WO2022057647A1 - Procédé, système et dispositif de traitement de paquets - Google Patents

Procédé, système et dispositif de traitement de paquets Download PDF

Info

Publication number
WO2022057647A1
WO2022057647A1 PCT/CN2021/116602 CN2021116602W WO2022057647A1 WO 2022057647 A1 WO2022057647 A1 WO 2022057647A1 CN 2021116602 W CN2021116602 W CN 2021116602W WO 2022057647 A1 WO2022057647 A1 WO 2022057647A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
port
attack
packets
forwarding priority
Prior art date
Application number
PCT/CN2021/116602
Other languages
English (en)
Chinese (zh)
Inventor
曹晶
张耀坤
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022057647A1 publication Critical patent/WO2022057647A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/22—Traffic shaping
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2425—Traffic characterised by specific attributes, e.g. priority or QoS for supporting services specification, e.g. SLA
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/32—Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/36—Flow control; Congestion control by determining packet size, e.g. maximum transfer unit [MTU]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a message processing method, system and device.
  • the network device usually forwards the to-be-forwarded packets in an orderly manner according to the forwarding priority of the to-be-forwarded packets.
  • packets with higher forwarding priorities will be preferentially forwarded by network devices.
  • the forwarding priority corresponding to these packets is usually set to the highest forwarding priority. level to ensure that these packets are effectively processed to ensure the normal operation of network devices.
  • attack packets with the highest forwarding priority will also be preferentially processed. Since the total bandwidth of each network device is limited, once the number of attack packets increases sharply, the total bandwidth of the packets with the highest forwarding priority exceeds the total bandwidth of the network device, and the network device will respond to the highest forwarding priority. Therefore, protocol packets, detection packets of network devices, or more important data packets may be lost, resulting in the failure of network devices to provide normal services.
  • the network device identifies safe packets from the received packets through the security policy template, forwards the safe packets normally, and discards the unrecognized packets. , to achieve defense against attack packets to improve network security.
  • the security policy template since the security policy template is fixed, it cannot effectively defend against changeable attack packets.
  • the embodiments of the present application provide a packet processing method, system, and device.
  • the network device can identify and process the attack packet to ensure that Security packets with the highest forwarding priority are effectively forwarded, making it possible for network devices to provide normal services.
  • an embodiment of the present application provides a method for processing a packet, and the method may include: when a first communication device determines that a packet with the highest forwarding priority transmitted through a first port occupies the bandwidth of the first port When the first condition is satisfied, the characteristic information of the first attack packet included in the packet with the highest forwarding priority transmitted through the first port is acquired, and the characteristic information of the first attack packet is sent to the control management entity.
  • the first condition is a condition configured by the first communication device for the first port and used to determine whether the attack packet processing needs to be performed on the first port.
  • control and management entity can generate a packet processing policy based on the packet characteristics of the received first attack packet, so that the first communication device can compare the characteristics of the first attack packet with the characteristics of the first attack packet based on the packet processing policy.
  • Packet loss and/or rate limiting are performed on packets with matching information to avoid network equipment congestion caused by attacks based on high-priority packets, and ensure that normal packets with the highest forwarding priority can be effectively forwarded, so that the first communication It becomes possible for the device to provide normal services.
  • the control management entity may further generate a packet processing policy based on the feature information of the first attack packet, the first The communication device acquires the packet processing policy, where the packet processing policy is used to process the packet matching the feature information of the first attack packet.
  • the first communication device can obtain the message processing policy through internal data transmission; if the control management entity and the first communication device are two different devices, the first communication device A communication device can obtain a message processing policy through a message, and the message can be a Border Gateway Protocol (English: Border Gateway Protocol, referred to as: BGP) message, Path Computation Element Communication Protocol (English: Path Computation Element Communication Protocol) , referred to as: PCEP) message, telemetry (English: Telemetry) message or Network Configuration Protocol (English: Network Configuration Protocol, referred to as: NETCONF) message any kind of message, for example: the message processing policy can carry The Type Length Value (English: Type Length Value, TLV for short) field extended in the indication message carries the feature information of the first attack message.
  • Border Gateway Protocol English: Border Gateway Protocol, referred to as: BGP
  • Path Computation Element Communication Protocol English: Path Computation Element Communication Protocol
  • PCEP Path Computation Element Communication Protocol
  • telemetry English: Telemetry
  • Network Configuration Protocol
  • control management entity by acquiring the packet processing policy generated by the control management entity, a precondition is provided for subsequent processing of the packet matching the characteristic information of the first attack packet, so that the normal packet with the highest forwarding priority on the network device can be processed.
  • the purpose of efficient forwarding becomes possible. It should be noted that, in the following description, the control management entity and the first communication apparatus belong to two independent network devices as an example for description.
  • the first communication device may process the first packet based on the packet processing policy, where the first packet is A packet whose characteristic information matches the characteristic information of the first attack packet.
  • the first packet is A packet whose characteristic information matches the characteristic information of the first attack packet.
  • the first communication apparatus processing the first packet based on the packet processing policy may include: performing packet loss processing on the first packet based on the packet processing policy.
  • the first communication apparatus processes the first packet based on the packet processing policy, and may also include: performing rate-limiting processing on the first packet based on the packet processing policy.
  • suppression processing such as packet loss or rate limiting on the first packet matching the characteristic information of the first attack packet
  • the attack packet can effectively prevent the attack packet from occupying a large number of bandwidth resources of the normal packet with the highest forwarding priority. Reduce the forwarding delay of normal packets with the highest forwarding priority.
  • the first communication device may also send indication information to the control management entity, where the indication information is used to instruct the control management entity to generate a packet processing policy.
  • the first communication device may carry the indication information and the feature information of the first attack packet in different indication packets and deliver them to the control management entity.
  • the first communication apparatus may carry the indication information and the feature information of the first attack packet in the same indication packet and send it to the control management entity.
  • the indication message can be any one of the following messages: BGP message, PCEP message, Telemetry message or NETCONF message.
  • the indication information and the feature information of the first attack packet may be carried through the extended TLV field in any of the foregoing types of packets.
  • the indication information and the characteristic information of the first attack packet may also be carried through other available fields such as a reserved (English: Reserved) field in any of the foregoing types of packets.
  • the first condition may include that the ratio of the bandwidth of the first port occupied by the packets with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold.
  • the first threshold is 70%
  • the bandwidth of the first port is 20 megabytes per second (English: Gb/s)
  • the first communication device obtains the packet with the highest forwarding priority transmitted through the first port as 15Gb/s
  • the first condition may also include that the packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold. For example, if the second threshold is 15 Gb/s, the bandwidth of the first port is 20 Gb/s, and the packet with the highest forwarding priority acquired by the first communication device through the first port is 15 Gb/s, then the first communication The device determines that the size of the message with the highest forwarding priority on the first port is equal to the second threshold of 15 Gb/s, thereby determining that the message with the highest forwarding priority transmitted through the first port occupies the bandwidth of the first port to satisfy the first port. condition.
  • the first communication apparatus may poll and detect the bandwidth occupancy status of each port.
  • the first communication device can poll and detect the bandwidth occupancy of the first port, for example, it can be realized by the timer of the traffic management (English: Traffic Management, TM for short) module of the first communication device.
  • the TM module sets the timing of the timer to 1 second, and when the timer reaches 1 second, obtains the size of the packet transmitted through the first port once.
  • the first communication device polls and detects the bandwidth occupancy of the first port, obtains the size of all packets transmitted through the first port, and then determines that all packets transmitted through the first port occupy the first port.
  • the second condition may refer to that the proportion of the bandwidth of the first port occupied by all packets transmitted through the first port is greater than or equal to the third threshold, or the second condition may also mean that all packets transmitted through the first port are greater than or equal to the third threshold. equal to the fourth threshold.
  • the first communication device determines that all the packets transmitted through the first port satisfy the second condition through polling detection, it is determined that there are many packets transmitted through the first port, and there is a risk of congestion, and it is necessary to focus on the more important ones.
  • the bandwidth occupancy of the highest forwarding priority At this time, when it is determined that the bandwidth of the first port occupied by the packet with the highest forwarding priority transmitted through the first port satisfies the first condition, it can be considered that the highest forwarding priority transmitted on the first port is the highest bandwidth.
  • attack packets in the packets of forwarding priority that is to say, the above-mentioned polling mechanism and the two judgment conditions, so that the normal packets with the highest forwarding priority transmitted on the first communication device through the first port can be Normal forwarding provides the premise and guarantee.
  • a third condition corresponding to the first condition of the first port is also set.
  • the packet processing process on the second port may include: when the first communication device determines that the bandwidth of the second port occupied by the packet with the highest forwarding priority transmitted through the second port satisfies the third condition, obtaining the The characteristic information of the second attack packet included in the packet with the highest forwarding priority transmitted by the two ports, and the characteristic information of the second attack packet is sent to the control management entity.
  • the third condition may refer to that the ratio of the bandwidth of the second port occupied by the packets with the highest forwarding priority transmitted through the second port is greater than or equal to the fifth threshold; The transmitted packet with the highest forwarding priority is greater than or equal to the sixth threshold. It should be noted that, for the second port, one or more of the foregoing implementation manners can also be used to process the counterfeit attack packet with the highest forwarding priority, and the relevant description will not be repeated.
  • the feature information of the attack packet may refer to the feature information that can identify the attack packet and the attack flow to which the attack packet belongs.
  • the characteristic information of the attack packet may specifically be all or part of the content of the quintuple of the attack packet.
  • the attack packet is an Internet Protocol (English: Internet Protocol, IP for short) packet
  • the The feature information may include one or more of the following information: source IP address, destination IP address, source port number, destination port number or transport layer protocol number; for another example, the attack packet is a multi-protocol label switching (English: Multiprotocol Label Switching, MPLS for short) message
  • the feature information of the attack message may include one or more of the following information: MPLS label, the source media access control of the attack message (English: Media Access Control, Abbreviation: MAC address, destination MAC address, source IP address, and destination IP address.
  • the first communication device may perform the processing method provided in this embodiment of the present application on the packet with the highest forwarding priority in the network scenario transmitted through the first port.
  • the first communication device may run on the Internet Protocol version 4 (English: Internet Protocol version 4, referred to as: IPv4) network, on the Internet Protocol version 6 (English: Internet Protocol version 6, referred to as: IPv6) network, virtual private Network (English: Virtual Private Network, referred to as: VPN) network, Multiprotocol Label Switching (English: Multiprotocol Label Switching, referred to as: MPLS) network, Virtual Extended Local Area Network (English: Virtual Extensible Local Area Network, referred to as: VXLAN) and other network environments middle.
  • IPv4 Internet Protocol version 4, referred to as: IPv4
  • IPv6 Internet Protocol version 6
  • VPN Virtual Private Network
  • MPLS Multiprotocol Label Switching
  • VXLAN Virtual Extended Local Area Network
  • VXLAN Virtual Extensible Local Area Network
  • the first communication device may refer to any network device capable of implementing a message forwarding function, for example, the communication device may be a switch, a router, etc.; or, the first communication device may also be a network device with a message A single board, chip, etc. with the text forwarding function.
  • the TM module may refer to a TM chip in the first communication device or a functional module capable of implementing the TM function.
  • the port of the first communication device may be a physical port of the first communication device or a logical port of the first communication device.
  • an embodiment of the present application further provides a method for processing a packet, the method comprising: the first communication device determines that the packet with the highest forwarding priority transmitted by the first port occupies the bandwidth of the first port and satisfies the first When the conditions are met, the packets with the highest forwarding priority transmitted through the first port are analyzed, and it is determined that the packets transmitted by the first port include attack packets with the highest forwarding priority.
  • the first communication device may also send an alarm signal to the network management, where the alarm signal is used for It is indicated that there are attack packets in the first communication device, so that the network management can perform security defense on the network to prevent the attack packets from causing greater threats to the network.
  • the alarm signal may also carry characteristic information of the attack.
  • the first communication apparatus may further acquire feature information of the attack packet after determining that the packet transmitted by the first port includes the attack packet with the highest forwarding priority.
  • the first communication device may also send the characteristic information of the attack packet to the control management entity, and obtain a packet processing policy generated by the control management entity, where the packet processing policy is used to compare the characteristics of the attack packet with the attack packet.
  • the first communication device can perform packet loss and/or speed limit processing on the first packet based on the packet processing policy, and the first packet is an attack packet.
  • the characteristic information matches the packet.
  • the first condition may include that the ratio of the bandwidth of the first port occupied by the packets with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold.
  • the first condition may also include that the packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold.
  • an embodiment of the present application further provides a method for processing a packet, the method may include: the first communication device determines that the packet with the highest forwarding priority transmitted through the first port occupies the bandwidth of the first port and satisfies the first port. Under one condition, obtain the characteristic information of the attack packet in the packet with the highest forwarding priority, and send the characteristic information of the attack packet to the control management entity; at this time, the control management entity can be based on the characteristics of the attack packet The information generates a packet processing policy, where the packet processing policy is used to process the packet matching the characteristic information of the attack packet.
  • the method may further include: the first communication device obtains a packet processing policy generated by the control and management device, so that the first communication device processes the first packet based on the packet processing policy, where the first packet is Packets matching the feature information of attack packets.
  • the method may further include: controlling the management device to send a packet processing policy to the second communication apparatus, so that the second communication apparatus processes the second packet based on the packet processing policy, and the second packet is Packets matching the feature information of attack packets.
  • the first condition may include that the ratio of the bandwidth of the first port occupied by the packets with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold.
  • the first condition may also include that the packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold.
  • an embodiment of the present application further provides a system for processing a message.
  • the system may include at least a first communication device and a control management entity, wherein the first communication device is configured to determine the highest value transmitted through the first port.
  • the control management entity uses According to the packet feature information of the attack packet, a packet processing policy is generated, and the packet processing policy is used to process the packet matching the characteristic information of the attack packet.
  • control and management device is further configured to send the packet processing policy to the first communication apparatus.
  • the first communication device is further configured to process a first packet based on the packet processing policy, where the first packet is a packet matching the feature information of the attack packet.
  • the system may further include a second communication apparatus, which controls a management device, and is further configured to send the packet processing policy to the second communication apparatus. Then, the second communication device is further configured to process a second packet based on the packet processing policy, where the second packet is a packet matching the feature information of the attack packet.
  • the first condition may include that the ratio of the bandwidth of the first port occupied by the packets with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold.
  • the first condition may also include that the packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold.
  • the present application further provides a first communication device, including a transceiver unit and a processing unit.
  • the transceiver unit is configured to perform the transceiver operation in the method provided in the first aspect, any possible implementation manner of the first aspect, the second aspect, or any possible implementation manner of the second aspect, or for performing The transceiving operation of the first communication device in the method provided by the third aspect or any possible implementation manner of the third aspect;
  • the processing unit is configured to execute the first aspect, any possible implementation manner of the first aspect, and the second Other operations other than the transceiving operation in the method provided by the aspect or any possible implementation manner of the second aspect, or for performing the first aspect in the method provided by the third aspect or any possible implementation manner of the third aspect.
  • the transceiver unit is configured to send the feature information of the first attack packet to the control management entity; the processing unit is configured to determine A packet with the highest forwarding priority transmitted by a port occupies the bandwidth of the first port and satisfies the first condition; the processing unit is further configured to acquire the information included in the packet with the highest forwarding priority transmitted through the first port The feature information of the first attack packet.
  • an embodiment of the present application further provides a first communication apparatus, including a first communication interface and a processor.
  • the first communication interface is used to perform the sending operation in the method provided by the first aspect, any possible implementation manner of the first aspect, the second aspect, or any possible implementation manner of the second aspect, or, using the sending operation of the first communication device in performing the method provided by the third aspect or any of the possible implementations of the third aspect;
  • the processor is configured to execute the first aspect or any of the possible implementations of the first aspect , other operations other than the receiving and sending operations in the method provided by the second aspect or any possible implementation manner of the second aspect, or, for performing the above-mentioned third aspect or any one of the possible implementations of the third aspect
  • Other operations other than the receiving and sending operations of the first communication apparatus in the method provided by the implementation manner are implemented.
  • the first communication device may further include a second communication interface, and the second communication interface is used to perform the receiving operation of the aforementioned first communication device.
  • an embodiment of the present application further provides a first communication apparatus, where the first communication apparatus includes a memory and a processor.
  • the memory includes computer-readable instructions; a processor in communication with the memory is configured to execute the computer-readable instructions, so that the first communication device is configured to execute the first aspect and any possible implementation of the first aspect manner, the method provided by the second aspect or any possible implementation manner of the second aspect, or the method implemented by the first communication device for performing the method provided by the third aspect or any possible implementation manner of the third aspect method.
  • embodiments of the present application further provide a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium runs on a computer, the computer is configured to execute the above first aspect,
  • the method provided by any possible implementation manner of the first aspect, the second aspect or any possible implementation manner of the second aspect, or, for implementing the third aspect or any possible implementation manner of the third aspect.
  • the method is implemented by the first communication device.
  • the embodiments of the present application also provide a computer program product, including a computer program or computer-readable instructions, when the computer program or the computer-readable instructions are run on a computer, the computer is made to execute the above first aspect,
  • the method provided by any possible implementation manner of the first aspect, the second aspect or any possible implementation manner of the second aspect, or, for implementing the third aspect or any possible implementation manner of the third aspect.
  • the method is implemented by the first communication device.
  • an embodiment of the present application further provides a communication system, where the communication system includes the first communication device provided in the fifth aspect, the sixth aspect or the seventh aspect, and the corresponding method in the third aspect.
  • a control management entity (or a control management entity in the system provided by the fourth aspect).
  • the communication device in the foregoing embodiment may be a network device for executing the foregoing method, or may refer to a single board, a line card, a chip, or the like for executing the foregoing method.
  • FIG. 1 is a schematic structural diagram of a network 10 to which this embodiment of the application is applied;
  • FIG. 2 is a schematic flowchart of performing packet processing in the network 10 according to an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a method 100 for processing a message in an embodiment of the present application
  • FIG. 4 is a schematic flowchart of another packet processing method 200 in an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another method 300 for processing a message in an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another method 400 for processing a message in an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a message processing system 700 according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a first communication apparatus 800 according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a first communication apparatus 900 in an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a first communication apparatus 1000 according to an embodiment of the present application.
  • ordinal numbers such as “1”, “2”, “3”, “first”, “second” and “third” are used to distinguish multiple objects, and are not used to limit the order of multiple objects .
  • a and/or B mentioned in this application should be understood to include the following situations: only A, only B, or both A and B are included.
  • each network device After the source network device of the packet carries the priority in the packet, each network device forwards the packet according to the priority carried in the packet. Among them, the more important packets correspond to the higher priority packets, and the network device preferentially forwards the higher priority packets compared to the lower priority packets.
  • the highest priority is usually set for the packets that affect the normal operation of network equipment, such as protocol packets, detection packets of network equipment, and more important data packets, to ensure that these packets are processed Efficient processing.
  • the priority carried in the packet is used to instruct the network device to perform the forwarding processing on the packet, the priority is referred to as the forwarding priority in the embodiment of this application, and the forwarding priority mentioned in this application refers to The priority of the packet indicated by the priority field carried in the packet.
  • the forwarding priority of the packet can be determined by the IP
  • the value of the type of service (English: Type of Service, referred to as: TOS) field in the packet indicates; for another example, when the packet is a Multiprotocol Label Switching (English: Multiprotocol Label Switching, referred to as: MPLS) packet, the packet
  • the forwarding priority of the message may be indicated by the value of the experimental bits (English: Experimental Bits, EXP for short) field in the MPLS message.
  • attack packets that carry the highest forwarding priority will also be prioritized for processing by the network device, occupying the bandwidth of the network device. Since the total bandwidth of each network device is limited, the received attack packets will quickly cause network device congestion. For example, the total bandwidth of the received packets to be forwarded exceeds the total bandwidth of the network device. In this case, even the to-be-processed packets corresponding to the highest forwarding priority will be discarded by the network device, causing the network device to lose the protocol. Packets, detection packets, or more important data packets cause network devices to be attacked by a large number of attack packets, affecting the normal operation of network devices.
  • a security policy template is manually configured on the network device, and the security policy template is used to identify secure packets.
  • the packets are normally forwarded, and the packets that cannot be identified by the security policy template are regarded as attack packets, and the attack packets are discarded.
  • the security policy template is fixed, on the one hand, if the attack packet is forged into a format that can be recognized by the security policy template, the attack packet cannot be effectively defended; on the other hand, the attack packet cannot be effectively defended.
  • the security policy template needs to be modified so that the security policy module can identify the packets corresponding to the new service, otherwise the packets corresponding to the new service will be discarded, and the implementation process is relatively complex.
  • an embodiment of the present application provides a packet processing method.
  • the communication device determines that the packet with the highest forwarding priority transmitted through a certain port occupies the bandwidth of the port and satisfies the condition, that is, when the highest forwarding priority is configured
  • the attack packets of the highest priority have not yet caused congestion on the network device
  • the characteristic information of the attack packets in the packets with the highest forwarding priority is obtained, and the characteristic information of the attack packets is sent to the control management entity.
  • the control management entity can generate a message processing strategy based on the message characteristics of the received attack message, and send the message processing strategy to the communication device. Packets with matching feature information are processed (eg packet loss and/or rate limiting).
  • the security defense mechanism provided by this application can effectively identify and process attack packets, effectively avoid network equipment congestion caused by attacks based on high-priority packets, and ensure that normal packets with the highest forwarding priority can be effectively forwarded , making it possible for the communication device to provide normal services.
  • the network 10 includes a network device 110 , a network device 120 , . . . , a network device 130 , and a control management entity 200 .
  • Each network device includes a traffic management (English: Traffic Management, TM for short) module.
  • the network device 110 includes a TM module 111
  • the network device 120 includes a TM module 121
  • the network device 130 includes a TM module 131 .
  • the TM module is used to manage the traffic in the network device to which it belongs, for example, to count the bandwidth of the packets of each forwarding priority corresponding to each port on the network device.
  • Each network device at least has the function of message forwarding; the control and management entity 200 can perform data interaction with each network device, so as to realize the management and control of the network device.
  • the number of network devices included in the network 10 is not specifically limited in this embodiment of the present application, for example, there may be more than three network devices, that is, in addition to the above-mentioned network device 110 , network device 120 , and network device 130 , other network devices are also included; or, the number of network devices included in the network 10 may also be less than 3.
  • the bandwidth of port 1 is c
  • the processing process of the attack packet may include: S11, the TM module 121 of the network device 120 periodically acquires (for example, once every 1 second) the packet transmitted through the port 1 bandwidth a; S12, the TM module 121 judges whether (a ⁇ c) ⁇ Th1 is satisfied, if so, execute the following S13, otherwise, return to execute S11; S13, the TM module 121 obtains the highest forwarding priority transmitted through port 1 Bandwidth b of the class packet; S14, the TM module 121 judges whether (b ⁇ c) ⁇ Th2 is satisfied, if so, execute the following S15, otherwise, return to execute S11; The quintuple of the attack packet in the packet with the highest forwarding priority (that is, the source Internet Protocol (English: Internet Protocol, IP) address, destination IP address, source port number, destination port number and protocol version number); S16, the network device 120 sends the quintuple of the attack packet to the control management entity 200; S17, the control management entity 200 generates a packet processing policy
  • the attack packets with the highest forwarding priority can be effectively suppressed before the attack packets with the highest forwarding priority cause serious network congestion, so as to avoid a large number of the highest forwarding priority on the network device.
  • Attack packets occupy the bandwidth resources of normal packets, causing normal packets with the highest forwarding priority to be discarded, which affects the normal operation of the network.
  • normal packets with the highest forwarding priority can be reduced. It can be seen that the method provided by the embodiment of the present application makes it possible for the network device to still operate normally when there are attack packets.
  • the communication device in this embodiment of the present application may refer to any network device capable of implementing a message forwarding function.
  • the communication device may be a switch, a router, etc.; or, the communication device may also be an internal network device.
  • the control management entity may be any device or functional entity capable of controlling the communication device, for example, the control management entity may be a network cloud engine (English: Network Cloud Engine, NCE for short), a server or a router with control functions; Alternatively, the control management entity may also be a functional entity integrated in any communication device, and the functional entity may be embodied in the form of hardware or in the form of software.
  • the TM module in the communication device may refer to a TM chip in the communication device or a functional module capable of realizing the TM function.
  • the port of the communication device in the embodiment of the present application may be a physical port of the communication device or a logical port of the communication device.
  • a method 100 for processing a packet provided in an embodiment of the present application is implemented by a first communication device, where the first communication device may be any network device with a packet forwarding function in the network or a single board in the network device , chip, etc.
  • the network device 110 , the network device 120 , and the network device 130 can all be used as the first communication apparatus to implement the method 100 .
  • FIG. 3 is a schematic flowchart of a packet processing method 100 according to an embodiment of the present application. Referring to FIG. 3, the method 100 may include, for example:
  • the forwarding priority carried in the message is used to indicate the priority of the communication device that forwards the message to forward the message.
  • the higher the forwarding priority the more important the message is, and the more important the communication device is to forward the message.
  • the forwarding priorities of the packets can be divided into priority 0 to priority 7, and the packet with priority 7 is the packet with the highest forwarding priority.
  • the forwarding priority and the highest forwarding priority of a packet may be backward compatible, and the highest forwarding priority referred to in the embodiments of this application may be the highest packet priority in any scenario that occurs later.
  • the forwarding priority of the packet may be carried in the priority field of the packet, and the first communication device may determine the forwarding priority to which the packet belongs by parsing the priority field of the received packet.
  • the first condition is a condition defined by the first communication device for the first port and used to determine whether the attack packet processing needs to be performed on the first port.
  • the first communication device may also set a corresponding condition for each port.
  • the first communication device may set a corresponding third condition for the second port, and the third condition and the first condition may be the same or different.
  • a certain port on the first communication device is used as an example for description.
  • the first condition may be that the ratio of the bandwidth of the first port occupied by the packets with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold.
  • the first threshold is a trigger condition for executing the following S102 and S103 correspondingly set in advance on the first communication device for the first port.
  • the first threshold is 70%
  • the bandwidth of the first port is 20 megabytes per second (English: Gb/s)
  • the first communication device obtains the packet with the highest forwarding priority transmitted through the first port as 15Gb/s
  • the third condition may be that the ratio of the bandwidth of the second port occupied by the packets with the highest forwarding priority transmitted through the second port is greater than or equal to the fifth threshold, where the fifth threshold may be equal to the first threshold, or not equal to the first threshold.
  • the first condition may also be that the packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold.
  • the second threshold is a trigger condition for executing the following S102 and S103 correspondingly set in advance on the first communication device for the first port.
  • the first communication The device determines that the size of the message with the highest forwarding priority on the first port is equal to the second threshold of 15 Gb/s, thereby determining that the message with the highest forwarding priority transmitted through the first port occupies the bandwidth of the first port to satisfy the first port. condition.
  • the third condition may be that the packet with the highest forwarding priority transmitted through the second port is greater than or equal to the sixth threshold, where the sixth threshold may or may not be equal to the second threshold.
  • the first communication device may periodically (for example, 100 milliseconds) obtain the size of the packet with the highest forwarding priority transmitted through the first port, and determine the highest forwarding priority transmitted through the first port Whether the bandwidth occupied by the packets of the first port satisfies the first condition. Similarly, the first communication device may also periodically obtain the size of the packet with the highest forwarding priority transmitted through the second port, and determine that the packet with the highest forwarding priority transmitted through the second port occupies the size of the second port. Whether the bandwidth satisfies the second condition. In this way, the first communication device can timely find out that the packet with the highest forwarding priority transmitted through each port occupies the bandwidth of each port. Therefore, the following processes S102 to S103 are performed on the port, so as to prevent the congestion of the port from affecting the forwarding of normal packets with the highest forwarding priority.
  • the first communication device may also, based on an event trigger, acquire the size of the packet with the highest forwarding priority transmitted through the first port, and determine the packet with the highest forwarding priority transmitted through the first port. Whether the bandwidth occupied by the file on the first port satisfies the first condition.
  • the event triggering the execution of S101 includes but is not limited to: the first communication device determines that all packets transmitted through the first port satisfy the second condition, where the second condition is defined by the first communication device for the first port , a condition for determining whether to measure the packet with the highest forwarding priority on the first port.
  • the first communication device may also set a corresponding event-triggered condition for each port.
  • the first communication device may set a corresponding fourth condition for the second port, and the fourth condition and the second condition may be the same or the same Differently, in the embodiments of the present application, a certain port on the first communication device is used as an example for description.
  • the second condition may be that the proportion of all packets transmitted through the first port occupying the bandwidth of the first port is greater than or equal to the third threshold.
  • the third threshold is a threshold corresponding to the first port pre-set on the first communication device.
  • the third threshold is 80%
  • the bandwidth of the first port is 20 megabytes per second (English: Gb/s)
  • the first communication device obtains all packets transmitted through the first port as 17 Gb/s
  • the fourth condition may be that the proportion of all packets transmitted through the second port occupying the bandwidth of the second port is greater than or equal to the seventh threshold, where the seventh threshold may be equal to the third threshold, or may not be equal to the third threshold. threshold.
  • the second condition may also be that all packets transmitted through the first port are greater than or equal to the fourth threshold.
  • the fourth threshold is a threshold corresponding to the first port set in advance on the first communication device. For example, if the fourth threshold is 18 Gb/s, the bandwidth of the first port is 20 Gb/s, and the first communication device acquires that all packets transmitted through the first port are 18.5 Gb/s, the first communication device determines that the The size of all the packets transmitted on the first port is greater than the fourth threshold of 18 Gb/s, so it is determined that the bandwidth of the first port occupied by all the packets transmitted through the first port satisfies the second condition.
  • the magnitude relationship between the fourth threshold and the second threshold is not specifically limited.
  • the fourth condition may be that all packets transmitted through the second port are greater than or equal to the eighth threshold, where the eighth threshold may or may not be equal to the fourth threshold.
  • the method 100 may further include: S21, the first communication device polls the first port, and obtains information through the first communication device.
  • the polling in S21 may be specifically implemented by the timer of the TM module of the first communication device.
  • the timing of the timer is set to 1 second, and when the timer counts up to 1 second, a pass through the first time is obtained.
  • the first communication device obtains the size of all packets transmitted through the first port, and obtains the size of the packet with the highest forwarding priority transmitted through the first port, both of which may be obtained by the first communication device through its own TM module This is achieved by performing a measurement operation on the first port.
  • the first communication device may monitor and process the packets with the highest forwarding priority in the network scenario transmitted through the first port according to different operating network scenarios.
  • the first communication device may run on the Internet Protocol version 4 (English: Internet Protocol version 4, referred to as: IPv4) network, on the Internet Protocol version 6 (English: Internet Protocol version 6, referred to as: IPv6) network, virtual private Network (English: Virtual Private Network, referred to as: VPN) network, Multiprotocol Label Switching (English: Multiprotocol Label Switching, referred to as: MPLS) network, Virtual Extended Local Area Network (English: Virtual Extensible Local Area Network, referred to as: VXLAN) and other network environments middle.
  • IPv4 Internet Protocol version 4, referred to as: IPv4
  • IPv6 Internet Protocol version 6
  • VPN Virtual Private Network
  • MPLS Multiprotocol Label Switching
  • VXLAN Virtual Extended Local Area Network
  • VXLAN Virtual Extensible Local Area Network
  • the first condition may be that the proportion of the bandwidth of the first port occupied by the IPv6 packet with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold; A condition may also be that the IPv6 packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold.
  • the second condition may be that the proportion of the bandwidth of the first port occupied by all IPv6 packets transmitted through the first port is greater than or equal to the third threshold; or, the second condition may also be that the bandwidth of the first port is transmitted through the first port. All IPv6 packets are greater than or equal to the fourth threshold.
  • the first communication device may process the attack packet by executing the following S102-S103.
  • S102 Acquire feature information of a first attack packet in the packet with the highest forwarding priority transmitted through the first port.
  • the characteristic information of the attack packet refers to characteristic information that can identify the attack packet and the attack flow to which the attack packet belongs.
  • the characteristic information of the attack packet may specifically be all or part of the contents of the five-tuple of the attack packet.
  • the characteristic information of the attack packet may include one of the following information or Multiple: source IP address, destination IP address, source port number, destination port number or transport layer protocol number; for another example, if the attack packet is an MPLS packet, the characteristic information of the attack packet may include one of the following information or multiple: MPLS label, source media access control (English: Media Access Control, MAC for short) address of the attack packet, destination MAC address, source IP address, and destination IP address.
  • the characteristic information of the attack packet may be a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol number.
  • the first attack packet is determined according to the source IP address, destination IP address, source port number, destination port number and transport layer protocol number of each packet, so as to obtain the source IP address,
  • the destination IP address, source port number, destination port number, and transport layer protocol number are used as feature information of the first attack packet in the packet with the highest forwarding priority obtained in S102.
  • the characteristic information of the attack packet may be the source port number and the destination port number, and the first communication device selects the source port number of each packet from the packets with the highest forwarding priority transmitted through the first port. and the destination port number to determine the first attack packet, so as to obtain the source port number and destination port number of the first attack packet, as the first attack packet in the packet with the highest forwarding priority obtained in S102.
  • characteristic information For example, a packet whose source port number and destination port number are constantly changing may be determined by the first communication device as the first attack packet.
  • the characteristic information of the attack packet may be the source MAC address and the destination MAC address, and the first communication device selects the source MAC address of each packet from the packets with the highest forwarding priority transmitted through the first port. and the destination MAC address to determine the first attack packet, so as to obtain the source MAC address and destination MAC address of the first attack packet, as the first attack packet in the packet with the highest forwarding priority obtained in S102.
  • characteristic information For example, a packet in which the source MAC address and the destination MAC address change may be determined by the first communication device as the first attack packet.
  • the TM module of the first communication device may determine the first attack packet from the packets with the highest forwarding priority transmitted through the first port, and obtain feature information of the first attack packet, which is used for subsequent The processing of the first attack packet provides a basis, so that the first attack packet can be sensed and suppressed, and conditions are provided for the normal operation of the first communication device.
  • S103 Send the feature information of the first attack packet to the control management entity.
  • S103 may be, for example, that the first communication device sends an indication message to the control management entity, where the indication message carries the feature information of the first attack message acquired in S102.
  • the indication message can be any one of the following messages: Border Gateway Protocol (English: Border Gateway Protocol, referred to as: BGP) message, Path Computation Element Communication Protocol (English: Path Computation Element Communication Protocol, referred to as: BGP) message : PCEP) message, telemetry (English: Telemetry) message or Network Configuration Protocol (English: Network Configuration Protocol, referred to as: NETCONF) message.
  • Border Gateway Protocol English: Border Gateway Protocol, referred to as: BGP
  • Path Computation Element Communication Protocol English: Path Computation Element Communication Protocol, referred to as: BGP
  • PCEP PCEP
  • telemetry English: Telemetry
  • Network Configuration Protocol English: Network Configuration Protocol, referred to as: NETCONF
  • the characteristic information of the first attack packet may be carried through an extended type length value (English: Type Length Value, TLV for short) field in any of the foregoing types of packets.
  • the feature information of the first attack packet may also be carried through other available fields such as a reserved (English:
  • control management entity and the first communication device belong to two different devices respectively, taking the indication message as a Telemetry message as an example, before executing S103, it is also necessary to implement a network between the first communication device and the control management entity through a routing protocol. Layer connectivity, and configure and enable the Telemetry function on the first communication device and the control management entity, so that after S102, the first communication device can carry the feature information of the first attack packet in the Telemetry packet and send it to Control management entity.
  • the first communication device may periodically send the attack detection result to the control management entity, and the control management entity may take the initiative to determine that the received attack detection result includes the feature information of the first attack packet. generates a packet processing policy for the first attack packet.
  • the first communication device sends the feature information of the first attack packet to the control management entity only when the first attack packet is detected.
  • the control management entity may also actively generate a report against the first attack packet message processing policy.
  • the first communication device may also send indication information to the control management entity for instructing the control management entity to generate packet processing policy, where the packet processing policy is used to process packets matching the feature information of the first attack packet.
  • the first communication device may carry the indication information and the characteristic information of the first attack packet in an indication packet and send it to the control management entity, or the first communication device may send the indication information and the first attack packet to the control management entity.
  • the feature information of the message is carried in different indication messages and sent to the control management entity respectively.
  • the indication message for carrying the indication information may be any one of the following messages: a BGP message, a PCEP message, a Telemetry message or a NETCONF message.
  • the control management entity and the first communication device belong to one network device respectively, taking the indication message as an example of a Telemetry message, before executing S103, the first communication device and the control management entity need to be configured and enabled with the Telemetry function.
  • the first communication device may send the feature information of the first attack packet to the control management entity in the form of Telemetry data.
  • the first communication device can obtain the highest forwarding priority when it is determined that the bandwidth of the first port occupied by the packet with the highest forwarding priority transmitted through the first port satisfies the first condition
  • the feature information of the first attack packet in the packets of the highest level is sent to the control management entity.
  • the control management entity can generate a message processing strategy based on the message characteristics of the received first attack message, and send the message processing strategy to the communication device, so that the communication device that receives the message processing strategy
  • the packet that matches the characteristic information of the first attack packet can be processed based on the packet processing policy (for example, packet loss and/or speed limit), so that the first attack packet does not cause the port of the first communication device
  • the security defense mechanism can effectively identify and process attack packets to ensure that the attack packets will not cause the communication device to be congested, thereby ensuring that the security packets with the highest forwarding priority can be transmitted. Effective forwarding makes it possible for the first communication device to provide normal services.
  • the above takes the processing of the attack packet in the packet with the highest forwarding priority transmitted on the first port as an example, and describes the implementation and effect of the packet processing method provided in the embodiment of the present application. Similarly, this The method can be applied to other ports. For example, when it is determined that the bandwidth of the packet with the highest forwarding priority transmitted through the second port occupies the bandwidth of the second port and satisfies the third condition, the highest forwarding priority transmitted through the second port is obtained.
  • the characteristic information of the second attack packet in the packets of the advanced level is sent to the control management entity. Among them, the "first" and "second" in the first attack packet and the second attack packet are only to distinguish the attack packets with the highest forwarding priority transmitted on different ports, and do not refer to a certain packet. .
  • the first communication apparatus may analyze the packet transmitted through the first port when determining that the bandwidth of the packet with the highest forwarding priority transmitted through the first port occupies the bandwidth of the first port and satisfies the first condition. For the packets with the highest forwarding priority, it is determined that the packets with the highest forwarding priority transmitted through the first port include attack packets.
  • the first communication device may also send an alarm signal to the network management device to notify the network management that there is an attack packet on the first communication device, so that the network management can respond to the first communication device and the communication device that may transmit attack packets. Manage and control to ensure network security.
  • the embodiment of the present application also provides another method 200 for processing attack packets.
  • the method may further include:
  • control and management entity generates a packet processing policy based on the characteristic information of the first attack packet, where the packet processing policy is used to process the packet matching the characteristic information of the first attack packet.
  • the packet processing strategy may include, for example, feature information and a processing strategy of the first attack packet.
  • the characteristic information of the first attack packet is used to describe the characteristic information of the to-be-processed packet, so that the second communication device executing the packet processing policy can determine the attack packet to be processed according to the processing policy.
  • the processing strategy refers to the specific processing operation performed on the to-be-processed packet. For example, it can be a packet loss operation, that is, packet loss processing is performed on the packet matching the characteristic information of the first attack packet; for example, it can be a rate-limiting operation. , that is, performing rate-limiting processing on the packets matching the characteristic information of the first attack packet. Whether it is packet loss or rate limiting, it can effectively reduce the preemption of network resources by attack packets, especially the probability of insufficient bandwidth resources for normal packets with the highest forwarding priority.
  • any current algorithm for packet loss and/or rate limiting processing may be adopted, which is not specifically limited in this embodiment of the present application.
  • control management entity sends a message processing policy to the second communication apparatus.
  • the second communication apparatus and the first communication apparatus may belong to the same network device, or may belong to two different network devices.
  • control management entity may carry the message processing policy in a BGP message, a PCEP message, a Telemetry message or a NETCONF message and send it to the second communication device.
  • control and management entity may also send indication information to the second communication device for instructing the second communication device to process the packet matching the feature information of the first attack packet according to the packet processing policy.
  • the second communication apparatus processes the packet matching the feature information of the first attack packet based on the packet processing policy.
  • S106 may, for example, include: the second communication device obtains the first packet; then, judging whether the packet characteristics of the first packet and the packet characteristics of the first attack packet in the packet processing policy match, if If they match, the first packet is processed based on the processing policy in the packet processing policy.
  • the processing of the first packet based on the packet processing policy may, for example, include: performing packet loss processing on the first packet based on the processing policy in the packet processing policy, or processing based on the processing policy in the packet processing policy The policy performs rate-limiting processing on the first packet.
  • S106 may include, for example: the second communication device determines that the packet transmitted through the first port matches the packet characteristic of the first attack packet in the packet processing policy , if it matches, then, based on the processing policy in the packet processing policy, packet loss or speed limit processing is performed on the packet transmitted through the first port, so that the first communication device can be prevented from being caused by the first attack packet.
  • the normal packet with the highest forwarding priority is lost, ensuring the effective forwarding of the normal packet by the first communication device
  • the second communication device may be any network device controlled by the control management entity, so that even if the first attack packet attacks a network device in the network Other communication devices can also prevent the normal packets with the highest forwarding priority from being lost by other communication devices due to the first attack packet, and ensure effective forwarding of normal packets by other communication devices.
  • the second communication device may belong to the previous hop node of the network device where the first communication device is located on the transmission path of the attack packet.
  • the control and management entity sends the packet processing policy to the second communication device.
  • the first attack packet can be suppressed from the source as much as possible, so that the first attack packet no longer occupies the bandwidth resources of the first communication device, and the effect of the first attack packet on the first communication device is eliminated. influence.
  • the control management entity may also send the packet processing policy to the first communication device; then, the first communication device may also use the The packet processing policy is to process packets received from the first port that match the feature information of the attack packets.
  • the control management entity may also send the packet processing policy to all communication devices in the network connected to the control management entity, so that each communication device receives
  • the packet can be determined as an attack packet, and based on the processing policy in the packet processing policy Packet loss or rate limit processing. In this way, the transmission of the first attack packet between multiple communication devices in the network to attack the multiple communication devices can be effectively avoided, which greatly improves network security.
  • the control management entity generates a packet processing policy based on the feature information of the first attack packet reported by the first communication device and sends it to the second communication device, and the second communication device can
  • the packet that matches the feature information of the first attack packet is processed, so that the security defense mechanism is effective under the condition that the attack packet does not cause port congestion of the first communication device and threaten the security of the first communication device
  • the attack packets are identified and processed to ensure that the attack packets will not cause congestion of the communication device, thereby ensuring that the security packets with the highest forwarding priority can be effectively forwarded, making it possible for the first communication device to provide normal services.
  • the method may further include: the control management entity generates a packet processing policy based on the feature information of the second attack packet, and the packet The message processing policy is used to process the message matching the feature information of the second attack message; the control management entity sends the message processing policy to the third communication device; the third communication device, based on the message processing policy, The packets matching the characteristic information of the attack packets are processed.
  • the third communication apparatus and the first communication apparatus may belong to the same network device, or may belong to two different network devices.
  • FIG. 5 shows a schematic flowchart of a packet processing method 300 in an embodiment of the present application.
  • the method 300 takes the first communication device as the execution subject, and the method 300 may include, for example:
  • the first communication device determines that a packet with the highest forwarding priority transmitted by the first port occupies the bandwidth of the first port and satisfies the first condition
  • S303 Determine that the packet transmitted by the first port includes the attack packet with the highest forwarding priority.
  • the first communication device may also send an alarm signal to the network management, where the alarm signal is used for It is indicated that there are attack packets in the first communication device, so that the network management can perform security defense on the network to prevent the attack packets from causing greater threats to the network.
  • the alarm signal may also carry characteristic information of the attack.
  • the first communication apparatus may further acquire feature information of the attack packet after determining that the packet transmitted by the first port includes the attack packet with the highest forwarding priority.
  • the first communication device may also send the characteristic information of the attack packet to the control management entity, and obtain a packet processing policy generated by the control management entity, where the packet processing policy is used to compare the characteristics of the attack packet with the attack packet.
  • the first communication device can perform packet loss and/or speed limit processing on the first packet based on the packet processing policy, and the first packet is an attack packet.
  • the characteristic information matches the packet.
  • the first condition may include that the ratio of the bandwidth of the first port occupied by the packets with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold.
  • the first condition may also include that the packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold.
  • FIG. 6 shows a schematic flowchart of a packet processing method 400 in an embodiment of the present application.
  • the method 400 is described with the interaction between the first communication device and the control management entity.
  • the method 400 may include:
  • the first communication device sends the characteristic information of the attack packet to the control management entity
  • the control and management entity generates a packet processing policy based on the characteristic information of the attack packet, where the packet processing policy is used to process the packet matching the characteristic information of the attack packet.
  • the method 400 may further include: the first communication apparatus obtains a packet processing policy generated by the control and management device, so that the first communication apparatus processes the first packet based on the packet processing policy, and the first packet It is a packet matching the feature information of the attack packet.
  • the method 400 may further include: controlling the management device to send a packet processing policy to the second communication apparatus, so that the second communication apparatus processes the second packet based on the packet processing policy, and the second packet It is a packet matching the feature information of the attack packet.
  • the first condition may include that the ratio of the bandwidth of the first port occupied by the packets with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold.
  • the first condition may also include that the packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold.
  • an embodiment of the present application further provides a system 700 for processing a message, as shown in FIG. 7 .
  • the system 700 may include at least a first communication device 701 and a control management entity 702 . in,
  • the first communication device 701 is configured to obtain and send the highest forwarding priority to the control management entity 702 when determining that the bandwidth of the first port occupied by the packet with the highest forwarding priority transmitted through the first port satisfies a first condition The characteristic information of the attack packet in the packet;
  • the control and management entity 702 is configured to generate a packet processing policy according to the packet characteristic information of the attack packet, where the packet processing policy is used to process the packet matching the characteristic information of the attack packet.
  • control and management device 702 is further configured to send the packet processing policy to the first communication apparatus. Then, the first communication device 701 is further configured to process a first packet based on the packet processing policy, where the first packet is a packet matching the feature information of the attack packet.
  • system 700 may further include a second communication apparatus, a control and management device 702, which is further configured to send the packet processing policy to the second communication apparatus. Then, the second communication device is further configured to process a second packet based on the packet processing policy, where the second packet is a packet matching the feature information of the attack packet.
  • the first condition may include that the ratio of the bandwidth of the first port occupied by the packets with the highest forwarding priority transmitted through the first port is greater than or equal to the first threshold.
  • the first condition may also include that the packet with the highest forwarding priority transmitted through the first port is greater than or equal to the second threshold.
  • an embodiment of the present application further provides a first communication apparatus 800, as shown in FIG. 8 .
  • the first communication apparatus 800 includes a processing unit 801 and a sending unit 802 .
  • the processing unit 801 is configured to execute the processing operation performed by the first communication device in any of the embodiments shown in FIG. 3 to FIG. 6 ;
  • the sending unit 802 is configured to execute any of the embodiments shown in FIG. 3 to FIG. 6 above.
  • the processing unit 801 may perform the operations in the embodiment in FIG.
  • the sending unit 802 may perform the operation in the embodiment in FIG. 3: send the feature information of the first attack packet to the control management entity.
  • an embodiment of the present application further provides a first communication apparatus 900, as shown in FIG. 9 .
  • the first communication device 900 includes a first communication interface 901 , a second communication interface 902 and a processor 903 .
  • the first communication interface 901 is used to perform the aforementioned receiving operation performed by the first communication device in any of the embodiments shown in FIG. 3 to FIG. 6 ;
  • the second communication interface 902 is used to perform the aforementioned FIG. 3 to FIG. 6 .
  • the processor 903 is configured to perform the above-mentioned any of the embodiments shown in FIG. 3 to FIG. 6 except the receiving operation and the sending operation performed by the first communication apparatus. other operations.
  • the processor 903 may perform the operations in the embodiment of FIG. 3 to determine that the bandwidth of the packet with the highest forwarding priority transmitted through the first port occupies the bandwidth of the first port and satisfies the first condition; The feature information of the first attack packet included in the packet with the highest forwarding priority.
  • an embodiment of the present application further provides a first communication apparatus 1000, as shown in FIG. 10 .
  • the first communication device 1000 includes a memory 1001 and a processor 1002 in communication with the memory 1001 .
  • the memory 1001 includes computer-readable instructions; the processor 1002 is configured to execute the computer-readable instructions, so that the first communication device 1000 executes the execution of the first communication device in any of the embodiments shown in FIG. 3 to FIG. 6 . Methods.
  • the processor may be a central processing unit (English: central processing unit, abbreviation: CPU), a network processor (English: network processor, abbreviation: NP) or a combination of CPU and NP.
  • the processor may also be an application-specific integrated circuit (English: application-specific integrated circuit, abbreviation: ASIC), a programmable logic device (English: programmable logic device, abbreviation: PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), a field programmable logic gate array (English: field-programmable gate array, abbreviation: FPGA), a general-purpose array logic (English: generic array logic, abbreviation: GAL) or any combination thereof.
  • a processor may refer to a single processor or may include multiple processors.
  • the memory may include volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory), For example, read-only memory (English: read-only memory, abbreviation: ROM), flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviation: HDD) or solid-state hard disk (English: solid-state drive, Abbreviation: SSD); the memory may also comprise a combination of the above-mentioned kinds of memory.
  • the memory may refer to one memory, or may include multiple memories.
  • computer-readable instructions are stored in the memory, and the computer-readable instructions include a plurality of software modules, such as a sending module, a processing module and a receiving module. After executing each software module, the processor can perform corresponding operations according to the instructions of each software module. In this embodiment, the operation performed by a software module actually refers to the operation performed by the processor according to the instruction of the software module. After the processor executes the computer-readable instructions in the memory, it can execute all operations that can be performed by the first communication device in the packet processing method according to the instructions of the computer-readable instructions.
  • the second communication interface 902 of the first communication device 900 can be specifically used as the sending unit 802 in the first communication device 800 to realize the communication between the first communication device and the control management entity.
  • Data communication; the first communication interface 901 of the first communication apparatus 900 may be specifically used as a receiving unit in the first communication apparatus 800, for example, may be used to receive a message sent by an upstream network device.
  • an embodiment of the present application further provides a communication system
  • the first communication apparatus in the communication system may be, for example, the above-mentioned first communication apparatus 800 , 900 or 1000 .
  • the communication system is the processing system 700 of the above-mentioned message
  • the first communication device is the first communication device 701
  • the control management entity is the control management entity 702 .
  • an embodiment of the present application also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium runs on a computer, the computer is made to execute the implementation shown in FIG. 3 to FIG. 6 above.
  • the processing method of the message in the example is made to execute the implementation shown in FIG. 3 to FIG. 6 above.
  • the embodiments of the present application also provide a computer program product, including a computer program or computer-readable instructions, when the computer program or the computer-readable instructions are run on a computer, the computer is made to execute the above-mentioned FIG. 3 to FIG. 6 .
  • the method for processing the packet in the example embodiment is described in detail below.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Sont divulgués dans des modes de réalisation de la présente demande un procédé, un système et un dispositif de traitement de paquets qui consistent : à obtenir, lorsqu'un premier dispositif de communication détermine que la bande passante d'un premier port, occupé par des paquets ayant la priorité de transfert la plus élevée et transmis par le premier port, satisfait une première condition, des informations de caractéristiques d'un premier paquet d'attaque compris dans les paquets ayant la priorité de transfert la plus élevée et transmis par le premier port, et à envoyer les informations de caractéristiques du premier paquet d'attaque à une entité de gestion de commande, de sorte que l'entité de gestion de commande génère une stratégie de traitement de paquets sur la base des caractéristiques du paquet d'attaque reçu, et ainsi le dispositif de communication peut effectuer un traitement tel qu'une perte de paquets et/ou une limitation de débit sur le paquet correspondant aux informations de caractéristiques du paquet d'attaque sur la base de la stratégie de traitement de paquets, empêchant ainsi l'encombrement du dispositif de réseau provoquée par des attaques fondées sur des paquets de haute priorité et garantissant que les paquets normaux possédant la plus haute priorité de transfert peuvent être efficacement transférés, ce qui permet ainsi au dispositif de communication de fournir des services normaux.
PCT/CN2021/116602 2020-09-15 2021-09-06 Procédé, système et dispositif de traitement de paquets WO2022057647A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010966693.5A CN114268592A (zh) 2020-09-15 2020-09-15 一种报文的处理方法、系统及设备
CN202010966693.5 2020-09-15

Publications (1)

Publication Number Publication Date
WO2022057647A1 true WO2022057647A1 (fr) 2022-03-24

Family

ID=80777560

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/116602 WO2022057647A1 (fr) 2020-09-15 2021-09-06 Procédé, système et dispositif de traitement de paquets

Country Status (2)

Country Link
CN (1) CN114268592A (fr)
WO (1) WO2022057647A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114793199A (zh) * 2022-03-30 2022-07-26 新华三信息安全技术有限公司 一种报文处理方法、装置及网络设备
CN117978758A (zh) * 2024-03-29 2024-05-03 珠海星云智联科技有限公司 用于数据处理单元的适配方法、计算机设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1725705A (zh) * 2005-05-09 2006-01-25 杭州华为三康技术有限公司 流量攻击网络设备的报文特征的检测方法
CN104702560A (zh) * 2013-12-04 2015-06-10 华为技术有限公司 一种防止报文攻击方法及装置
CN105991637A (zh) * 2015-06-15 2016-10-05 杭州迪普科技有限公司 网络攻击的防护方法和装置
US20190230101A1 (en) * 2018-01-19 2019-07-25 Fujitsu Limited Device and method for detecting attack in network
CN111092840A (zh) * 2018-10-23 2020-05-01 中兴通讯股份有限公司 处理策略的生成方法、系统及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1725705A (zh) * 2005-05-09 2006-01-25 杭州华为三康技术有限公司 流量攻击网络设备的报文特征的检测方法
CN104702560A (zh) * 2013-12-04 2015-06-10 华为技术有限公司 一种防止报文攻击方法及装置
CN105991637A (zh) * 2015-06-15 2016-10-05 杭州迪普科技有限公司 网络攻击的防护方法和装置
US20190230101A1 (en) * 2018-01-19 2019-07-25 Fujitsu Limited Device and method for detecting attack in network
CN111092840A (zh) * 2018-10-23 2020-05-01 中兴通讯股份有限公司 处理策略的生成方法、系统及存储介质

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114793199A (zh) * 2022-03-30 2022-07-26 新华三信息安全技术有限公司 一种报文处理方法、装置及网络设备
CN114793199B (zh) * 2022-03-30 2024-02-09 新华三信息安全技术有限公司 一种报文处理方法、装置及网络设备
CN117978758A (zh) * 2024-03-29 2024-05-03 珠海星云智联科技有限公司 用于数据处理单元的适配方法、计算机设备及介质
CN117978758B (zh) * 2024-03-29 2024-06-07 珠海星云智联科技有限公司 用于数据处理单元的适配方法、计算机设备及介质

Also Published As

Publication number Publication date
CN114268592A (zh) 2022-04-01

Similar Documents

Publication Publication Date Title
US9819590B2 (en) Method and apparatus for notifying network abnormality
US10778809B2 (en) Per-input port, per-control plane network data traffic class control plane policing
US10404555B2 (en) System and method for dynamic management of network device data
EP3253025B1 (fr) Système, dispositif et procédé de prévention contre les attaques ddos basées sur sdn
US7921460B1 (en) Rate limiting data traffic in a network
US8443444B2 (en) Mitigating low-rate denial-of-service attacks in packet-switched networks
WO2022057647A1 (fr) Procédé, système et dispositif de traitement de paquets
US20050102414A1 (en) Systems and methods to support quality of service in communications networks
US20070014276A1 (en) Route processor adjusting of line card admission control parameters for packets destined for the route processor
WO2009089701A1 (fr) Procédé et système d'inspection de paquet
US7818795B1 (en) Per-port protection against denial-of-service and distributed denial-of-service attacks
TW201032542A (en) Network intrusion protection
TWI713501B (zh) 識別網路環路的方法、裝置、流量清洗設備及系統
US8505091B2 (en) Method of protecting against denial-of-service attacks
CA2887428C (fr) Un systeme informatise et une methode permettant de securiser la selection d'un parcours au moyen d'une cote de reseau
WO2015070608A1 (fr) Procédé et appareil de surveillance de performances d'opération, administration et maintenance (oam)
WO2020083272A1 (fr) Procédé et système de génération de stratégie de traitement, et support d'informations
KR20120060655A (ko) 서버 공격을 탐지할 수 있는 라우팅 장치와 라우팅 방법 및 이를 이용한 네트워크
US11223568B2 (en) Packet processing method and apparatus
US10944695B2 (en) Uplink port oversubscription determination
CN114157609B (zh) Pfc死锁检测方法及装置
Isyaku et al. Software defined networking failure recovery with flow table aware and flows classification
WO2019096104A1 (fr) Prévention contre les attaques
WO2021083324A1 (fr) Procédé de rapport d'informations, et procédé et dispositif de traitement de données
Mohammadi et al. Practical extensions to countermeasure dos attacks in software defined networking

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21868474

Country of ref document: EP

Kind code of ref document: A1