message processing unit configured to: when the second device determines that the second address of the message is the same as the IP address in the access control table, and that the autonomous domain identifier in the routing and forwarding entry is the same as the autonomous domain identifier When the autonomous domain indexes in the access control table match, the message is processed according to the message processing mode indicated by the action item stored in the access control table.
  • An embodiment of the present application further provides a message processing device.
  • the device is a first device.
  • the first device includes a storage unit, a processing unit, and a communication unit.
  • the storage unit is configured to store instructions
  • the processing unit is configured to execute the instructions in the memory and execute the foregoing message processing method applied to the first device;
  • the communication unit is configured to communicate with a second device.
  • An embodiment of the present application further provides a message processing device.
  • the device is a second device.
  • the second device includes a storage unit, a processing unit, and a communication unit.
  • the storage unit is configured to store instructions
  • the processing unit is configured to execute the instructions in the memory and execute the foregoing message processing method applied to the second device;
  • the communication unit is configured to communicate with a first device.
  • An embodiment of the present application further provides a computer-readable storage medium including instructions that, when run on a computer, cause the computer to execute the above message processing method applied to the first device and / or the second device.
  • An embodiment of the present application further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the above message processing method applied to the first device and / or the second device.
  • An embodiment of the present application further provides a message processing system, and the system includes the foregoing first device and second device.
  • FIG. 1 is a schematic diagram of a forwarding device according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of a flow control device according to an embodiment of the present application.
  • FIG. 3 is a structural block diagram of a message processing system according to an embodiment of the present application.
  • FIG. 5 is a flowchart of another message processing method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a message according to an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a routing and forwarding entry in the prior art
  • FIG. 8 is a schematic diagram of a routing and forwarding entry provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of an access control entry provided by an embodiment of the present application.
  • FIG. 10 is a structural block diagram of a message processing apparatus according to an embodiment of the present application.
  • FIG. 11 is a structural block diagram of another message processing apparatus according to an embodiment of the present application.
  • FIG. 12 is a hardware architecture diagram of a message processing device according to an embodiment of the present application.
  • FIG. 13 is a hardware architecture diagram of another message processing device according to an embodiment of the present application.
  • the embodiments of the present application provide a message processing method, device, and related equipment, which are used to solve the problem of issuing a large number of matching rules for each forwarding device and reduce the waste of network resources.
  • a packet can be forwarded through a forwarding device.
  • the forwarding device can determine the next hop information corresponding to the packet according to the routing and forwarding table, and forward the packet to the corresponding other network. device.
  • the first user 101 and the second user 102 may send a message to the forwarding device 103, and the forwarding device 103 forwards the received message to the first device 104, the second device 105, and the first device.
  • Three devices 106 and fourth device 107 Three devices 106 and fourth device 107.
  • the address of the first device 104 is the first address
  • the address of the second device 105 is the second address
  • the address of the third device 106 is the third address
  • the address of the fourth device 107 is the fourth address.
  • the forwarding device relies on network resources to forward packets, such as bandwidth, cache space, and processing capabilities of the forwarding device. If the required network resources exceed the currently available network resources, the network will be blocked.
  • a criminal can use a distributed denial of service (DDOS) client or server to attack, that is, multiple computers can be used as an attack platform to launch a DDOS attack on one or more targets, causing network congestion. , Thereby affecting the normal business operation of the target device and achieving the purpose of the attack.
  • DDOS distributed denial of service
  • the traffic of the forwarding device can be analyzed to obtain a flow filtering rule, the flow filtering rule can be issued for the forwarding device, and the forwarding device processes the packet according to the flow filtering rule, such as redirecting or discarding the packet, etc. Control of flow.
  • FIG. 2 a schematic diagram of a flow control system according to an embodiment of the present application is provided.
  • the control device 108 can analyze the traffic of the forwarding device 103 to obtain a flow filtering rule, and forward it to the forwarding device.
  • 103 issues a flow filtering rule, and the forwarding device 103 can process the received packet according to the flow filtering rule.
  • the first user 101 sends a packet to the first device 104 through the forwarding device 103, and a flow filtering rule may be correspondingly configured.
  • the matching rule of the filtering rule includes the IP address of the first user and First IP address
  • the second user 102 sends a packet to the first device 104 through the forwarding device 103
  • a flow filtering rule may be correspondingly configured, for example, the matching rule of the filtering rule includes the IP address of the second user and the first IP address . Therefore, two users and four IP addresses shown in Figure 2 need to be configured with eight flow filtering rules.
  • embodiments of the present application provide a message processing method, device, and related equipment, which are used to solve the problem of wasting network resources caused by forming and issuing a large number of flow filtering rules.
  • the first device generates a flow filtering rule, and sends the flow filtering rule to the second device.
  • the flow filtering rule includes a match item and an action item.
  • the match item includes an IP address and an autonomous system (AS) identification (ID).
  • the action item instructs the second device to identify the packet matching the match item according to the action item.
  • the indicated processing method processes the message.
  • the IP addresses of network devices in the autonomous domain corresponding to the autonomous domain identifier are aggregated, and a flow filtering rule is generated by using the autonomous domain identifier as a unit.
  • a flow filtering rule is generated by using the autonomous domain identifier as a unit.
  • FIG. 3 is a schematic diagram of a system framework according to an embodiment of the present application.
  • the system includes a first device 100, a second device 200, a sending device 300, and a receiving device 400. Among them, the first device 100 and the second device 200 is connected, and the transmitting device 300 and the receiving device 400 are both connected to the second device 200.
  • the first device 100 may be a controller in a software-defined network (SDN), or other devices, such as a network management device, a server, a terminal, or a router.
  • the server is, for example, a border gateway protocol (BGP).
  • BGP border gateway protocol
  • Flow specification server flow specification server
  • the first device 100 is configured to generate a flow filtering rule, where the flow filtering rule includes a matching item and an action item, and the matching item includes an IP address and an autonomous domain identifier.
  • the action item in the flow filtering rule may instruct the second device to report the matching item.
  • the message is processed according to the message processing mode indicated by the action item.
  • the second device 200 may be a forwarding device, such as a router or a switch, and is configured to send the received packet from the sending device 300 to the receiving device 400.
  • the transmitting device 300 and the receiving device 400 may be a terminal, a server, or a device connected to a user.
  • the second device 200 receives the flow filtering rule sent by the first device 100. After the second device 200 receives the packet sent by the sending device 300, it can determine a routing and forwarding entry according to the first address in the packet, where the routing forwarding The entry contains the autonomous domain identifier. When it is determined that the first address of the packet matches the IP address in the flow filtering rule, and the autonomous domain identifier in the routing and forwarding entry is the same as the autonomous domain identifier in the flow filtering rule, The message processing mode indicated by the action item processes the message.
  • the first address may be a destination IP address of the message, and the second address may be a source IP address of the message.
  • the first address is the source IP address of the message
  • the second address is the destination IP address of the message.
  • the matching item of the flow filtering rule may include the source IP address IP-1 and the autonomous domain ID AS1000 of the autonomous domain to which the device corresponding to the destination IP address belongs, and the action item corresponding to the matching item may be discarded.
  • the second device 200 receives the packet M1 with the source IP address being IP-1 and the destination IP address being IP-2, it can look up the routing and forwarding table through the destination IP address to obtain the routing and forwarding entry corresponding to the destination IP address.
  • the routing and forwarding entries include the destination IP address IP-2 and the autonomous domain identifier of the autonomous domain to which the destination IP address belongs.
  • the second device 200 may discard the packet M1 according to the packet processing mode indicated by the corresponding action item.
  • FIG. 4 is a flowchart of a message processing method according to an embodiment of the present application.
  • the method can be applied to a first device and includes the following steps:
  • the first device may be a control device for generating and issuing a flow filtering rule, and may be a server, a terminal, or a router. Specifically, a border gateway protocol traffic specification server may be set as the first device.
  • the flow filtering rule is a rule for instructing the second device to match and process the packet, and may include a match item and an action item.
  • the matching items may include an IP address and an autonomous domain identifier. Specifically, if the IP address is the source IP address of the message, the autonomous domain identifier is the autonomous domain identifier of the autonomous domain to which the device corresponding to the destination IP address of the message belongs; if the IP address is the destination IP address of the message, the autonomous domain The ID is the autonomous domain ID of the autonomous domain to which the device corresponding to the source IP address of the packet belongs.
  • the autonomous domain identifier is used to distinguish different autonomous domains. For example, the autonomous domain identifier of telecommunications can be AS1000, and the autonomous autonomous domain identifier can be AS2000.
  • the first device may obtain information of a message received by the second device, where the message information includes a source IP address and a destination IP address of the message.
  • the first device also needs to obtain the autonomous domain identifier corresponding to the source IP address or the destination IP address. If the second device and the network device corresponding to the source IP address belong to the same autonomous domain, the autonomous domain ID of the autonomous domain to which the device corresponding to the source IP address belongs can be obtained by obtaining the autonomous domain identifier of the autonomous domain to which the second device belongs.
  • the identity of the autonomous domain to which the destination IP address belongs can also be obtained by obtaining the identity of the autonomous domain to which the second device belongs. That is, in this case, the autonomous domain identifier in the matching item is the autonomous domain identifier to which the second device belongs. If the second device is independent of the autonomous domain to which the device corresponding to the source IP address belongs or the autonomous domain to which the device corresponding to the destination IP address belongs, then other ways must be used to obtain the autonomous domain identifier.
  • the address or destination IP address is directly configured with the corresponding autonomous domain identifier.
  • the embodiment of the present application achieves the purpose of reducing the number of generated flow filtering rules by clustering an autonomous domain identifier to a source IP address or a destination IP address.
  • n IP addresses belong to the same autonomous domain, and the autonomous domain identifier is A, then You can generate m * 1 flow filtering rules.
  • the matching items of each flow filtering rule include the identity A of the autonomous domain and the IP address of one of the users, which effectively reduces the number of flow filtering rules.
  • the match may include the IP address of the first user 101 and the identifier of the first autonomous domain, and the match may be used for matching.
  • the first user 101 accesses a message generated by the first IP address 104 and / or the second IP address 105 through the forwarding device 103.
  • the third IP address 106 and the fourth IP address 107 belong to the second autonomous domain.
  • the match may include the IP address of the first user 101 and the identifier of the second autonomous domain.
  • the match is used to match the first user 101 through the forwarding device.
  • 103 accesses a message generated by the third IP address 106 and / or the fourth IP address 107. Therefore, for two users accessing the first autonomous domain, two flow filtering rules can be generated, and for two users accessing the second autonomous domain, two flow filtering rules can be generated.
  • each flow filtering rule includes the identifiers of the autonomous domain B and One of the n IP addresses. Compared with the prior art, the number of flow filtering rules can also be effectively reduced.
  • the match can also include other information about the message, such as the IP protocol, source port, destination port, network control message protocol (Internet Protocol Protocol, ICMP) type, ICMP code, One or more of information such as a transmission control protocol (TCP) flag, a data packet length, and a differentiated services code point (DSCP).
  • IP protocol Internet Protocol Protocol
  • ICMP Internet Protocol Protocol
  • TCP transmission control protocol
  • DSCP differentiated services code point
  • the action item in the flow filtering rule corresponds to the match item, and is used to instruct the packets matching the match item to be processed according to the message processing mode indicated by the action item.
  • the action item may include Discard processing, redirection processing of packets, and traffic marking of packets. Among them, discarding a message means not forwarding the message and deleting the message; and redirecting a message means changing the next hop information corresponding to the message in order to change the message.
  • the forwarding path implements control of the traffic on the network. Traffic marking of packets refers to marking packets for subsequent processing, such as traffic statistics.
  • the second device may be a forwarding device, such as a router, a switch, a bridge, or a gateway.
  • the first device may send a flow filtering rule with a match item and an action item to the second device, so that the second device matches the packet.
  • the second device performs the action item corresponding to the match item.
  • the indicated message processing method processes the message.
  • the number of flow filtering rules generated by the first device is small, the number of flow filtering rules sent by the first device to the second device is also small, which saves network resources and also saves storage resources of the second device.
  • a first device generates a flow filtering rule, and sends the flow filtering rule to a second device.
  • the flow filtering rule includes a match item and an action item
  • the match item includes an IP address and an autonomous domain identifier.
  • the action item instructs the second device to process the packet matching the match item according to the message processing mode indicated by the action item. deal with. That is, in the embodiment of the present application, the IP addresses of network devices in the autonomous domain corresponding to the autonomous domain identifier are aggregated, and a flow filtering rule is generated by using the autonomous domain identifier as a unit.
  • FIG. 5 is a flowchart of another packet processing method according to an embodiment of the present application. The method can be applied to a second device and includes the following steps.
  • the second device may be a forwarding device, for example, it may be a router, a switch, a bridge, or a gateway.
  • the second device may receive the flow filtering rule sent by the first device.
  • the first device may be a control device for generating and issuing a flow filtering rule, and may be a server, a terminal, or a router.
  • the border gateway protocol traffic specification server may be used as the first device.
  • the flow filtering rule received by the second device may include a match item and an action item, and the match item may include an IP address and an autonomous domain identifier.
  • the IP address may be the source IP address of the message, and the autonomous domain identifier is the identifier of the autonomous domain to which the device corresponding to the destination IP address of the message belongs.
  • the IP address may also be the destination IP address of the message, and the autonomous domain identifier is the identifier of the autonomous domain to which the device corresponding to the source IP address of the message belongs.
  • the second device Since there are fewer flow filtering rules generated by the first device, there are fewer flow filtering rules received by the second device. Take the control of m users accessing n IP addresses as an example. If m users belong to the same autonomous domain, the second device receives 1 * n flow filtering rules. Similarly, if n IP addresses belong to In the same autonomous domain, the second device receives m * 1 flow filtering rules.
  • the matching item may also include other information of the packet, such as one or more of information such as IP protocol, source port, destination port, ICMP type, ICMP code, TCP flag, packet length, and DSCP.
  • the action item in the flow filtering rule corresponds to the match item, and is used to instruct the packets matching the match item to be processed according to the message processing mode indicated by the action item.
  • the action item may include Discard processing, redirection processing of packets, and traffic marking of packets.
  • S202 Receive a message, and determine a routing and forwarding entry according to a first address in the message.
  • the packet received by the second device includes a source IP address 201, a destination IP address 202, and data 203.
  • the source IP address 201 is the address of the network device that generates the message
  • the destination IP address 202 is the address of the network device that is expected to receive the message.
  • the second device needs to forward the packet, but when the packet is flow-controlled, it needs to perform other processing on the packet.
  • a routing and forwarding table may be stored in the second device.
  • the routing and forwarding table there are multiple routing and forwarding entries, and each routing and forwarding entry correspondingly stores message forwarding information.
  • FIG. 7 is a schematic diagram of a routing and forwarding entry in the prior art, including a source IP address 301 of a packet, a destination IP address 302 of a packet, and next hop information 303. Therefore, the second device may look up the routing and forwarding table according to the information of the message, such as the source IP address and the destination IP address, determine the next hop information corresponding to the message, and forward the message according to the next hop information.
  • an autonomous domain identifier may be added to the routing and forwarding table. Specifically, the identifier of the autonomous domain to which the source IP address belongs, the identifier of the autonomous domain to which the device corresponding to the destination IP address can be added, and the identifier of the autonomous domain to which the device corresponding to the source IP address belongs and the destination IP address can be added simultaneously. ID of the autonomous domain to which the device belongs.
  • a schematic diagram of a routing and forwarding entry provided by an embodiment of this application includes a source IP address 301, a source AS-ID 304, a destination IP address 302, a destination AS-ID 305, and a next hop of a packet.
  • Information 303 where the source AS-ID 304 is the autonomous domain identifier to which the source IP address 301 belongs, and the destination AS-ID 305 is the autonomous domain identifier to which the destination IP address 302 belongs.
  • the autonomous domain ID to which the device corresponding to the source IP address in the routing and forwarding entry belongs and / or the autonomous domain ID to which the device corresponding to the destination IP address belongs can be configured.
  • the second device is an internal network gateway protocol device or a border gateway protocol device, usually, the second device stores one or more autonomous domain identifiers. Specifically, if the second device is an internal gateway protocol device and the network device corresponding to the source IP address belongs to the same autonomous domain, an autonomous domain identifier stored by the second device is the autonomous domain to which the device corresponding to the source IP address belongs. Domain ID; if the second device is an internal gateway protocol device and the network device corresponding to the destination IP address belongs to the same autonomous domain, an autonomous domain ID stored by the second device is the autonomous domain to which the device corresponding to the destination IP address belongs Domain ID.
  • the second device is a border gateway protocol device, that is, the network device corresponding to the second device and the source IP address belongs to the same autonomous domain, and the network device corresponding to the destination IP address belongs to the same autonomous domain, the second device then At least two autonomous domain identifiers are stored, so it is necessary to specifically determine which of the autonomous domain identifiers is added to the routing and forwarding table according to the source IP address and the destination IP address.
  • the second device may determine a routing and forwarding entry according to the first address of the message.
  • the entry includes at least the first address and an identifier of the autonomous domain to which the first address belongs.
  • the first address may be the source IP address of the message, and the second address may be the destination IP address of the message. Accordingly, the first address may be the destination IP address of the message, and the second address may be the message. Source IP address.
  • the second device can determine the routing and forwarding entry by using the first address of the message, and the entry includes the first address and the identifier of the autonomous domain to which the second address belongs, that is, the first AS-ID. Then, the second device can match the matching item in the flow filtering rule with the second address and the first AS-ID of the packet. Specifically, the second device can determine whether the second address of the packet is the same as the IP address in the flow filtering rule, and whether the first AS-ID is the same as the autonomous domain identifier in the flow filtering rule. If both are the same, the packet is considered to be the same. The packet matches the match in the flow filtering rule. At this time, the packet can be processed according to the packet processing mode indicated by the action item. Action items can include discarding packets, redirecting packets, and marking traffic on packets.
  • the matching item of the flow filtering rule may include the autonomous domain identifier AS1000 to which the device corresponding to the source IP address IP-1 and the destination IP address belongs, and the action item corresponding to the matching item may be discarded.
  • the routing forwarding table corresponding to the destination IP address can be obtained by searching the routing forwarding table by the destination IP address.
  • the forwarding entry includes the identifier of the autonomous domain to which the destination IP address IP-2 and the device corresponding to the destination IP address belong, that is, the first AS-ID, which is AS1000. Therefore, it can be determined that the source IP address of the packet is the same as the IP address in the flow filtering rule.
  • the first AS-ID obtained from the routing and forwarding entry is the same as the autonomous domain identifier in the flow filtering rule.
  • the message matches the match in the flow filtering rule, and the message is processed according to the message processing mode indicated by the corresponding action item. Specifically, the message may be discarded.
  • the matching item of the flow filtering rule may also include the autonomous domain ID AS2000 of the device corresponding to the destination IP address IP-2 and the source IP address, and the action item corresponding to the matching item may be redirected.
  • the source IP address of the packet received by the second device is IP-1 and the destination IP address is IP-2
  • the routing and forwarding entries include the autonomous domain to which the source IP address is IP-1 and the device corresponding to the source IP address belongs.
  • the identifier that is, the first AS-ID, is AS2000. Therefore, it can be determined that the destination IP address of the packet is the same as the IP address in the flow filtering rule.
  • the first AS-ID obtained from the routing and forwarding entry is the same as the autonomous domain identifier in the flow filtering rule.
  • the packet matches the matching item in the flow filtering rule, and the packet is processed according to the packet processing mode indicated by the corresponding action item. Specifically, the packet may be redirected.
  • an access control list may be generated according to the flow filtering rule, and the access control list may include matching items and action items.
  • FIG. 9 is a schematic diagram of an access control entry according to an embodiment of the present application.
  • the matching entry may include an IP address 401 and an autonomous domain index 402, corresponding to the IP address and autonomous domain identifier in the flow filtering rule.
  • the autonomous domain index corresponds to the autonomous domain identifier in the flow filtering rule.
  • a mapping relationship between an autonomous domain identifier and an autonomous domain index in a flow filtering rule can be established. If the mapping relationship is met, the two are considered to match.
  • the autonomous domain identifier and the autonomous domain index may be the same or different.
  • the second device can determine the routing and forwarding entry by using the first address of the message.
  • the entry includes the first address and the identifier of the autonomous domain to which it belongs, that is, the first AS-ID.
  • the second address and the first AS-ID are matched with the IP address and the autonomous domain index in the access control list. Specifically, it can be determined whether the second address of the packet is the same as the IP address in the access control table, and whether the first AS-ID matches the autonomous domain index in the access control table. If both, the packet is considered to be an access
  • the matching items in the control table match.
  • the message can be processed according to the message processing mode indicated by the action item.
  • the second device receives a flow filtering rule sent by the first device, wherein the matching item includes an IP address and an autonomous domain identifier, and the autonomous domain identifier may identify a different autonomous domain.
  • the second device receives the message and determines a routing and forwarding entry according to the first address in the message, where the routing and forwarding entry includes an autonomous domain identifier.
  • the second device determines the second address of the message and the IP address in the flow filtering rule
  • the autonomous domain identifier in the routing table entry is the same as the autonomous domain identifier in the flow filtering rule, the message is processed according to the message processing mode indicated by the action entry.
  • the IP addresses of network devices in the autonomous domain corresponding to the autonomous domain identifier are aggregated, and a flow filtering rule is generated by using the autonomous domain identifier as a unit.
  • a flow filtering rule is generated by using the autonomous domain identifier as a unit.
  • an embodiment of the present application further provides a device for processing a message, which is applied to a first device.
  • the first device can implement the functions of the first device in the embodiment shown in FIG. 4 or FIG.
  • the device includes a rule generating unit 101 and a rule sending unit 102.
  • the rule generating unit 101 is configured to execute step S101 in the embodiment shown in FIG. 4.
  • the rule sending unit 102 is configured to execute step S102 in the embodiment shown in FIG. 4. specific,
  • the rule generating unit 101 is configured to generate a flow filtering rule, where the flow filtering rule includes a match item and an action item, and the match item includes an Internet protocol IP address and an autonomous domain identifier.
  • a rule sending unit 102 is configured to send the flow filtering rule to a second device, and the action item is used to instruct the second device to match a message that matches the match item according to the message indicated by the action item.
  • the processing method processes the message.
  • the IP address is a source IP address of the message
  • the autonomous domain identifier is an identifier of an autonomous domain to which a device corresponding to a destination IP address of the message belongs.
  • the IP address is a destination IP address of the message
  • the autonomous domain identifier is an identifier of an autonomous domain to which a device corresponding to a source IP address of the message belongs.
  • the autonomous domain identifier is an autonomous domain identifier to which the second device belongs.
  • an embodiment of the present application further provides a device for processing a message, which is applied to a second device.
  • the second device can implement the functions of the second device in the embodiment shown in FIG. 4 or FIG.
  • the device includes a rule receiving unit 201, a rule receiving unit 201, and a message processing unit 203.
  • the rule receiving unit 201 is configured to perform step S201 in the embodiment shown in FIG. 5
  • the rule receiving unit 202 is configured to perform step S202 in the embodiment shown in FIG. 5
  • the message processing unit 203 is configured to execute the embodiment shown in FIG. 5.
  • Step S203 is performed. specific,
  • a rule receiving unit 201 is configured to receive a flow filtering rule sent by a first device, where the flow filtering rule includes a match item and an action item, and the match item includes an Internet protocol IP address and an autonomous domain identifier;
  • the rule receiving unit 202 is configured to receive a message and determine a routing and forwarding entry according to a first address in the message, where the routing and forwarding entry includes an autonomous domain identifier;
  • a message processing unit 203 configured to: when it is determined that the second address of the message matches the IP address in the flow filtering rule, and the autonomous domain identifier in the routing and forwarding entry matches the When the autonomous domain identifiers are the same, the message is processed according to the message processing mode indicated by the action item.
  • the first address is a destination IP address of the message
  • the second address is a source IP address of the message
  • the first address is a source IP address of the message
  • the second address is a destination IP address of the message.
  • the message processing method indicated by the action item includes one or more of the following processing methods:
  • Packets are discarded, packets are redirected, and packets are marked for traffic.
  • the device further includes:
  • a table generating unit configured to generate an access control table according to the flow filtering rule, where the access control table stores the IP address, an autonomous domain index, and an action item, and the autonomous domain index corresponds to the autonomous domain identifier;
  • a message processing unit configured to: when the second device determines that the second address of the message is the same as the IP address in the access control table, and that the autonomous domain identifier in the routing and forwarding entry is the same as the autonomous domain identifier When the autonomous domain indexes in the access control table match, the message is processed according to the message processing mode indicated by the action item stored in the access control table.
  • an embodiment of the present application further provides a message processing device 300.
  • the device is a first device.
  • the device 300 can implement the functions of the first device in the embodiment shown in FIG. 4 or FIG.
  • the device includes a storage unit 301, a processing unit 302, and a communication unit 303.
  • the storage unit 301 is configured to store instructions
  • the processing unit 302 is configured to execute the instructions in the memory and execute the foregoing packet processing method applied to the first device in the embodiment shown in FIG. 4 or FIG. 5;
  • the communication unit 303 is configured to communicate with a second device.
  • the storage unit 301, the processing unit 302 and the communication unit 303 are connected to each other through a bus 304; the bus 304 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) Bus, etc.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 12, but it does not mean that there is only one bus or one type of bus.
  • an embodiment of the present application further provides a packet processing device 400.
  • the device 400 may implement the function of the second device in the embodiment shown in FIG. 4 or FIG.
  • the second device includes a storage unit 401, a processing unit 402, and a communication unit 403.
  • the storage unit 401 is configured to store instructions
  • the processing unit 402 is configured to execute the instructions in the memory and execute the foregoing packet processing method applied to the second device in the embodiment shown in FIG. 4 or FIG. 5;
  • the communication unit 403 is configured to communicate with a first device.
  • the storage unit 401, the processing unit 402, and the communication unit 403 are connected to each other through a bus 404; the bus 404 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) Bus, etc.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 13, but it does not mean that there is only one bus or one type of bus.
  • the above storage unit 301 and storage unit 401 may be random-access memory (RAM), flash memory, flash, read-only memory (ROM), erasable programmable read-only memory (erasable programmable read only memory (EPROM), electrically erasable programmable read-only memory (electrically programmable, read only memory (EEPROM), registers
  • RAM random-access memory
  • ROM read-only memory
  • EPROM erasable programmable read only memory
  • EEPROM electrically erasable programmable read-only memory
  • the processing unit 302 and the processing unit 402 may be, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (ASIC). , Field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure.
  • a processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the communication unit 303 and the communication unit 403 may be, for example, an interface card, etc., and may be an Ethernet interface or an asynchronous transfer mode (ATM) interface.
  • ATM asynchronous transfer mode
  • An embodiment of the present invention provides a message processing system, which is used to implement the method for message processing in the foregoing method embodiments.
  • the system includes the first device in the embodiment shown in FIG. 10 and the second device in the embodiment shown in FIG. 11, or the system includes the first device in the embodiment shown in FIG. 12 and the embodiment shown in FIG. 13. Second device.
  • An embodiment of the present application further provides a computer-readable storage medium including instructions that, when run on a computer, cause the computer to execute the above message processing method applied to the first device and / or the second device.
  • An embodiment of the present application further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the above message processing method applied to the first device and / or the second device.
  • the disclosed systems, devices, and methods may be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the unit is only a logical function division.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, which may be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objective of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each of the units may exist separately physically, or two or more units may be integrated into one unit.
  • the above integrated unit may be implemented in the form of hardware or in the form of software functional unit.
  • the integrated unit When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially a part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium. , Including a plurality of instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiments of the present application.
  • the foregoing storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes .
  • the functions described in the present invention may be implemented by hardware, software, firmware, or any combination thereof.
  • the functions may be stored on a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage media may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例公开了一种报文处理的方法、装置及相关设备，用于解决下发大量流过滤规则，造成的占用较多网络资源的问题。其中方法包括：第一设备生成流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识；所述第一设备向第二设备发送所述流过滤规则，所述动作项用于指示所述第二设备对与所述匹配项匹配的报文按照所述动作项所指示的报文处理方式对所述报文进行处理。

Description

报文处理的方法、装置及相关设备
本申请要求于2018年8月30日提交中国国家知识产权局、申请号、申请名称为“报文处理的方法、装置及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络通信领域，尤其涉及一种报文处理的方法、装置及相关设备。
背景技术
在网络通信过程中，可以通过路由器或者交换机等转发设备对报文进行转发，以路由器为例，路由器在接收到报文后，可以根据报文的信息，例如源互联网协议(internet protocol，IP)地址和目的IP地址，查找路由转发表(forwarding information base，FIB)确定对应于该报文的下一跳信息，将该报文转发至相应的其他路由器、终端或者服务器等网络设备。而转发设备依赖网络资源进行报文转发，网络资源例如带宽、缓存空间和转发设备的处理能力等，在需要的网络资源超过当前可用的网络资源时，网络会发生拥塞，因此，可以对转发设备的流量进行控制，以免网络发生拥塞。
为了对流量进行控制，控制设备可以对转发设备的流量进行分析，得到流过滤规则，然后向转发设备下发流过滤规则，转发设备根据流过滤规则对报文进行处理，例如对报文进行重定向或丢弃等，实现对流量的控制。在传统的方式中，控制设备为每一对利用转发设备进行通信的网络设备都配置一条流过滤规则，当网络设备较多时，配置的流过滤规则的条数也较多，从而需要占用较多的网络资源来将流过滤规则从控制设备下发到转发设备，进一步也导致转发设备占用大量的存储资源。
发明内容
本申请实施例提供了一种报文处理方法、装置及相关设备，用于解决下发大量流过滤规则，造成的占用较多网络资源的问题。
本申请实施例提供了一种报文处理的方法，应用于第一设备，具体包括如下步骤：首先，生成流过滤规则，然后，向第二设备发送该流过滤规则。其中，流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识；所述动作项用于指示所述第二设备对与所述匹配项匹配的报文按照所述动作项所指示的报文处理方式对所述报文进行处理。第一设备可以是用于生成和下发流过滤规则的控制设备，可以是服务器、终端或路由器等。具体的，可以设置边界网关协议流量规范服务器作为第一设备。第二设备可以是转发设备，例如可以是路由器、交换机、网桥或网关等。
也就是说，本申请实施例将自治域标识对应的自治域中的网络设备的IP地址进行聚合，以自治域标识为单位生成流过滤规则。例如，当匹配项中的IP地址为接收的报文的源IP地址时，该自治域为接收的报文的目的地址对应的设备所属的自治域，这样针对该自治域内的所有网络设备只需要生成一条过滤规则。不再需要为该自治域内每 个设备分别生成过滤策略。减少了流过滤规则的生成数量，也就减少了下发到第二设备所需要占用的网络资源。
可选的，所述IP地址可以为所述报文的源IP地址，相应的，所述自治域标识是所述报文的目的IP地址对应的设备所属自治域的标识。或者，所述IP地址可以为所述报文的目的IP地址，相应的，所述自治域标识是所述报文的源IP地址对应的设备所属自治域的标识。自治域标识用于区别不同的自治域，举例来说，电信的自治域标识可以为AS1000，移动的自治域标识可以为AS2000。
可选的，所述自治域标识为所述第二设备的所属的自治域标识。若第二设备和源IP地址对应的网络设备属于同一个自治域，那么在生成流过滤规则时，可以通过获取第二设备所属自治域的自治域标识来得到源IP地址对应的设备所属自治域的自治域标识。若第二设备与目的IP地址对应的网络设备属于同一个自治域，那么也可以通过获取第二设备所属自治域的自治域标识来得到目的IP地址所属自治域的自治域标识。
本申请实施例还提供了一种报文处理的方法，应用于第二设备，具体包括如下步骤：第二设备接收第一设备发送的流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识。第二设备接收报文，根据所述报文中的第一地址确定路由转发表项，所述路由转发表项中包含自治域标识。当所述第二设备确定所述报文的第二地址与所述流过滤规则中的IP地址匹配，并且所述路由转发表项中的自治域标识与所述流过滤规则中的自治域标识相同时，按照所述动作项所指示的报文处理方式对所述报文进行处理。
本申请实施例将自治域标识对应的自治域中的网络设备的IP地址进行聚合，以自治域标识为单位生成流过滤规则。例如，当匹配项中的IP地址为接收的报文的目的IP地址时，该自治域为报文的源IP地址对应的设备所属的自治域，这样针对该自治域内的所有网络设备只需要生成一条过滤规则。不再需要为该自治域内每个设备分别生成过滤规则，减少了流过滤规则的生成数量，第二设备存储的过滤规则也大大减少，节省了第二设备的存储资源。
可选的，所述第一地址可以为所述报文的目的IP地址，相应的，所述第二地址为所述报文的源IP地址。或者，第一地址可以为所述报文的源IP地址，相应的，所述第二地址为所述报文的目的IP地址。
可选的，所述动作项所述指示的报文处理方式包括以下处理方式中的一种或多种：
对报文进行丢弃处理、对报文进行重定向处理和对报文进行流量标记。
其中，对报文进行丢弃处理是指，不对该报文进行转发，并删除该报文；对报文进行重定向处理是指改变该报文对应的下一跳信息，以便改变该报文的转发路径，实现对网络中流量的控制；对报文进行流量标记是指对报文进行标记，以便进行后续处理，例如流量统计等。
可选的，所述方法还包括：
根据所述流过滤规则生成访问控制表，所述访问控制表存储所述IP地址、自治域索引和动作项，所述自治域索引与所述自治域标识对应。因为访问控制表通常能够存储的字符数量较少，所以以字符数量较少的自治域索引来代替自治域标识存储在访问 控制表中，并且可以建立所述自治域索引与所述自治域标识之间的映射关系，以便后续能够根据自治域标识查找到自治域索引。
那么，所述当所述第二设备确定所述报文的第二地址与所述流过滤规则中的IP地址匹配，并且所述路由转发表项中的自治域标识与所述流过滤规则中的自治域标识相同时，按照所述动作项所指示的报文处理方式对所述报文进行处理包括：
当所述第二设备确定所述报文的第二地址与所述访问控制表中的IP地址相同，并且所述路由转发表项中的自治域标识与所述访问控制表中的自治域索引相匹配时，按照所述访问控制表中存储的动作项所指示的报文处理方式对所述报文进行处理。
本申请实施例还提供了一种报文处理的装置，应用于第一设备，包括：
规则生成单元，用于成流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识；
规则发送单元，用于向第二设备发送所述流过滤规则，所述动作项用于指示所述第二设备对与所述匹配项匹配的报文按照所述动作项所指示的报文处理方式对所述报文进行处理。
可选的，所述IP地址为所述报文的源IP地址，所述自治域标识是所述报文的目的IP地址对应的设备所属自治域的标识。
可选的，所述IP地址为所述报文的目的IP地址，所述自治域标识是所述报文的源IP地址对应的设备所属自治域的标识。
可选的，所述自治域标识为所述第二设备的所属的自治域标识。
本申请实施例还提供了一种报文处理的装置，应用于第二设备，包括：
规则接收单元，用于接收第一设备发送的流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识；
报文接收单元，用于接收报文，根据所述报文中的第一地址确定路由转发表项，所述路由转发表项中包含自治域标识；
报文处理单元，用于当确定所述报文的第二地址与所述流过滤规则中的IP地址匹配，并且所述路由转发表项中的自治域标识与所述流过滤规则中的自治域标识相同时，按照所述动作项所指示的报文处理方式对所述报文进行处理。
可选的，所述第一地址为所述报文的目的IP地址，所述第二地址为所述报文的源IP地址。
可选的，所述第一地址为所述报文的源IP地址，所述第二地址为所述报文的目的IP地址。
可选的，所述动作项所述指示的报文处理方式包括以下处理方式中的一种或多种：
对报文进行丢弃处理、对报文进行重定向处理和对报文进行流量标记。
可选的，所述装置还包括：
表生成单元，用于根据所述流过滤规则生成访问控制表，所述访问控制表存储所述IP地址、自治域索引和动作项，所述自治域索引与所述自治域标识对应；
报文处理单元，具体用于当所述第二设备确定所述报文的第二地址与所述访问控制表中的IP地址相同，并且所述路由转发表项中的自治域标识与所述访问控制表中的 自治域索引相匹配时，按照所述访问控制表中存储的动作项所指示的报文处理方式对所述报文进行处理。
本申请实施例还提供了一种报文处理的设备，所述设备为第一设备，所述第一设备包括存储单元、处理单元和通信单元，
所述存储单元，用于存储指令；
所述处理单元，用于执行所述存储器中的所述指令，执行上述应用于第一设备的报文处理方法；
所述通信单元，用于与第二设备进行通信。
本申请实施例还提供了一种报文处理的设备，所述设备为第二设备，所述第二设备包括存储单元、处理单元和通信单元，
所述存储单元，用于存储指令；
所述处理单元，用于执行所述存储器中的所述指令，执行上述应用于第二设备的报文处理方法；
所述通信单元，用于与第一设备进行通信。
本申请实施例还提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行以上应用于第一设备和/或第二设备的报文处理方法。
本申请实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行以上应用于第一设备和/或第二设备的报文处理方法。
本申请实施例还提供了一种报文处理的系统，该系统包括前述第一设备和第二设备。
附图说明
图1为本申请实施例提供的一种转发设备示意图；
图2为本申请实施例提供的一种流量控制设备示意图；
图3为本申请实施例提供的一种报文处理系统的结构框图；
图4为本申请实施例提供的一种报文处理方法的流程图；
图5为本申请实施例提供的另一种报文处理方法的流程图；
图6为本申请实施例提供的一种报文的示意图；
图7为现有技术中的路由转发表项示意图；
图8为本申请实施例提供的一种路由转发表项示意图；
图9为本申请实施例提供的一种访问控制表项示意图；
图10为本申请实施例提供的一种报文处理的装置的结构框图；
图11为本申请实施例提供的另一种报文处理的装置的结构框图；
图12为本申请实施例提供的一种报文处理的设备的硬件架构图；
图13为本申请实施例提供的另一种报文处理的设备的硬件架构图。
具体实施方式
本申请实施例提供了一种报文处理方法、装置及相关设备，用于解决为每个转发设备均下发大量的匹配规则的问题，降低网络资源的浪费。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
传统技术中，可以通过转发设备对报文进行转发，在转发设备接收到报文后，可以根据路由转发表确定对应于该报文的下一跳信息，将该报文转发至相应的其他网络设备。举例来说，参考图1所示，第一用户101和第二用户102可以向转发设备103发送报文，转发设备103将接收到的报文转发至第一设备104、第二设备105、第三设备106和第四设备107。其中，第一设备104的地址为第一地址，第二设备105的地址为第二地址，第三设备106的地址为第三地址，第四设备107的地址为第四地址。
然而，转发设备依赖网络资源进行报文转发，例如依赖带宽、缓存空间和转发设备的处理能力等，如果需要的网络资源超过当前可用的网络资源时，网络会发生阻塞。例如，不法人员可以通过分布式拒绝服务(distributed denial of service，DDOS)的客户端或服务器进行攻击，即将多个计算机联合起来作为攻击平台，对一个或多个目标发动DDOS攻击，使网络造成阻塞，从而影响目标设备中的正常业务的运行，达到攻击的目的。
为了有效防止网络发生拥塞，可以对转发设备进行流量控制。具体的，可以对转发设备的流量进行分析，得到流过滤规则，为转发设备发布流过滤规则，转发设备根据流过滤规则对报文进行处理，例如对报文进行重定向或丢弃等，实现对流量的控制。
举例来说，参考图2所示，为本申请实施例提供的一种流量控制的系统示意图，其中，可以通过控制设备108对转发设备103的流量进行分析，得到流过滤规则，并向转发设备103发布流过滤规则，转发设备103可以根据流过滤规则对接收到的报文进行处理。
然而，网络中往往存在大量的网络设备，因此需要对应于每一对利用转发设备进行通信的网络设备均配置一条流过滤规则，当网络设备较多时，配置的流过滤规则的条数也较多，将形成的大量的流过滤规则下发至每个转发设备，才能实现对每个转发设备进行流量控制，因此占用较多的网络资源。
举例来说，参考图2所示，第一用户101通过转发设备103向第一设备104发送报文，可以对应配置一条流过滤规则，例如该过滤规则的匹配项包括第一用户的IP地址和第一IP地址，第二用户102通过转发设备103向第一设备104发送报文，可以对应配置一条流过滤规则，例如该过滤规则的匹配项包括的第二用户的IP地址和第一IP地址。因此，图2所示的2个用户和4个IP地址，就需要配置8条流过滤规则。同理，若有m个用户具有源IP地址，访问n个IP地址，该网络具有目的IP地址，为了对m个用户访问n个IP地址的流量进行控制，需要根据m个源IP地址和n个目的IP地址生成m*n个流过滤规则。将这m*n个流过滤规则分发至每个转发设备，从而使转发设备可以对接收到的报文进行相应的处理，过滤规则分发过程占用了较多的网络资源， 同时，转发设备存储这些过滤规则占用较多的存储资源。
为了解决上述技术问题，本申请实施例提供了一种报文处理方法、装置及相关设备，用于解决形成和下发大量流过滤规则，造成的网络资源浪费的问题。具体的，第一设备生成流过滤规则，并向第二设备发送该流过滤规则。其中，流过滤规则包括匹配项和动作项，匹配项包括IP地址和自治域(autonomous system，AS)标识(identification，ID)，动作项指示第二设备对于匹配项匹配的报文按照动作项所指示的处理方式对报文进行处理。也就是说，本申请实施例将与自治域标识对应的自治域中网络设备的IP地址进行聚合，以自治域标识为单位生成流过滤规则。这样，所有与匹配项中IP地址对应的网络设备进行通信的自治域中的网络设备，只生成一条流过滤规则即可，无需如传统技术一样为每个自治域的网络设备分别生成一条流过滤规则，减少了流过滤规则的生成数量，从而也减少了下发到第二设备所需要占用的网络资源。
请参阅图3所示，图3为本申请实施例一个系统框架示意图，该系统包括第一设备100、第二设备200、发送设备300和接收设备400，其中，第一设备100和第二设备200连接，发送设备300和接收设备400均与第二设备200连接。
第一设备100可以是软件定义网络(software defined network，SDN)中的控制器，或其他设备，例如是网络管理设备、服务器、终端或路由器等，服务器例如为边界网关协议(border gateway protocol，BGP)流量规范服务器(flow specification server)等。第一设备100用于生成流过滤规则，其中流过滤规则中包括匹配项和动作项，匹配项包括IP地址和自治域标识，流过滤规则中的动作项可以指示第二设备对于匹配项的报文按照动作项所指示的报文处理方式对报文进行处理。
第二设备200可以是转发设备，例如可以是路由器或交换机等，用于将接收到的来自发送设备300的报文发送到接收设备400中。发送设备300和接收设备400可以是终端、服务器或连接用户的设备。
第二设备200接收第一设备100发送的流过滤规则，当第二设备200接收到发送设备300发送的报文后，可以根据该报文中的第一地址确定路由转发表项，其中路由转发表项中包括自治域标识，当确定报文的第一地址与流过滤规则中的IP地址匹配时，并且路由转发表项中的自治域标识与流过滤规则中的自治域标识相同时，按照动作项所指示的报文处理方式对报文进行处理。
其中，第一地址可以为报文的目的IP地址，第二地址为报文的源IP地址。或者，第一地址为报文的源IP地址，第二地址为报文的目的IP地址。
举例来说，流过滤规则的匹配项中可以包括源IP地址IP-1，以及目的IP地址对应的设备所属的自治域的自治域标识AS1000，该匹配项对应的动作项可以为丢弃处理。若第二设备200接收到源IP地址为IP-1，目的IP地址为IP-2的报文M1，则可以通过目的IP地址查找路由转发表，得到目的IP地址对应的路由转发表项，该路由转发表项包括目的IP地址IP-2和该目的IP地址所属自治域的自治域标识。当与目的IP地址IP-2对应的自治域标识为AS1000时，且因报文M1的源IP地址与流过滤规则中的IP地址相同，都是IP-1，所以可以认为该报文与流过滤规则中的匹配项匹配，第二设备200可以对报文M1按照相应的动作项所指示的报文处理方式进行丢弃处理。
为了便于理解，下面对本申请实施例进行详细的介绍。
请参考图4所示，图4为本申请实施例提供的一种报文处理方法的流程图，该方法可以应用于第一设备，包括以下步骤：
S101，生成流过滤规则。
第一设备可以是用于生成和下发流过滤规则的控制设备，可以是服务器、终端或路由器等。具体的，可以设置边界网关协议流量规范服务器作为第一设备。
流过滤规则是用于指示第二设备对报文进行匹配和处理的规则，可以包括匹配项和动作项。其中，匹配项可以包括IP地址和自治域标识。具体的，若IP地址为报文的源IP地址，则自治域标识为报文的目的IP地址对应的设备所属自治域的自治域标识；若IP地址为报文的目的IP地址，则自治域标识为报文的源IP地址对应的设备所属自治域的自治域标识。自治域标识用于区别不同的自治域，举例来说，电信的自治域标识可以为AS1000，移动的自治域标识可以为AS2000。
为了使第一设备能够生成流过滤规则，第一设备可以获取第二设备接收的报文的信息，该报文信息包括报文的源IP地址和目的IP地址。此外，第一设备还需要获取源IP地址或目的IP地址对应的自治域标识。若第二设备和源IP地址对应的网络设备属于同一个自治域，那么可以通过获取第二设备所属自治域的自治域标识来得到源IP地址对应的设备所属自治域的自治域标识。若第二设备与目的IP地址对应的网络设备属于同一个自治域，那么也可以通过获取第二设备所属自治域的自治域标识来得到目的IP地址所属自治域的自治域标识。也就是说，在这种情况下，匹配项中的自治域标识为所述第二设备所属的自治域标识。而如果第二设备独立于源IP地址对应的设备所属的自治域或目的IP地址对应的设备所属的自治域，那么就需要通过其他途径来获取自治域标识，例如在第一设备中根据源IP地址或目的IP地址直接配置对应的自治域标识。
本申请实施例通过将自治域标识对源IP地址或目的IP地址进行聚类，来达到减少生成的流过滤规则的数量的目的。
以对m个用户访问n个IP地址的流量进行控制为例，现有技术需要生成m*n条流过滤规则，而若n个IP地址属于同一个自治域，其自治域标识为A，那么可以生成m*1条流过滤规则即可，每条流过滤规则的匹配项分别包括该自治域的标识A和其中一个用户的IP地址，有效减少了流过滤规则的数量。
参考图2所示，第一IP地址104和第二IP地址105属于第一自治域，则匹配项可以包括第一用户101的IP地址和第一自治域的标识，该匹配项可以用于匹配第一用户101通过转发设备103访问第一IP地址104和/或第二IP地址105产生的报文。第三IP地址106和第四IP地址107属于第二自治域，则匹配项可以包括第一用户101的IP地址和第二自治域的标识，该匹配项用于匹配第一用户101通过转发设备103访问第三IP地址106和/或第四IP地址107产生的报文。因此，对于两个用户访问第一自治域，可以产生2条流过滤规则，对于两个用户访问第二自治域，可以产生2条流过滤规则。
同理，若m个用户属于同一个自治域，其自治域标识为B，那么可以生成1*n条流过滤规则即可，每条流过滤规则的匹配项分别包括该自治域的标识B和n个IP地址 的其中一个。相对于现有技术，也可以有效减少流过滤规则的数量。
此外，除了IP地址和自治域标识，匹配项中还可以包括报文的其他信息，例如IP协议、源端口、目的端口、网络控制报文协议(internet control message protocol，ICMP)类型、ICMP代码、传输控制协议(transmission control protocol，TCP)标志、数据包长度和差分服务代码点(differentiated services code point，DSCP)等信息中的一种或多种。
流过滤规则中的动作项是与匹配项对应的，用于指示对与匹配项匹配的报文按照动作项所指示的报文处理方式对该报文进行处理，动作项可以包括对报文进行丢弃处理、对报文进行重定向处理和对报文进行流量标记等。其中，对报文进行丢弃处理是指，不对该报文进行转发，并删除该报文；对报文进行重定向处理是指改变该报文对应的下一跳信息，以便改变该报文的转发路径，实现对网络中流量的控制；对报文进行流量标记是指对报文进行标记，以便进行后续处理，例如流量统计等。
S102，向第二设备发送流过滤规则。
第二设备可以是转发设备，例如可以是路由器、交换机、网桥或网关等。第一设备可以向第二设备发送具有匹配项和动作项的流过滤规则，以便第二设备对报文进行匹配，在报文与匹配项匹配时，第二设备按照该匹配项对应的动作项所指示的报文处理方式对报文进行处理。
由于第一设备生成的流过滤规则的数量较少，因此，第一设备向第二设备发送的流过滤规则的数量也较少，节省了网络资源，同时也节省了第二设备的存储资源。
本申请实施例提供的一种报文处理方法中，第一设备生成流过滤规则，并向第二设备发送该流过滤规则。其中，流过滤规则包括匹配项和动作项，匹配项包括IP地址和自治域标识，动作项指示第二设备对与匹配项匹配的报文按照动作项所指示的报文处理方式对报文进行处理。也就是说，本申请实施例将与自治域标识对应的自治域中网络设备的IP地址进行聚合，以自治域标识为单位生成流过滤规则。这样，所有与匹配项中IP地址对应的网络设备进行通信的自治域中的网络设备，只生成一条流过滤规则即可，无需如传统技术一样为每个自治域的网络设备分别生成一条流过滤规则，减少了流过滤规则的生成数量，从而也减少了下发到第二设备所需要占用的网络资源。
请参考图5，图5为本申请实施例提供的另一种报文处理方法的流程图，该方法可以应用于第二设备，包括以下步骤。
S201，接收第一设备发送的流过滤规则。
如前文所述，第二设备可以是转发设备，例如可以是路由器、交换机、网桥或网关等，第二设备可以接收第一设备发送的流过滤规则。第一设备可以是用于生成和下发流过滤规则的控制设备，可以是服务器、终端或路由器等。具体的，可以将边界网关协议流量规范服务器作为第一设备。
第二设备接收到的流过滤规则中，可以包括匹配项和动作项，其中，匹配项可以包括IP地址和自治域标识。具体的，IP地址可以为报文的源IP地址，自治域标识为报文的目的IP地址对应的设备所属自治域的标识。IP地址也可以为报文的目的IP地址，而自治域标识为报文的源IP地址对应的设备所属自治域的标识。
由于第一设备生成的流过滤规则较少，则第二设备接收到的流过滤规则也较少。以对m个用户访问n个IP地址的流量进行控制为例，若m个用户属于同一个自治域，则第二设备接收到1*n条流过滤规则；同理，若n个IP地址属于同一个自治域，则第二设备接收到m*1条流过滤规则。
当然，匹配项中还可以包括报文的其他信息，例如IP协议、源端口、目的端口、ICMP类型、ICMP代码、TCP标志、数据包长度和DSCP等信息中的一种或多种。流过滤规则中的动作项是与匹配项对应的，用于指示对与匹配项匹配的报文按照动作项所指示的报文处理方式对该报文进行处理，动作项可以包括对报文进行丢弃处理、对报文进行重定向处理和对报文进行流量标记等。
S202，接收报文，根据报文中的第一地址确定路由转发表项。
参考图6所示，第二设备接收到的报文包括源IP地址201、目的IP地址202和数据203。源IP地址201为生成报文的网络设备的地址，目的IP地址202为预计接收该报文的网络设备的地址。正常情况下，第二设备需要对该报文进行转发，但是在对报文进行流量控制的情况下，就需要对报文进行其他处理。
在第二设备中可以存储有路由转发表，在路由转发表中，具有多个路由转发表项，每一个路由转发表项中，对应存储有报文的转发信息。参考图7所示，为现有技术中的路由转发表项示意图，包括报文的源IP地址301、报文的目的IP地址302和下一跳信息303。因此第二设备可以根据报文的信息，例如源IP地址和目的IP地址，查找路由转发表，确定对应于该报文的下一跳信息，根据下一跳信息对该报文进行转发。
在本申请实施例中，可以在路由转发表中增加自治域标识。具体的，可以增加源IP地址所属自治域的标识，也可以增加目的IP地址对应的设备所属自治域的标识，还可以同时增加源IP地址对应的设备所属自治域的标识和目的IP地址对应的设备所属自治域的标识。参考图8所示，为本申请实施例提供的一种路由转发表项示意图，包括报文的源IP地址301、源AS-ID 304、目的IP地址302、目的AS-ID 305和下一跳信息303，其中，源AS-ID 304为源IP地址301所属的自治域标识，目的AS-ID 305为目的IP地址302所属的自治域标识。
路由转发表项中的源IP地址对应的设备所属的自治域标识和/或目的IP地址对应的设备所属的自治域标识可以通过配置完成。
若第二设备为内部网络网关协议设备或边界网关协议设备，那么通常情况下，第二设备中存储有一个或多个自治域标识。具体的，若第二设备为内部网关协议设备，且与源IP地址对应的网络设备属于同一个自治域，则第二设备所存储的一个自治域标识即为源IP地址对应的设备所属的自治域标识；若第二设备为内部网关协议设备，且与目的IP地址对应的网络设备属于同一个自治域，则第二设备所存储的一个自治域标识即为目的IP地址对应的设备所属的自治域标识。若第二设备为边界网关协议设备，即第二设备与源IP地址对应的网络设备属于同一个自治域，同时也与目的IP地址对应的网络设备属于同一个自治域，此时第二设备就会存储至少两个自治域标识，所以需要根据源IP地址和目的IP地址来具体确定获取其中哪个自治域标识加入到路由转发表中。
第二设备在接收到报文后，可以根据报文的第一地址确定路由转发表项，该表项 中至少包括第一地址和第一地址所属自治域的标识。其中，第一地址可以是报文的源IP地址，则第二地址可以为报文的目的IP地址，相应的，第一地址可以是报文的目的IP地址，则第二地址可以为报文的源IP地址。
S203，当确定报文的第二地址与流过滤规则中的IP地址相同，并且路由转发表项中的自治域标识与流过滤规则中的自治域标识相同时，按照动作项所指示的报文处理方式对报文进行处理。
由上可知，第二设备可以通过报文的第一地址确定路由转发表项，该表项中，包括第一地址及其所属自治域的标识，即第一AS-ID。接着，第二设备可以通过报文的第二地址和第一AS-ID与流过滤规则中的匹配项进行匹配。具体的，第二设备可以判断报文的第二地址与流过滤规则中的IP地址是否相同，第一AS-ID与流过滤规则中的自治域标识是否相同，若都相同，则认为该报文与流过滤规则中的匹配项匹配，此时，可以按照动作项所指示的报文处理方式对报文进行处理。动作项可以包括对报文进行丢弃处理、对报文进行重定向处理和对报文进行流量标记等。
举例来说，流过滤规则的匹配项中可以包括源IP地址IP-1和目的IP地址对应的设备所属的自治域标识AS1000，该匹配项对应的动作项可以为丢弃处理。若第二设备接收到的报文的源IP地址为IP-1，目的IP地址为IP-2，通过目的IP地址查找路由转发表，可以得到目的IP地址对应的路由转发表项，其中，路由转发表项中包括目的IP地址IP-2和目的IP地址对应的设备所属的自治域的标识，即第一AS-ID，为AS1000。因此，可以确定报文的源IP地址和流过滤规则中的IP地址相同，同时，根据路由转发表项得到的第一AS-ID与流过滤规则中的自治域标识相同，则可以认为该报文与流过滤规则中的匹配项匹配，按照相应的动作项所指示的报文处理方式对报文进行处理，具体的，可以对该报文丢弃处理。
同理，流过滤规则的匹配项中也可以包括目的IP地址IP-2和源IP地址对应的设备所属的自治域标识AS2000，该匹配项对应的动作项可以为重定向处理。若第二设备接收到的报文的源IP地址为IP-1，目的IP地址为IP-2，则根据流过滤规则的匹配原则，可以确定源IP地址为第一地址，目的IP地址为第二地址，通过源IP地址查找路由转发表，可以得到源IP地址对应的路由转发表项，其中，路由转发表项中包括源IP地址为IP-1和源IP地址对应的设备所属的自治域的标识，即第一AS-ID，为AS2000。因此，可以确定报文的目的IP地址和流过滤规则中的IP地址相同，同时，根据路由转发表项得到的第一AS-ID与流过滤规则中的自治域标识相同，则可认为该报文与流过滤规则中的匹配项匹配，对报文按照相应的动作项所指示报文处理方式进行处理，具体的，可以对该报文进行重定向处理。
为了方便根据流过滤规则进行流量控制，本申请实施例中，还可以根据流过滤规则生成访问控制表(access control list，ACL)，在访问控制表中可以包括匹配项和动作项。参考图9所示，为本申请实施例中一种访问控制表项的示意图，其中，匹配项可以包括IP地址401和自治域索引402，分别对应流过滤规则中的IP地址和自治域标识，其中，自治域索引与流过滤规则中的自治域标识对应。在实际应用中，可以建立流过滤规则中的自治域标识和自治域索引之间的映射关系，符合该映射关系，则认为二者匹配。该自治域标识和自治域索引可以相同，也可以不同。
因此，第二设备可以通过报文的第一地址确定路由转发表项，该表项中，包括第一地址及其所属自治域的标识，即第一AS-ID，则可以通过报文的第二地址和第一AS-ID与访问控制表中的IP地址和自治域索引进行匹配。具体的，可以确定报文的第二地址与访问控制表中的IP地址是否相同，第一AS-ID与访问控制表中的自治域索引是否匹配，若都是，则认为该报文与访问控制表中的匹配项匹配，此时，可以按照动作项所指示的报文处理方式对报文进行处理。
本申请实施例提供的另一种报文处理方法中，第二设备接收第一设备发送的流过滤规则，其中，匹配项包括IP地址和自治域标识，自治域标识可以标识不同的自治域，一个自治域中可以有多个网络设备，对应多个网络设备的信息。第二设备接收报文，根据报文中的第一地址确定路由转发表项，其中路由转发表项包括自治域标识，当第二设备确定报文的第二地址与流过滤规则中的IP地址相同，并且路由表项中的自治域标识与流过滤规则中的自治域标识相同时，按照动作项所指示的报文处理方式对报文进行处理。也就是说，本申请实施例将与自治域标识对应的自治域中网络设备的IP地址进行聚合，以自治域标识为单位生成流过滤规则。这样，所有与匹配项中IP地址对应的网络设备进行通信的自治域中的网络设备，只生成一条流过滤规则即可，无需如传统技术一样为每个自治域的网络设备分别生成一条流过滤规则，减少了流过滤规则的生成数量，第一设备可以根据较少的流过滤规则对接收到的报文进行匹配，以及对匹配的报文进行处理，节约了网络资源。
参见图10，本申请实施例还提供了一种报文处理的装置，应用于第一设备，该第一设备可以实现图4或图5所示实施例中第一设备的功能，该第一设备包括：规则生成单元101和规则发送单元102。其中，规则生成单元101用于执行图4所示实施例中的步骤S101。规则发送单元102用于执行图4所示实施例中的步骤S102。具体的，
规则生成单元101，用于生成流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识。
规则发送单元102，用于向第二设备发送所述流过滤规则，所述动作项用于指示所述第二设备对与所述匹配项匹配的报文按照所述动作项所指示的报文处理方式对所述报文进行处理。
可选的，所述IP地址为所述报文的源IP地址，所述自治域标识是所述报文的目的IP地址对应的设备所属自治域的标识。
可选的，所述IP地址为所述报文的目的IP地址，所述自治域标识是所述报文的源IP地址对应的设备所属自治域的标识。
可选的，所述自治域标识为所述第二设备的所属的自治域标识。
参见图11，本申请实施例还提供了一种报文处理的装置，应用于第二设备，该第二设备可以实现图4或图5所示实施例中第二设备的功能，该第二设备包括：规则接收单元201、规则接收单元201和报文处理单元203。其中，规则接收单元201用于执行图5所示实施例中步骤S201，规则接收单元202用于执行图5所示实施例中步骤S202，报文处理单元203用于执行图5所示实施例中步骤S203。具体的，
规则接收单元201，用于接收第一设备发送的流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识；
规则接收单元202，用于接收报文，根据所述报文中的第一地址确定路由转发表项，所述路由转发表项中包含自治域标识；
报文处理单元203，用于当确定所述报文的第二地址与所述流过滤规则中的IP地址匹配，并且所述路由转发表项中的自治域标识与所述流过滤规则中的自治域标识相同时，按照所述动作项所指示的报文处理方式对所述报文进行处理。
可选的，所述第一地址为所述报文的目的IP地址，所述第二地址为所述报文的源IP地址。
可选的，所述第一地址为所述报文的源IP地址，所述第二地址为所述报文的目的IP地址。
可选的，所述动作项所述指示的报文处理方式包括以下处理方式中的一种或多种：
对报文进行丢弃处理、对报文进行重定向处理和对报文进行流量标记。
可选的，所述装置还包括：
表生成单元，用于根据所述流过滤规则生成访问控制表，所述访问控制表存储所述IP地址、自治域索引和动作项，所述自治域索引与所述自治域标识对应；
报文处理单元，具体用于当所述第二设备确定所述报文的第二地址与所述访问控制表中的IP地址相同，并且所述路由转发表项中的自治域标识与所述访问控制表中的自治域索引相匹配时，按照所述访问控制表中存储的动作项所指示的报文处理方式对所述报文进行处理。
参见图12，本申请实施例还提供了一种报文处理的设备300，所述设备为第一设备，设备300可以实现图4或图5所示实施例中第一设备的功能，所述设备包括存储单元301、处理单元302和通信单元303，
所述存储单元301，用于存储指令；
所述处理单元302，用于执行所述存储器中的所述指令，执行上述应用于图4或图5所示实施例中第一设备的报文处理方法；
所述通信单元303，用于与第二设备进行通信。
存储单元301、处理单元302和通信单元303通过总线304相互连接；总线304可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
参见图13，本申请实施例还提供了一种报文处理的设备400，设备400可以实现图4或图5所示实施例中第二设备的功能，所述设备为第二设备，所述第二设备包括存储单元401、处理单元402和通信单元403，
所述存储单元401，用于存储指令；
所述处理单元402，用于执行所述存储器中的所述指令，执行上述应用于图4或 图5所示实施例中第二设备的报文处理方法；
所述通信单元403，用于与第一设备进行通信。
存储单元401、处理单元402和通信单元403通过总线404相互连接；总线404可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图13中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
上述存储单元301和存储单元401可以是随机存取存储器(random-access memory，RAM)、闪存(flash)、只读存储器(read only memory，ROM)、可擦写可编程只读存储器(erasable programmable read only memory，EPROM)、电可擦除可编程只读存储器(electrically erasable programmable read only memory，EEPROM)、寄存器
(register)、硬盘、移动硬盘、CD-ROM或者本领域技术人员知晓的任何其他形式的存储介质。
上述处理单元302和处理单元402例如可以是中央处理器(central processing unit，CPU)、通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application-specific integrated circuit，ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。
上述通信单元303和通信单元403例如可以是接口卡等，可以为以太(ethernet)接口或异步传输模式(asynchronous transfer mode，ATM)接口。
本发明实施例提供了一种报文处理系统，该系统用于实现前述方法实施例中的报文处理的方法。该系统包括图10所示实施例中的第一设备和图11所示实施例中的第二设备，或者该系统包括图12所示实施例中的第一设备和图13所示实施例中的第二设备。
本申请实施例还提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行以上应用于第一设备和/或第二设备的报文处理方法。
本申请实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行以上应用于第一设备和/或第二设备的报文处理方法。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执 行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。。

Claims (22)

  1. 一种报文处理的方法，其特征在于，包括：
    第一设备生成流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识；
    所述第一设备向第二设备发送所述流过滤规则，所述动作项用于指示所述第二设备对与所述匹配项匹配的报文按照所述动作项所指示的报文处理方式对所述报文进行处理。
  2. 根据权利要求1所述的方法，其特征在于，所述IP地址为所述报文的源IP地址，所述自治域标识是所述报文的目的IP地址对应的设备所属自治域的标识。
  3. 根据权利要求1所述的方法，其特征在于，所述IP地址为所述报文的目的IP地址，所述自治域标识是所述报文的源IP地址对应的设备所属自治域的标识。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述自治域标识为所述第二设备的所属的自治域标识。
  5. 一种报文处理的方法，其特征在于，包括：
    第二设备接收第一设备发送的流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识；
    所述第二设备接收报文，根据所述报文中的第一地址确定路由转发表项，所述路由转发表项中包含自治域标识；
    当所述第二设备确定所述报文的第二地址与所述流过滤规则中的IP地址匹配，并且所述路由转发表项中的自治域标识与所述流过滤规则中的自治域标识相同时，按照所述动作项所指示的报文处理方式对所述报文进行处理。
  6. 根据权利要求5所述的方法，其特征在于，所述第一地址为所述报文的目的IP地址，所述第二地址为所述报文的源IP地址。
  7. 根据权利要求5所述的方法，其特征在于，所述第一地址为所述报文的源IP地址，所述第二地址为所述报文的目的IP地址。
  8. 根据权利要求5至7任一项所述的方法，其特征在于，所述动作项所述指示的报文处理方式包括以下处理方式中的一种或多种：
    对报文进行丢弃处理、对报文进行重定向处理和对报文进行流量标记。
  9. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    根据所述流过滤规则生成访问控制表，所述访问控制表存储所述IP地址、自治域索引和动作项，所述自治域索引与所述自治域标识对应；
    所述当所述第二设备确定所述报文的第二地址与所述流过滤规则中的IP地址匹配，并且所述路由转发表项中的自治域标识与所述流过滤规则中的自治域标识相同时，按照所述动作项所指示的报文处理方式对所述报文进行处理包括：
    当所述第二设备确定所述报文的第二地址与所述访问控制表中的IP地址相同，并且所述路由转发表项中的自治域标识与所述访问控制表中的自治域索引相匹配时，按照所述访问控制表中存储的动作项所指示的报文处理方式对所述报文进行处理。
  10. 一种报文处理的装置，其特征在于，应用于第一设备，包括：
    规则生成单元，用于成流过滤规则，所述流过滤规则包括匹配项和动作项， 所述匹配项包括互联网协议IP地址和自治域标识；
    规则发送单元，用于向第二设备发送所述流过滤规则，所述动作项用于指示所述第二设备对与所述匹配项匹配的报文按照所述动作项所指示的报文处理方式对所述报文进行处理。
  11. 根据权利要求10所述的装置，其特征在于，所述IP地址为所述报文的源IP地址，所述自治域标识是所述报文的目的IP地址对应的设备所属自治域的标识。
  12. 根据权利要求10所述的装置，其特征在于，所述IP地址为所述报文的目的IP地址，所述自治域标识是所述报文的源IP地址对应的设备所属自治域的标识。
  13. 根据权利要求10至12任一项所述的装置，其特征在于，所述自治域标识为所述第二设备的所属的自治域标识。
  14. 一种报文处理的装置，其特征在于，应用于第二设备，包括：
    规则接收单元，用于接收第一设备发送的流过滤规则，所述流过滤规则包括匹配项和动作项，所述匹配项包括互联网协议IP地址和自治域标识；
    报文接收单元，用于接收报文，根据所述报文中的第一地址确定路由转发表项，所述路由转发表项中包含自治域标识；
    报文处理单元，用于当确定所述报文的第二地址与所述流过滤规则中的IP地址匹配，并且所述路由转发表项中的自治域标识与所述流过滤规则中的自治域标识相同时，按照所述动作项所指示的报文处理方式对所述报文进行处理。
  15. 根据权利要求14所述的装置，其特征在于，所述第一地址为所述报文的目的IP地址，所述第二地址为所述报文的源IP地址。
  16. 根据权利要求14所述的装置，其特征在于，所述第一地址为所述报文的源IP地址，所述第二地址为所述报文的目的IP地址。
  17. 根据权利要求14至16任一项所述的装置，其特征在于，所述动作项所述指示的报文处理方式包括以下处理方式中的一种或多种：
    对报文进行丢弃处理、对报文进行重定向处理和对报文进行流量标记。
  18. 根据权利要求14所述的装置，其特征在于，所述装置还包括：
    表生成单元，用于根据所述流过滤规则生成访问控制表，所述访问控制表存储所述IP地址、自治域索引和动作项，所述自治域索引与所述自治域标识对应；
    报文处理单元，具体用于当所述第二设备确定所述报文的第二地址与所述访问控制表中的IP地址相同，并且所述路由转发表项中的自治域标识与所述访问控制表中的自治域索引相匹配时，按照所述访问控制表中存储的动作项所指示的报文处理方式对所述报文进行处理。
  19. 一种报文处理的设备，其特征在于，所述设备为第一设备，所述第一设备包括存储单元、处理单元和通信单元，
    所述存储单元，用于存储指令；
    所述处理单元，用于执行所述存储器中的所述指令，执行权利要求1-4任意一项所述的方法；
    所述通信单元，用于与第二设备进行通信。
  20. 一种报文处理的设备，其特征在于，所述设备为第二设备，所述第二设备包 括存储单元、处理单元和通信单元，
    所述存储单元，用于存储指令；
    所述处理单元，用于执行所述存储器中的所述指令，执行权利要求5-9任意一项所述的方法；
    所述通信单元，用于与第一设备进行通信。
  21. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行以上权利要求1-9任意一项所述的方法。
  22. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行以上权利要求1-9任意一项所述的方法。
PCT/CN2019/102899 2018-08-30 2019-08-27 报文处理的方法、装置及相关设备 WO2020043107A1 (zh)

Priority Applications (9)

Application Number Priority Date Filing Date Title
KR1020217008398A KR102536676B1 (ko) 2018-08-30 2019-08-27 패킷 처리 방법 및 장치, 및 관련 디바이스들
KR1020237017259A KR102586898B1 (ko) 2018-08-30 2019-08-27 패킷 처리 방법 및 장치, 및 관련 디바이스들
BR112021003695-4A BR112021003695A2 (pt) 2018-08-30 2019-08-27 método e aparelho de processamento de pacote, e dispositivo relacionado
MX2021002287A MX2021002287A (es) 2018-08-30 2019-08-27 Método y aparato de procesamiento de paquetes y dispositivo relacionado.
JP2021510854A JP7193619B2 (ja) 2018-08-30 2019-08-27 パケット処理方法及び装置、及び、関連するデバイス
EP19853800.1A EP3832963A4 (en) 2018-08-30 2019-08-27 METHOD AND DEVICE FOR MESSAGE PROCESSING AND APPROPRIATE DEVICES
US17/186,385 US11575606B2 (en) 2018-08-30 2021-02-26 Method, apparatus, and system for generating, and processing packets according to, a flow filtering rule
JP2022196008A JP2023036647A (ja) 2018-08-30 2022-12-08 パケット処理方法及び装置、及び、関連するデバイス
US18/156,175 US20230179523A1 (en) 2018-08-30 2023-01-18 Packet processing method and apparatus, and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811004608.6 2018-08-30
CN201811004608.6A CN110808913B (zh) 2018-08-30 2018-08-30 报文处理的方法、装置及相关设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/186,385 Continuation US11575606B2 (en) 2018-08-30 2021-02-26 Method, apparatus, and system for generating, and processing packets according to, a flow filtering rule

Publications (1)

Publication Number Publication Date
WO2020043107A1 true WO2020043107A1 (zh) 2020-03-05

Family

ID=69487226

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/102899 WO2020043107A1 (zh) 2018-08-30 2019-08-27 报文处理的方法、装置及相关设备

Country Status (8)

Country Link
US (2) US11575606B2 (zh)
EP (1) EP3832963A4 (zh)
JP (2) JP7193619B2 (zh)
KR (2) KR102536676B1 (zh)
CN (3) CN113285882B (zh)
BR (1) BR112021003695A2 (zh)
MX (1) MX2021002287A (zh)
WO (1) WO2020043107A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4203427A4 (en) * 2020-09-22 2024-02-28 Huawei Tech Co Ltd TRAFFIC PROCESSING METHOD, APPARATUS AND NETWORK APPARATUS

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113872861B (zh) * 2020-06-30 2023-07-18 华为技术有限公司 一种生成表项的方法、发送报文的方法及设备
US20230319698A1 (en) 2020-08-27 2023-10-05 Nippon Telegraph And Telephone Corporation Gateway apparatus, network control apparatus, method, program and system
CN114143257B (zh) * 2020-09-03 2023-04-28 华为技术有限公司 一种生成表项的方法、发送报文的方法、设备及系统
CN112866208B (zh) * 2020-12-31 2022-11-08 迈普通信技术股份有限公司 表项配置方法、报文处理方法、装置、设备及存储介质
CN112929376A (zh) * 2021-02-10 2021-06-08 恒安嘉新（北京）科技股份公司 一种流量数据的处理方法、装置、计算机设备和存储介质
CN113904798B (zh) * 2021-08-27 2024-03-22 长沙星融元数据技术有限公司 Ip报文的多元组过滤方法、系统、设备及存储介质
CN114221781A (zh) * 2021-11-05 2022-03-22 网络通信与安全紫金山实验室 流量过滤方法与系统、电子设备及存储介质
CN114143254A (zh) * 2021-11-30 2022-03-04 锐捷网络股份有限公司 报文转发方法、装置、电子设备及计算机可读存储介质
CN114374622B (zh) * 2021-12-31 2023-12-19 恒安嘉新（北京）科技股份公司 一种基于融合分流设备的分流方法及融合分流设备
WO2024082081A1 (zh) * 2022-10-17 2024-04-25 新华三技术有限公司 一种报文处理方法及装置
CN117439953B (zh) * 2023-12-20 2024-03-26 珠海星云智联科技有限公司 等价成本多路径选择系统、方法、设备、集群以及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101159636A (zh) * 2007-11-23 2008-04-09 中国电信股份有限公司 一种非法接入的检测系统和方法
CN101917434A (zh) * 2010-08-18 2010-12-15 清华大学 域内ip源地址验证的方法
CN103036733A (zh) * 2011-10-09 2013-04-10 上海城际互通通信有限公司 非常规网络接入行为的监测系统及监测方法
CN106657161A (zh) * 2017-02-28 2017-05-10 杭州迪普科技股份有限公司 数据包过滤的实现方法和装置

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6147976A (en) * 1996-06-24 2000-11-14 Cabletron Systems, Inc. Fast network layer packet filter
US6914886B2 (en) * 2001-05-03 2005-07-05 Radware Ltd. Controlling traffic on links between autonomous systems
JP4319925B2 (ja) 2004-03-02 2009-08-26 株式会社日立製作所 ストレージネットワークシステムの制御方法及びストレージネットワークシステム
CN1697443B (zh) * 2004-05-11 2010-06-02 华为技术有限公司 一种控制动态数据流的方法
WO2008114007A1 (en) * 2007-03-22 2008-09-25 British Telecommunications Public Limited Company Data communication method and apparatus
JP5122399B2 (ja) 2008-04-24 2013-01-16 シャープ株式会社 中継装置、および通信制御装置
US10348571B2 (en) * 2009-06-11 2019-07-09 Talari Networks, Inc. Methods and apparatus for accessing dynamic routing information from networks coupled to a wide area network (WAN) to determine optimized end-to-end routing paths
US8281397B2 (en) 2010-04-29 2012-10-02 Telcordia Technologies, Inc. Method and apparatus for detecting spoofed network traffic
US8925079B2 (en) 2011-11-14 2014-12-30 Telcordia Technologies, Inc. Method, apparatus and program for detecting spoofed network traffic
US10305937B2 (en) * 2012-08-02 2019-05-28 CellSec, Inc. Dividing a data processing device into separate security domains
US9647985B2 (en) * 2013-05-23 2017-05-09 Check Point Software Technologies Ltd Location-aware rate-limiting method for mitigation of denial-of-service attacks
US9590901B2 (en) * 2014-03-14 2017-03-07 Nicira, Inc. Route advertisement by managed gateways
US9413783B1 (en) * 2014-06-02 2016-08-09 Amazon Technologies, Inc. Network interface with on-board packet processing
CN105871576A (zh) * 2015-01-21 2016-08-17 杭州华三通信技术有限公司 基于sdn的策略管理方法及装置
CN104796348B (zh) 2015-04-03 2018-02-13 华为技术有限公司 基于sdn的idc网络出口流量均衡调整方法、设备及系统
US10348684B2 (en) 2016-09-01 2019-07-09 Hewlett Packard Enterprise Development Lp Filtering of packets for packet types at network devices
CN106254152B (zh) * 2016-09-19 2019-11-08 新华三技术有限公司 一种流量控制策略处理方法和装置
CN107846341B (zh) * 2016-09-20 2021-02-12 华为技术有限公司 调度报文的方法、相关装置和系统
CN106341423B (zh) * 2016-10-26 2019-12-06 新华三技术有限公司 一种报文处理方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101159636A (zh) * 2007-11-23 2008-04-09 中国电信股份有限公司 一种非法接入的检测系统和方法
CN101917434A (zh) * 2010-08-18 2010-12-15 清华大学 域内ip源地址验证的方法
CN103036733A (zh) * 2011-10-09 2013-04-10 上海城际互通通信有限公司 非常规网络接入行为的监测系统及监测方法
CN106657161A (zh) * 2017-02-28 2017-05-10 杭州迪普科技股份有限公司 数据包过滤的实现方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
WU JIANPING , REN GANG , LI XING : "IPv6 Inter-AS Source Address Validation on Ipv6 Network", SCIENCEPAPER ONLINE, vol. 2, no. 10, 15 October 2007 (2007-10-15), pages 715 - 719, XP055784456 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4203427A4 (en) * 2020-09-22 2024-02-28 Huawei Tech Co Ltd TRAFFIC PROCESSING METHOD, APPARATUS AND NETWORK APPARATUS
US11924103B2 (en) 2020-09-22 2024-03-05 Huawei Technologies Co., Ltd. Traffic processing method, apparatus, and network device

Also Published As

Publication number Publication date
JP2023036647A (ja) 2023-03-14
JP7193619B2 (ja) 2022-12-20
CN112910792B (zh) 2023-06-20
CN110808913A (zh) 2020-02-18
KR102536676B1 (ko) 2023-05-26
CN113285882B (zh) 2024-01-09
CN112910792A (zh) 2021-06-04
EP3832963A4 (en) 2021-10-27
US20230179523A1 (en) 2023-06-08
KR20230079462A (ko) 2023-06-07
JP2021535678A (ja) 2021-12-16
CN113285882A (zh) 2021-08-20
US20210184974A1 (en) 2021-06-17
KR102586898B1 (ko) 2023-10-11
KR20210038686A (ko) 2021-04-07
MX2021002287A (es) 2021-07-15
BR112021003695A2 (pt) 2021-05-18
CN110808913B (zh) 2021-02-23
US11575606B2 (en) 2023-02-07
EP3832963A1 (en) 2021-06-09

Similar Documents

Publication Publication Date Title
WO2020043107A1 (zh) 报文处理的方法、装置及相关设备
CA2968964C (en) Source ip address transparency systems and methods
US7996894B1 (en) MAC address modification of otherwise locally bridged client devices to provide security
US8169910B1 (en) Network traffic analysis using a flow table
US20180083876A1 (en) Optimization of multi-table lookups for software-defined networking systems
TWI495301B (zh) 控制封包的階層式速率限制
US20070171826A1 (en) System, method, and computer program product for controlling output port utilization
Choi Implementation of content-oriented networking architecture (CONA): a focus on DDoS countermeasure
EP3076612A1 (en) Packet processing method, node and system
US20130294449A1 (en) Efficient application recognition in network traffic
JP7216120B2 (ja) Ｂｇｐメッセージ送信方法、ｂｇｐメッセージ受信方法、及びデバイス
US20160380899A1 (en) Method and apparatus for dynamic traffic control in sdn environment
Deri High-speed dynamic packet filtering
WO2024093478A1 (zh) 基于策略路由的数据处理方法和装置、设备和存储介质
US11838197B2 (en) Methods and system for securing a SDN controller from denial of service attack
TWI281804B (en) Packet forwarding method and system
WO2022100511A1 (zh) 转发表项的处理方法和装置
David Dynamic Flow Reduction Scheme Using Two Tags Multi protocol Label Switching (MPLS) in Software Define Network
CN110958185B (zh) 基于业务的QoS配置方法及装置
CN115460143A (zh) 报文的处理方法、装置及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19853800

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021510854

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112021003695

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2019853800

Country of ref document: EP

Effective date: 20210305

ENP Entry into the national phase

Ref document number: 20217008398

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 112021003695

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20210226