WO2022017249A1 - 可编程交换机、流量统计方法、防御方法和报文处理方法 - Google Patents

可编程交换机、流量统计方法、防御方法和报文处理方法 Download PDF

Info

Publication number
WO2022017249A1
WO2022017249A1 PCT/CN2021/106452 CN2021106452W WO2022017249A1 WO 2022017249 A1 WO2022017249 A1 WO 2022017249A1 CN 2021106452 W CN2021106452 W CN 2021106452W WO 2022017249 A1 WO2022017249 A1 WO 2022017249A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
packet
message
traffic statistics
target
Prior art date
Application number
PCT/CN2021/106452
Other languages
English (en)
French (fr)
Inventor
汤明
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2022017249A1 publication Critical patent/WO2022017249A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/10—Packet switching elements characterised by the switching fabric construction
    • H04L49/109—Integrated on microchip, e.g. switch-on-chip
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information

Definitions

  • a programmable switch is a switch that uses programmable switching chips to perform packet forwarding logic.
  • the programmable switching chip provides programmable functions related to packet processing. Users can flexibly expand the match-action table through programming, so that the forwarding logic of the packet can be controlled by programming.
  • the embodiments of the present application propose a programmable switch, a traffic statistics method, a defense method, and a message processing method, so as to integrate the functions of other network devices on the basis of realizing the message forwarding function, thereby reducing the number of network devices deployed and reducing the cost of network infrastructure construction.
  • An embodiment of the present application provides a programmable switch, including: a programmable switch chip and a processor using an X86 architecture, where the programmable switch chip is communicatively connected to the processor.
  • Embodiments of the present application further provide a programmable switch, including: a programmable switch chip, configured to intercept key information in the packet in response to receiving a packet, and mirror the key information to a processor; The processor is configured to parse the received key information, generate a defense entry and a defense strategy corresponding to the defense entry; and transmit the defense entry and the defense strategy to the programmable a switch chip; the programmable switch chip is further configured to use a subsequently received message as a message to be tested, and to detect whether the message to be tested matches the defense entry; in response to the match, based on the The defense policy defends the message to be tested; in response to the mismatch, the message to be tested is forwarded.
  • a programmable switch chip configured to intercept key information in the packet in response to receiving a packet, and mirror the key information to a processor
  • the processor is configured to parse the received key information, generate a defense entry and a defense strategy corresponding to the defense entry; and transmit the defense entry and the defense strategy to
  • An embodiment of the present application further provides a programmable switch, including: a programmable switch chip configured to, in response to receiving a packet, determine the type of a destination IP address in the packet; in response to the type being any a destination class, transmitting the message to the processor; the processor is configured to use the destination IP address as the first destination IP address, and determine the second destination based on the class of the first destination IP address IP address; replace the first destination IP address with the second destination IP address to obtain a target packet; transmit the target packet to the programmable switching chip; the programmable switching chip is further is configured to forward the target packet to the second destination IP address.
  • An embodiment of the present application further provides a traffic statistics method, which is applied to a programmable switch chip in a programmable switch, where the programmable switch further includes a processor, and the method includes: receiving a traffic statistics table transmitted by the processor item; in response to receiving the message, detect whether the message matches the traffic statistics table entry; in response to the message matching the traffic statistics table entry, take the message as the target message, The target packet performs traffic statistics, generates traffic statistics results, and forwards the packets; and transmits the traffic statistics results to the processor.
  • An embodiment of the present application further provides a security defense method, which is applied to a programmable switch chip in a programmable switch, where the programmable switch further includes a processor, and the method includes: in response to receiving a packet, intercepting the The key information in the message is mirrored to the processor; the defense table entry and defense strategy transmitted by the processor are received, and the defense table entry and the defense strategy are processed by the processor. generated after information analysis; take the subsequently received message as the message to be tested, and detect whether the message to be tested matches the defense table entry; in response to the match, analyze the message to be tested based on the defense policy to defend.
  • An embodiment of the present application further provides a packet processing method, which is applied to a processor in a programmable switch, where the programmable switch further includes a programmable switch chip, and the method includes: receiving a message transmitted by the programmable switch chip. packet, wherein the category of the destination IP address in the packet is any target category; the destination IP address in the packet is used as the first destination IP address, based on the category of the first destination IP address, Determine the second destination IP address; replace the first destination IP address with the second destination IP address to obtain a target message; transmit the target message to the programmable switching chip, so that the The programmable switching chip forwards the target packet to the second destination IP address.
  • An embodiment of the present application further provides a traffic statistics device, which is applied to a programmable switch chip in a programmable switch, where the programmable switch further includes a processor, and the device includes: a receiving unit configured to receive the The traffic statistics entry transmitted by the processor; the detection unit is configured to, in response to receiving the packet, detect whether the packet matches the traffic statistics entry; the statistics unit is configured to respond to the packet and the traffic statistics entry. If the traffic statistics table entry matches, take the packet as a target packet, perform traffic statistics on the target packet, generate a traffic statistics result, and forward the packet; the transmission unit is configured to send the processing The device transmits the traffic statistics results.
  • An embodiment of the present application further provides a security defense device, which is applied to a programmable switch chip in a programmable switch, the programmable switch further includes a processor, and the device includes: a mirroring unit, configured to respond to receiving receiving the message, intercepting key information in the message, and mirroring the key information to the processor; the receiving unit is configured to receive the defense entry and defense strategy transmitted by the processor, the defense entry and The defense strategy is generated by the processor after parsing the key information; the matching unit is configured to use the subsequently received message as the message to be tested, and to detect the message to be tested and the defense entry Whether it matches; the defense unit is configured to, in response to the match, defend the packet to be tested based on the defense policy.
  • An embodiment of the present application further provides a message processing apparatus, which is applied to a processor in a programmable switch, where the programmable switch further includes a programmable switching chip, and the apparatus includes: a receiving unit configured to receive the received The message transmitted by the programmable switching chip, wherein the category of the destination IP address in the message is any target category; the determining unit is configured to use the destination IP address in the message as the first destination IP address address, determine the second destination IP address based on the category of the first destination IP address; the replacement unit is configured to replace the first destination IP address with the second destination IP address to obtain a target message; A transmission unit configured to transmit the target packet to the programmable switch chip, so that the programmable switch chip forwards the target packet to the second destination IP address.
  • the embodiments of the present application further provide one or more machine-readable media on which executable codes are stored, and when the executable codes are executed, cause the processor to execute the execution of one or more of the embodiments of the present application.
  • traffic statistics method security defense method, or packet processing method.
  • the embodiments of the present application include the following advantages:
  • the programmable switch can integrate the functions of other network devices on the basis of the packet forwarding function, reducing data During the construction of the center, the number of network devices deployed as basic network facilities reduces the cost of network infrastructure construction.
  • FIG. 1A is an exemplary architecture diagram of a programmable switch according to an embodiment of the present application.
  • FIG. 1B is a schematic diagram of a processing process of a programmable switch according to an embodiment of the present application
  • FIG. 2A is a schematic diagram of a processing process of a programmable switch in a traffic statistics scenario according to an embodiment of the present application
  • FIG. 2B is a schematic diagram of a processing process of a programmable switch security defense scenario according to an embodiment of the present application
  • 3 is a flow chart of an embodiment of the traffic statistics method of the present application.
  • FIG. 6 is a schematic structural diagram of an embodiment of a traffic statistics device of the present application.
  • FIG. 7 is a schematic structural diagram of an embodiment of the security defense device of the present application.
  • FIG. 8 is a schematic structural diagram of an embodiment of a message processing apparatus of the present application.
  • the embodiments of the present application can be applied to the communication field, and specifically can be applied to network infrastructure construction scenarios, such as traditional cloud data centers, edge cloud data centers, and other network infrastructure construction scenarios.
  • network infrastructure construction a large number of network devices, such as switches, servers, and optical splitters, need to be deployed to implement functions such as packet forwarding, traffic statistics, security defense, load balancing, traffic accounting, and gateways.
  • edge cloud data centers usually contain thousands of network devices, so infrastructure consumption accounts for a small proportion of traditional cloud data centers.
  • edge cloud data centers With the gradual rise of edge computing, there are more and more demands for the construction of edge cloud data centers.
  • the edge cloud data center is usually built by renting racks in the operator's computer room, so it is usually only in the scale of dozens of servers. Under the scale of dozens of servers, more than ten servers are needed to realize the above functions. As a result, infrastructure consumption occupies a large proportion of the entire edge cloud data center, which seriously hinders the development of edge cloud.
  • the programmable switch in the embodiment of the present application can integrate the functions of some other network devices while implementing the message forwarding function, thereby reducing the number of network devices deployed as basic network facilities during the construction of the data center, and reducing the network infrastructure Facility construction costs.
  • a programmable switch includes a programmable switch chip and a processor.
  • the programmable switch chip here can be various existing programmable switch chips.
  • the processor here may use an X86 architecture, and specifically may be a central processing unit (Central Processing Unit, CPU) using the X86 architecture (The X86architecture).
  • the programmable switch chip is communicatively connected with the processor for data and signal transmission.
  • the processor can execute the logic of the switch control layer, and can also execute the traffic accounting logic, act as a load scheduler to execute the load balancing logic, execute the gateway logic, formulate the defense strategy, and issue various entries to the programmable switching chip (such as Traffic statistics entries, defense entries), etc. Since the processor has the function of executing various logics, the programmable switch can have the functions of other network devices such as servers and gateways, which reduces the number of network devices deployed as basic network facilities in the process of data center construction and reduces the network infrastructure. Facility construction costs.
  • the programmable switch may also include other components required by the programmable switch, such as a memory and a bus, which is not limited in this embodiment.
  • FIG. 1B is a schematic diagram of a processing process of a programmable switch according to an embodiment of the present application.
  • the above-described processor may be configured to transmit control information to the programmable switch chip.
  • the control information is used to control the programmable switching chip to execute the target operation logic before executing the message forwarding logic.
  • the target operation logic may include, but is not limited to, traffic statistics operation logic, security defense operation logic, mirroring operation logic, distribution operation logic, and the like.
  • the programmable switching chip can be configured to execute the target operation logic first when receiving the message; and execute the message forwarding logic after the execution of the target operation logic is completed.
  • the target operation logic can be written in the programmable switch chip through a specific domain programming language of the programmable switch chip, such as the P4 language, so that the processor can control the execution sequence of the programmable switch chip for different logics.
  • the programmable switching chip By transmitting control information to the programmable switching chip by the processor, the programmable switching chip can be controlled to first execute the target operation logic after receiving the message, and then execute the message forwarding logic after the execution of the target operation logic ends.
  • the programmable switch can integrate the functions of other network devices on the basis of the packet forwarding function, which reduces the number of network devices deployed as basic network facilities in the process of data center construction, and reduces network infrastructure construction costs.
  • FIG. 2A is a schematic diagram of a processing process of a programmable switch in a traffic statistics scenario according to an embodiment of the present application.
  • the processor in the programmable switch may be configured to transmit traffic statistics entries to the programmable switch chips, and the traffic statistics entries may be located in the control information.
  • the traffic statistics entry may be an entry used to filter target packets for traffic statistics.
  • Table entries can be fields, etc.
  • the programmable switch chip may be configured to first execute traffic statistics operation logic in response to receiving the packet. Specifically, it is possible to first detect whether the packet matches the traffic statistics entry by means of character string matching. In response to the packet matching the above-mentioned traffic statistics entry, the above-mentioned packet may be used as a target packet, and traffic statistics are performed on the above-mentioned target packet, thereby generating a traffic statistics result.
  • the traffic statistics result here may include but not limited to at least one of the following: the total number of target packets and the total number of bytes of the target packets.
  • the programmable switching chip may be further configured to execute the packet forwarding logic after the traffic statistics operation logic is executed.
  • the programmable switch has the function of traffic statistics on the basis of the traditional packet forwarding function.
  • access control lists ACLs are used to filter out some packets. Therefore, traffic statistics are performed first, and then packets are forwarded to avoid inaccurate traffic statistics results.
  • One or more fields can be included in the traffic statistics table item.
  • Internet Protocol Internet Protocol, IP
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • UDP User Datagram Protocol
  • control packet Protocol Internet Control Message Protocol
  • SYN Synchronize Sequence Numbers
  • ACK Acknowledge character
  • the programmable switching chip can be further configured to detect whether the above packets match the above traffic statistics entries through the following steps: first, in response to receiving the packets, read The header of the above message.
  • the packet header usually contains fields such as IP address, IP address, protocol type, port number, confirmation character, and synchronization sequence number. Then, it can be detected whether the above-mentioned packet header contains the fields in the above-mentioned traffic statistics table entry. In response to the packet header including the field in the traffic statistics entry, it is determined that the packet matches the traffic statistics entry. Otherwise, it can be considered that the packet does not match the traffic statistics entry.
  • the traffic statistics entry is the field "IP 1.1.1.1”. If the header of the received packet contains the field "IP 1.1.1.1”, it can be considered that the packet matches the traffic statistics entry , so that the packet can be included in the traffic statistics result as a target packet.
  • the traffic statistics entry includes the fields "IP 2.2.2.2", "TCP” and "80”. If the packet contains the above fields, that is, the IP address is 2.2.2.2 and the protocol type is the TCP protocol, And the source port number is 80, it can be considered that the packet matches the traffic statistics entry, so that the packet can be included in the traffic statistics result as a target packet.
  • each traffic statistics entry may include one or more fields.
  • packets can be matched for each traffic statistics entry.
  • the IP address in the traffic statistics table entry may be further limited to a source IP address or a destination IP address.
  • the port number can also be further limited to the source port number or the destination port number, so as to conduct more fine-grained traffic statistics.
  • the programmable switching chip may be further configured to generate traffic statistics results through the following steps: first, count the total number of target packets and the total number of bytes of the target packets. For example, each time a target packet is received, the total number of packets of the target packet can be calculated by adding one to obtain a new total number of packets. At the same time, each time a target message is received, the number of bytes of the target message can be read, and the number of bytes and the total number of bytes obtained last time can be summed to obtain a new total number of bytes. After that, the traffic statistics result including the newly determined total number of target packets and the total number of bytes can be generated. Therefore, the traffic statistics result can be updated once every time a target packet matching the traffic statistics entry is received.
  • the cumulative calculation process is relatively simple, which ensures the performance of the programmable switching chip.
  • the processor may also obtain traffic statistics results by reading the external interface provided by the programmable switching chip at two time points, and continue to perform other types of traffic statistics operations. Specifically, the processor may first obtain the first traffic statistics result from the programmable switch chip at the first time. Then, the second traffic statistics result is obtained from the programmable switch chip at a second time. Then, the time difference between the second time and the first time is determined. Then, determine the first difference between the total number of packets in the second traffic statistics result and the total number of packets in the first traffic statistics result, and determine the total number of bytes in the second traffic statistics result and the first traffic statistics result The second difference of the total number of bytes.
  • the ratio of the first difference to the time difference is determined as the packet forwarding rate (Packet Per Second, PPS), and the ratio of the second difference to the time difference is determined as the bit rate (Bytes Per Second, BPS).
  • the target traffic statistics results including the packet forwarding rate and the bit rate are generated. Using the packet forwarding rate and bit rate as the target traffic statistics results is helpful for subsequent traffic accounting operations.
  • the processor may be further configured to: encapsulate the target traffic statistics results to obtain the encapsulated packets.
  • the encapsulated packet includes the IP address of the target server.
  • the target server may be a server for performing traffic accounting or other operations based on the target traffic statistics.
  • the packaged message is transmitted to the programmable switching chip. Therefore, the programmable switching chip can forward the encapsulated message to the IP address of the target server, so as to facilitate the target server to perform traffic accounting and other operations.
  • the traffic input to the switch is usually first split and mirrored through the wind turbine, and the traffic is copied to multiple servers; then fine-grained statistics are performed on the traffic on each server, and finally each server is collected. The statistical results are accumulated to obtain accurate traffic information. Since the traffic received by the switch is usually 3.2T, and the server can only handle the traffic of 40G, dozens of servers need to be deployed. At the same time, an additional beam splitter is required. As a result, a large number of devices need to be deployed to implement the traffic statistics function, and the network infrastructure construction cost is relatively high.
  • the programmable switch provided by the embodiment of the present application has a traffic statistics function on the basis of the traditional packet forwarding function, and only needs one programmable switch to complete the fine-grained traffic statistics operation, and does not need to perform optical splitter and
  • the deployment of servers reduces the number of network devices deployed and the cost of network infrastructure construction.
  • FIG. 2B is a schematic diagram of a processing process of a programmable switch in a security defense scenario according to an embodiment of the present application.
  • the processor in the programmable switch can transmit defense entries and defense policies to the programmable switch chip.
  • Defense table entries and defense policies can be located in control information.
  • the defense entry is an entry used to filter out attack packets for defense.
  • Defense entries can contain information about pre-identified attack packets, such as IP addresses, TCP, and UDP. Similar to the above traffic statistics entry, the defense entry can also contain one or more fields.
  • the above-mentioned attack packets may refer to some packets that send a large number of attack requests to network devices such as servers, so that normal legitimate users cannot obtain services.
  • the defense policy is used to indicate the operation logic to be executed after an attack packet is detected based on the defense entry.
  • the programmable switch chip may first execute defense operation logic in response to receiving the message.
  • the packet may be used as the packet to be tested first, and it is detected whether the packet to be tested matches the defense entry.
  • the method of detecting whether the packet to be tested matches the defense entry is basically the same as the method of detecting whether the packet matches the traffic statistics entry, and thus will not be repeated here.
  • the packet to be tested can be defended based on the defense policy, that is, the operation logic in the defense policy is executed, and the packet to be tested is defended.
  • each defense entry may include one or more fields.
  • the packets to be tested can be matched for each flow defense entry.
  • defense entry A is the field “IP 1.1.1.1”
  • defense entry B contains the field "IP 2.2.2.2” and port "80”.
  • the defense policy corresponding to defense entry A can be set to limit the rate to 10 requests per second, and the defense policy corresponding to defense entry B can be set to prohibit access within 3 minutes.
  • the programmable switch chip can execute the message forwarding logic. Specifically, if the packet to be tested is not discarded after the defense operation logic is executed, it means that the packet to be tested is not an attack packet or a packet that can continue to be forwarded after executing the defense strategy. The message to be tested is forwarded. If the packet to be tested is discarded after the defense operation logic is executed, there may be no packet to be forwarded, so the packet forwarding logic can automatically end. Therefore, on the basis of the traditional packet forwarding function, the programmable switch also has the function of performing security defense before packet forwarding, thereby discarding or reducing attack packets. It enriches the functions of programmable switches, reduces the cost of network infrastructure construction, and ensures network security at the same time.
  • the defense strategy may be to limit the forwarding number of packets matching the defense entry within a unit time to less than a first preset value (such as 10). Therefore, the programmable switching chip can be further configured to defend the message to be tested through the following steps: firstly, to detect the forwarding number of messages from the same source of the message to be tested within a unit duration.
  • the same-source packet is a packet containing the same source IP as the packet to be tested.
  • the packet to be tested is discarded, thereby effectively reducing the number of network devices accessed by the attack traffic.
  • the defense policy may be to limit the access interval duration of the packets matching the defense entry to be less than a second preset value (for example, 3 seconds). Therefore, the programmable switching chip can be further configured to defend the message to be tested by the following steps: first, obtain the first reception time of the message to be tested. Then, the second receiving time of the target same-source message of the message to be tested is obtained, wherein the target same-source message is the same-source message with the latest reception time, and the same-source message contains the same message as the message to be tested. Source IP packets. After that, the time difference between the first reception time and the second reception time is determined. In response to the time difference being less than the second preset threshold (eg, 3 seconds), the packet to be tested is discarded, thereby effectively reducing the number of accesses to the network device by the attack traffic.
  • a second preset value for example, 3 seconds
  • the defense table entry and defense policy may be generated by the processor after analyzing the packets received by the programmable switching chip.
  • the programmable switch chip can be further configured to intercept key information in the received packet before receiving the control information, and mirror the key information to the processor.
  • the key information may be a packet header of the packet, or may be some key fields in the packet header, such as an IP address, a protocol type, a port number, and the like.
  • the processor may be further configured to parse the received key information, and generate a defense entry and a defense strategy corresponding to the defense entry.
  • the processor may generate a defense entry and a defense strategy corresponding to the defense entry through the following steps: first, perform statistics on the received key information within the target duration, and determine the quantity of the same key information within the target duration.
  • the target duration may be a unit duration, such as 1 second, or may be any other predetermined duration.
  • a third preset threshold such as 100,000, etc.
  • the number of packets containing the source IP address per second is greater than 100,000, which is far greater than the normal number of packets sent per unit time, it can be considered that the packets containing the source IP address are sent.
  • the message is an attack message.
  • the source IP address can be used as a defense entry, and a defense policy corresponding to the defense entry can be created. Therefore, the defense table entry and defense strategy can be generated by the processor based on the analysis of the packets received by the programmable switching chip, without resorting to other network devices.
  • bypass defense means that the switch is additionally equipped with an optical splitter and a server, the traffic is split to the server through the optical splitter, the traffic statistics are collected on the server to formulate defense entries and defense strategies, and then the defense entries and defense strategies are delivered to the switch. In the access control list, some packets are filtered out through the access control list. However, the number of entries in the ACL is limited, and it is usually necessary to ensure that the number of entries is less than 10,000, so comprehensive security defense cannot be implemented.
  • Bypass defense means mirroring traffic to the security server, filtering all traffic through the security server, and then forwarding the traffic by the switch.
  • the processor can generate defense entries and defense policies after analyzing the packets received by the programmable switching chip, and the programmable switching chip can perform subsequent reporting based on the defense entries and defense policies.
  • the defense of the text Therefore, on the basis of the traditional packet forwarding function, the programmable switch also has the security defense function. Only one programmable switch can complete comprehensive security defense operations, without the deployment of optical splitters and security servers, reducing the number of network equipment deployments and reducing network infrastructure construction costs.
  • the security defense scenario can also be combined with the traffic statistics scenario.
  • the programmable switching chip After the programmable switching chip receives the packet, it can first perform traffic statistics. The post-processor obtains the traffic statistics results through the interface provided by the programmable switching chip, thereby analyzes the traffic statistics results, generates defense entries and defense policies, and sends them to the programmable switching chips. Thus, the programmable switching chip can perform security defense operations on subsequent packets. In addition, the programmable switching chip can continue to maintain the traffic statistics operation on subsequent packets before performing security defense operations on subsequent packets, so that the processor can change defense entries and defense policies in time according to the traffic statistics results to facilitate adaptation. Scenarios where attack packets change.
  • the programmable switch also integrates other functions, such as load balancing functions, or gateway functions, according to the type of IP addresses in the packets.
  • the programmable switching chip may first execute IP address class detection logic to determine whether the class of the destination IP address in the message is any target class.
  • the target category may include but is not limited to: virtual IP (Virtual IP, VIP) address class of virtual server (Linux Virtual Server, LVS) cluster, public network IP address class of cloud server, edge cloud IP address class, cloud data center IP address class, etc.
  • the category of the destination IP address can be detected by string matching.
  • the above-mentioned message can be transmitted to the processor by the programmable switch chip.
  • the processor may modify the destination IP address based on the category of the destination IP address to generate a target packet, so as to return the target packet to the programmable switching chip.
  • the programmable switch chip can replace the original message with the target message, and perform message forwarding logic on the target message.
  • the programmable switch can act as the LVS scheduler (load balancer) to achieve load balancing.
  • the VIP of the LVS cluster usually refers to the external network IP of the LVS cluster.
  • users can connect to the real server (Real Server) at the backend by accessing the VIP of the LVS cluster, and the user does not need to determine the location and number of the real servers that are actually accessed.
  • the scheduler of the LVS cluster which can be regarded as the external front-end machine of the LVS cluster, is the only entry point (Single Entry Point) of the LVS cluster, and is responsible for sending customer requests to a group of real servers for execution through load balancing and other methods.
  • the processor may first use the destination IP address in the packet as the first destination IP address. Then select the real server through the load balancing algorithm. The processor may select a server with a smaller current load from the server pool according to the load situation of each server in the server pool of the LVS cluster. Finally, the selected IP address of the real server is used as the second destination IP address, and the first destination IP address of the message is replaced with the second destination IP address to generate a target message.
  • the programmable switch chip can forward the target packet to the second destination IP address, so that the destination IP address of the packet is replaced by the original virtual IP address to the IP address of the real server selected by the load balancing algorithm, so that the programmable switch Implemented load balancing function.
  • the category of the destination IP address in the packet received by the programmable switching chip is the public network IP address class of the cloud server of the cloud server, the edge cloud IP address class, and the cloud data center IP address class
  • the programmable switch can act as a gateway to determine the IP address of the physical server bearing the destination IP address, and forward packets to the IP address of the physical server to implement the gateway function.
  • the processor may first use the destination IP address in the packet as the first destination IP address. If the first destination IP address is the public network IP address of the cloud server, the IP address of the physical server bearing the public network IP address may be obtained, and the IP address of the physical server may be used as the second destination IP address. Afterwards, the first destination IP address of the packet can be replaced with the second destination IP address to generate a target packet.
  • the programmable switching chip can forward the target message to the second destination IP address, so that the destination IP address of the message is changed from the public network IP address of the original cloud server to the IP address of the physical server carrying the public network IP address,
  • the programmable switch realizes the gateway function in the process of cloud-on-cloud intercommunication.
  • the programmable switch chip can forward the target packet to the second destination IP address, so that the destination IP address of the packet is changed from the original edge cloud IP address to the IP address of the physical server bearing the edge cloud IP address. Therefore, when the source IP address in the packet is the IP address of the user equipment, the programmable switch realizes the gateway function in the cloud-on-cloud intercommunication process. When the source IP address in the packet is the IP address of the cloud data center, the programmable switch realizes the gateway function in the process of intercommunication between the cloud data center and the edge cloud.
  • the programmable switch chip can forward the target packet to the second destination IP address, so that the destination IP address of the packet is changed from the original cloud data center IP address to the IP address of the physical server bearing the cloud data center IP address. Therefore, when the source IP address in the packet is the edge cloud IP address, the programmable switch realizes the gateway function in the process of intercommunication between the cloud data center and the edge cloud.
  • the programmable switching chip When the programmable switching chip detects that the category of the destination IP address in the packet is the target category, the packet is transmitted to the processor, and the processor modifies the destination IP address according to the category of the destination IP address in the packet. , which can make the programmable switching chip integrate the load balancing function or the gateway function, further reducing the number of network equipment deployment and reducing the cost of network infrastructure construction.
  • the traffic statistics method is applied to a programmable switch chip in a programmable switch.
  • the programmable switch also includes processors, such as the central processing unit of the X86 architecture.
  • the traffic statistics method includes the following steps:
  • Step 301 Receive traffic statistics entries transmitted by the processor.
  • the execution body of the traffic statistics method may receive the traffic statistics entries transmitted by the processor.
  • the traffic statistics entry may be an entry used to filter target packets for traffic statistics.
  • the traffic statistics table entry may include, but is not limited to, at least one of the following fields: IP address, protocol type (such as TCP, UDP, ICMP, etc.), synchronization sequence number, confirmation character, port number, and the like.
  • IP address IP address
  • protocol type such as TCP, UDP, ICMP, etc.
  • synchronization sequence number confirmation character
  • port number port number
  • Step 302 in response to receiving the packet, detect whether the packet matches the traffic statistics entry.
  • the above-mentioned execution body may detect whether the packet matches the traffic statistics table entry by means of character string matching. It should be noted that the number of traffic statistics entries may be one or more, and each traffic statistics entry may include one or more fields. When there are multiple traffic statistics entries, packets can be matched for each traffic statistics entry.
  • the following steps may be used to detect whether the above packets match the above traffic statistics entries: first, in response to receiving the packets , and read the packet header of the above packet.
  • the packet header usually contains fields such as IP address, IP address, protocol type, port number, confirmation character, and synchronization sequence number. Then, it can be detected whether the above-mentioned packet header contains the fields in the above-mentioned traffic statistics table entry. In response to whether the packet header contains the fields in the traffic statistics entry, it can be determined that the packet matches the traffic statistics entry. Otherwise, it can be considered that the packet does not match the traffic statistics entry.
  • Step 303 In response to the packet being matched with the traffic statistics entry, the packet is used as a target packet, and traffic statistics are performed on the target packet, a traffic statistics result is generated, and the packet is forwarded.
  • the programmable switch By performing the traffic statistics operation before the packet forwarding operation, the programmable switch has the fine-grained traffic statistics function on the basis of the traditional packet forwarding function.
  • access control lists ACLs
  • traffic statistics are performed first, and then packets are forwarded to avoid inaccurate traffic statistics results.
  • the traffic statistics result may be generated through the following steps: first, the total number of target packets and the total number of bytes of the target packets are counted. After that, the traffic statistics result including the total number of target packets and the total number of bytes is generated.
  • the total number of packets of the target packet can be calculated by adding one to obtain a new total number of packets.
  • the number of bytes of the target message can be read, and the number of bytes and the total number of bytes obtained last time can be summed to obtain a new total number of bytes. Therefore, the traffic statistics result can be updated once every time a target packet matching the traffic statistics entry is received.
  • the cumulative calculation process is relatively simple, which ensures the performance of the programmable switching chip.
  • Step 304 transmitting the traffic statistics result to the processor.
  • the above-mentioned execution body can transmit the traffic statistics result to the processor through the external interface of the programmable switch chip, so that the processor can continue to perform other types of traffic statistics operations.
  • transmitting the traffic statistics result to the processor includes: transmitting the first traffic statistics result to the controller at the first time; transmitting the second traffic statistics result to the controller at the second time ; In response to receiving the encapsulated packet transmitted by the processor, forward the encapsulated packet.
  • the encapsulated packet includes target traffic statistics results, and the target traffic statistics results are generated by the processor based on the first traffic statistics results and the second traffic statistics results.
  • the encapsulated packet may further include the IP address of the target server.
  • the target server may be a server for performing traffic accounting or other operations based on the target traffic statistics. Therefore, by forwarding the encapsulated packet to the IP address of the target server, it is convenient for the target server to perform operations such as traffic accounting.
  • the traffic input to the switch is usually first split and mirrored through the wind turbine, and the traffic is copied to multiple servers; then fine-grained statistics are performed on the traffic on each server, and finally each server is collected. The statistical results are accumulated to obtain accurate traffic information. Since the traffic received by the switch is usually 3.2T, and the server can only handle the traffic of 40G, dozens of servers need to be deployed. At the same time, an additional beam splitter is required. As a result, a large number of devices need to be deployed to implement the traffic statistics function, and the network infrastructure construction cost is relatively high.
  • the traffic statistics operation is performed before packet forwarding, which can not only avoid inaccurate traffic statistics results due to the influence of the access control list, but also enable the programmable switch to have traditional On the basis of the packet forwarding function, it also has the function of traffic statistics. Only one programmable switch can complete the fine-grained traffic statistics operation, without the deployment of optical splitters and servers, which reduces the number of network devices deployed and the cost of network infrastructure construction.
  • FIG. 4 a flowchart of an embodiment of the security defense method of the present application is shown.
  • the security defense method is applied to the programmable switch chip in the programmable switch.
  • the programmable switch also includes processors, such as the central processing unit of the X86 architecture.
  • the security defense method includes the following steps:
  • Step 401 in response to receiving the message, intercept key information in the message, and mirror the key information to the processor.
  • the execution body of the security defense can intercept key information in the packet in response to receiving the packet, such as the packet header or the IP address, TCP, IP address in the packet header, etc. UDP, port number and other information. Then, the captured key information is mirrored to the processor by mirroring. Mirroring refers to the operation of copying a message to a specified location.
  • Step 402 Receive defense entries and defense policies transmitted by the processor.
  • the above-mentioned execution body may receive the defense entry and the defense policy transmitted by the processor.
  • the defense entry is an entry used to filter out attack packets for defense.
  • Defense entries can contain information about pre-identified attack packets, such as IP addresses, TCP, and UDP. Similar to the above traffic statistics entry, the defense entry can also contain one or more fields.
  • the above-mentioned attack packets may refer to some packets that send a large number of attack requests to network devices such as servers, so that normal legitimate users cannot obtain services.
  • the defense policy is used to indicate the operation logic to be executed after an attack packet is detected based on the defense entry.
  • the defense table entry and defense strategy can be generated by the processor after analyzing the key information.
  • the processor may generate a defense entry and a defense strategy corresponding to the defense entry through the following steps: first, perform statistics on the received key information within the target duration, and determine the quantity of the same key information within the target duration.
  • the target duration may be a unit duration, such as 1 second, or may be any other predetermined duration.
  • a third preset threshold such as 100,000, etc.
  • the number of packets containing the source IP address per second is greater than 100,000, which is far greater than the normal number of packets sent per unit time, it can be considered that the packets containing the source IP address are sent.
  • the message is an attack message.
  • the source IP address can be used as a defense entry, and a defense policy corresponding to the defense entry can be created. Therefore, the defense table entry and defense strategy can be generated by the processor based on the analysis of the packets received by the programmable switching chip, without resorting to other network devices.
  • Step 403 taking the subsequently received packet as the packet to be tested, and detecting whether the packet to be tested matches the defense entry.
  • the packets received subsequently are the packets received after the defense entry and the defense policy are received. String matching can also be used to detect whether the packet to be tested matches the defense entry.
  • Step 404 in response to the match, defending the packet to be tested based on the defense policy.
  • the packet to be tested in response to a match between the packet to be tested and the defense entry, it can be considered that the packet to be tested is an attack packet hit by the defense entry. Therefore, the above-mentioned execution subject can defend the packet to be tested based on the defense policy. . In addition, in response to a mismatch, it can be considered that the packet to be tested is not hit by the defense entry, and at this time, the packet to be tested can be directly forwarded, and the defense policy is not executed for the packet to be tested.
  • the defense strategy may be to limit the forwarding number of packets matching the defense entry within a unit duration to be less than a first preset value (eg, 10). Therefore, the packet to be tested can be defended by the following steps: first, the forwarding number of the packets of the same source of the packet to be tested within a unit duration is detected.
  • the same-source packet is a packet containing the same source IP as the packet to be tested.
  • the packet to be tested is discarded, thereby effectively reducing the number of network devices accessed by the attack traffic.
  • the defense policy may be to limit the access interval duration of the packets matching the defense entry to be less than a second preset value (for example, 3 seconds). Therefore, the message to be tested can be defended by the following steps: First, the first reception time of the message to be tested is obtained. Then, the second receiving time of the target same-source message of the message to be tested is obtained, wherein the target same-source message is the same-source message with the latest reception time, and the same-source message contains the same message as the message to be tested. Source IP packets. After that, the time difference between the first reception time and the second reception time is determined. In response to the time difference being less than the second preset threshold (eg, 3 seconds), the packet to be tested is discarded, thereby effectively reducing the number of accesses to the network device by the attack traffic.
  • a second preset value for example, 3 seconds
  • defense strategies are not limited to the above-mentioned ones, and other defense strategies can also be set as required.
  • bypass defense means that the switch is additionally equipped with an optical splitter and a server, the traffic is split to the server through the optical splitter, the traffic statistics are collected on the server to formulate defense entries and defense strategies, and then the defense entries and defense strategies are delivered to the switch. In the access control list, some packets are filtered out through the access control list. However, the number of entries in the ACL is limited, and it is usually necessary to ensure that the number of entries is less than 10,000, so comprehensive security defense cannot be implemented.
  • Bypass defense means mirroring traffic to the security server, filtering all traffic through the security server, and then forwarding the traffic by the switch.
  • defense entries and defense strategies are generated after the processor analyzes the packets received by the programmable switching chip, and then the subsequent packets are processed based on the defense entries and defense strategies.
  • Defense executes defense operations after performing defense operations, and has security defense functions, so that only one programmable switch can complete comprehensive security defense operations, without the deployment of optical splitters and security servers, reducing network equipment deployment. Quantity, reducing the cost of network infrastructure construction.
  • FIG. 5 a flowchart of an embodiment of the packet processing method of the present application is shown.
  • the packet processing method is applied to a programmable switch chip in a programmable switch.
  • the programmable switch also includes processors, such as the central processing unit of the X86 architecture.
  • the packet processing method includes the following steps:
  • Step 501 Receive the message transmitted by the programmable switch chip.
  • the execution body of the message processing method receives the message transmitted by the programmable switch chip.
  • the category of the destination IP address in the packet is any destination category.
  • Target categories may include, but are not limited to: virtual IP addresses of virtual server clusters (ie, VIPs of LVS clusters), public network IP addresses of cloud servers, edge cloud IP addresses, cloud data center IP addresses, and the like.
  • the programmable switch chip can transmit the message to the above-mentioned execution body after detecting that the destination IP address in the message is of any target category.
  • Step 502 taking the destination IP address in the packet as the first destination IP address, and determining the second destination IP address based on the type of the first destination IP address.
  • the above-mentioned execution subject may perform different modifications on the first destination IP addresses to generate target packets.
  • the execution subject may select the real server through a load balancing algorithm For example, according to the load situation of each server in the server pool of the LVS cluster, a real server with a smaller current load is selected from the server pool, so as to determine the IP address of the real server as the second destination IP address.
  • the integrated load balancing function during packet forwarding eliminates the need to separately configure the scheduler of the LVS cluster, which reduces the cost of network infrastructure construction.
  • the class of the first destination IP address being any of the public network IP address class of the cloud server, the edge cloud IP address class, and the cloud data center IP address class
  • the IP address of the physical server bearing the first destination IP address is determined, so that the IP address of the physical server is used as the second destination IP address.
  • Step 503 Replace the first destination IP address with the second destination IP address to obtain the target packet.
  • Step 504 Transmit the target packet to the programmable switching chip, so that the programmable switching chip forwards the target packet to the second destination IP address.
  • the above-mentioned execution body may transmit the target packet to the programmable switch chip, so that the programmable switch chip forwards the target packet to the second destination IP address.
  • the packet processing method provided by the embodiment of the present application by replacing the destination IP address in the original packet, enables the programmable server to integrate the load balancing function or the gateway function, further reducing the number of network devices deployed and reducing the network Infrastructure construction costs.
  • the present application provides an embodiment of a traffic statistics device, which can be specifically applied to a programmable switch chip in a programmable switch.
  • the programmable switch further includes a processor.
  • the traffic statistics apparatus 600 in this embodiment includes: a receiving unit 601, configured to receive the traffic statistics entries transmitted by the above-mentioned processor; and a detection unit 602, configured to detect the above-mentioned packets in response to receiving the packets Whether the packet matches the above-mentioned traffic statistics entry; the statistics unit 603 is configured to, in response to the above-mentioned packet matching the above-mentioned traffic statistics entry, take the above-mentioned packet as a target packet, perform traffic statistics on the above-mentioned target packet, and generate The traffic statistics result, and forward the above-mentioned packets; the transmission unit 604 is configured to transmit the above-mentioned traffic statistics results to the above-mentioned processor.
  • the above-mentioned apparatus further includes: a first forwarding unit configured to forward the above-mentioned packet in response to the above-mentioned packet not matching the above-mentioned traffic statistics entry.
  • the traffic statistics table entry includes at least one of the following fields: Internet Protocol IP address, Transmission Control Protocol, User Datagram Protocol, Control Packet Protocol, Sync Sequence Number, Confirmation Character , port number; and, the above-mentioned detection unit 602 is further configured to: read the message header of the above-mentioned message; detect whether the above-mentioned message header contains the field in the above-mentioned traffic statistics table entry; in response to the above-mentioned message header Whether the fields in the above-mentioned traffic statistics entry are included, it is determined that the above-mentioned packets match the above-mentioned traffic statistics entries.
  • the above-mentioned statistical unit 603 is further configured to: count the total number of target packets and the total number of bytes of the target packet; generate a total number of target packets and the above-mentioned total number of bytes. traffic statistics.
  • the above-mentioned apparatus further includes: a second forwarding unit, configured to: transmit the first traffic statistics result to the above-mentioned controller at the first time; transmit the first traffic statistics result to the above-mentioned controller at the second time The second traffic statistics result; in response to receiving the encapsulated packet transmitted by the processor, forward the encapsulated packet, wherein the encapsulated packet includes the target traffic statistics result, and the target traffic statistics result is determined by The above-mentioned processor generates based on the above-mentioned first traffic statistics result and the above-mentioned second traffic statistics results.
  • the device provided by the above-mentioned embodiments of the present application performs traffic statistics operation before packet forwarding, which can not only avoid inaccurate traffic statistics results due to the influence of the access control list, but also enables programmable switches with traditional On the basis of the packet forwarding function, it also has the function of traffic statistics. Only one programmable switch can complete the fine-grained traffic statistics operation, without the deployment of optical splitters and servers, which reduces the number of network devices deployed and the cost of network infrastructure construction.
  • the present application provides an embodiment of a security defense device, which can be specifically applied to a programmable switch chip in a programmable switch.
  • the programmable switch further includes a processor.
  • the security defense device 700 of this embodiment includes: a mirroring unit 701 configured to, in response to receiving a message, intercept key information in the message, and mirror the key information to the processor; the receiving unit 702, is configured to receive the defense table entry and defense strategy transmitted by the above-mentioned processor, the above-mentioned defense table entry and the above-mentioned defense strategy are generated by the above-mentioned processor after parsing the above-mentioned key information; the matching unit 703 is configured to receive the subsequently received data.
  • the message is used as the message to be tested, and detects whether the message to be tested matches the defense entry; the defense unit 704 is configured to, in response to the match, defend the message to be tested based on the defense policy.
  • the above-mentioned apparatus further includes: a forwarding unit configured to: in response to a mismatch, forward the above-mentioned message to be tested.
  • the above-mentioned defense unit 704 is further configured to: detect the forwarding number of the same-source packets of the above-mentioned to-be-tested packets within a unit duration, wherein the above-mentioned same-source packets are the same as The above-mentioned packets to be tested include packets of the same source IP; in response to the above-mentioned forwarding quantity being greater than or equal to the first preset threshold, the above-mentioned packets to be measured are discarded.
  • the device receives the defense table entry and defense strategy generated after analyzing the packet received by the programmable switching chip by the processor, and then performs subsequent packet processing based on the defense table entry and defense strategy.
  • Defense executes defense operations after performing defense operations, and has security defense functions, so that only one programmable switch can complete comprehensive security defense operations, without the deployment of optical splitters and security servers, reducing network equipment deployment. Quantity, reducing the cost of network infrastructure construction.
  • the present application provides an embodiment of a packet processing apparatus, which may be specifically applied to a programmable switch chip in a programmable switch.
  • the programmable switch further includes a processor.
  • the packet processing apparatus 800 in this embodiment includes: a receiving unit 801 configured to receive the packet transmitted by the programmable switch chip, wherein the type of the destination IP address in the packet is any one target category; the determining unit 802 is configured to use the destination IP address in the above-mentioned packet as the first destination IP address, and determine the second destination IP address based on the category of the first destination IP address; the replacing unit 803 is configured to Replace the above-mentioned first destination IP address with the above-mentioned second destination IP address to obtain a target message; the transmission unit 804 is configured to transmit the above-mentioned target message to the above-mentioned programmable switching chip, so that the above-mentioned programmable switching chip sends the above-mentioned programmable switching chip to the above-mentioned programmable switch chip.
  • the second destination IP address forwards the above-mentioned destination packet.
  • the above-mentioned target class includes a virtual IP address class of a virtual server cluster; and the above-mentioned determining unit 802 is further configured to: in response to the above-mentioned class of the first destination IP address being the above-mentioned For the virtual IP address class of the virtual server cluster, the real server is selected through a load balancing algorithm; the IP address of the above real server is determined as the second destination IP address.
  • the above target category includes at least one of the following: a public network IP address class of a cloud server, an edge cloud IP address class, and a cloud data center IP address class; and the above determining unit 802 is further configured to: in response to the type of the first destination IP address being any one of the public network IP address type of the cloud server, the edge cloud IP address type, and the cloud data center IP address type, determine to carry the above-mentioned The IP address of the physical server of the first destination IP address; the IP address of the above-mentioned physical server is used as the second destination IP address.
  • the programmable server can integrate the load balancing function or the gateway function, further reducing the number of network devices deployed and reducing the network infrastructure. facility construction costs.
  • the embodiment of the present application also provides a programmable switch, including:
  • the processor is configured to transmit traffic statistics entries to the programmable switching chip.
  • the programmable switch chip is configured to, in response to the above-mentioned packets matching the above-mentioned traffic statistics table entries, take the above-mentioned packets as target packets, perform traffic statistics on the above-mentioned target packets, generate traffic statistics results, and forward the above-mentioned packets.
  • the above-mentioned processor is further configured to obtain the above-mentioned traffic statistics result from the above-mentioned programmable switching chip.
  • the programmable switch provided in this embodiment is similar to the description corresponding to the foregoing embodiment, and for related parts, reference may be made to the partial description of the foregoing embodiment.
  • the programmable switch chip is configured to, in response to receiving the message, intercept key information in the message, and mirror the key information to the processor.
  • the processor is configured to parse the received key information, generate a defense table entry and a defense strategy corresponding to the defense table entry, and transmit the defense table entry and the defense strategy to the programmable switching chip.
  • the embodiment of the present application also provides another programmable switch, including:
  • the programmable switching chip is configured to determine the type of the destination IP address in the packet in response to receiving the packet; in response to the type being any target type, transmit the packet to the processor.
  • the above-mentioned processor is configured to use the above-mentioned destination IP address as the first destination IP address, and determine the second destination IP address based on the category of the above-mentioned first destination IP address; and replace the above-mentioned first destination IP address with the above-mentioned second destination IP address address, and obtain the target message; and transmit the above target message to the above programmable switching chip.
  • the above-mentioned programmable switching chip is further configured to forward the above-mentioned target packet to the above-mentioned second destination IP address.
  • the programmable switch provided in this embodiment is similar to the description corresponding to the foregoing embodiment, and for related parts, reference may be made to the partial description of the foregoing embodiment.
  • Embodiments of the present application further provide a non-volatile readable storage medium, where one or more modules (programs) are stored in the storage medium, and when the one or more modules are applied to a device, the device can be executed by the device. Instructions for each method step in the embodiments of the present application.
  • the embodiments of the present application provide one or more machine-readable media on which instructions are stored, and when executed by one or more processors, cause an electronic device to perform the method described in one or more of the foregoing embodiments.
  • the electronic devices include various types of devices such as terminal devices and servers (clusters).
  • These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing terminal equipment to produce a machine that causes the instructions to be executed by the processor of the computer or other programmable data processing terminal equipment Means are created for implementing the functions specified in the flow or flows of the flowcharts and/or the blocks or blocks of the block diagrams.
  • These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal equipment to operate in a particular manner, such that the instructions stored in the computer readable memory result in an article of manufacture comprising instruction means, the The instruction means implement the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了可编程交换机、流量统计方法、防御方法和报文处理方法。该可编程交换机包括可编程交换芯片和采用X86架构的处理器，可编程交换芯片与处理器通信连接，处理器被配置成向可编程交换芯片传输控制信息，控制信息用于控制可编程交换芯片在执行报文转发逻辑之前执行目标操作逻辑；可编程交换芯片被配置成响应于接收到报文，执行目标操作逻辑；在目标操作逻辑执行结束后，执行报文转发逻辑。该可编程交换机可在报文转发功能的基础上融合其他网络设备的功能，减少了数据中心建设过程中作为基础网络设施的网络设备的部署数量，降低了网络基础设施建设成本。

Description

可编程交换机、流量统计方法、防御方法和报文处理方法
本申请要求2020年07月21日递交的申请号为202010714377.9、发明名称为“可编程交换机、流量统计方法、防御方法和报文处理方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，特别是涉及一种可编程交换机、流量统计方法、防御方法和报文处理方法。
背景技术
可编程交换机是一种利用可编程交换芯片执行报文转发逻辑的交换机。可编程交换芯片提供了与包处理相关的可编程功能，用户可通过编程灵活地对匹配-动作表(match-action table)进行扩展，从而使报文的转发逻辑能够通过编程控制。
现有的可编程交换机，其中的可编程交换芯片仅具备执行报文转发逻辑的功能。在接收到报文后，可编程交换芯片立即自动执行报文转发逻辑，从而进行报文转发。然而，在数据中心等网络基础设施的建设过程中，通常还需除交换机以外的其他网络设备来实现更多网络功能，如流量统计、安全防御、负载均衡、网关功能等。这些功能的实现需要部署大量网络设备，因而需要提供一种可以降低网络基础设施建设成本的方案。
发明内容
本申请实施例提出了一种可编程交换机、流量统计方法、防御方法和报文处理方法，以在实现报文转发功能的基础上融合其他网络设备的功能，减少了网络设备部署的数量，降低了网络基础设施建设成本。
本申请实施例提供了一种可编程交换机，包括：可编程交换芯片和采用X86架构的处理器，可编程交换芯片与处理器通信连接。
本申请实施例还提供了一种可编程交换机，包括：处理器，被配置成向所述可编程交换芯片传输流量统计表项；可编程交换芯片，被配置成响应于所述报文与所述流量统计表项匹配，将所述报文作为目标报文，对所述目标报文进行流量统计，生成流量统计结果，并转发所述报文；所述处理器，进一步被配置成从所述可编程交换芯片获取所述流量统计结果。
本申请实施例还提供了一种可编程交换机，包括：可编程交换芯片，被配置成响应于接收到报文，截取所述报文中的关键信息，将所述关键信息镜像至处理器；所述处理器，被配置成对所接收到的关键信息进行解析，生成防御表项和所述防御表项对应的防御策略；将所述防御表项和所述防御策略传输至所述可编程交换芯片；所述可编程交换芯片，进一步被配置成将后续接收到的报文作为待测报文，检测所述待测报文与所述防御表项是否匹配；响应于匹配，基于所述防御策略对所述待测报文进行防御；响应于不匹配，转发所述待测报文。
本申请实施例还提供了一种可编程交换机，包括：可编程交换芯片，被配置成响应于接收到报文，确定所述报文中的目的IP地址的类别；响应于所述类别为任一目标类别，将所述报文传输至处理器；所述处理器，被配置成将所述目的IP地址作为第一目的IP地址，基于所述第一目的IP地址的类别，确定第二目的IP地址；将所述第一目的IP地址替换为所述第二目的IP地址，得到目标报文；将所述目标报文传输至所述可编程交换芯片；所述可编程交换芯片，进一步被配置成向所述第二目的IP地址转发所述目标报文。
本申请实施例还提供了一种流量统计方法，应用于可编程交换机中的可编程交换芯片，所述可编程交换机中还包括处理器，该方法包括：接收所述处理器传输的流量统计表项；响应于接收到报文，检测所述报文与所述流量统计表项是否匹配；响应于所述报文与所述流量统计表项匹配，将所述报文作为目标报文，对所述目标报文进行流量统计，生成流量统计结果，并转发所述报文；向所述处理器传输所述流量统计结果。
本申请实施例还提供了一种安全防御方法，应用于可编程交换机中的可编程交换芯片，所述可编程交换机中还包括处理器，该方法包括：响应于接收到报文，截取所述报文中的关键信息，将所述关键信息镜像至处理器；接收所述处理器传输的防御表项和防御策略，所述防御表项和所述防御策略由所述处理器对所述关键信息解析后生成；将后续接收到的报文作为待测报文，检测所述待测报文与所述防御表项是否匹配；响应于匹配，基于所述防御策略对所述待测报文进行防御。
本申请实施例还提供了一种报文处理方法，应用于可编程交换机中的处理器，所述可编程交换机中还包括可编程交换芯片，该方法包括：接收所述可编程交换芯片传输的报文，其中，所述报文中的目的IP地址的类别为任一目标类别；将所述报文中的目的IP地址作为第一目的IP地址，基于所述第一目的IP地址的类别，确定第二目的IP地址，；将所述第一目的IP地址替换为所述第二目的IP地址，得到目标报文；将所述目标报文传输至所述可编程交换芯片，以使所述可编程交换芯片向所述第二目的IP地址转发所述目标报文。
本申请实施例还提供了一种流量统计装置，应用于可编程交换机中的可编程交换芯片，所述可编程交换机中还包括处理器，所述装置包括：接收单元，被配置成接收所述处理器传输的流量统计表项；检测单元，被配置成响应于接收到报文，检测所述报文与所述流量统计表项是否匹配；统计单元，被配置成响应于所述报文与所述流量统计表项匹配，将所述报文作为目标报文，对所述目标报文进行流量统计，生成流量统计结果，并转发所述报文；传输单元，被配置成向所述处理器传输所述流量统计结果。
本申请实施例还提供了一种安全防御装置，应用于可编程交换机中的可编程交换芯片，所述可编程交换机中还包括处理器，所述装置包括：镜像单元，被配置成响应于接收到报文，截取所述报文中的关键信息，将所述关键信息镜像至处理器；接收单元，被配置成接收所述处理器传输的防御表项和防御策略，所述防御表项和所述防御策略由所 述处理器对所述关键信息解析后生成；匹配单元，被配置成将后续接收到的报文作为待测报文，检测所述待测报文与所述防御表项是否匹配；防御单元，被配置成响应于匹配，基于所述防御策略对所述待测报文进行防御。
本申请实施例还提供了一种报文处理装置，应用于可编程交换机中的处理器，所述可编程交换机中还包括可编程交换芯片，所述装置包括：接收单元，被配置成接收所述可编程交换芯片传输的报文，其中，所述报文中的目的IP地址的类别为任一目标类别；确定单元，被配置成将所述报文中的目的IP地址作为第一目的IP地址，基于所述第一目的IP地址的类别，确定第二目的IP地址，；替换单元，被配置成将所述第一目的IP地址替换为所述第二目的IP地址，得到目标报文；传输单元，被配置成将所述目标报文传输至所述可编程交换芯片，以使所述可编程交换芯片向所述第二目的IP地址转发所述目标报文。
本申请实施例还提供了一个或多个机器可读介质，其上存储有可执行代码，当所述可执行代码被执行时，使得处理器执行如本申请实施例中一个或多个所述的流量统计方法、安全防御方法或报文处理方法。
与现有技术相比，本申请实施例包括以下优点：
在本申请实施例中，通过将可编程芯片和采用X86架构的处理器融合在一台设备上，能够使可编程交换机可在报文转发功能的基础上融合其他网络设备的功能，减少了数据中心建设过程中作为基础网络设施的网络设备的部署数量，降低了网络基础设施建设成本。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1A是本申请实施例的一种可编程交换机的示例性架构图；
图1B是本申请实施例的一种可编程交换机的处理过程示意图；
图2A是本申请实施例的一种可编程交换机在流量统计场景的处理过程示意图；
图2B是本申请实施例的一种可编程交换机安全防御场景的处理过程示意图；
图3是本申请的流量统计方法的一个实施例的流程图；
图4是本申请的安全防御方法的一个实施例的流程图；
图5是本申请的报文处理方法的一个实施例的流程图；
图6是本申请的流量统计装置的一个实施例的结构示意图；
图7是本申请的安全防御装置的一个实施例的结构示意图；
图8是本申请的报文处理装置的一个实施例的结构示意图。
具体实施方式
下面结合附图和实施例对本申请作进一步的详细说明。可以理解的是，此处所描述 的具体实施例仅仅用于解释相关发明，而非对该发明的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与有关发明相关的部分。
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。下面将参考附图并结合实施例来详细说明本申请。
本申请实施例可应用于通信领域，具体可应用于网络基础设施建设场景，如传统的云数据中心、边缘云数据中心等网络基础设施建设的场景等。在网络基础设施建设过程中，需要部署大量的网络设备，如交换机，服务器，分光器等，以实现如报文转发、流量统计、安全防御、负载均衡、流量计费、网关等功能。
传统的云数据中心通常包含成千上万台网络设备，因而基础设施消耗在传统的云数据中心中占比较小。然而，随着边缘计算的逐步兴起，边缘云数据中心的建设需求越来越多。而边缘云数据中心通常租用运营商机房中的机架来构建，因而通常仅为几十台服务器的规模。在几十台服务器的规模下，实现上述功能需要消耗十余台服务器。由此，基础设施消耗占据整个边缘云数据中心的比例很大，严重阻碍了边缘云的发展。
本申请实施例中的可编程交换机可在实现报文转发功能的同时，融合一些其他网络设备的功能，从而能够减少数据中心建设过程中作为基础网络设施的网络设备的部署数量，能够降低网络基础设施建设成本。
请参见图1A，示出了本申请实施例的可编程交换机的示例性架构图。如图1A所示，可编程交换机包括可编程交换芯片和处理器。此处的可编程交换芯片可以是各种现有可编程交换芯片。此处的处理器可以采用X86架构，具体可以是采用X86架构(The X86architecture)的中央处理器(Central Processing Unit，CPU)。可编程交换芯片与处理器通信连接，以进行数据、信号传输。
处理器可以执行交换机控制层的逻辑，还可以执行流量计费逻辑、充当负载调度器执行负载均衡逻辑、执行网关逻辑、进行防御策略的制定以及向可编程交换芯片下发各类表项(如流量统计表项、防御表项)等。由于处理器具有执行多种逻辑的功能，因而能够使可编程交换机具有服务器以及网关等其他网络设备的功能，减少了数据中心建设过程中作为基础网络设施的网络设备的部署数量，降低了网络基础设施建设成本。
需要说明的是，可编程交换机除包含可编程交换芯片和处理器外，还可以包含内存、总线等可编程交换机所需的其他部件，本实施例不作限定。
图1B是本申请实施例的一种可编程交换机的处理过程示意图。如图1B所示，上述处理器可被配置成向可编程交换芯片传输控制信息。其中，控制信息用于控制上述可编程交换芯片在执行报文转发逻辑之前执行目标操作逻辑。目标操作逻辑可以包括但不限于流量统计操作逻辑、安全防御操作逻辑、镜像操作逻辑、分流操作逻辑等。
可编程交换芯片，可被配置成在接收到报文时，首先执行目标操作逻辑；在目标操作逻辑执行结束后，执行报文转发逻辑。实践中，可预先通过可编程交换芯片的特定领 域编程语言，如P4语言，在可编程交换芯片中写入目标操作逻辑，从而通过处理器控制可编程交换芯片对不同逻辑的执行顺序。
通过处理器向可编程交换芯片传输控制信息，能够控制可编程交换芯片在接收到报文后首先执行目标操作逻辑，在目标操作逻辑执行结束后，再进行报文转发逻辑的执行。由此，可编程交换机可在报文转发功能的基础上融合其他网络设备的功能，减少了数据中心建设过程中作为基础网络设施的网络设备的部署数量，降低了网络基础设施建设成本。
图2A是本申请实施例的一种可编程交换机在流量统计场景的处理过程示意图。在流量统计场景中，可编程交换机中的处理器可以被配置成向可编程交换芯片传输流量统计表项，流量统计表项可位于控制信息中。其中，流量统计表项可以是用于筛选目标报文以进行流量统计的表项。表项可以是字段等。
可编程交换芯片，可被配置成响应于接收到报文，首先执行流量统计操作逻辑。具体地，可以首先通过字符串匹配的方式检测该报文与流量统计表项是否匹配。响应于该报文与上述流量统计表项匹配，可以将上述该报文作为目标报文，对上述目标报文进行流量统计，从而生成流量统计结果。此处的流量统计结果可包括但不限于以下至少一项：目标报文总数、目标报文的总字节数。
可编程交换芯片，可进一步被配置成在流量统计操作逻辑执行完毕后，执行报文转发逻辑。由此，可编程交换机在具备传统的报文转发功能的基础上，同时具备流量统计功能。由于在报文转发逻辑执行过程中，会利用访问控制列表(Access Control Lists，ACL)过滤掉一些报文，因而先进行流量统计，再进行报文转发，可避免流量统计结果不准确的情况。
流量统计表项中可包括一个或多个字段。可选的，可包括但不限于以下至少一项字段：互联网协议(Internet Protocol，IP)地址、传输控制协议(Transmission Control Protocol，TCP)、用户数据报协议(User Datagram Protocol，UDP)、控制报文协议(Internet Control Message Protocol，ICMP)、同步序列编号(Synchronize Sequence Numbers，SYN)、确认字符(Acknowledge character，ACK)、端口号。
由于上述字段通常位于报文头中，因而，可编程交换芯片，还可进一步被配置成通过如下步骤检测上述报文与上述流量统计表项是否匹配：首先，响应于接收到报文，读取上述报文的报文头。报文头中通常包含IP地址、IP地址、协议类型、端口号、确认字符、同步序列编号等各个字段。而后，可以检测上述报文头中是否包含上述流量统计表项中的字段。响应于报文头中包含流量统计表项中的字段，确定所述报文与所述流量统计表项匹配。反之，可认为该报文与流量统计表项不匹配。
作为示例，流量统计表项为字段“IP 1.1.1.1”，若所接收到的报文的报文头中包含字段“IP 1.1.1.1”，则可认为该报文与该流量统计表项匹配，从而可将该报文作为目标 报文计入流量统计结果。作为又一示例，流量统计表项包括字段“IP 2.2.2.2”、“TCP”和“80”，若该报文中包含上述各字段，即IP地址为2.2.2.2、协议类别为TCP协议，且源端口号为80，则可认为该报文与该流量统计表项匹配，从而可将该报文作为目标报文计入流量统计结果。
需要说明的是，流量统计表项的数量可以是一个或多个，每个流量统计表项中可以包括一个或多个字段。当流量统计表项的数量有多个时，可分别针对各流量统计表项，进行报文的匹配。
此外，还需要指出的是，流量统计表项中的IP地址可进一步限定为源IP地址或者目的IP地址。同理，端口号也可进一步限定为源端口号或目的端口号，以便于进行更细粒度的流量统计。
可选的，可编程交换芯片，还可进一步被配置成通过如下步骤生成流量统计结果：首先，统计目标报文总数和目标报文的总字节数。例如，每接收到一个目标报文，可对目标报文的报文总数做一次加一计算，从而得到一个新的报文总数。同时，每接收到一个目标报文，可以读取该目标报文的字节数，并将该字节数与上一次所得到的总字节数求和，得到新的总字节数。之后，可以生成包含最新确定的目标报文总数和总字节数的流量统计结果。由此，每接收到一个与流量统计表项匹配的目标报文，可以更新一次流量统计结果。累计计算过程较为简便，保证了可编程交换芯片的性能。
在此基础上，可选的，处理器还可在两个时间点通过读取可编程交换芯片提供的对外接口获取到流量统计结果，并继续进行其他类型的流量统计操作。具体地，处理器可以首先在第一时间从可编程交换芯片获取第一流量统计结果。而后，在第二时间从可编程交换芯片获取第二流量统计结果。而后，确定第二时间与第一时间的时间差。而后，确定第二流量统计结果中的报文总数与第一流量统计结果中的报文总数的第一差值，并确定第二流量统计结果中的总字节数与第一流量统计结果中的总字节数的第二差值。而后，将第一差值与时间差的比值，确定为包转发率(Packet Per Second，PPS)，并将第二差值与时间差的比值，确定为比特率(Bytes Per Second，BPS)。最后生成包含包转发率和比特率的目标流量统计结果。使用包转发率和比特率作为目标流量统计结果，有助于进行后续的流量计费操作。
可选的，在得到目标流量统计结果后，处理器还可进一步被配置成：将目标流量统计结果进行封装，得到封装后的报文。其中，封装后的报文中包括目标服务器的IP地址。目标服务器可以是用于进行流量计费或者基于目标流量统计结果进行其他操作的服务器。而后，将封装后的报文传输至可编程交换芯片。从而可编程交换芯片可以向目标服务器的IP地址转发封装后的报文，以便于目标服务器进行流量计费等操作。
以往的流量统计方式，通常首先通过风光器对输入至交换机的流量进行分光和镜像，将流量复制到多台服务器上；而后在各台服务器上分别对流量进行细粒度统计，最后将 各台服务器的统计结果累加，从而得到流量的准确信息。由于交换机所接收的流量通常是3.2T，而服务器仅可处理40G的流量，因而需要部署数十台服务器。同时，还需额外使用分光器。由此导致实现流量统计功能需要部署大量的设备，网络基础设施建设成本较高。
本申请实施例提供的可编程交换机，在具备传统的报文转发功能的基础上，同时具备流量统计功能，仅需一台可编程交换机即可完成细粒度的流量统计操作，无需进行分光器以及服务器的部署，减少了网络设备部署的数量，降低了网络基础设施建设成本。
图2B是本申请实施例的一种可编程交换机在安全防御场景的处理过程示意图。在安全防御场景中，可编程交换机中的处理器可以向可编程交换芯片传输防御表项和防御策略。防御表项和防御策略可位于控制信息中。其中，防御表项是用于筛选出攻击报文以进行防御的表项。防御表项可以包含预先识别出的攻击报文的信息，如IP地址、TCP、UDP等。与上述流量统计表项类似，防御表项也可以包含一个或多个字段。上述攻击报文可以指一些对服务器等网络设备发送大量攻击请求导致正常合法用户无法获得服务的报文。防御策略用于指示在基于防御表项检测到攻击报文后执行的操作逻辑。
可编程交换芯片响应于接收到报文，可以首先执行防御操作逻辑。具体地，可首先将该报文作为待测报文，检测待测报文与防御表项是否匹配。此处，检测待测报文与防御表项是否匹配的方式，与上述检测报文与流量统计表项是否匹配的方式基本相同，因而不再赘述。响应于报文与防御表项匹配，可基于防御策略对待测报文进行防御，即执行防御策略中的操作逻辑，待测报文进行防御。
需要说明的是，防御表项的数量可以是一个或多个，每个防御表项中可以包括一个或多个字段。当防御表项的数量有多个时，可分别针对各流防御表项，进行待测报文的匹配。
此外，还需要指出的是，不同的防御表项可对应不同的防御策略。例如，防御表项A为字段“IP 1.1.1.1”，防御表项B包含字段“IP 2.2.2.2”以及端口“80”。可将防御表项A对应的防御策略设置为限速至每秒钟转发10个请求，将防御表项B对应的防御策略设置为3分钟内禁止访问。
可编程交换芯片在防御操作逻辑执行完毕后，可执行报文转发逻辑。具体地，若防御操作逻辑执行完毕后，该待测报文未被丢弃，则意味着待测报文不为攻击报文或者为执行防御策略后仍可继续转发的报文，此时，可对该待测报文进行转发。若防御操作逻辑执行完毕后，该待测报文被丢弃，可不存在待转发的报文，因而报文转发逻辑可自动结束。由此，可编程交换机在具备传统的报文转发功能的基础上，同时具备在报文转发前进行安全防御的功能，从而丢弃或减少攻击报文。丰富了可编程交换机的功能，降低了网络基础设施建设成本，同时保证了网络安全。
可选的，防御策略可以是将单位时长内与防御表项匹配的报文转发数量限制在第一 预设数值(如10)以下。由此，可编程交换芯片，可进一步被配置成通过如下步骤对待测报文进行防御：首先，检测单位时长内待测报文的相同来源报文的转发数量。其中，相同来源报文为与待测报文包含相同的源IP的报文。响应于转发数量大于或等于第一预设阈值(如10)，丢弃该待测报文，从而可有效减少攻击流量对网络设备的访问数量。
可选的，防御策略可以是将与防御表项匹配的报文的访问间隔时长限制在第二预设数值(如3秒钟)以下。由此，可编程交换芯片，可进一步被配置成通过如下步骤对待测报文进行防御：首先，获取待测报文的第一接收时间。而后，获取待测报文的目标相同来源报文的第二接收时间，其中，目标相同来源报文为接收时间最晚的相同来源报文，相同来源报文为与待测报文包含相同的源IP的报文。之后，确定第一接收时间与第二接收时间的时间差。响应于时间差小于第二预设阈值(如3秒钟)，丢弃待测报文，从而可有效减少攻击流量对网络设备的访问数量。
可选的，防御表项和防御策略可以由处理器对可编程交换芯片接收到的报文进行分析后生成。由此，可编程交换芯片，可进一步被配置成在接收到控制信息之前，截取所接收到的报文中的关键信息，将关键信息镜像至处理器。其中，关键信息可以是报文的报文头，也可以是报文头中的一些关键字段，如IP地址、协议类别、端口号等。处理器，可进一步被配置成对所接收到的关键信息进行解析，生成防御表项和防御表项对应的防御策略。
作为示例，处理器可通过如下步骤生成防御表项和防御表项对应的防御策略：首先，对目标时长内所接收到的关键信息进行统计，确定上述目标时长内的相同关键信息的数量。其中，目标时长可以是单位时长，如1秒；也可以是预先设定的其他任意时长。而后，将数量大于第三预设阈值(如10万等)的相同关键信息作为攻击报文中的关键信息，从攻击报文中的关键信息中提取至少一项字段，生成防御表项，并创建上述防御表项对应的防御策略。以关键信息包含源IP地址为例，若每秒钟包含该源IP地址的报文数量大于10万，远远大于单位时间内的正常报文发送数量，则可认为包含该源IP地址的报文为攻击报文。而后，可以将源该IP地址作为防御表项，并创建防御表项对应的防御策略。由此，防御表项和防御策略可由处理器基于对可编程交换芯片接收到的报文进行分析后生成，无需借助于其他网络设备。
以往的安全防御方式，通常为旁路防御或串行防御。旁路防御是指为交换机额外配备分光器和服务器，通过分光器将流量分光至服务器，通过服务器进行流量统计以制定防御表项和防御策略，而后将防御表项和防御策略下发至交换机的访问控制列表中，从而通过访问控制列表过滤掉一些报文。但是，访问控制列表可容纳的表项有限，通常需要保证表项在1万条以内，因而无法全面进行安全防御。旁路防御是指将流量镜像到安全服务器上，通过安全服务器对全部流量进行过滤后，在由交换机将流量进行转发。但是，由于交换机入口流量通常很大，如800G或者T级，而服务器目前还都停留在40G、 100G等，因而需要部署大量的安全服务器才能实现全面的安全防御，且多台安全服务器还会带来协同配合困难的问题。
本申请实施例提供的可编程交换机，可由处理器对可编程交换芯片接收到的报文进行分析后生成防御表项和防御策略，并可由可编程交换芯片基于防御表项和防御策略进行后续报文的防御。从而可编程交换机在具备传统的报文转发功能的基础上，同时具备安全防御功能。仅需一台可编程交换机即可完成全面的安全防御操作，无需进行分光器以及安全服务器的部署，减少了网络设备部署的数量，降低了网络基础设施建设成本。
需要说明的是，安全防御场景还可与流量统计场景相结合。可编程交换芯片在接收到报文后，可首先进行流量统计。而后处理器通过可编程交换芯片提供的接口获取到流量统计结果，从而对流量统计结果进行分析，生成防御表项和防御策略，并下发至可编程交换芯片。由此，可编程交换芯片可对后续报文执行安全防御操作。此外，可编程交换芯片在对后续报文执行安全防御操作以前，还可继续保持对后续报文的流量统计操作，从而处理器可及时根据流量统计结果变更防御表项和防御策略，以便于适应攻击报文发生变化的场景。
在另一种场景中，可编程交换机还针对报文中的IP地址的类别，融合其他功能，如负载均衡功能，或者网关功能等。
具体地，在接收到报文后，可编程交换芯片可首先执行IP地址类别检测逻辑，以确定报文中的目的IP地址的类别是否为任一目标类别。其中，目标类别可以包括但不限于：虚拟服务器(Linux Virtual Server，LVS)集群的虚拟IP(Virtual IP，VIP)地址类、云服务器的公网IP地址类、边缘云IP地址类、云数据中心IP地址类等。实践中，可通过字符串匹配的方式检测目的IP地址的类别。
而后，响应于目的IP地址的类别为任一目标类别，可由可编程交换芯片将上述报文传输至处理器。处理器可基于目的IP地址的类别，对目的IP地址进行修改以生成目标报文，从而将目标报文返回至可编程交换芯片。最后，可编程交换芯片可将原始的报文替换为目标报文，并对目标报文执行报文转发逻辑。
针对目的IP地址的不同的类别，可对目标IP地址进行不同修改，从而实现不同功能。下面以不同情况作为示例进行具体说明：
在一个示例中，若可编程交换芯片接收到的报文中的目的IP地址的类别为虚拟服务器集群的虚拟IP地址类，即LVS集群的VIP，则可编程交换机能够作为LVS的调度器(load balancer)，实现负载均衡功能。实践中，LVS集群的VIP通常指LVS集群的外网IP。对于用户而言，用户通过访问LVS集群的VIP，即可连接后端的真实服务器(Real Server)，用户无需确定出实际访问的真实服务器的位置和数量。LVS集群的调度器，可视为LVS集群对外的前端机，是LVS集群的唯一入口点(Single Entry Point)，负责通过负载均衡等方式将客户的请求发送到一组真实服务器上执行。
具体地，在可编程交换芯片将该报文通过网卡和板口连接通道传输给处理器后，处理器可首先将该报文中的目的IP地址作为第一目的IP地址。而后通过负载均衡算法选取真实服务器。处理器可根据LVS集群的服务器池中各服务器负载情况，从服务器池中选出一个当前负载较小的服务器。最后，将所选取的真实服务器的IP地址作为第二目的IP地址，并该报文的第一目的IP地址替换为第二目的IP地址，生成目标报文。从而，可编程交换芯片可向第二目的IP地址转发目标报文，使报文的目的IP地址由原始的虚拟IP地址更换为通过负载均衡算法选取出的真实服务器的IP地址，使可编程交换机实现了负载均衡功能。
在另一个示例中，若可编程交换芯片接收到的报文中的目的IP地址的类别为云服务器的云服务器的公网IP地址类、边缘云IP地址类、云数据中心IP地址类，则可编程交换机能够作为网关，确定出承载目的IP地址的物理服务器的IP地址，并对该物理服务器的IP地址进行报文转发，以实现网关功能。
具体地，在可编程交换芯片将该报文通过网卡和板口连接通道传输给处理器后，处理器可首先将该报文中的目的IP地址作为第一目的IP地址。若该第一目的IP地址为云服务器的公网IP地址，则可以获取承载该公网IP地址的物理服务器的IP地址，并将物理服务器的IP地址作为第二目的IP地址。之后，可以该报文的第一目的IP地址替换为第二目的IP地址，生成目标报文。从而，可编程交换芯片可向第二目的IP地址转发目标报文，使报文的目的IP地址由原始的云服务器的公网IP地址更换为承载该公网IP地址的物理服务器的IP地址，使得可编程交换机实现了云上云下互通过程中的网关功能。
同理，若该第一目的IP地址为边缘云IP地址，则可以获取承载该边缘云IP地址的物理服务器的IP地址，并将物理服务器的IP地址作为第二目的IP地址。之后，可以该报文的第一目的IP地址替换为第二目的IP地址，生成目标报文。从而，可编程交换芯片可向第二目的IP地址转发目标报文，使报文的目的IP地址由原始的边缘云IP地址更换为承载该边缘云IP地址的物理服务器的IP地址。由此，当报文中的源IP地址为用户设备的IP地址时，使得可编程交换机实现了云上云下互通过程中的网关功能。当报文中的源IP地址为云数据中心IP地址时，使得可编程交换机实现了云数据中心与边缘云互通过程中的网关功能。
同理，若该第一目的IP地址为云数据中心IP地址，则可以获取承载该云数据中心IP地址的物理服务器的IP地址，并将物理服务器的IP地址作为第二目的IP地址。之后，可以该报文的第一目的IP地址替换为第二目的IP地址，生成目标报文。从而，可编程交换芯片可向第二目的IP地址转发目标报文，使报文的目的IP地址由原始的云数据中心IP地址更换为承载该云数据中心IP地址的物理服务器的IP地址。由此，当报文中的源IP地址为边缘云IP地址时，使得可编程交换机实现了云数据中心与边缘云互通过程中的网关功能。
通过可编程交换芯片在检测出报文中的目的IP地址的类别为目标类别时，将报文传输至处理器，并通过处理器针对报文中的目的IP地址的类别进行目的IP地址的修改，可使可编程交换芯片融合负载均衡功能或者网关功能，进一步减少了网络设备部署的数量，降低了网络基础设施建设成本。
继续参考图3，示出了本申请的流量统计方法的一个实施例的流程图。该流量统计方法应用于可编程交换机中的可编程交换芯片。可编程交换机中还包括处理器，如X86架构的中央中央处理器等。
该流量统计方法包括以下步骤：
步骤301，接收处理器传输的流量统计表项。
在本实施例中，流量统计方法的执行主体(如上述可编程交换芯片)可以接收处理器传输的流量统计表项。流量统计表项可以是用于筛选目标报文以进行流量统计的表项。
可选的，流量统计表项可包括但不限于以下至少一项字段：IP地址、协议类型(如TCP、UDP、ICMP等)、同步序列编号、确认字符、端口号等。
步骤302，响应于接收到报文，检测报文与流量统计表项是否匹配。
在本实施例中，上述执行主体响应于接收到报文，可以通过字符串匹配的方式，检测该报文与流量统计表项是否匹配。需要说明的是，流量统计表项的数量可以是一个或多个，每个流量统计表项中可以包括一个或多个字段。当流量统计表项的数量有多个时，可分别针对各流量统计表项，进行报文的匹配。
由于上述字段通常位于报文头中，因而，在本实施例的一些可选的实现方式中，可通过如下步骤检测上述报文与上述流量统计表项是否匹配：首先，响应于接收到报文，读取上述报文的报文头。报文头中通常包含IP地址、IP地址、协议类型、端口号、确认字符、同步序列编号等各个字段。而后，可以检测上述报文头中是否包含上述流量统计表项中的字段。响应于报文头中是否包含上述流量统计表项中的字段，可确定该报文与流量统计表项匹配。反之，可认为该报文与流量统计表项不匹配。
步骤303，响应于报文与流量统计表项匹配，将报文作为目标报文，对目标报文进行流量统计，生成流量统计结果，并转发报文。
通过在报文转发操作前执行流量统计操作，使得可编程交换机在具备传统的报文转发功能的基础上，同时具备细粒度的流量统计功能。由于在报文转发逻辑执行过程中，会利用访问控制列表(Access Control Lists，ACL)过滤掉一些报文，因而先进行流量统计，再进行报文转发，可避免流量统计结果不准确的情况。
需要说明的是，响应于所接收到的报文与上述流量统计表项不匹配，则表示该报文不是需要进行流量统计的报文，因而可直接转发该报文。
在本实施例的一些可选的实现方式中，可通过如下步骤生成流量统计结果：首先，统计目标报文总数和目标报文的总字节数。之后，而后生成包含目标报文总数和总字节 数的流量统计结果。
例如，每接收到一个目标报文，可对目标报文的报文总数做一次加一计算，从而得到一个新的报文总数。同时，每接收到一个目标报文，可以读取该目标报文的字节数，并将该字节数与上一次所得到的总字节数求和，得到新的总字节数。由此，每接收到一个与流量统计表项匹配的目标报文，可以更新一次流量统计结果。累计计算过程较为简便，保证了可编程交换芯片的性能。
步骤304，向处理器传输流量统计结果。
在本实施例中，上述执行主体可通过可编程交换芯片的对外接口向处理器传输流量统计结果，以便于处理器继续进行其他类型的流量统计操作。
在本实施例的一些可选的实现方式中，向处理器传输流量统计结果，包括：在第一时间向控制器传输第一流量统计结果；在第二时间向控制器传输第二流量统计结果；响应于接收到处理器传输的封装后的报文，转发封装后的报文。其中，封装后的报文中包括目标流量统计结果，目标流量统计结果由处理器基于第一流量统计结果和第二流量统计结果生成。此外，封装后的报文中还可以包括目标服务器的IP地址。目标服务器可以是用于进行流量计费或者基于目标流量统计结果进行其他操作的服务器。从而通过向目标服务器的IP地址转发封装后的报文，以便于目标服务器进行流量计费等操作。
本实施例各步骤与上述实施例对应步骤描述类似，具体可参见上述实施例的描述。
以往的流量统计方式，通常首先通过风光器对输入至交换机的流量进行分光和镜像，将流量复制到多台服务器上；而后在各台服务器上分别对流量进行细粒度统计，最后将各台服务器的统计结果累加，从而得到流量的准确信息。由于交换机所接收的流量通常是3.2T，而服务器仅可处理40G的流量，因而需要部署数十台服务器。同时，还需额外使用分光器。由此导致实现流量统计功能需要部署大量的设备，网络基础设施建设成本较高。
本申请的上述实施例提供的方法，在进行报文转发前执行流量统计操作，不仅能够避免由于访问控制列表的影响导致流量统计结果不准确的情况，同时，还可以使可编程交换机在具备传统的报文转发功能的基础上，同时具备流量统计功能。仅需一台可编程交换机即可完成细粒度的流量统计操作，无需进行分光器以及服务器的部署，减少了网络设备部署的数量，降低了网络基础设施建设成本。
进一步参考图4，示出了本申请的安全防御方法的一个实施例的流程图。该安全防御方法应用于可编程交换机中的可编程交换芯片。可编程交换机中还包括处理器，如X86架构的中央中央处理器等。
该安全防御方法包括以下步骤：
步骤401，响应于接收到报文，截取报文中的关键信息，将关键信息镜像至处理器。
在本实施例中，安全防御的执行主体(如上述可编程交换芯片)响应于接收到报文， 可以截取报文中的关键信息，如报文头或者报文头中的IP地址、TCP、UDP、端口号等信息。而后，并通过镜像方式将所截取的关键信息镜像至处理器。镜像是指将报文复制一份到指定位置的操作。
步骤402，接收处理器传输的防御表项和防御策略。
在本实施例中，上述执行主体可以接收处理器传输的防御表项和防御策略。其中，防御表项是用于筛选出攻击报文以进行防御的表项。防御表项可以包含预先识别出的攻击报文的信息，如IP地址、TCP、UDP等。与上述流量统计表项类似，防御表项也可以包含一个或多个字段。上述攻击报文可以指一些对服务器等网络设备发送大量攻击请求导致正常合法用户无法获得服务的报文。防御策略用于指示在基于防御表项检测到攻击报文后执行的操作逻辑。
其中，防御表项和防御策略可由处理器对关键信息解析后生成。作为示例，处理器可通过如下步骤生成防御表项和防御表项对应的防御策略：首先，对目标时长内所接收到的关键信息进行统计，确定上述目标时长内的相同关键信息的数量。其中，目标时长可以是单位时长，如1秒；也可以是预先设定的其他任意时长。而后，将数量大于第三预设阈值(如10万等)的相同关键信息作为攻击报文中的关键信息，从攻击报文中的关键信息中提取至少一项字段，生成防御表项，并创建上述防御表项对应的防御策略。以关键信息包含源IP地址为例，若每秒钟包含该源IP地址的报文数量大于10万，远远大于单位时间内的正常报文发送数量，则可认为包含该源IP地址的报文为攻击报文。而后，可以将源该IP地址作为防御表项，并创建防御表项对应的防御策略。由此，防御表项和防御策略可由处理器基于对可编程交换芯片接收到的报文进行分析后生成，无需借助于其他网络设备。
步骤403，将后续接收到的报文作为待测报文，检测待测报文与防御表项是否匹配。
其中，后续接收到的报文即为在接收到防御表项和防御策略后所接收到的报文。检测待测报文与防御表项是否匹配也可以采用字符串匹配方式。
步骤404，响应于匹配，基于防御策略对待测报文进行防御。
在本实施例中，响应于待测报文与防御表项匹配，可认为待测报文为防御表项命中的攻击报文，由此，上述执行主体可以基于防御策略对待测报文进行防御。此外，响应于不匹配，可认为待测报文未被防御表项命中，此时可直接转发上述待测报文，不对该待测报文执行防御策略。
在本实施例的一些可选的实现方式中，防御策略可以是将单位时长内与防御表项匹配的报文转发数量限制在第一预设数值(如10)以下。由此，可通过如下步骤对待测报文进行防御：首先，检测单位时长内待测报文的相同来源报文的转发数量。其中，相同来源报文为与待测报文包含相同的源IP的报文。响应于转发数量大于或等于第一预设阈值(如10)，丢弃该待测报文，从而可有效减少攻击流量对网络设备的访问数量。
可选的，防御策略可以是将与防御表项匹配的报文的访问间隔时长限制在第二预设数值(如3秒钟)以下。由此，可通过如下步骤对待测报文进行防御：首先，获取待测报文的第一接收时间。而后，获取待测报文的目标相同来源报文的第二接收时间，其中，目标相同来源报文为接收时间最晚的相同来源报文，相同来源报文为与待测报文包含相同的源IP的报文。之后，确定第一接收时间与第二接收时间的时间差。响应于时间差小于第二预设阈值(如3秒钟)，丢弃待测报文，从而可有效减少攻击流量对网络设备的访问数量。
需要指出的是，防御策略不限于上述列举，还可根据需要设定其他防御策略。
以往的安全防御方式，通常为旁路防御或串行防御。旁路防御是指为交换机额外配备分光器和服务器，通过分光器将流量分光至服务器，通过服务器进行流量统计以制定防御表项和防御策略，而后将防御表项和防御策略下发至交换机的访问控制列表中，从而通过访问控制列表过滤掉一些报文。但是，访问控制列表可容纳的表项有限，通常需要保证表项在1万条以内，因而无法全面进行安全防御。旁路防御是指将流量镜像到安全服务器上，通过安全服务器对全部流量进行过滤后，在由交换机将流量进行转发。但是，由于交换机入口流量通常很大，如800G或者T级，而服务器目前还都停留在40G、100G等，因而需要部署大量的安全服务器才能实现全面的安全防御，且多台安全服务器还会带来协同配合困难的问题。
本申请实施例提供的安全防御方法，通过接收处理器对可编程交换芯片接收到的报文进行分析后生成的防御表项和防御策略，而后基于该防御表项和防御策略进行后续报文的防御，在执行防御操作后再进执行，同时具备安全防御功能，从而仅需一台可编程交换机即可完成全面的安全防御操作，无需进行分光器以及安全服务器的部署，减少了网络设备部署的数量，降低了网络基础设施建设成本。
进一步参考图5，示出了本申请的报文处理方法的一个实施例的流程图。该报文处理方法应用于可编程交换机中的可编程交换芯片。可编程交换机中还包括处理器，如X86架构的中央中央处理器等。
该报文处理方法包括以下步骤：
步骤501，接收可编程交换芯片传输的报文。
在本实施例中，报文处理方法的执行主体接收可编程交换芯片传输的报文。其中，报文中的目的IP地址的类别为任一目标类别。目标类别可以包括但不限于：虚拟服务器集群的虚拟IP地址(即LVS集群的VIP)类、云服务器的公网IP地址类、边缘云IP地址类、云数据中心IP地址类等。实践中，可编程交换芯片可在检测出报文中的目的IP地址为任一目标类别后将该报文传输给上述执行主体。
步骤502，将报文中的目的IP地址作为第一目的IP地址，基于第一目的IP地址的类别，确定第二目的IP地址。
在本实施例中，对于不同类型的第一目的IP地址，上述执行主体可以对第一目的IP地址进行不同修改以生成目标报文。
在本实施例的一些可选的实现方式中，响应于第一目的IP地址的类别为虚拟服务器集群的虚拟IP地址类，即LVS集群的VIP，上述执行主体可以可通过负载均衡算法选取真实服务器，如根据LVS集群的服务器池中各服务器负载情况，从服务器池中选出一个当前负载较小的真实服务器，从而将真实服务器的IP地址确定为第二目的IP地址。由此，在报文转发时融合的负载均衡的功能，无需单独设置LVS集群的调度器，降低了网络基础设施建设成本。
在本实施例的一些可选的实现方式中，响应于第一目的IP地址的类别为云服务器的公网IP地址类、边缘云IP地址类、云数据中心IP地址类中的任一类，确定承载第一目的IP地址的物理服务器的IP地址，从而将物理服务器的IP地址作为第二目的IP地址。
步骤503，将第一目的IP地址替换为第二目的IP地址，得到目标报文。
通过将第一目的IP地址替换为承载第一目的IP地址的物理服务器的IP地址，能够在第一目的IP地址为云服务器的公网IP地址的情况下，使可编程交换机起到云上云下互通过程中的网关功能。另外，能够在第一目的IP地址为边缘云IP地址的情况下且报文中的源IP地址为用户设备的IP地址时，使可编程交换机起到云上云下互通过程中的网关功能。此外，能够在第一目的IP地址为边缘云IP地址的情况下且报文中的源IP地址为云数据中心IP地址时，使可编程交换机实现了云数据中心与边缘云互通过程中的网关功能。同时，能够在第一目的IP地址为云数据中心IP地址时，使得可编程交换机实现了云数据中心与边缘云互通过程中的网关功能。
步骤504，将目标报文传输至可编程交换芯片，以使可编程交换芯片向第二目的IP地址转发目标报文。
在本实施例中，上述执行主体可以将目标报文传输至可编程交换芯片，以使可编程交换芯片向第二目的IP地址转发目标报文。
本申请实施例提供的报文处理方法，通过对原始的报文中的目的IP地址进行替换，可使可编程服务器融合负载均衡功能或者网关功能，进一步减少了网络设备部署的数量，降低了网络基础设施建设成本。
需要说明的是，对于方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请实施例并不受所描述的动作顺序的限制，因为依据本申请实施例，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作并不一定是本申请实施例所必须的。
进一步参考图6，作为对上述流量统计方法实施例的实现，本申请提供了一种流量统计装置的一个实施例，该装置具体可以应用于可编程交换机中的可编程交换芯片中。 其中，可编程交换机中还包括处理器。
如图6所示，本实施例的流量统计装置600包括：接收单元601，被配置成接收上述处理器传输的流量统计表项；检测单元602，被配置成响应于接收到报文，检测上述报文与上述流量统计表项是否匹配；统计单元603，被配置成响应于上述报文与上述流量统计表项匹配，将上述报文作为目标报文，对上述目标报文进行流量统计，生成流量统计结果，并转发上述报文；传输单元604，被配置成向上述处理器传输上述流量统计结果。
在本实施的一些可选的实现方式中，上述装置还包括：第一转发单元，被配置成响应于上述报文与上述流量统计表项不匹配，转发上述报文。
在本实施的一些可选的实现方式中，上述流量统计表项中包括以下至少一项字段：互联网协议IP地址、传输控制协议、用户数据报协议、控制报文协议、同步序列编号、确认字符、端口号；以及，上述检测单元602，进一步被配置成：读取上述报文的报文头；检测上述报文头中是否包含上述流量统计表项中的字段；响应于上述报文头中是否包含上述流量统计表项中的字段，确定上述报文与上述流量统计表项匹配。
在本实施的一些可选的实现方式中，上述统计单元603，进一步被配置成：统计目标报文总数和目标报文的总字节数；生成包含上述目标报文总数和上述总字节数的流量统计结果。
在本实施的一些可选的实现方式中，上述装置还包括：第二转发单元，被配置成：在第一时间向上述控制器传输第一流量统计结果；在第二时间向上述控制器传输第二流量统计结果；响应于接收到上述处理器传输的封装后的报文，转发上述封装后的报文，其中，上述封装后的报文中包括目标流量统计结果，上述目标流量统计结果由上述处理器基于上述第一流量统计结果和上述第二流量统计结果生成。
本申请的上述实施例提供的装置，在进行报文转发前执行流量统计操作，不仅能够避免由于访问控制列表的影响导致流量统计结果不准确的情况，同时，还可以使可编程交换机在具备传统的报文转发功能的基础上，同时具备流量统计功能。仅需一台可编程交换机即可完成细粒度的流量统计操作，无需进行分光器以及服务器的部署，减少了网络设备部署的数量，降低了网络基础设施建设成本。
进一步参考图7，作为对上述安全防御方法实施例的实现，本申请提供了一种安全防御装置的一个实施例，该装置具体可以应用于可编程交换机中的可编程交换芯片中。其中，可编程交换机中还包括处理器。
如图7所示，本实施例的安全防御装置700包括：镜像单元701，被配置成响应于接收到报文，截取上述报文中的关键信息，将上述关键信息镜像至处理器；接收单元702，被配置成接收上述处理器传输的防御表项和防御策略，上述防御表项和上述防御策略由上述处理器对上述关键信息解析后生成；匹配单元703，被配置成将后续接收到的报文 作为待测报文，检测上述待测报文与上述防御表项是否匹配；防御单元704，被配置成响应于匹配，基于上述防御策略对上述待测报文进行防御。
在本实施例的一些可选的实现方式中，上述装置还包括：转发单元，被配置成：响应于不匹配，转发上述待测报文。
在本实施例的一些可选的实现方式中，上述镜像单元701，进一步被配置成：截取上述报文的报文头；将上述报文头作为关键信息，将上述关键信息镜像至上述处理器。
在本实施例的一些可选的实现方式中，上述防御单元704，进一步被配置成：检测单位时长内上述待测报文的相同来源报文的转发数量，其中，上述相同来源报文为与上述待测报文包含相同的源IP的报文；响应于上述转发数量大于或等于第一预设阈值，丢弃上述待测报文。
在本实施例的一些可选的实现方式中，上述防御单元704，进一步被配置成：获取上述待测报文的第一接收时间；获取上述待测报文的目标相同来源报文的第二接收时间，其中，上述目标相同来源报文为接收时间最晚的相同来源报文，上述相同来源报文为与上述待测报文包含相同的源IP的报文；确定上述第一接收时间与上述第二接收时间的时间差；响应于上述时间差小于第二预设阈值，丢弃上述待测报文。
本申请的上述实施例提供的装置，通过接收处理器对可编程交换芯片接收到的报文进行分析后生成的防御表项和防御策略，而后基于该防御表项和防御策略进行后续报文的防御，在执行防御操作后再进执行，同时具备安全防御功能，从而仅需一台可编程交换机即可完成全面的安全防御操作，无需进行分光器以及安全服务器的部署，减少了网络设备部署的数量，降低了网络基础设施建设成本。
进一步参考图8，作为对上述报文处理方法实施例的实现，本申请提供了一种报文处理装置的一个实施例，该装置具体可以应用于可编程交换机中的可编程交换芯片中。其中，可编程交换机中还包括处理器。
如图8所示，本实施例的报文处理装置800包括：接收单元801，被配置成接收上述可编程交换芯片传输的报文，其中，上述报文中的目的IP地址的类别为任一目标类别；确定单元802，被配置成将上述报文中的目的IP地址作为第一目的IP地址，基于上述第一目的IP地址的类别，确定第二目的IP地址；替换单元803，被配置成将上述第一目的IP地址替换为上述第二目的IP地址，得到目标报文；传输单元804，被配置成将上述目标报文传输至上述可编程交换芯片，以使上述可编程交换芯片向上述第二目的IP地址转发上述目标报文。
在本实施例的一些可选的实现方式中，上述目标类别包括虚拟服务器集群的虚拟IP地址类；以及，上述确定单元802，进一步被配置成：响应于上述第一目的IP地址的类别为上述虚拟服务器集群的虚拟IP地址类，通过负载均衡算法选取真实服务器；将上述真实服务器的IP地址确定为第二目的IP地址。
在本实施例的一些可选的实现方式中，上述目标类别包括以下至少一项：云服务器的公网IP地址类、边缘云IP地址类、云数据中心IP地址类；以及，上述确定单元802，进一步被配置成：响应于上述第一目的IP地址的类别为上述云服务器的公网IP地址类、上述边缘云IP地址类、上述云数据中心IP地址类中的任一类，确定承载上述第一目的IP地址的物理服务器的IP地址；将上述物理服务器的IP地址作为第二目的IP地址。
本申请的上述实施例提供的装置，通过对原始的报文中的目的IP地址进行替换，可使可编程服务器融合负载均衡功能或者网关功能，进一步减少了网络设备部署的数量，降低了网络基础设施建设成本。
本申请实施例还提供了一种可编程交换机，包括：
处理器，被配置成向上述可编程交换芯片传输流量统计表项。
可编程交换芯片，被配置成响应于上述报文与上述流量统计表项匹配，将上述报文作为目标报文，对上述目标报文进行流量统计，生成流量统计结果，并转发上述报文。
上述处理器，进一步被配置成从上述可编程交换芯片获取上述流量统计结果。
本实施例所提供的可编程交换机，与前述实施例对应的描述类似，相关之处参见前述实施例的部分说明即可。
本申请实施例还提供了另一种可编程交换机，包括：
可编程交换芯片，被配置成响应于接收到报文，截取上述报文中的关键信息，将上述关键信息镜像至处理器。
上述处理器，被配置成对所接收到的关键信息进行解析，生成防御表项和上述防御表项对应的防御策略；将上述防御表项和上述防御策略传输至上述可编程交换芯片。
上述可编程交换芯片，进一步被配置成将后续接收到的报文作为待测报文，检测上述待测报文与上述防御表项是否匹配；响应于匹配，基于上述防御策略对上述待测报文进行防御；响应于不匹配，转发上述待测报文。
本实施例所提供的可编程交换机，与前述实施例对应的描述类似，相关之处参见前述实施例的部分说明即可。
本申请实施例还提供了另一种可编程交换机，包括：
可编程交换芯片，被配置成响应于接收到报文，确定上述报文中的目的IP地址的类别；响应于上述类别为任一目标类别，将上述报文传输至处理器。
上述处理器，被配置成将上述目的IP地址作为第一目的IP地址，基于上述第一目的IP地址的类别，确定第二目的IP地址；将上述第一目的IP地址替换为上述第二目的IP地址，得到目标报文；将上述目标报文传输至上述可编程交换芯片。
上述可编程交换芯片，进一步被配置成向上述第二目的IP地址转发上述目标报文。
本实施例所提供的可编程交换机，与前述实施例对应的描述类似，相关之处参见前述实施例的部分说明即可。
本申请实施例还提供了一种非易失性可读存储介质，该存储介质中存储有一个或多个模块(programs)，该一个或多个模块被应用在设备时，可以使得该设备执行本申请实施例中各方法步骤的指令(instructions)。
本申请实施例提供了一个或多个机器可读介质，其上存储有指令，当由一个或多个处理器执行时，使得电子设备执行如上述实施例中一个或多个所述的方法。本申请实施例中，所述电子设备包括终端设备、服务器(集群)等各类型的设备。
对于装置实施例而言，由于其与方法实施例基本相似，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本说明书中的各个实施例均采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似的部分互相参见即可。
本申请实施例是参照根据本申请实施例的方法、终端设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理终端设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理终端设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理终端设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理终端设备上，使得在计算机或其他可编程终端设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程终端设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请实施例的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请实施例范围的所有变更和修改。
最后，还需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者终端设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者终端设备所固有的要素。在没有更多限制的情况下，由语句“包 括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者终端设备中还存在另外的相同要素。
以上对本申请所提供的可编程交换机、流量统计方法、防御方法和报文处理方法，进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (35)

  1. 一种可编程交换机，其特征在于，所述可编程交换机包括可编程交换芯片和采用X86架构的处理器，所述可编程交换芯片与所述处理器通信连接。
  2. 根据权利要求1所述的可编程交换机，其特征在于，
    所述处理器，被配置成向可编程交换芯片传输控制信息，其中，所述控制信息用于控制所述可编程交换芯片在执行报文转发逻辑之前执行目标操作逻辑；
    所述可编程交换芯片，被配置成响应于接收到报文，执行所述目标操作逻辑；在所述目标操作逻辑执行结束后，执行所述报文转发逻辑。
  3. 根据权利要求2所述的可编程交换机，其特征在于，所述控制信息包括流量统计表项，所述目标操作逻辑包括流量统计操作逻辑；以及
    所述可编程交换芯片，进一步被配置成通过如下步骤执行所述流量统计操作逻辑：
    检测所述报文与所述流量统计表项是否匹配；
    响应于所述报文与所述流量统计表项匹配，将所述报文作为目标报文，对所述目标报文进行流量统计，生成流量统计结果。
  4. 根据权利要求3所述的可编程交换机，其特征在于，所述流量统计表项中包括以下至少一项字段：互联网协议IP地址、传输控制协议、用户数据报协议、控制报文协议、同步序列编号、确认字符、端口号；以及
    所述可编程交换芯片，进一步被配置成通过如下步骤检测所述报文与所述流量统计表项是否匹配：
    响应于接收到报文，读取所述报文的报文头；
    检测所述报文头中是否包含所述流量统计表项中的字段；
    响应于所述报文头中包含所述流量统计表项中的字段，确定所述报文与所述流量统计表项匹配。
  5. 根据权利要求3所述的可编程交换机，其特征在于，所述可编程交换芯片，进一步被配置成通过如下步骤生成流量统计结果：
    统计目标报文总数和目标报文的总字节数；
    生成包含所述总数和所述总字节数的流量统计结果。
  6. 根据权利要求5所述的可编程交换机，其特征在于，所述处理器，进一步被配置成：
    在第一时间从所述可编程交换芯片获取第一流量统计结果；
    在第二时间从所述可编程交换芯片获取第二流量统计结果；
    确定所述第二时间与所述第一时间的时间差；
    确定所述第二流量统计结果中的目标报文总数与所述第一流量统计结果中的目标报文总数的第一差值，并确定所述第二流量统计结果中的总字节数与所述第一流量统计结果中的总字节数的第二差值；
    将所述第一差值与所述时间差的比值，确定为包转发率；
    将所述第二差值与所述时间差的比值，确定为比特率；
    生成包含所述包转发率和所述比特率的目标流量统计结果。
  7. 根据权利要求6所述的可编程交换机，其特征在于，所述处理器，进一步被配置成：
    将所述目标流量统计结果进行封装，得到封装后的报文，所述封装后的报文中包括目标服务器的IP地址；
    将所述封装后的报文传输至所述可编程交换芯片；以及
    所述可编程交换芯片，进一步被配置成向所述目标服务器的IP地址转发所述封装后的报文。
  8. 根据权利要求2所述的可编程交换机，其特征在于，所述控制信息包括防御表项和防御策略，所述目标操作逻辑包括对流量攻击的防御操作逻辑；以及
    所述可编程交换芯片，进一步被配置成通过如下步骤执行所述防御操作逻辑：
    将所述报文作为待测报文，检测所述待测报文与所述防御表项是否匹配；
    响应于所述报文与所述防御表项匹配，基于所述防御策略对所述待测报文进行防御。
  9. 根据权利要求8所述的可编程交换机，其特征在于，所述可编程交换芯片，进一步被配置成通过如下步骤对所述待测报文进行防御：
    检测单位时长内所述待测报文的相同来源报文的转发数量，其中，所述相同来源报文为与所述待测报文包含相同的源IP的报文；
    响应于所述转发数量大于或等于第一预设阈值，丢弃所述待测报文。
  10. 根据权利要求8所述的可编程交换机，其特征在于，所述可编程交换芯片，进一步被配置成通过如下步骤对所述待测报文进行防御：
    获取所述待测报文的第一接收时间；
    获取所述待测报文的目标相同来源报文的第二接收时间，其中，所述目标相同来源报文为接收时间最晚的相同来源报文，所述相同来源报文为与所述待测报文包含相同的源IP的报文；
    确定所述第一接收时间与所述第二接收时间的时间差；
    响应于所述时间差小于第二预设阈值，丢弃所述待测报文。
  11. 根据权利要求8所述的可编程交换机，其特征在于，
    所述可编程交换芯片，进一步被配置成在接收到所述控制信息之前，截取所接收到的报文中的关键信息，将所述关键信息镜像至所述处理器；以及
    所述处理器，进一步被配置成对所接收到的关键信息进行解析，生成防御表项和所述防御表项对应的防御策略。
  12. 根据权利要求11所述的可编程交换机，其特征在于，所述关键信息包括源IP 地址；以及
    所述处理器，进一步被配置成通过如下步骤生成防御表项和所述防御表项对应的防御策略：
    对目标时长内所接收到的关键信息进行统计，确定所述目标时长内的相同关键信息的数量；
    将数量大于第三预设阈值的相同关键信息作为攻击报文中的关键信息，从所述攻击报文中的关键信息中提取至少一项字段，生成防御表项，并创建所述防御表项对应的防御策略。
  13. 根据权利要求2所述的可编程交换机，其特征在于，所述目标操作逻辑包括IP地址类别检测逻辑；以及
    所述可编程交换芯片，进一步被配置成通过如下步骤执行所述IP地址类别检测逻辑：
    从所述报文的报文头中读取目的IP地址；
    检测所述目的IP地址的类别；
    响应于所述类别为任一目标类别，将所述报文传输至处理器，并将所述报文替换为所述处理器返回的目标报文，其中，所述目标报文由所述处理器对所述报文中的目的IP地址进行修改后所生成。
  14. 根据权利要求13所述的可编程交换机，其特征在于，所述目标类别包括虚拟服务器集群的虚拟IP地址类；以及
    所述处理器，进一步被配置成通过如下步骤生成所述目标报文：
    将所述目的IP地址作为第一目的IP地址，响应于所述第一目的IP地址的类别为所述虚拟服务器集群的虚拟IP地址类，通过负载均衡算法选取真实服务器；
    将所述真实服务器的IP地址作为第二目的IP地址，并将所述报文的第一目的IP地址替换为所述第二目的IP地址，生成目标报文。
  15. 根据权利要求13所述的可编程交换机，其特征在于，所述目标类别包括以下至少一项：云服务器的公网IP地址类、边缘云IP地址类、云数据中心IP地址类；以及
    所述处理器，进一步被配置成通过如下步骤生成所述目标报文：
    将所述目的IP地址作为第一目的IP地址，响应于所述第一目的IP地址的类别为所述云服务器的公网IP地址类、所述边缘云IP地址类、所述云数据中心IP地址类中的任一类，确定承载所述第一目的IP地址的物理服务器的IP地址；
    将所述物理服务器的IP地址作为第二目的IP地址，并将所述报文的第一目的IP地址替换为所述第二目的IP地址，生成目标报文。
  16. 一种可编程交换机，其特征在于，包括：
    处理器，被配置成向所述可编程交换芯片传输流量统计表项；
    可编程交换芯片，被配置成响应于报文与所述流量统计表项匹配，将所述报文作为 目标报文，对所述目标报文进行流量统计，生成流量统计结果，并转发所述报文；
    所述处理器，进一步被配置成从所述可编程交换芯片获取所述流量统计结果。
  17. 一种可编程交换机，其特征在于，包括：
    可编程交换芯片，被配置成响应于接收到报文，截取所述报文中的关键信息，将所述关键信息镜像至处理器；
    所述处理器，被配置成对所接收到的关键信息进行解析，生成防御表项和所述防御表项对应的防御策略；将所述防御表项和所述防御策略传输至所述可编程交换芯片；
    所述可编程交换芯片，进一步被配置成将后续接收到的报文作为待测报文，检测所述待测报文与所述防御表项是否匹配；响应于匹配，基于所述防御策略对所述待测报文进行防御；响应于不匹配，转发所述待测报文。
  18. 一种可编程交换机，其特征在于，包括：
    可编程交换芯片，被配置成响应于接收到报文，确定所述报文中的目的IP地址的类别；响应于所述类别为任一目标类别，将所述报文传输至处理器；
    所述处理器，被配置成将所述目的IP地址作为第一目的IP地址，基于所述第一目的IP地址的类别，确定第二目的IP地址；将所述第一目的IP地址替换为所述第二目的IP地址，得到目标报文；将所述目标报文传输至所述可编程交换芯片；
    所述可编程交换芯片，进一步被配置成向所述第二目的IP地址转发所述目标报文。
  19. 一种流量统计方法，其特征在于，应用于可编程交换机中的可编程交换芯片，所述可编程交换机中还包括处理器，所述方法包括：
    接收所述处理器传输的流量统计表项；
    响应于接收到报文，检测所述报文与所述流量统计表项是否匹配；
    响应于所述报文与所述流量统计表项匹配，将所述报文作为目标报文，对所述目标报文进行流量统计，生成流量统计结果，并转发所述报文；
    向所述处理器传输所述流量统计结果。
  20. 根据权利要求19所述的方法，其特征在于，在所述检测所述报文与所述流量统计表项是否匹配之后，所述方法还包括：
    响应于所述报文与所述流量统计表项不匹配，转发所述报文。
  21. 根据权利要求19所述的方法，其特征在于，所述流量统计表项中包括以下至少一项字段：互联网协议IP地址、传输控制协议、用户数据报协议、控制报文协议、同步序列编号、确认字符、端口号；以及
    所述检测所述报文与所述流量统计表项是否匹配，包括：
    读取所述报文的报文头；
    检测所述报文头中是否包含所述流量统计表项中的字段；
    响应于所述报文头中包含所述流量统计表项中的字段，确定所述报文与所述流量统计表项匹配。
  22. 根据权利要求19所述的方法，其特征在于，所述对所述目标报文进行流量统计，生成流量统计结果，包括：
    统计目标报文总数和目标报文的总字节数；
    生成包含所述目标报文总数和所述总字节数的流量统计结果。
  23. 根据权利要求22所述的方法，其特征在于，所述方法还包括：
    在第一时间向控制器传输第一流量统计结果；
    在第二时间向所述控制器传输第二流量统计结果；
    响应于接收到所述处理器传输的封装后的报文，转发所述封装后的报文，其中，所述封装后的报文中包括目标流量统计结果，所述目标流量统计结果由所述处理器基于所述第一流量统计结果和所述第二流量统计结果生成。
  24. 一种安全防御方法，其特征在于，应用于可编程交换机中的可编程交换芯片，所述可编程交换机中还包括处理器，所述方法包括：
    响应于接收到报文，截取所述报文中的关键信息，将所述关键信息镜像至处理器；
    接收所述处理器传输的防御表项和防御策略，所述防御表项和所述防御策略由所述处理器对所述关键信息解析后生成；
    将后续接收到的报文作为待测报文，检测所述待测报文与所述防御表项是否匹配；
    响应于匹配，基于所述防御策略对所述待测报文进行防御。
  25. 根据权利要求24所述的方法，其特征在于，在所述检测所述待测报文与所述防御表项是否匹配之后，所述方法还包括：
    响应于不匹配，转发所述待测报文。
  26. 根据权利要求24所述的方法，其特征在于，所述截取所述报文中的关键信息，将所述关键信息镜像至处理器，包括：
    截取所述报文的报文头；
    将所述报文头作为关键信息，将所述关键信息镜像至所述处理器。
  27. 根据权利要求24所述的方法，其特征在于，所述基于所述防御策略对所述待测报文进行防御，包括：
    检测单位时长内所述待测报文的相同来源报文的转发数量，其中，所述相同来源报文为与所述待测报文包含相同的源IP的报文；
    响应于所述转发数量大于或等于第一预设阈值，丢弃所述待测报文。
  28. 根据权利要求24所述的方法，其特征在于，所述基于所述防御策略对所述待测报文进行防御，包括：
    获取所述待测报文的第一接收时间；
    获取所述待测报文的目标相同来源报文的第二接收时间，其中，所述目标相同来源报文为接收时间最晚的相同来源报文，所述相同来源报文为与所述待测报文包含相同的源IP的报文；
    确定所述第一接收时间与所述第二接收时间的时间差；
    响应于所述时间差小于第二预设阈值，丢弃所述待测报文。
  29. 一种报文处理方法，其特征在于，应用于可编程交换机中的处理器，所述可编程交换机中还包括可编程交换芯片，所述方法包括：
    接收所述可编程交换芯片传输的报文，其中，所述报文中的目的IP地址的类别为任一目标类别；
    将所述报文中的目的IP地址作为第一目的IP地址，基于所述第一目的IP地址的类别，确定第二目的IP地址；
    将所述第一目的IP地址替换为所述第二目的IP地址，得到目标报文；
    将所述目标报文传输至所述可编程交换芯片，以使所述可编程交换芯片向所述第二目的IP地址转发所述目标报文。
  30. 根据权利要求29所述的报文处理方法，其特征在于，所述目标类别包括虚拟服务器集群的虚拟IP地址类；以及
    所述基于所述第一目的IP地址的类别，确定第二目的IP地址，包括：
    响应于所述第一目的IP地址的类别为所述虚拟服务器集群的虚拟IP地址类，通过负载均衡算法选取真实服务器；
    将所述真实服务器的IP地址确定为第二目的IP地址。
  31. 根据权利要求29所述的报文处理方法，其特征在于，所述目标类别包括以下至少一项：云服务器的公网IP地址类、边缘云IP地址类、云数据中心IP地址类；以及
    所述基于所述第一目的IP地址的类别，确定第二目的IP地址，包括：
    响应于所述第一目的IP地址的类别为所述云服务器的公网IP地址类、所述边缘云IP地址类、所述云数据中心IP地址类中的任一类，确定承载所述第一目的IP地址的物理服务器的IP地址；
    将所述物理服务器的IP地址作为第二目的IP地址。
  32. 一种流量统计装置，其特征在于，应用于可编程交换机中的可编程交换芯片，所述可编程交换机中还包括处理器，所述装置包括：
    接收单元，被配置成接收所述处理器传输的流量统计表项；
    检测单元，被配置成响应于接收到报文，检测所述报文与所述流量统计表项是否匹配；
    统计单元，被配置成响应于所述报文与所述流量统计表项匹配，将所述报文作为目标报文，对所述目标报文进行流量统计，生成流量统计结果，并转发所述报文；
    传输单元，被配置成向所述处理器传输所述流量统计结果。
  33. 一种安全防御装置，其特征在于，应用于可编程交换机中的可编程交换芯片，所述可编程交换机中还包括处理器，所述装置包括：
    镜像单元，被配置成响应于接收到报文，截取所述报文中的关键信息，将所述关键 信息镜像至处理器；
    接收单元，被配置成接收所述处理器传输的防御表项和防御策略，所述防御表项和所述防御策略由所述处理器对所述关键信息解析后生成；
    匹配单元，被配置成将后续接收到的报文作为待测报文，检测所述待测报文与所述防御表项是否匹配；
    防御单元，被配置成响应于匹配，基于所述防御策略对所述待测报文进行防御。
  34. 一种报文处理装置，其特征在于，应用于可编程交换机中的处理器，所述可编程交换机中还包括可编程交换芯片，所述装置包括：
    接收单元，被配置成接收所述可编程交换芯片传输的报文，其中，所述报文中的目的IP地址的类别为任一目标类别；
    确定单元，被配置成将所述报文中的目的IP地址作为第一目的IP地址，基于所述第一目的IP地址的类别，确定第二目的IP地址；
    替换单元，被配置成将所述第一目的IP地址替换为所述第二目的IP地址，得到目标报文；
    传输单元，被配置成将所述目标报文传输至所述可编程交换芯片，以使所述可编程交换芯片向所述第二目的IP地址转发所述目标报文。
  35. 一个或多个机器可读介质，其上存储有可执行代码，当所述可执行代码被执行时，使得处理器执行如权利要求19-31中一个或多个所述的方法。
PCT/CN2021/106452 2020-07-21 2021-07-15 可编程交换机、流量统计方法、防御方法和报文处理方法 WO2022017249A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010714377.9A CN113315744A (zh) 2020-07-21 2020-07-21 可编程交换机、流量统计方法、防御方法和报文处理方法
CN202010714377.9 2020-07-21

Publications (1)

Publication Number Publication Date
WO2022017249A1 true WO2022017249A1 (zh) 2022-01-27

Family

ID=77370629

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/106452 WO2022017249A1 (zh) 2020-07-21 2021-07-15 可编程交换机、流量统计方法、防御方法和报文处理方法

Country Status (2)

Country Link
CN (1) CN113315744A (zh)
WO (1) WO2022017249A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114553757A (zh) * 2022-01-29 2022-05-27 阿里巴巴（中国）有限公司 基于可编程交换机的协议报文处理方法、装置和设备
CN114598647A (zh) * 2022-01-30 2022-06-07 阿里巴巴（中国）有限公司 数据处理方法、系统和存储介质
CN114726801A (zh) * 2022-04-01 2022-07-08 北京东土军悦科技有限公司 一种加密流量的转发方法和系统
CN114745323A (zh) * 2022-04-02 2022-07-12 北京东土军悦科技有限公司 一种流量报文的转发方法和系统
CN115002039A (zh) * 2022-07-27 2022-09-02 之江实验室 一种基于udf的流量卸载方法及系统
CN115086220A (zh) * 2022-06-30 2022-09-20 绿盟科技集团股份有限公司 一种网络报文转发方法、装置、设备及介质
CN115208827A (zh) * 2022-07-11 2022-10-18 京东科技信息技术有限公司 一种流量分配的方法和装置
CN115396314A (zh) * 2022-08-26 2022-11-25 湖北天融信网络安全技术有限公司 获得防护策略集合、报文检测的方法、装置、系统及介质
WO2023168872A1 (zh) * 2022-03-10 2023-09-14 中国电信股份有限公司 异常反馈和故障定位方法、网络节点及存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113885474A (zh) * 2021-09-30 2022-01-04 株洲中车时代电气股份有限公司 控制网络及列车
CN113645154B (zh) * 2021-10-12 2022-04-15 阿里云计算有限公司 网络流量控速的方法以及装置
CN114866414A (zh) * 2022-03-24 2022-08-05 阿里巴巴（中国）有限公司 虚拟网络状态确定方法、装置及设备
CN115296995B (zh) * 2022-06-30 2024-03-12 北京达佳互联信息技术有限公司 交换机配置方法、装置、电子设备及存储介质
CN115858181B (zh) * 2023-02-27 2023-06-06 中用科技有限公司 基于可编程交换机的分布式存储倾斜工作负载平衡方法
CN116208497B (zh) * 2023-05-05 2023-07-21 广东省新一代通信与网络创新研究院 一种可编程网络系统、方法、交换机及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101299719A (zh) * 2008-06-04 2008-11-05 北京星网锐捷网络技术有限公司 数据流的检测处理方法、中央处理器及交换机
CN106131083A (zh) * 2016-08-30 2016-11-16 迈普通信技术股份有限公司 一种攻击报文检测和防范的方法及交换机
CN106534278A (zh) * 2016-11-01 2017-03-22 锐捷网络股份有限公司 一种报文转发方法及交换设备
CN107547567A (zh) * 2017-09-29 2018-01-05 新华三技术有限公司 一种防攻击方法和装置
CN110071853A (zh) * 2019-04-30 2019-07-30 新华三技术有限公司 一种报文统计方法及网络设备
CN110113230A (zh) * 2019-04-30 2019-08-09 新华三技术有限公司 一种报文统计方法及网络设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104506531B (zh) * 2014-12-19 2018-05-01 上海斐讯数据通信技术有限公司 针对流量攻击的安全防御系统及方法
CN104883321B (zh) * 2015-05-05 2017-11-17 浙江大学 一种基于交换机负载的域内负载均衡方法
CN106921666B (zh) * 2017-03-06 2020-10-02 中山大学 一种基于协同理论的DDoS攻击防御系统及方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101299719A (zh) * 2008-06-04 2008-11-05 北京星网锐捷网络技术有限公司 数据流的检测处理方法、中央处理器及交换机
CN106131083A (zh) * 2016-08-30 2016-11-16 迈普通信技术股份有限公司 一种攻击报文检测和防范的方法及交换机
CN106534278A (zh) * 2016-11-01 2017-03-22 锐捷网络股份有限公司 一种报文转发方法及交换设备
CN107547567A (zh) * 2017-09-29 2018-01-05 新华三技术有限公司 一种防攻击方法和装置
CN110071853A (zh) * 2019-04-30 2019-07-30 新华三技术有限公司 一种报文统计方法及网络设备
CN110113230A (zh) * 2019-04-30 2019-08-09 新华三技术有限公司 一种报文统计方法及网络设备

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114553757A (zh) * 2022-01-29 2022-05-27 阿里巴巴（中国）有限公司 基于可编程交换机的协议报文处理方法、装置和设备
CN114598647A (zh) * 2022-01-30 2022-06-07 阿里巴巴（中国）有限公司 数据处理方法、系统和存储介质
WO2023168872A1 (zh) * 2022-03-10 2023-09-14 中国电信股份有限公司 异常反馈和故障定位方法、网络节点及存储介质
CN114726801A (zh) * 2022-04-01 2022-07-08 北京东土军悦科技有限公司 一种加密流量的转发方法和系统
CN114726801B (zh) * 2022-04-01 2024-03-29 北京东土军悦科技有限公司 一种加密流量的转发方法和系统
CN114745323A (zh) * 2022-04-02 2022-07-12 北京东土军悦科技有限公司 一种流量报文的转发方法和系统
CN115086220A (zh) * 2022-06-30 2022-09-20 绿盟科技集团股份有限公司 一种网络报文转发方法、装置、设备及介质
CN115086220B (zh) * 2022-06-30 2024-05-17 绿盟科技集团股份有限公司 一种网络报文转发方法、装置、设备及介质
CN115208827A (zh) * 2022-07-11 2022-10-18 京东科技信息技术有限公司 一种流量分配的方法和装置
CN115002039B (zh) * 2022-07-27 2023-03-24 之江实验室 一种基于udf的流量卸载方法及系统
CN115002039A (zh) * 2022-07-27 2022-09-02 之江实验室 一种基于udf的流量卸载方法及系统
CN115396314A (zh) * 2022-08-26 2022-11-25 湖北天融信网络安全技术有限公司 获得防护策略集合、报文检测的方法、装置、系统及介质
CN115396314B (zh) * 2022-08-26 2024-04-26 湖北天融信网络安全技术有限公司 获得防护策略集合、报文检测的方法、装置、系统及介质

Also Published As

Publication number Publication date
CN113315744A (zh) 2021-08-27

Similar Documents

Publication Publication Date Title
WO2022017249A1 (zh) 可编程交换机、流量统计方法、防御方法和报文处理方法
AU2016384755B2 (en) Efficient packet capture for cyber threat analysis
Hofstede et al. Flow monitoring explained: From packet capture to data analysis with netflow and ipfix
US9917783B2 (en) Method, system and non-transitory computer readable medium for profiling network traffic of a network
US10320692B2 (en) Ethernet loopback detection and service traffic blocking
US9762546B2 (en) Multi-connection system and method for service using internet protocol
US8904524B1 (en) Detection of fast flux networks
EP2482497B1 (en) Data forwarding method, data processing method, system and device thereof
US10498627B2 (en) Detecting packet forwarding path
US9356844B2 (en) Efficient application recognition in network traffic
CN108259425A (zh) 攻击请求的确定方法、装置及服务器
US20120207039A1 (en) Method and system for validating network traffic classification in a blade server
JP7388613B2 (ja) パケット処理方法及び装置、デバイス、並びに、コンピュータ可読ストレージ媒体
US10652211B2 (en) Control device, border router, control method, and control program
US9894074B2 (en) Method and system for extracting access control list
US10904288B2 (en) Identifying and deceiving adversary nodes and maneuvers for attack deception and mitigation
US9071545B2 (en) Network appliance that determines what processor to send a future packet to based on a predicted future arrival time
JP6502902B2 (ja) 攻撃検知装置、攻撃検知システムおよび攻撃検知方法
CN112887229B (zh) 一种会话信息同步方法及装置
US10999303B2 (en) Capturing data
US8537676B1 (en) Rate limiting for DTCP message transport
WO2019043804A1 (ja) ログ分析装置、ログ分析方法及びコンピュータ読み取り可能記録媒体
US8966321B2 (en) Logical port and layer protocol test configuration resource manager
CN108833282A (zh) 数据转发方法、系统、装置及sdn交换机
CN113596037B (zh) 一种基于网络全流量中事件关系有向图的apt攻击检测方法

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21845664

Country of ref document: EP

Kind code of ref document: A1