WO2022105730A1 - 一种保障sctp协议多归属报文同源同宿的方法和装置 - Google Patents

一种保障sctp协议多归属报文同源同宿的方法和装置 Download PDF

Info

Publication number
WO2022105730A1
WO2022105730A1 PCT/CN2021/130836 CN2021130836W WO2022105730A1 WO 2022105730 A1 WO2022105730 A1 WO 2022105730A1 CN 2021130836 W CN2021130836 W CN 2021130836W WO 2022105730 A1 WO2022105730 A1 WO 2022105730A1
Authority
WO
WIPO (PCT)
Prior art keywords
sctp
session
port
message
entry
Prior art date
Application number
PCT/CN2021/130836
Other languages
English (en)
French (fr)
Inventor
胡乐勇
曾伟
Original Assignee
武汉绿色网络信息服务有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 武汉绿色网络信息服务有限责任公司 filed Critical 武汉绿色网络信息服务有限责任公司
Publication of WO2022105730A1 publication Critical patent/WO2022105730A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/06—Notations for structuring of protocol data, e.g. abstract syntax notation one [ASN.1]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/26—Special purpose or proprietary protocols or architectures

Definitions

  • the present invention relates to the technical field of homology and homeostasis, in particular to a method and a device for guaranteeing the same source and homology of SCTP protocol multi-homed messages.
  • Each communication connection of the Stream Control Transmission Protocol SCTP (full name: Stream Control Transmission Protocol) is called an association.
  • the two parties communicating through the SCTP protocol are called endpoints.
  • SCTP coupling can have multi-homing characteristics.
  • Figure 1 There are 4 communication paths in SCTP coupling between Client and Server: Client IP1 to Server IP1, Client IP1 to Sever IP2, Client IP2 to Server IP1, Client IP2 to Server IP2.
  • Client IP1 to Server IP1 Client IP1 to Sever IP2
  • Client IP2 to Server IP1 Client IP2 to Server IP2.
  • the network splitter is the front-end processing unit in the deep packet inspection (Deep Packet Inspection, abbreviated as: DPI) system. Its function is to aggregate the upstream and downstream traffic of multiple lines, and then according to certain rules Perform operations such as filtering, load balancing, and replication, and output specific traffic to different back-end analysis systems.
  • DPI Deep Packet Inspection
  • the network splitter in the DPI system needs to ensure that the traffic of the same communication session is sent to the same server, that is, the same source and same sink function of the communication session.
  • the general TCP or UDP data can use the IP quintuple (source IP, destination IP, source port, destination port, and transport layer protocol) as the basis for the homologous algorithm to ensure that the same communication session data can be Source and sink to the same server.
  • IP quintuple source IP, destination IP, source port, destination port, and transport layer protocol
  • the same application may communicate data through different IP pairs.
  • the general algorithm to ensure the same source and same location of application data according to IP quintuple cannot satisfy the same source and same location of SCTP data. demand.
  • the technical problem to be solved by the present invention is that in the DPI system, the general TCP or UDP data can be used as the basis for the homologous and homologous algorithm through the IP quintuple (source IP, destination IP, source port, destination port, and transport layer protocol). , to ensure that the same communication session data can go to the same server from the same source and the same sink.
  • the same application may communicate data through different IP pairs.
  • the general algorithm to ensure the same source and same location of application data according to IP quintuple cannot satisfy the same source and same location of SCTP data. demand.
  • the present invention adopts following technical scheme:
  • the first aspect is a method for ensuring the same source and same destination for SCTP protocol multi-homing packets.
  • the type of chunk information in the payload is analyzed, and the method includes:
  • the SCTP session is in the session establishment phase, and session entry establishment in the session establishment phase is performed;
  • the establishment of the session entry in the session establishment stage includes performing hash calculation according to the quadruple information of the SCTP message of the INIT type, determining the output interface according to the calculated hash value, and then determining the output to the corresponding target DPI server;
  • a pair of uplink and downlink session entries of the SCTP session are established at the corresponding target DPI server, and the Initiate tag in the packet chunk information is recorded in the session entry of the session as the verification tag in the downlink direction of the uplink and downlink session entry;
  • the verification tag record is empty;
  • the S-port, D-port and verification tag in the SCTP message of the INIT ACK type are used to match the historically established session entries;
  • Each subsequent SCTP message received uses the S-port, D-port and verification tag to match the same source and the same source.
  • the match is unsuccessful, it indicates that the historical INIT type SCTP packet of the session where the INIT ACK type SCTP packet is located has not been correctly captured by the network splitter, and the session table is established according to the INIT ACK type SCTP packet. item.
  • the establishment of the session entry according to the SCTP message of the INIT ACK type specifically includes:
  • the SIP of the SCTP message of the INIT ACK type is used as the SIP in the uplink direction of the SCTP session and the DIP in the downlink direction;
  • the DIP of the SCTP message of the INIT ACK type is used as the DIP in the uplink direction of the session and the SIP in the downlink direction;
  • the S-port of the SCTP message of the INIT ACK type is used as the S-port in the downstream direction of the SCTP session and the D-port in the upstream direction;
  • the D-port of the SCTP message of the INIT ACK type is used as the downstream direction of the session.
  • the D-port and the S-port of the upstream direction; the verification tag of the SCTP message of the INIT ACK type is the verification tag of the downstream direction in the SCTP session table entry; in the SCTP message chunk information of the INIT ACK type
  • the initial tag is used as the verification tag in the upstream direction.
  • the chunk type of the SCTP message is not INIT or INIT ACK
  • the S-port, D-port and verification tag of the SCTP message fail to match with the session entries historically established in the network splitter
  • the session entry of the SCTP session needs to be established according to the current SCTP message, and the method includes:
  • the SIP of the SCTP message is used as the SIP in this direction and the DIP in the other direction of the SCTP session entry; the DIP in the SCTP message is used as the DIP in the SCTP session entry in the current direction and the SIP in the other direction;
  • the S-port of the SCTP message is used as the S-port of the SCTP session entry in the current direction and the D-port of the other direction; the D-port of the SCTP message is used as the SCTP session entry in the current direction.
  • the verification tag of the SCTP message is used as the verification tag in this direction in the SCTP session entry; the verification tag in the other direction of the SCTP session entry is marked as empty;
  • the verification tag in the other direction of the SCTP session when the SIP, DIP, S-port, and D-port in the other direction of the SCTP session entry are matched to the SCTP packet, the verification recorded in the corresponding SCTP packet is verified.
  • the tag is updated to the verification tag in the SCTP session entry whose history tag is empty.
  • the method further includes:
  • Each aggregation and distribution device will distribute the corresponding SCTP session entry with incomplete information to each aggregation and distribution device if the verification tag in the upstream direction and the verification tag in the downstream direction contained in its own SCTP session entry are incomplete, so that When each aggregation and distribution device obtains the SCTP message, it can quickly complete the appearance update according to the to-be-completed SCTP session table entry from each aggregation and distribution device in the network;
  • each aggregation and distribution device maintains the SCTP session representation established by itself, and distributes the hash value corresponding to the quadruple in the corresponding representation, and the hash value corresponding to the S-port, D-port and verification tag to other aggregation and distribution devices.
  • the filling content of the corresponding uplink and downlink session entries further includes:
  • the quadruple is specifically: source IP address SIP, destination IP address DIP, source port number S-port and destination port number D-port.
  • the S-port, D-port and verification tag in the SCTP message of the INIT ACK type are used to match the session entries established in history, specifically including:
  • the present invention also provides a device for ensuring the same source and same sink for SCTP protocol multi-homing packets, which is used to realize the method for ensuring the same source and same sinking of SCTP protocol multi-homing packets, the device includes: :
  • the at least one processor and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the processor for The method for ensuring the same source and same destination for multi-homing packets of the SCTP protocol described in the first aspect is executed.
  • the present invention also provides a non-volatile computer storage medium storing computer-executable instructions, the computer-executable instructions being executed by one or more processors for completing the first The method for ensuring the same source and same destination for multi-homing packets of the SCTP protocol described in the aspect.
  • the invention solves the problem of the same source and same destination in the DPI system when the same coupling data in the SCTP message is transmitted through different IP addresses.
  • a large number of SCTP data packets do not need to identify and calculate the IP address. It only needs to parse and hash the source port, destination port and verification tag to determine the output interface, which reduces the consumption of computing resources.
  • FIG. 1 is a schematic structural diagram of a SCTP communication scenario in the prior art provided by an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a process flow of SCTP protocol processing of a flow distribution and convergence device in the prior art provided by an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of three stages of session establishment, session communication, and session completion in the prior art provided by an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of a method for ensuring the same source and same destination for SCTP protocol multi-homing messages provided by an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of another method for ensuring the same source and same destination for SCTP protocol multi-homing messages provided by an embodiment of the present invention
  • FIG. 6 is a schematic structural diagram of another apparatus for ensuring the same source and same destination for SCTP protocol multi-homing packets according to an embodiment of the present invention.
  • the existing technical solutions lack the solution to the multi-homing problem in the processing of SCTP protocol packets.
  • the SCTP protocol processing flow of the existing distribution and aggregation equipment is shown in Figure 2.
  • the client and the server are bidirectional endpoints of SCTP communication. All communication paths between endpoints are called paths, and the paths between ClientIP1 and ServerIP1 that initially establish the SCTP connection are called primary paths.
  • the SCTP data on the primary path will be mirrored and forwarded to DPI server 1 by the aggregation and distribution device, and the data communicated on other paths will be mirrored and forwarded to DPI server 2.
  • a technical solution is required to enable data communicated between other paths to be forwarded to the DPI server 1 .
  • the embodiments of the present invention are proposed in response to the above technical solution requirements.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • the network splitter needs to execute different processing schemes according to different stages of the SCTP protocol session.
  • the complete session process of SCTP mainly includes three stages: session establishment, session communication, and session completion.
  • the process is shown in Figure 3.
  • the SCTP session information is processed according to the INIT and INIT ACK messages in the SCTP protocol (which will also be described as an SCTP message of the INIT type and an SCTP message of the INIT ACK type in this embodiment of the present invention). and save it to provide a reference for the forwarding path provided by subsequent SCTP packets.
  • the embodiment of the present invention proposes a method for ensuring the same source and same destination for SCTP protocol multi-homed packets.
  • the type of chunk information in the payload is analyzed, as shown in FIG. 4 , the method includes:
  • step 201 when the chunk type is INIT, the SCTP session is in the session establishment phase, and session entry establishment in the session establishment phase is performed.
  • the establishment of the session entry in the session establishment stage includes performing hash calculation according to the quadruple information of the SCTP message of the INIT type, determining the output interface according to the calculated hash value, and then determining the output to the corresponding target DPI server.
  • the four-tuple is specifically: source IP address SIP, destination IP address DIP, source port number S-port and destination port number D-port.
  • step 203 a pair of uplink and downlink session entries of the SCTP session are established at the corresponding target DPI server, and the Initiate tag in the message chunk information is recorded in the session table of the session as the verification tag of the downlink direction of the uplink and downlink session entry. item; the verification tag record in the upstream direction is empty.
  • the verification tag in the upstream direction cannot be obtained, so it is set to be empty; the verification tags of the upstream and downstream directions are different.
  • the INIT packet is an upstream packet, and the initial tag contained in the chunk information is the verification in the downstream direction. tag.
  • the filling content of the corresponding uplink and downlink session entries further includes: taking the SIP of the SCTP message of the INIT type as the SIP in the uplink direction of the session and the SIP in the downlink direction of the session.
  • DIP take the DIP of the SCTP message of the INIT type as the DIP in the upstream direction of the session and the SIP in the downstream direction, the S-port as the S-port in the upstream direction of the session and the D-port in the downstream direction, and the D-port as the S-port in the upstream direction of the session and the D-port in the downstream direction.
  • the D-port in the upstream direction and the S-port in the downstream direction of the session are recorded in the session entry of the session.
  • step 204 when the chunk type of the SCTP protocol message is INIT ACK, the S-port, D-port and verification tag in the SCTP message of the INIT ACK type are used to match the session entries established in the history.
  • step 205 if the match is successful, record the initial tag in the chunk information carried in the SCTP message of the INIT ACK type into the verification tag field in the upstream direction vacant in the corresponding session entry.
  • the INIT ACK message is a downstream message, which is a response to the upstream INIT message.
  • the initial tag contained in the chunk information is equal to the verification tag in the upstream direction. Only here can the missing verification tag in the upstream direction be filled in the session record entry.
  • each subsequent SCTP message received uses the S-port, D-port and verification tag to perform the matching basis of the same location and the same source.
  • the embodiment of the present invention solves the problem of the same source and the same destination in the DPI system when the same coupling data in the SCTP message is transmitted through different IP addresses.
  • a large number of SCTP data packets do not need to identify and calculate the IP address. It only needs to parse and hash the source port, destination port and verification tag to determine the output interface, which reduces the consumption of computing resources.
  • the SCTP coupling data fails on the Primary Path, for example, a physical interface of a certain endpoint fails and the data communicates through other Paths, the session only needs to communicate with the session table through S-port, D-port and verification tag. Then, the output interface of the data is determined to ensure that the data communicated through different IP addresses, that is, different Paths, in the SCTP session can also be of the same origin and the same destination.
  • step 207 if the match is unsuccessful, it indicates the historical INIT of the session where the SCTP message of the INIT ACK type is located.
  • the type of SCTP message is not correctly captured by the network splitter, and the session entry is established according to the SCTP message of the INIT ACK type.
  • the establishment of the session entry according to the SCTP message of the INIT ACK type specifically includes:
  • the SIP of the SCTP message of the INIT ACK type is used as the SIP in the uplink direction of the SCTP session and the DIP in the downlink direction;
  • the DIP of the SCTP message of the INIT ACK type is used as the DIP in the uplink direction of the session and the SIP in the downlink direction;
  • the S-port of the SCTP message of the INIT ACK type is used as the S-port in the downstream direction of the SCTP session and the D-port in the upstream direction;
  • the D-port of the SCTP message of the INIT ACK type is used as the downstream direction of the session.
  • the D-port and the S-port of the upstream direction; the verification tag of the SCTP message of the INIT ACK type is the verification tag of the downstream direction in the SCTP session table entry; in the SCTP message chunk information of the INIT ACK type
  • the initial tag is used as the verification tag in the upstream direction.
  • the method further includes:
  • a session entry of the SCTP session needs to be established according to the current SCTP message, and the method includes:
  • the SIP of the SCTP message is used as the SIP in this direction and the DIP in the other direction of the SCTP session entry; the DIP in the SCTP message is used as the DIP in the SCTP session entry in the current direction and the SIP in the other direction;
  • the S-port of the SCTP message is used as the S-port of the SCTP session entry in the current direction and the D-port of the other direction; the D-port of the SCTP message is used as the SCTP session entry in the current direction.
  • the verification tag of the SCTP message is used as the verification tag in this direction in the SCTP session entry; the verification tag in the other direction of the SCTP session entry is marked as empty;
  • the verification tag in the other direction of the SCTP session when the SIP, DIP, S-port, and D-port in the other direction of the SCTP session entry are matched to the SCTP packet, the verification recorded in the corresponding SCTP packet is verified.
  • the tag is updated to the verification tag in the SCTP session entry whose history tag is empty.
  • the method further includes:
  • Each aggregation and distribution device will distribute the corresponding SCTP session entries with incomplete information to each aggregation and distribution device if the verification tag in the upstream direction and the verification tag in the downstream direction contained in its own SCTP session entries are incomplete, so that When each aggregation and distribution device obtains the SCTP message, it can quickly complete the appearance update according to the to-be-completed SCTP session table entry from each aggregation and distribution device in the network;
  • each aggregation and distribution device maintains the SCTP session representation established by itself, and distributes the hash value corresponding to the quadruple in the corresponding representation, and the hash value corresponding to the S-port, D-port and verification tag to other aggregation and distribution devices. This ensures that the entire network record information under the distributed aggregation and distribution device is as concise as possible, and the entire data can be replayed.
  • Embodiment 2 of the present invention is described from a logical level system that is easier to understand by linking the related expansion solutions in Embodiment 1 together, and is presented in conjunction with an example of SCTP session entry formation. It should be noted that the SCTP message of the similar INIT type in Embodiment 1 will be referred to as an INIT message for short in this embodiment of the present invention.
  • step (1) hash calculation is performed according to the quadruple information of the INIT packet of SCTP, and the aggregation and distribution device determines the output interface according to the calculation result, and then determines which DPI server to output to.
  • Step (2) establish a pair of uplink and downlink session entries of the SCTP session, use the SIP of the INIT message as the SIP in the uplink direction of the session and the DIP in the downlink direction, and use the DIP as the DIP in the uplink direction of the session and the DIP in the downlink direction.
  • SIP S-port as the S-port in the upstream direction and D-port in the downstream direction of the session, D-port as the D-port in the upstream direction of the session and S-port in the downstream direction, recorded in the session entry of the session ;
  • the Initiate tag in the chunk information of the message is recorded in the session entry of the session as the verification tag in the downlink direction of the session;
  • the verification tag record in the uplink direction is empty;
  • the output interface obtained in the record step (1) goes to the SCTP in a pair of entries in the session.
  • the session table entry looks like this:
  • the four-tuple information of the packet is hashed, and the aggregation and distribution device determines the output interface according to the calculation result, and records it in a pair of session entries of the SCTP.
  • the SIP of the INIT ACK message is used as the SIP in the upstream direction and the DIP in the downstream direction of the session; the DIP of the message is used as the DIP in the upstream direction of the session and the SIP in the downstream direction; the S-port of the message is used as the SCTP session.
  • the verification tag of the packet is used as the SCTP session entry
  • the verification tag in the downstream direction; the initial tag in the chunk information of the packet is used as the verification tag in the upstream direction. The above information is recorded in the session entry of the session.
  • Step (1) add the message matching field, and match the four-tuple information, that is, match with SIP, DIP, S-port and D-port. If it can match at this time, it proves that the other direction of the session reports The message has been captured and parsed. At this time, the verification tag information of this direction is missing in the session entry. It is necessary to record the verification tag in this packet into the session entry, and output the interface according to the output interface recorded in the session entry. message;
  • Step (2) if the corresponding session entry still cannot be matched according to the quadruple information, then the session entry of the SCTP session needs to be established according to this message, and the establishment rules are as follows:
  • the SIP of the packet is used as the SIP in the upstream direction and the DIP in the downstream direction of the session; the DIP of the packet is used as the DIP in the upstream direction of the session and the SIP in the downstream direction; the S-port of the packet is used as the S-port in the downstream direction of the session.
  • -port and D-port in the upstream direction; the D-port of the message is used as the D-port in the downstream direction of the SCTP session and the S-port in the upstream direction;
  • the verification tag of the message is used as the downstream D-port in the SCTP session entry Verification tag of the direction; the verification tag of the upstream direction of this session is empty.
  • the packets of different stages of the SCTP session can be established or matched to the session entry in the network splitter, and the output interface can be determined according to the session entry.
  • the SCTP coupling data fails on the Primary Path, for example, a physical interface of a certain endpoint fails and the data communicates through other Paths, the session only needs to communicate with the session table through S-port, D-port and verification tag. Then, the output interface of the data is determined to ensure that the data communicated through different IP addresses, that is, different Paths, in the SCTP session can also be of the same origin and the same destination.
  • FIG. 6 it is a schematic structural diagram of an apparatus for ensuring the same source and same destination for SCTP protocol multi-homing packets according to an embodiment of the present invention.
  • the apparatus for ensuring the same source and same destination for SCTP protocol multi-homing packets in this embodiment includes one or more processors 21 and a memory 22 .
  • one processor 21 is taken as an example in FIG. 6 .
  • the processor 21 and the memory 22 may be connected through a bus or in other ways, and the connection through a bus is taken as an example in FIG. 6 .
  • the processor 21 executes the method for ensuring the same source and same destination for multi-homed packets of the SCTP protocol by running the non-volatile software programs and instructions stored in the memory 22 .
  • Memory 22 may include high speed random access memory, and may also include nonvolatile memory such as at least one magnetic disk storage device, flash memory device, or other nonvolatile solid state storage device.
  • the memory 22 may optionally include memory located remotely from the processor 21, and these remote memories may be connected to the processor 21 through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
  • the program instructions/modules are stored in the memory 22, and when executed by the one or more processors 21, execute the method for ensuring the same source and the same destination for SCTP protocol multi-homed packets in the above-mentioned embodiment 1, for example, The various steps shown in FIGS. 4 and 5 described above are performed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明涉及同源同宿技术领域，提供了一种保障SCTP协议多归属报文同源同宿的方法和装置。方法包括SCTP会话处于会话建立阶段，进行会话建立阶段的会话表项建立；在相应目标DPI服务器建立该SCTP会话的一对上下行会话表项，Initiate tag作为下行方向的verification tag记录到该会话的会话表项中；记录INIT ACK报文中携带的initiate tag到上行方向的verification tag；后续接收到各SCTP报文均使用S-port、D-port和verification tag进行同宿同源的匹配依据。本发明解决了通过不同IP地址传输时，报文在DPI系统中同源同宿的问题。

Description

一种保障SCTP协议多归属报文同源同宿的方法和装置 【技术领域】
本发明涉及同源同宿技术领域，特别是涉及一种保障SCTP协议多归属报文同源同宿的方法和装置。
【背景技术】
流控制传输协议SCTP(全称为：Stream Control Transmission Protocol)协议每个通信连接称为一个偶联(association)。通过SCTP协议进行通信的双方，称为endpoint，当任意一个endpoint具备多个IP地址时，SCTP偶联能够具备多归属(multi-homing)特性，假设某一SCTP通信场景如图1所示，图中的Client和Server之间的SCTP偶联共有4条通信路径：Client IP1到Server IP1，Client IP1到Sever IP2，Client IP2到Server IP1，Client IP2到Server IP2。当任意一个接口出现故障时，偶联之间的数据通信可通过其他路径通信，数据传输不产生中断。
网络分流器是深度报文检测(Deep Packet Inspection，简写为：DPI)系统中处于系统的最前端的处理单元，其作用是，将多条线路的上下行流量，进行汇聚，再根据一定的规则进行过滤，负载均衡分流，复制等操作，将特定流量输出到不同的后端分析系统中。DPI系统中的网络分流器，需要保障同一通信会话的流量，发送到同一服务器上，即通信会话的同源同宿功能。
在DPI系统中，一般的TCP或UDP数据，可以通过IP五元组(源IP、目的IP、源端口、目的端口、传输层协议)作为同源同宿算法的依据，保障相同通信会话数据能够同源同宿到同一服务器上。而SCTP协议应用因为具备多归属的特性，导致同一应用可能通过不同IP对进行数据通信，此时一般的通过根据IP五元组保障应用数据同源同宿的算法就不能满足SCTP数据同源同宿的需求了。
鉴于此，克服该现有技术所存在的缺陷是本技术领域亟待解决的问题。
【发明内容】
本发明要解决的技术问题是在DPI系统中，一般的TCP或UDP数据，可以通过IP五元组(源IP、目的IP、源端口、目的端口、传输层协议)作为同源同宿算法的依据，保障相同通信会话数据能够同源同宿到同一服务器上。而SCTP协议应用因为具备多归属的特性，导致同一应用可能通过不同IP对进行数据通信，此时一般的通过根据IP五元组保障应用数据同源同宿的算法就不能满足SCTP数据同源同宿的需求了。
本发明采用如下技术方案：
第一方面，一种保障SCTP协议多归属报文同源同宿的方法，收到SCTP协议报文时，分析payload中chunk信息的类型，方法包括：
当chunk type为INIT时，所述SCTP会话处于会话建立阶段，进行会话建立阶段的会话表项建立；
所述会话建立阶段的会话表项建立，包括根据INIT类型的SCTP报文的四元组信息进行hash计算，根据计算hash值确定输出接口，进而确定输出到相应目标DPI服务器；
在相应目标DPI服务器建立该SCTP会话的一对上下行会话表项，报文chunk信息中的Initiate tag作为该上下行会话表项下行方向的verification tag记录到该会话的会话表项中；上行方向的verification tag记录为空；
当SCTP协议报文的chunk type是INIT ACK时，则使用INIT ACK类型的SCTP报文中的S-port、D-port和verification tag进行历史建立的会话表项的匹配；
若匹配成功，则记录INIT ACK类型的SCTP报文中携带的chunk信息中的initiate tag到相应会话表项中空缺的上行方向的verification tag字段中；
后续接收到各SCTP报文均使用S-port、D-port和verification tag进行同宿同源的匹配依据。
优选的，若匹配不成功，则表明INIT ACK类型的SCTP报文所在会话的历史INIT类型的SCTP报文未被网络分流器正确捕获，根据所述INIT ACK类型的SCTP报文建立所述会话表项。
优选的，所述根据所述INIT ACK类型的SCTP报文建立所述会话表项，具体包括：
将INIT ACK类型的SCTP报文的四元组信息进行hash计算，汇聚分流设备根据hash计算值确定输出接口，并记录到对应相应SCTP会话的一对会话表项中；
所述INIT ACK类型的SCTP报文的SIP作为所述SCTP会话上行方向的SIP以及下行方向的DIP；所述INIT ACK类型的SCTP报文的DIP作为该会话上行方向的DIP以及下行方向的SIP；所述INIT ACK类型的SCTP报文的S-port作为所述SCTP会话下行方向的S-port以及上行方向的D-port；所述INIT ACK类型的SCTP报文的D-port作为该会话下行方向的D-port以及上行方向的S-port；所述INIT ACK类型的SCTP报文的verification tag作为所述SCTP会话表项中下行方向的verification tag；所述INIT ACK类型的SCTP报文chunk信息中的initiate tag作为上行方向的verification tag。
优选的，当SCTP报文chunk type不是INIT或者INIT ACK时，且所述SCTP报文的S-port、D-port和verification tag未能与网络分流器中历史建立的会话表项匹配时，所述方法还包括：
增加报文匹配字段，根据四元组信息SIP、DIP、S-port和D-port进行匹配；若能匹配，则证明所述SCTP会话的另一方向报文已经被捕捉和解析，此时该会话表项中缺少本方向的verification tag信息，需将本报文中的verification tag记录到会话表项中，并按照会话表项中所记录输出接口，输出该报文。
优选的，若根据所述四元组信息依旧无法匹配到对应的会话表项，则需要根据当前SCTP报文建立该SCTP会话的会话表项，方法包括：
根据四元组进行hash计算，根据计算结果确定输出接口，并记录在该会话 的会话表项中；
所述SCTP报文的SIP作为所述SCTP会话表项本方向的SIP以及另一方向的DIP；所述SCTP报文的DIP作为所述SCTP会话表项本方向的DIP以及另一方向的SIP；所述SCTP报文的S-port作为所述SCTP会话表项本方向的S-port以及另一方向的D-port；所述SCTP报文的D-port作为所述SCTP会话表项本方向的D-port以及另一方向的S-port；所述SCTP报文的verification tag作为所述SCTP会话表项中本方向的verification tag；所述SCTP会话表项另一方向verification tag标记为空；
所述SCTP会话另一方向verification tag，在根据所述SCTP会话表项另一方向的SIP、DIP、S-port和D-port匹配到SCTP报文情况下，将相应SCTP报文中记载的verification tag更新到历史标记为空的SCTP会话表项中的verification tag。
优选的，在有多个汇聚分流设备和/或DPI服务器时，所述方法还包括：
各汇聚分流设备对于自身所的SCTP会话表项中，所包含的上行方向的verification tag和下行方向的verification tag不全的，会将相应的信息不全的SCTP会话表项分发给各个汇聚分流设备，以便各汇聚分流设备在获取到SCTP报文时，能够根据来自网络中各个汇聚分流设备的待补全SCTP会话表项快速完成表象更新；
其中，各个汇聚分流设备维护自身建立起来的SCTP会话表象，而将相应表象中对应四元组的hash值，以及对应S-port、D-port和verification tag的hash值分发给其他汇聚分流设备。
优选的，所述建立该SCTP会话的一对上下行会话表项后，相应的上下行会话表项填写内容还包括：
将所述INIT类型的SCTP报文的SIP作为该会话上行方向的SIP以及下行方向的DIP；将所述INIT类型的SCTP报文的DIP作为该会话上行方向的DIP以及下行方向的SIP，S-port作为该会话上行方向的S-port以及下行方向的D-port，D-port作为该会话上行方向的D-port以及下行方向的S-port，记录 到该会话的会话表项中。
优选的，所述四元组就具体为：源IP地址SIP、目的IP地址DIP、源端口号S-port和目的端口号D-port。
优选的，所述使用INIT ACK类型的SCTP报文中的S-port、D-port和verification tag进行历史建立的会话表项的匹配，具体包括：
通过计算S-port、D-port和verification tag三者的hash值，并利用计算出的hash值进行历史建立的会话表项中相对应的hash值进行匹配。
第二方面，本发明还提供了一种保障SCTP协议多归属报文同源同宿的装置，用于实现第一方面所述的保障SCTP协议多归属报文同源同宿的方法，所述装置包括：
至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述处理器执行，用于执行第一方面所述的保障SCTP协议多归属报文同源同宿的方法。
第三方面，本发明还提供了一种非易失性计算机存储介质，所述计算机存储介质存储有计算机可执行指令，该计算机可执行指令被一个或多个处理器执行，用于完成第一方面所述的保障SCTP协议多归属报文同源同宿的方法。
本发明解决了SCTP报文中同一偶联数据，通过不同IP地址传输时，报文在DPI系统中同源同宿的问题。SCTP大量的数据报文不需要进行IP地址的识别和计算，只需要对源端口，目的端口和verification tag进行解析和hash计算，就能够确定输出接口，降低了计算资源的损耗。
【附图说明】
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例中所需要使用的附图作简单地介绍。显而易见地，下面所描述的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例提供的现有技术中的一种SCTP通信场景结构示意图；
图2是本发明实施例提供的现有技术中的一种分流汇聚设备SCTP协议处理流程示意图；
图3是本发明实施例提供的现有技术中的会话建立，会话通信，会话完成三个阶段的流程示意图；
图4是本发明实施例提供的一种保障SCTP协议多归属报文同源同宿的方法流程示意图；
图5是本发明实施例提供的另一种保障SCTP协议多归属报文同源同宿的方法流程示意图；
图6是本发明实施例提供的另一种保障SCTP协议多归属报文同源同宿的装置结构示意图。
【具体实施方式】
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
在本发明的描述中，术语“内”、“外”、“纵向”、“横向”、“上”、“下”、“顶”、“底”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本发明而不是要求本发明必须以特定的方位构造和操作，因此不应当理解为对本发明的限制。
现有技术方案对SCTP协议报文的处理，缺少对多归属问题的解决方案，现有分流汇聚设备SCTP协议处理流程如图2所示，这里假设场景，Client与Server为SCTP通信的双向endpoint，endpoint之间所有的通信路径称为path，而初始建立SCTP连接的ClientIP1和ServerIP1的path称为primary path。该primary path上的SCTP数据会被汇聚分流设备镜像转发到DPI服务器1上，而其他path进行通信的数据会被镜像转发到DPI服务器2上。为保障SCTP偶联会话的完整性，需要通过一个技术方案，使其他path之间通信的数据能够被转发到DPI服务器1上。而本发明实施例正是针对上述的技术方案需求而提出的。
此外，下面所描述的本发明各个实施方式中所涉及到的技术特征只要彼此 之间未构成冲突就可以相互组合。
实施例1:
网络分流器需要根据SCTP协议会话的不同阶段，执行不同的处理方案。SCTP完整会话过程主要为：会话建立，会话通信，会话完成三个阶段。流程如图3所示。在SCTP会话建立过程中，根据SCTP协议中的INIT，INIT ACK报文(在本发明实施例也将描述为INIT类型的SCTP报文和INIT ACK类型的SCTP报文)，将SCTP会话信息加以处理和保存，为后续SCTP报文提供的转发路径提供参考。
本发明实施例提出了一种保障SCTP协议多归属报文同源同宿的方法，在收到SCTP协议报文时，分析payload中chunk信息的类型，如图4所示，方法包括：
在步骤201中，当chunk type为INIT时，所述SCTP会话处于会话建立阶段，进行会话建立阶段的会话表项建立。
在步骤202中，所述会话建立阶段的会话表项建立，包括根据INIT类型的SCTP报文的四元组信息进行hash计算，根据计算hash值确定输出接口，进而确定输出到相应目标DPI服务器。
所述四元组就具体为：源IP地址SIP、目的IP地址DIP、源端口号S-port和目的端口号D-port。
在步骤203中，在相应目标DPI服务器建立该SCTP会话的一对上下行会话表项，报文chunk信息中的Initiate tag作为该上下行会话表项下行方向的verification tag记录到该会话的会话表项中；上行方向的verification tag记录为空。
此时无法获取到上行方向的verification tag，因此设置为空；上下行的verification tag是不相同的，首先INIT报文是一个上行报文，其chunk信息中包含的initiate tag是作为下行方向的verification tag。
所述建立该SCTP会话的一对上下行会话表项后，相应的上下行会话表项填写内容还包括：将所述INIT类型的SCTP报文的SIP作为该会话上行方向的SIP以及下行方向的DIP；将所述INIT类型的SCTP报文的DIP作为该会话上行方向 的DIP以及下行方向的SIP，S-port作为该会话上行方向的S-port以及下行方向的D-port，D-port作为该会话上行方向的D-port以及下行方向的S-port，记录到该会话的会话表项中。
在步骤204中，当SCTP协议报文的chunk type是INIT ACK时，则使用INIT ACK类型的SCTP报文中的S-port、D-port和verification tag进行历史建立的会话表项的匹配。
例如：通过计算S-port、D-port和verification tag三者的hash值，并利用计算出的hash值进行历史建立的会话表项中相对应的hash值进行匹配。
在步骤205中，若匹配成功，则记录INIT ACK类型的SCTP报文中携带的chunk信息中的initiate tag到相应会话表项中空缺的上行方向的verification tag字段中。
INIT ACK报文是一个下行方向的报文，是对上行方向INIT报文的一个应答，其chunk信息中包含的initiate tag，与上行方向的verification tag相等。这里才能把会话记录表项中缺失的上行方向的verification tag补齐。
在步骤206中，后续接收到各SCTP报文均使用S-port、D-port和verification tag进行同宿同源的匹配依据。
本发明实施例解决了SCTP报文中同一偶联数据，通过不同IP地址传输时，报文在DPI系统中同源同宿的问题。SCTP大量的数据报文不需要进行IP地址的识别和计算，只需要对源端口，目的端口和verification tag进行解析和hash计算，就能够确定输出接口，降低了计算资源的损耗。
当SCTP的偶联数据，在Primary Path通道出现故障，如某一endpoint的某一物理接口失效而数据通过其他Path通信时，因会话仅需通过S-port，D-port和verification tag与会话表项进行匹配，进而确定该数据的输出接口，保障在SCTP会话通过不同IP地址，即不同Path通信的数据，也能够同源同宿。
对于本发明实施例中对应于步骤205的判断分支，还存在一种情况，如图5所示，在步骤207中，若匹配不成功，则表明INIT ACK类型的SCTP报文所在会话的历史INIT类型的SCTP报文未被网络分流器正确捕获，根据所述INIT ACK 类型的SCTP报文建立所述会话表项。
其中，所述根据所述INIT ACK类型的SCTP报文建立所述会话表项，具体包括：
将INIT ACK类型的SCTP报文的四元组信息进行hash计算，汇聚分流设备根据hash计算值确定输出接口，并记录到对应相应SCTP会话的一对会话表项中；
所述INIT ACK类型的SCTP报文的SIP作为所述SCTP会话上行方向的SIP以及下行方向的DIP；所述INIT ACK类型的SCTP报文的DIP作为该会话上行方向的DIP以及下行方向的SIP；所述INIT ACK类型的SCTP报文的S-port作为所述SCTP会话下行方向的S-port以及上行方向的D-port；所述INIT ACK类型的SCTP报文的D-port作为该会话下行方向的D-port以及上行方向的S-port；所述INIT ACK类型的SCTP报文的verification tag作为所述SCTP会话表项中下行方向的verification tag；所述INIT ACK类型的SCTP报文chunk信息中的initiate tag作为上行方向的verification tag。
在本发明实施例实现过程中，考虑到上述基于INIT类型的SCTP报文和INIT ACK类型的SCTP报文仅在会话建立时候才出现，那么根据实际可能发生的情况，有可能会错过或者丢失上述会话建立过程中实现SCTP会话表项的建立。因此，结合本发明实施例作为完整可能性实现方案而言，还存在一种扩展实现内容，具体的：当SCTP报文chunk type不是INIT或者INIT ACK时，且所述SCTP报文的S-port、D-port和verification tag未能与网络分流器中历史建立的会话表项匹配时，所述方法还包括：
增加报文匹配字段，根据四元组信息SIP、DIP、S-port和D-port进行匹配；若能匹配，则证明所述SCTP会话的另一方向报文已经被捕捉和解析，此时该会话表项中缺少本方向的verification tag信息，需将本报文中的verification tag记录到会话表项中，并按照会话表项中所记录输出接口，输出该报文；
若根据所述四元组信息依旧无法匹配到对应的会话表项，则需要根据当前 SCTP报文建立该SCTP会话的会话表项，方法包括：
根据四元组进行hash计算，根据计算结果确定输出接口，并记录在该会话的会话表项中；
所述SCTP报文的SIP作为所述SCTP会话表项本方向的SIP以及另一方向的DIP；所述SCTP报文的DIP作为所述SCTP会话表项本方向的DIP以及另一方向的SIP；所述SCTP报文的S-port作为所述SCTP会话表项本方向的S-port以及另一方向的D-port；所述SCTP报文的D-port作为所述SCTP会话表项本方向的D-port以及另一方向的S-port；所述SCTP报文的verification tag作为所述SCTP会话表项中本方向的verification tag；所述SCTP会话表项另一方向verification tag标记为空；
所述SCTP会话另一方向verification tag，在根据所述SCTP会话表项另一方向的SIP、DIP、S-port和D-port匹配到SCTP报文情况下，将相应SCTP报文中记载的verification tag更新到历史标记为空的SCTP会话表项中的verification tag。
此时SCTP会话建立过程的报文已经缺失，因此无法确定报文的方向性，且此时报文的方向性已经不再重要，因此可以假定收到的报文为上行或下行方向报文都可以，并记录相应信息到会话表项中，之后根据四元组信息进行匹配后，可以获取到下行行或上行方向的verification tag。在上述描述中，实际上使用修改“本方向”和“另一方向”代替历史上的“下行”和“上行”的描述形式。
进一步，考虑一种存在的分布式复杂场景，在有多个汇聚分流设备和/或DPI服务器时，所述方法还包括：
各汇聚分流设备对于自身所的SCTP会话表项中，所包含的上行方向的verification tag和下行方向的verification tag不全的，会将相应的信息不全的SCTP会话表项分发给各个汇聚分流设备，以便各汇聚分流设备在获取到SCTP报文时，能够根据来自网络中各个汇聚分流设备的待补全SCTP会话表项快速完成表象更新；
其中，各个汇聚分流设备维护自身建立起来的SCTP会话表象，而将相应表象中对应四元组的hash值，以及对应S-port、D-port和verification tag的hash值分发给其他汇聚分流设备。从而保证分布式汇聚分流设备下的全网记录信息尽可能精简，且可全数据复盘。
实施例2：
本发明实施例2从更为容易理解的逻辑层面系统的将实施例1中相关扩展方案联系到一起来进行阐述，并结合举例的SCTP会话表项形成进行呈现。需要指出的是，在实施例1中的类似INIT类型的SCTP报文在本发明实施例中将简称为INIT报文。
情况1、当网络分流器收到SCTP协议报文后，首先分析payload中chunk信息的类型，当chunk type为INIT时，则该SCTP处于会话建立阶段，其用于同源同宿的会话表项应遵循如下方案：
步骤(1)、根据SCTP的INIT报文的四元组信息进行hash计算，汇聚分流设备根据计算结果确定输出接口，进而确定输出到哪一台DPI服务器。
步骤(2)、建立该SCTP会话的一对上下行会话表项，将该INIT报文的SIP作为该会话上行方向的SIP以及下行方向的DIP，DIP作为该会话上行方向的DIP以及下行方向的SIP，S-port作为该会话上行方向的S-port以及下行方向的D-port，D-port作为该会话上行方向的D-port以及下行方向的S-port，记录到该会话的会话表项中；该报文chunk信息中的Initiate tag作为该会话下行方向的verification tag记录到该会话的会话表项中；上行方向的verification tag记录为空；记录步骤(1)中所得输出接口到该SCTP会话的一对表项中。会话表项如下所示：
Figure PCTCN2021130836-appb-000001
Figure PCTCN2021130836-appb-000002
情况2、当SCTP协议报文的chunk type是INIT ACK时，则使用该报文的S-port、D-port和verification tag进行会话匹配。此时可能出现两类情况：
情况2.1、如匹配成功，则证明该会话已经通过INIT报文建立了会话表项，此时该会话表项缺失上行方向的verification tag，需记录INIT ACK报文chunk信息中的initiate tag作为上行方向的verification tag。
情况2.2、如匹配不成功，则证明该会话的INIT报文未被网络分流器正确捕获，需要根据INIT ACK建立会话表项。会话表项建立规则是：
报文的四元组信息进行hash计算，汇聚分流设备根据计算结果确定输出接口，并记录到该SCTP的一对会话表项中。
该INIT ACK报文的SIP作为该会话上行方向的SIP以及下行方向的DIP；该报文的DIP作为该会话上行方向的DIP以及下行方向的SIP；该报文的S-port作为所述SCTP会话下行方向的S-port以及上行方向的D-port；该报文的D-port作为该会话下行方向的D-port以及上行方向的S-port；该报文的verification tag作为该SCTP会话表项中下行方向的verification tag；该报文chunk信息中的initiate tag作为上行方向的verification tag。以上信息记录到该会话的会话表项中。
情况3、当SCTP报文chunk type不是情况1、情况2中的情况时，且该报文的S-port、D-port和verification tag未能与网络分流器中现有会话表项匹配时，需要按照以下步骤进行处理：
步骤(1)、增加报文匹配字段，进行四元组信息的匹配，即以SIP、DIP、S-port和D-port进行匹配，此时若能匹配，则证明该会话的另一方向报文已经被捕捉和解析，此时该会话表项中缺少本方向的verification tag信息，需将本报文中的verification tag记录到会话表项中，并按照会话表项中所记录输出接口，输出该报文；
步骤(2)、如按照四元组信息依旧无法匹配到对应的会话表项，则需要根 据本报文建立该SCTP会话的会话表项，建立规则如下：
根据四元组进行hash计算，根据计算结果确定输出接口，并记录在该会话的会话表项中；
该报文的SIP作为该会话上行方向的SIP以及下行方向的DIP；该报文的DIP作为该会话上行方向的DIP以及下行方向的SIP；该报文的S-port作为该会话下行方向的S-port以及上行方向的D-port；该报文的D-port作为所述SCTP会话下行方向的D-port以及上行方向的S-port；该报文的verification tag作为该SCTP会话表项中下行方向的verification tag；该会话上行方向verification tag标记为空。
当有该会话另一方向报文被捕获是，则按照上述情况3进行处理。
通过情况1、情况2、情况3SCTP会话的不同阶段报文都能够在网络分流器中建立或匹配到会话表项，并根据会话表项确定输出接口。
当SCTP的偶联数据，在Primary Path通道出现故障，如某一endpoint的某一物理接口失效而数据通过其他Path通信时，因会话仅需通过S-port，D-port和verification tag与会话表项进行匹配，进而确定该数据的输出接口，保障在SCTP会话通过不同IP地址，即不同Path通信的数据，也能够同源同宿。
实施例3：
如图6所示，是本发明实施例的保障SCTP协议多归属报文同源同宿的装置的架构示意图。本实施例的保障SCTP协议多归属报文同源同宿的装置包括一个或多个处理器21以及存储器22。其中，图6中以一个处理器21为例。
处理器21和存储器22可以通过总线或者其他方式连接，图6中以通过总线连接为例。
存储器22作为一种非易失性计算机可读存储介质，可用于存储非易失性软件程序和非易失性计算机可执行程序，如实施例1中的保障SCTP协议多归属报文同源同宿的方法。处理器21通过运行存储在存储器22中的非易失性软件程序和指令，从而执行保障SCTP协议多归属报文同源同宿的方法。
存储器22可以包括高速随机存取存储器，还可以包括非易失性存储器，例 如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实施例中，存储器22可选包括相对于处理器21远程设置的存储器，这些远程存储器可以通过网络连接至处理器21。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
所述程序指令/模块存储在所述存储器22中，当被所述一个或者多个处理器21执行时，执行上述实施例1中的保障SCTP协议多归属报文同源同宿的方法，例如，执行以上描述的图4和图5所示的各个步骤。
值得说明的是，上述装置和系统内的模块、单元之间的信息交互、执行过程等内容，由于与本发明的处理方法实施例基于同一构思，具体内容可参见本发明方法实施例中的叙述，此处不再赘述。
本领域普通技术人员可以理解实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：只读存储器(ROM，Read Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁盘或光盘等。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (10)

  1. 一种保障SCTP协议多归属报文同源同宿的方法，其特征在于，收到SCTP协议报文时，分析payload中chunk信息的类型，方法包括：
    当chunk type为INIT时，所述SCTP会话处于会话建立阶段，进行会话建立阶段的会话表项建立；
    所述会话建立阶段的会话表项建立，包括根据INIT类型的SCTP报文的四元组信息进行hash计算，根据计算hash值确定输出接口，进而确定输出到相应目标DPI服务器；
    在相应目标DPI服务器建立该SCTP会话的一对上下行会话表项，报文chunk信息中的Initiate tag作为该上下行会话表项下行方向的verification tag记录到该会话的会话表项中；上行方向的verification tag记录为空；
    当SCTP协议报文的chunk type是INIT ACK时，则使用INIT ACK类型的SCTP报文中的S-port、D-port和verification tag进行历史建立的会话表项的匹配；
    若匹配成功，则记录INIT ACK类型的SCTP报文中携带的chunk信息中的initiate tag到相应会话表项中空缺的上行方向的verification tag字段中；
    后续接收到各SCTP报文均使用S-port、D-port和verification tag进行同宿同源的匹配依据。
  2. 根据权利要求1所述的保障SCTP协议多归属报文同源同宿的方法，其特征在于，若匹配不成功，则表明INIT ACK类型的SCTP报文所在会话的历史INIT类型的SCTP报文未被网络分流器正确捕获，根据所述INIT ACK类型的SCTP报文建立所述会话表项。
  3. 根据权利要求2所述的保障SCTP协议多归属报文同源同宿的方法，其特征在于，所述根据所述INIT ACK类型的SCTP报文建立所述会话表项，具体包括：
    将INIT ACK类型的SCTP报文的四元组信息进行hash计算，汇聚分流设备根据hash计算值确定输出接口，并记录到对应相应SCTP会话的一对会话表项中；
    所述INIT ACK类型的SCTP报文的SIP作为所述SCTP会话上行方向的SIP以及下行方向的DIP；所述INIT ACK类型的SCTP报文的DIP作为该会话上行方向的DIP以及下行方向的SIP；所述INIT ACK类型的SCTP报文的S-port作为所述SCTP会话下行方向的S-port以及上行方向的D-port；所述INIT ACK类型的SCTP报文的D-port作为该会话下行方向的D-port以及上行方向的S-port；所述INIT ACK类型的SCTP报文的verification tag作为所述SCTP会话表项中下行方向的verification tag；所述INIT ACK类型的SCTP报文chunk信息中的initiate tag作为上行方向的verification tag。
  4. 根据权利要求1-3任一所述的保障SCTP协议多归属报文同源同宿的方法，其特征在于，当SCTP报文chunk type不是INIT或者INIT ACK时，且所述SCTP报文的S-port、D-port和verification tag未能与网络分流器中历史建立的会话表项匹配时，所述方法还包括：
    增加报文匹配字段，根据四元组信息SIP、DIP、S-port和D-port进行匹配；若能匹配，则证明所述SCTP会话的另一方向报文已经被捕捉和解析，此时该会话表项中缺少本方向的verification tag信息，需将本报文中的verification tag记录到会话表项中，并按照会话表项中所记录输出接口，输出该报文。
  5. 根据权利要求4所述的保障SCTP协议多归属报文同源同宿的方法，其特征在于，若根据所述四元组信息依旧无法匹配到对应的会话表项，则需要根据当前SCTP报文建立该SCTP会话的会话表项，方法包括：
    根据四元组进行hash计算，根据计算结果确定输出接口，并记录在该会话的会话表项中；
    所述SCTP报文的SIP作为所述SCTP会话表项本方向的SIP以及另一方向的DIP；所述SCTP报文的DIP作为所述SCTP会话表项本方向的DIP以及另一方向的SIP；所述SCTP报文的S-port作为所述SCTP会话表项本方向的S-port以及另一方向的D-port；所述SCTP报文的D-port作为所述SCTP会话表项本方向的D-port以及另一方向的S-port；所述SCTP报文的verification tag作为所述SCTP会话表项中本方向的verification tag；所述SCTP会话表项另一方向verification tag标记为空；
    所述SCTP会话另一方向verification tag，在根据所述SCTP会话表项另一方向的SIP、DIP、S-port和D-port匹配到SCTP报文情况下，将相应SCTP报文中记载的verification tag更新到历史标记为空的SCTP会话表项中的verification tag。
  6. 根据权利要求5所述的保障SCTP协议多归属报文同源同宿的方法，其特征在于，在有多个汇聚分流设备和/或DPI服务器时，所述方法还包括：
    各汇聚分流设备对于自身所的SCTP会话表项中，所包含的上行方向的verification tag和下行方向的verification tag不全的，会将相应的信息不全的SCTP会话表项分发给各个汇聚分流设备，以便各汇聚分流设备在获取到SCTP报文时，能够根据来自网络中各个汇聚分流设备的待补全SCTP会话表项快速完成表象更新；
    其中，各个汇聚分流设备维护自身建立起来的SCTP会话表象，而将相应表象中对应四元组的hash值，以及对应S-port、D-port和verification tag的hash值分发给其他汇聚分流设备。
  7. 根据权利要求1所述的保障SCTP协议多归属报文同源同宿的方法，其特征在于，所述建立该SCTP会话的一对上下行会话表项后，相应的上下行会话表项填写内容还包括：
    将所述INIT类型的SCTP报文的SIP作为该会话上行方向的SIP以及下行 方向的DIP；将所述INIT类型的SCTP报文的DIP作为该会话上行方向的DIP以及下行方向的SIP，S-port作为该会话上行方向的S-port以及下行方向的D-port，D-port作为该会话上行方向的D-port以及下行方向的S-port，记录到该会话的会话表项中。
  8. 根据权利要求1所述的保障SCTP协议多归属报文同源同宿的方法，其特征在于，所述四元组就具体为：源IP地址SIP、目的IP地址DIP、源端口号S-port和目的端口号D-port。
  9. 根据权利要求1所述的保障SCTP协议多归属报文同源同宿的方法，其特征在于，所述使用INIT ACK类型的SCTP报文中的S-port、D-port和verification tag进行历史建立的会话表项的匹配，具体包括：
    通过计算S-port、D-port和verification tag三者的hash值，并利用计算出的hash值进行历史建立的会话表项中相对应的hash值进行匹配。
  10. 一种保障SCTP协议多归属报文同源同宿的装置，其特征在于，所述装置包括：
    至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述处理器执行，用于执行权利要求1-9任一所述的保障SCTP协议多归属报文同源同宿的方法。
PCT/CN2021/130836 2020-11-17 2021-11-16 一种保障sctp协议多归属报文同源同宿的方法和装置 WO2022105730A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011282409.9A CN112468469B (zh) 2020-11-17 2020-11-17 一种保障sctp协议多归属报文同源同宿的方法和装置
CN202011282409.9 2020-11-17

Publications (1)

Publication Number Publication Date
WO2022105730A1 true WO2022105730A1 (zh) 2022-05-27

Family

ID=74837951

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/130836 WO2022105730A1 (zh) 2020-11-17 2021-11-16 一种保障sctp协议多归属报文同源同宿的方法和装置

Country Status (2)

Country Link
CN (1) CN112468469B (zh)
WO (1) WO2022105730A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884882A (zh) * 2022-06-16 2022-08-09 深圳星云智联科技有限公司 一种流量可视化方法、装置、设备及存储介质
CN116233023A (zh) * 2022-12-29 2023-06-06 成都锋卫科技有限公司 基于dpdk的流量采集不对称的同源同宿方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112468469B (zh) * 2020-11-17 2022-01-04 武汉绿色网络信息服务有限责任公司 一种保障sctp协议多归属报文同源同宿的方法和装置
CN115134284B (zh) * 2021-03-24 2023-07-14 中国电信股份有限公司 通过多个分流器实现同源同宿分流的方法、装置和介质
CN114826559B (zh) * 2022-04-22 2024-07-26 深圳市东晟数据有限公司 一种数据对称性的处理方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101106528A (zh) * 2007-07-31 2008-01-16 杭州华三通信技术有限公司 基于安全设备的报文转发系统和方法以及安全设备
CN101873259A (zh) * 2010-06-01 2010-10-27 华为技术有限公司 Sctp报文识别方法和装置
CN106302236A (zh) * 2015-05-27 2017-01-04 国家计算机网络与信息安全管理中心 一种数据分流的方法及接入设备
CN112468469A (zh) * 2020-11-17 2021-03-09 武汉绿色网络信息服务有限责任公司 一种保障sctp协议多归属报文同源同宿的方法和装置

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7535916B2 (en) * 2005-02-07 2009-05-19 Cisco Technology, Inc. Method for sharing a transport connection across a multi-processor platform with limited inter-processor communications
US7890637B1 (en) * 2008-02-25 2011-02-15 Juniper Networks, Inc. Secure communications in a system having multi-homed devices
CN102118792B (zh) * 2009-12-31 2015-01-21 华为技术有限公司 一种传输数据包的方法及装置
CN104202771B (zh) * 2014-09-03 2017-11-28 武汉虹信技术服务有限责任公司 Lte核心网络接口大流量数据的负载均衡方法
CN104580550A (zh) * 2014-12-30 2015-04-29 北京天融信科技有限公司 分布式系统中多业务板分流时的nat处理方法及设备
CN107612840B (zh) * 2017-09-26 2020-10-30 东软集团股份有限公司 一种四层负载均衡设备的数据处理方法及装置
WO2019127068A1 (en) * 2017-12-27 2019-07-04 Intel Corporation User plane apparatus for edge computing
CN111083792B (zh) * 2018-10-22 2021-09-07 华为技术有限公司 WiFi网络中的数据传输方法、装置及设备
CN111163015B (zh) * 2019-12-24 2023-05-09 北京百卓网络技术有限公司 报文发送方法、装置及汇聚分流设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101106528A (zh) * 2007-07-31 2008-01-16 杭州华三通信技术有限公司 基于安全设备的报文转发系统和方法以及安全设备
CN101873259A (zh) * 2010-06-01 2010-10-27 华为技术有限公司 Sctp报文识别方法和装置
US20110296007A1 (en) * 2010-06-01 2011-12-01 Hua Liu Method and device for identifying an sctp packet
CN106302236A (zh) * 2015-05-27 2017-01-04 国家计算机网络与信息安全管理中心 一种数据分流的方法及接入设备
CN112468469A (zh) * 2020-11-17 2021-03-09 武汉绿色网络信息服务有限责任公司 一种保障sctp协议多归属报文同源同宿的方法和装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884882A (zh) * 2022-06-16 2022-08-09 深圳星云智联科技有限公司 一种流量可视化方法、装置、设备及存储介质
CN114884882B (zh) * 2022-06-16 2023-11-21 深圳星云智联科技有限公司 一种流量可视化方法、装置、设备及存储介质
CN116233023A (zh) * 2022-12-29 2023-06-06 成都锋卫科技有限公司 基于dpdk的流量采集不对称的同源同宿方法

Also Published As

Publication number Publication date
CN112468469B (zh) 2022-01-04
CN112468469A (zh) 2021-03-09

Similar Documents

Publication Publication Date Title
WO2022105730A1 (zh) 一种保障sctp协议多归属报文同源同宿的方法和装置
US11876880B2 (en) TCP processing for devices
US10440156B2 (en) Network connection hand-off and hand-back
US20240333632A1 (en) Flow modification including shared context
US10218592B2 (en) Method, device and system for performing bidirectional forwarding detection on aggregated link
EP3593498B1 (en) Router device using flow duplication
US10681188B2 (en) Reducing transmission pathway lengths within a distributed network
US20120239725A1 (en) Network Connection Hand-off Using State Transformations
US11902130B2 (en) Data packet loss detection
EP4333408A2 (en) Method and apparatus for managing routing disruptions in a computer network
US20080205388A1 (en) Discovery of network devices logically located between a client and a service
US10178015B2 (en) Methods, systems, and computer readable media for testing network equipment devices using connectionless protocols
WO2021008591A1 (zh) 数据传输方法、装置及系统
US9455950B1 (en) System and method for implementing traffic optimization for overlay networks
US10367856B2 (en) Failover management of SIP based multimedia communication sessions
US20150373135A1 (en) Wide area network optimization
EP3817308A1 (en) Method, device and system for responding to request and applied to bt system
WO2019184262A1 (zh) 多类型媒体数据网络地址转换穿越方法、终端及系统
US20220200915A1 (en) Network policy application based on session state
US20220337615A1 (en) Dynamic sessional redirection and proxy
CN115277806A (zh) 云桌面连接方法、装置和设备
US20110113145A1 (en) Stateless Transmission Control Protocol Rendezvous Solution For Border Gateway Function
CN107104892A (zh) 网络加速的方法和装置
US10476980B2 (en) Remote socket splicing system
CN106921624B (zh) 会话边界控制器及数据传输方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21893877

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21893877

Country of ref document: EP

Kind code of ref document: A1