A traffic scheduling method, device and medium

Abstract

The application discloses a flow scheduling method and device and a medium, and relates to the technical field of communication. The method applied to a user-side device comprises the following steps: in the case that a first data packet of a data flow is listened to, source identification information of the first data packet is identified, the source identification information comprises user identification information and application identification information; flow identification information is generated, the flow identification information comprises the source identification information; the first data packet and the flow identification information are sent to a network-side device, so as to instruct the network-side device to, in the case that a second data packet of the data flow is received and five-tuple information of the second data packet is the same as five-tuple information of the first data packet, perform flow scheduling on the second data packet according to the source identification information. The application can improve the protocol applicability and compatibility of the flow identification scheme.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer technology, and in particular to a traffic scheduling method, device and medium. BACKGROUND

[0002] Traffic identification is the premise of traffic control. In Quality of Service (QoS) scheduling of fine granularity, accurate traffic identification is more complex and particularly important.

[0003] In a Software-Defined Networking in a Wide Area Network (SDWAN) scenario, the identification of user application data flow can be described as the network's awareness ability of the application. At present, in the scenario involving Internet Protocol Version 6 (IPv6), an Application-aware IPv6 Networing (APN6) scheme based on IPv6 is usually used. The application information is added in the IPv6 packet extension header, and the network perceives the application program by analyzing the application information in the extension header. However, the above scheme is only applicable to IPv6 networks. SUMMARY

[0004] Embodiments of the present application provide a traffic scheduling method, device and medium to solve the problem of low network protocol compatibility of network side equipment identifying data flow.

[0005] To solve the above technical problems, the present application is implemented as follows:

[0006] In a first aspect, the embodiments of the present application provide a traffic scheduling method applied to a user side device, and the method comprises:

[0007] In the case of listening to a first data packet of a data flow, identifying source identification information of the first data packet; wherein the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal where the first data packet comes from, and the application identification information is used to identify an application program where the first data packet comes from;

[0008] Generating flow identification information, the flow identification information comprising the source identification information;

[0009] Sending the first data packet and the flow identification information to a network side device;

[0010] The flow identification information is used to instruct the network side device to perform flow scheduling on a second data packet of the data flow according to the source identification information in a case where the network side device receives the second data packet and five-tuple information of the second data packet is same as target five-tuple information, the target five-tuple information being five-tuple information of the first data packet, the second data packet including the first data packet.

[0011] Optionally, the user side device is a user agent device.

[0012] Optionally, the data flow is a transmission control protocol (TCP) data flow, and the first data packet is a first synchronization sequence number (SYN) data packet, the first SYN data packet being a first SYN data packet in a TCP handshake phase.

[0013] Before the first data packet and the flow identification information are sent to the network side device, the method further includes:

[0014] adding the flow identification information in an optional field of a header of the first SYN data packet;

[0015] The first data packet and the flow identification information are sent to the network side device, including:

[0016] The first SYN data packet is sent to the network side device.

[0017] Optionally, the data flow is a user datagram protocol (UDP) data flow, and the first data packet is a UDP data packet.

[0018] Before the first data packet and the flow identification information are sent to the network side device, the method further includes:

[0019] constructing a first guide UDP data packet, wherein the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is same as the target five-tuple information;

[0020] The first data packet and the flow identification information are sent to the network side device, including:

[0021] The UDP data packet and the first guide UDP data packet are sent to the network side device.

[0022] Optionally, after the source identification information of the first data packet is identified, the method further includes:

[0023] determining flow feature information and authentication feature information corresponding to the source identification information according to user preset information;

[0024] The flow identification information further includes the traffic feature information and authentication feature information, and the authentication feature information is used to instruct the network side device to authenticate the user side device in a case where the authentication feature information indicates that an authentication mode is a strong authentication mode.

[0025] Optionally, in a case where the data flow is a TCP data flow, the method further includes:

[0026] In a case where the second SYN data packet sent by the network side device is received, first encrypted authentication information carried in a header of the second SYN data packet is acquired; the second SYN data packet is a second SYN data packet in a TCP handshake stage, and is a response data packet of the first SYN data packet;

[0027] The first encrypted authentication information is decrypted according to target key information to obtain a first random number sequence; the target key information matches the user identifier information;

[0028] A first difference value sequence is randomly generated, and the first random number sequence and the first difference value sequence are added to obtain a second random number sequence;

[0029] The first difference value sequence and the second random number sequence are encrypted according to the target key information to obtain second encrypted authentication information;

[0030] In a case where a third SYN data packet of the data flow is listened to, the second encrypted authentication information is added to an optional field of a header of the third SYN data packet; the third SYN data packet is a third SYN data packet in a TCP handshake stage, and is a response data packet of the second SYN data packet;

[0031] The third SYN data packet is sent to the network side device;

[0032] The third SYN data packet is used for the network side device to authenticate the user side device according to the first encrypted authentication information and the second encrypted authentication information.

[0033] Optionally, in a case where the data flow is a UDP data flow, the method further includes:

[0034] In a case where a second guide UDP data packet sent by the network side device is received, third encrypted authentication information carried in the second guide UDP data packet is acquired;

[0035] The third encrypted authentication information is decrypted according to target key information to obtain a fourth random number sequence; the target key information matches the user identifier information;

[0036] a third difference value sequence is randomly generated, and the third difference value sequence is added to the fourth random sequence to obtain a fifth random sequence;

[0037] According to the target key information, the third difference value sequence and the fifth random sequence are encrypted to obtain fourth encrypted authentication information;

[0038] A third guide UDP data packet is constructed; wherein the five-tuple information of the third guide UDP data packet is the same as the target five-tuple information, and the third guide UDP data packet carries the fourth encrypted authentication information;

[0039] The third guide UDP data packet is sent to the network side device;

[0040] The third guide UDP data packet is used for the network side device to authenticate the user side device according to the third encrypted authentication information and the fourth encrypted authentication information.

[0041] Optionally, the flow identification information is used to instruct the network side device to perform flow scheduling on a second data packet of the data stream according to the source identification information based on an HQoS scheduling model when the second data packet is received and the five-tuple information of the second data packet is the same as the target five-tuple information, wherein the target five-tuple information is the five-tuple information of the first data packet.

[0042] In a second aspect, an embodiment of the present application further provides a flow scheduling method applied to a network side device, and the method comprises the following steps:

[0043] A first data packet of a data stream and flow identification information are received, wherein the flow identification information comprises source identification information of the first data packet, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is sourced, and the application identification information is used to identify an application program from which the first data packet is sourced.

[0044] Target five-tuple information of the first data packet is obtained, and the target five-tuple information is associated with the source identification information.

[0045] When a second data packet of the data stream is received and the five-tuple information of the second data packet is the same as the target five-tuple information, flow scheduling is performed on the second data packet according to the source identification information, wherein the second data packet comprises the first data packet.

[0046] Optionally, the network side device is a network edge device.

[0047] Optionally, the data stream is a transmission control protocol (TCP) data stream, and the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase.

[0048] The first data packet and the flow identification information of the data stream sent by the terminal-side device are received.

[0049] The first SYN data packet sent by the terminal-side device is received, and a header of the first SYN data packet carries the flow identification information.

[0050] Optionally, the data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet.

[0051] The first data packet and the flow identification information of the data stream sent by the terminal-side device are received.

[0052] The UDP data packet and a first guide UDP data packet sent by the terminal-side device are received, wherein the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is the same as the target five-tuple information.

[0053] Optionally, the flow identification information further includes traffic characteristic information and authentication characteristic information of the first data packet, and after the first data packet and the flow identification information of the data stream sent by the terminal-side device are received, the method further includes:

[0054] In a case where the authentication characteristic information indicates that an authentication mode is a strong authentication mode, the user-side device is authenticated.

[0055] In a case where the second data packet of the data stream is received, and five-tuple information of the second data packet is the same as the target five-tuple information, the second data packet is subjected to traffic scheduling according to the source identification information.

[0056] In a case where the second data packet of the data stream is received, and five-tuple information of the second data packet is the same as the target five-tuple information, and the user-side device is authenticated successfully, the second data packet is subjected to traffic scheduling according to the source identification information.

[0057] Optionally, in a case where the data stream is a TCP data stream, the authentication of the user-side device includes:

[0058] A first target random number sequence is generated.

[0059] encrypt the first target random number sequence according to target key information, to obtain first encrypted authentication information, the target key information matching the user identification information;

[0060] add the first encrypted authentication information in an optional field of a header of a second SYN data packet; wherein the second SYN data packet is a second SYN data packet in a TCP handshake stage, and is a response data packet of the first SYN data packet;

[0061] send the second SYN data packet to the user-side device;

[0062] in a case where a third SYN data packet sent by the user-side device is received, obtain second encrypted authentication information carried in a header of the third SYN data packet;

[0063] decrypt the second encrypted authentication information according to the target key information, to obtain a second difference value sequence and a third random number sequence;

[0064] add the first target random number sequence and the second difference value sequence, to obtain a first target sequence;

[0065] in a case where the first target sequence is the same as the third random number sequence, determine that the user-side device is authenticated successfully.

[0066] Optionally, in a case where the data stream is a UDP data stream, the authenticating the user-side device comprises:

[0067] generate a second target random number sequence;

[0068] encrypt the second target random number sequence according to target key information, to obtain third encrypted authentication information, the target key information matching the user identification information;

[0069] construct a second guide UDP data packet; wherein the second guide UDP data packet carries the third encrypted authentication information, and five-tuple information of the second guide UDP data packet is the same as the target five-tuple information;

[0070] send the second guide UDP data packet to the user-side device;

[0071] in a case where a third guide UDP data packet sent by the user-side device is received, obtain fourth encrypted authentication information carried in the third guide UDP data packet;

[0072] decrypt the fourth encrypted authentication information according to the target key information, to obtain a fourth difference value sequence and a sixth random number sequence;

[0073] add the second target random number sequence and the fourth difference value sequence to obtain a second target sequence;

[0074] In a case where the second target sequence is the same as the sixth random number sequence, it is determined that the user-side device is authenticated successfully.

[0075] Optionally, the traffic scheduling of the second data packet according to the source identification information comprises:

[0076] The traffic scheduling of the second data packet is performed according to the source identification information and based on an HQoS scheduling model.

[0077] Optionally, the traffic scheduling of the second data packet according to the source identification information and based on the HQoS scheduling model comprises:

[0078] According to the source identification information, a traffic scheduling strategy of the second data packet is determined, and the traffic scheduling strategy comprises a traffic scheduling level and a traffic scheduling algorithm.

[0079] An HQoS label used for indicating the traffic scheduling strategy is generated.

[0080] The HQoS label is added to metadata of a target Mbuf structure corresponding to the second data packet.

[0081] The target Mbuf structure is input into the HQoS scheduling model, so that the HQoS scheduling model performs traffic scheduling processing on the target Mbuf structure according to an HQoS label carried by the target Mbuf structure.

[0082] In a third aspect, an embodiment of the present application provides a user-side device, and the device comprises:

[0083] A first identification module is configured to identify source identification information of a first data packet of a data stream in a case where the first data packet is listened to, wherein the source identification information comprises user identification information and application identification information, the user identification information is used for identifying a user terminal from which the first data packet is sourced, and the application identification information is used for identifying an application program from which the first data packet is sourced.

[0084] A first generation module is configured to generate flow identification information, and the flow identification information comprises the source identification information.

[0085] A first sending module is configured to send the first data packet and the flow identification information to a network-side device.

[0086] The flow identification information is used to instruct the network side device to perform flow scheduling on the second data packet according to the source identification information in a case that the network side device receives the second data packet of the data flow and five-tuple information of the second data packet is same as target five-tuple information, the target five-tuple information being five-tuple information of the first data packet, the second data packet including the first data packet.

[0087] Optionally, the user side device is a user agent device.

[0088] Optionally, the data flow is a transmission control protocol (TCP) data flow, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the device further includes:

[0089] a first adding module, configured to add the flow identification information in an optional field of a header of the first SYN data packet;

[0090] The first sending module is configured to:

[0091] send the first SYN data packet to the network side device.

[0092] Optionally, the data flow is a user datagram protocol (UDP) data flow, and the first data packet is a UDP data packet; the device further includes:

[0093] a first constructing module, configured to construct a first guide UDP data packet; the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is same as the target five-tuple information;

[0094] The first sending module is configured to:

[0095] send the UDP data packet and the first guide UDP data packet to the network side device.

[0096] Optionally, the device further includes:

[0097] a first determining module, configured to determine flow characteristic information and authentication characteristic information corresponding to the source identification information according to user preset information;

[0098] The flow identification information further includes the flow characteristic information and the authentication characteristic information, and the authentication characteristic information is used to instruct the network side device to perform authentication on the user side device in a case that the authentication characteristic information represents that an authentication mode is a strong authentication mode.

[0099] Optionally, in a case that the data flow is a TCP data flow, the device further includes:

[0100] The first obtaining module is configured to obtain first encrypted authentication information carried in a header of a second SYN data packet in a case where the second SYN data packet is received, wherein the second SYN data packet is a second SYN data packet in a TCP handshake stage and is a response data packet of the first SYN data packet.

[0101] The first decryption module is configured to decrypt the first encrypted authentication information according to target key information to obtain a first random number sequence, wherein the target key information matches the user identifier information.

[0102] The second generation module is configured to randomly generate a first difference value sequence and add the first random number sequence and the first difference value sequence to obtain a second random number sequence.

[0103] The first encryption module is configured to encrypt the first difference value sequence and the second random number sequence according to the target key information to obtain second encrypted authentication information.

[0104] The second adding module is configured to add the second encrypted authentication information in an optional field of a header of a third SYN data packet in a case where the third SYN data packet of the data stream is listened to, wherein the third SYN data packet is a third SYN data packet in a TCP handshake stage and is a response data packet of the second SYN data packet.

[0105] The second sending module is configured to send the third SYN data packet to the network side device.

[0106] The third SYN data packet is used for the network side device to authenticate the user side device according to the first encrypted authentication information and the second encrypted authentication information.

[0107] Optionally, in a case where the data stream is a UDP data stream, the device further comprises:

[0108] The second obtaining module is configured to obtain third encrypted authentication information carried in a second guide UDP data packet in a case where the second guide UDP data packet is received.

[0109] The second decryption module is configured to decrypt the third encrypted authentication information according to target key information to obtain a fourth random number sequence, wherein the target key information matches the user identifier information.

[0110] The third generation module is configured to randomly generate a third difference value sequence and add the third difference value sequence and the fourth random number sequence to obtain a fifth random number sequence.

[0111] a second encryption module configured to encrypt the third difference sequence and the fifth random sequence according to the target key information to obtain fourth encrypted authentication information;

[0112] a second construction module configured to construct a third guide UDP data packet, wherein the five-tuple information of the third guide UDP data packet is the same as the target five-tuple information, and the third guide UDP data packet carries the fourth encrypted authentication information;

[0113] a third sending module configured to send the third guide UDP data packet to the network side device;

[0114] The third guide UDP data packet is used for the network side device to authenticate the user side device according to the third encrypted authentication information and the fourth encrypted authentication information.

[0115] Optionally, the stream identification information is used to instruct the network side device to perform flow scheduling on a second data packet of the data stream according to the source identification information based on an HQoS scheduling model when the second data packet is received and the five-tuple information of the second data packet is the same as target five-tuple information, wherein the target five-tuple information is the five-tuple information of the first data packet.

[0116] In a fourth aspect, an embodiment of the present application provides a network side device, which comprises:

[0117] a first receiving module configured to receive a first data packet and stream identification information of a data stream sent by a terminal side device, wherein the stream identification information comprises source identification information of the first data packet, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is sourced, and the application identification information is used to identify an application program from which the first data packet is sourced;

[0118] a third obtaining module configured to obtain target five-tuple information of the first data packet and associate the target five-tuple information with the source identification information;

[0119] a flow scheduling module configured to perform flow scheduling on a second data packet of the data stream according to the source identification information when the second data packet is received and the five-tuple information of the second data packet is the same as target five-tuple information, wherein the second data packet comprises the first data packet.

[0120] Optionally, the network side device is a network edge device.

[0121] Optionally, the data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the first receiving module is configured to:

[0122] receive the first SYN data packet sent by the terminal-side device, the header of the first SYN data packet carrying the flow identification information.

[0123] Optionally, the data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; the first receiving module is configured to:

[0124] receive the UDP data packet and a first guide UDP data packet sent by the terminal-side device, the first guide UDP data packet carrying the flow identification information, and the five-tuple information of the first guide UDP data packet being the same as the target five-tuple information.

[0125] Optionally, the flow identification information further includes traffic characteristic information and authentication characteristic information of the first data packet; the device further includes:

[0126] an authentication module configured to, in a case where the authentication characteristic information indicates that an authentication mode is a strong authentication mode, authenticate the user-side device;

[0127] the traffic scheduling module is configured to:

[0128] in a case where a second data packet of the data stream is received, the five-tuple information of the second data packet is the same as the target five-tuple information, and the user-side device is authenticated successfully, perform traffic scheduling on the second data packet according to the source identification information.

[0129] Optionally, in a case where the data stream is a TCP data stream, the authentication module includes:

[0130] a first generation unit configured to generate a first target random number sequence;

[0131] a first encryption unit configured to encrypt the first target random number sequence according to target key information matched with the user identification information to obtain first encrypted authentication information;

[0132] a first adding unit configured to add the first encrypted authentication information in an optional field of a header of a second SYN data packet, the second SYN data packet being a second SYN data packet in the TCP handshake phase and being a response data packet of the first SYN data packet.

[0133] The first sending unit is configured to send the second SYN data packet to the user-side device.

[0134] The first obtaining unit is configured to, in a case where the third SYN data packet sent by the user-side device is received, obtain second encryption authentication information carried in a header of the third SYN data packet.

[0135] The first decryption unit is configured to decrypt the second encryption authentication information according to the target key information, to obtain a second difference sequence and a third random sequence.

[0136] The first calculation unit is configured to add the first target random sequence and the second difference sequence, to obtain a first target sequence.

[0137] The first authentication unit is configured to, in a case where the first target sequence is the same as the third random sequence, determine that the user-side device is authenticated successfully.

[0138] Optionally, in a case where the data stream is a UDP data stream, the authentication module comprises:

[0139] The second generation unit is configured to generate a second target random sequence.

[0140] The second encryption unit is configured to encrypt the second target random sequence according to target key information, to obtain third encryption authentication information, the target key information matching the user identifier information.

[0141] The first construction unit is configured to construct a second guide UDP data packet; wherein the second guide UDP data packet carries the third encryption authentication information, and five-tuple information of the second guide UDP data packet is the same as the target five-tuple information.

[0142] The second sending unit is configured to send the second guide UDP data packet to the user-side device.

[0143] The second obtaining unit is configured to, in a case where a third guide UDP data packet sent by the user-side device is received, obtain fourth encryption authentication information carried in the third guide UDP data packet.

[0144] The second decryption unit is configured to decrypt the fourth encryption authentication information according to the target key information, to obtain a fourth difference sequence and a sixth random sequence.

[0145] The second calculation unit is configured to add the second target random sequence and the fourth difference sequence, to obtain a second target sequence.

[0146] The second authentication unit is configured to determine that the user-side device is authenticated successfully in a case where the second target sequence is the same as the sixth random sequence.

[0147] Optionally, the traffic scheduling module is configured to:

[0148] scheduling the second data packet based on a HQoS scheduling model according to the source identification information.

[0149] Optionally, the traffic scheduling module comprises:

[0150] The first determining unit is configured to determine a traffic scheduling strategy of the second data packet according to the source identification information, wherein the traffic scheduling strategy comprises a traffic scheduling level and a traffic scheduling algorithm.

[0151] The third generating unit is configured to generate a HQoS label used for indicating the traffic scheduling strategy.

[0152] The second adding unit is configured to add the HQoS label into metadata of a target Mbuf structure corresponding to the second data packet.

[0153] The traffic scheduling unit is configured to input the target Mbuf structure into the HQoS scheduling model, so that the HQoS scheduling model performs traffic scheduling processing on the target Mbuf structure according to the HQoS label carried by the target Mbuf structure.

[0154] In a fifth aspect, an embodiment of the present application further provides a user-side device, comprising a transceiver and a processor,

[0155] The processor is configured to:

[0156] In a case where a first data packet of a data flow is listened to, source identification information of the first data packet is identified, wherein the source identification information comprises user identification information and application identification information, the user identification information is used for identifying a user terminal from which the first data packet is sourced, and the application identification information is used for identifying an application program from which the first data packet is sourced.

[0157] Flow identification information is generated, wherein the flow identification information comprises the source identification information.

[0158] The transceiver is configured to:

[0159] The transceiver is configured to:

[0160] The flow identification information is used to instruct the network side device to perform flow scheduling on a second data packet of the data flow according to the source identification information in a case where the network side device receives the second data packet and five-tuple information of the second data packet is same as target five-tuple information, the target five-tuple information being five-tuple information of the first data packet, the second data packet including the first data packet.

[0161] Optionally, the user side device is a user agent device.

[0162] Optionally, the data flow is a transmission control protocol (TCP) data flow, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the processor is further configured to:

[0163] add the flow identification information in an optional field of a header of the first SYN data packet;

[0164] The transceiver is configured to:

[0165] send the first SYN data packet to the network side device.

[0166] Optionally, the data flow is a user datagram protocol (UDP) data flow, and the first data packet is a UDP data packet; the processor is further configured to:

[0167] construct a first guide UDP data packet; the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is same as the target five-tuple information;

[0168] The transceiver is configured to:

[0169] send the UDP data packet and the first guide UDP data packet to the network side device.

[0170] Optionally, the processor is further configured to:

[0171] determine flow characteristic information and authentication characteristic information corresponding to the source identification information according to user preset information;

[0172] The flow identification information further includes the flow characteristic information and the authentication characteristic information, and the authentication characteristic information is used to instruct the network side device to perform authentication on the user side device in a case where the authentication characteristic information represents that an authentication mode is a strong authentication mode.

[0173] Optionally, in a case where the data flow is a TCP data flow, the processor is further configured to:

[0174] In a case that the second SYN packet sent by the network side device is received, first encrypted authentication information carried in a header of the second SYN packet is acquired; wherein the second SYN packet is a second SYN packet in a TCP handshake stage, and is a response packet of the first SYN packet;

[0175] According to target key information, the first encrypted authentication information is decrypted to obtain a first random number sequence, and the target key information matches the user identifier information;

[0176] A first difference value sequence is randomly generated, and the first random number sequence and the first difference value sequence are added to obtain a second random number sequence;

[0177] According to the target key information, the first difference value sequence and the second random number sequence are encrypted to obtain second encrypted authentication information;

[0178] In a case that a third SYN packet of the data stream is listened to, the second encrypted authentication information is added in an optional field of a header of the third SYN packet; wherein the third SYN packet is a third SYN packet in a TCP handshake stage, and is a response packet of the second SYN packet;

[0179] The transceiver is further configured to:

[0180] The transceiver is further configured to:

[0181] The third SYN packet is used for the network side device to authenticate the user side device according to the first encrypted authentication information and the second encrypted authentication information.

[0182] Optionally, in a case that the data stream is a UDP data stream, the processor is further configured to:

[0183] In a case that a second guide UDP packet sent by the network side device is received, third encrypted authentication information carried in the second guide UDP packet is acquired;

[0184] According to target key information, the third encrypted authentication information is decrypted to obtain a fourth random number sequence, and the target key information matches the user identifier information;

[0185] A third difference value sequence is randomly generated, and the third difference value sequence and the fourth random number sequence are added to obtain a fifth random number sequence;

[0186] According to the target key information, the third difference value sequence and the fifth random number sequence are encrypted to obtain fourth encrypted authentication information;

[0187] constructing a third guide UDP data packet; wherein the quintuple information of the third guide UDP data packet is the same as the target quintuple information, and the third guide UDP data packet carries the fourth encrypted authentication information;

[0188] The transceiver is further configured to:

[0189] send the third guide UDP data packet to the network side device;

[0190] The third guide UDP data packet is used for the network side device to authenticate the user side device according to the third encrypted authentication information and the fourth encrypted authentication information.

[0191] Optionally, the flow identification information is used to instruct the network side device to perform flow scheduling on a second data packet of the data flow according to the source identification information based on an HQoS scheduling model in a case where the second data packet is received and the quintuple information of the second data packet is the same as target quintuple information, the target quintuple information being the quintuple information of the first data packet.

[0192] In a sixth aspect, an embodiment of the present application further provides a network side device, comprising a transceiver and a processor,

[0193] The transceiver is configured to:

[0194] receive a first data packet and flow identification information of a data flow sent by a terminal side device; wherein the flow identification information comprises source identification information of the first data packet, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is sourced, and the application identification information is used to identify an application program from which the first data packet is sourced;

[0195] The processor is configured to:

[0196] obtain target quintuple information of the first data packet, and associate the target quintuple information with the source identification information;

[0197] perform flow scheduling on a second data packet of the data flow according to the source identification information in a case where the second data packet is received and the quintuple information of the second data packet is the same as target quintuple information, the second data packet comprising the first data packet.

[0198] Optionally, the network side device is a network edge device.

[0199] Optionally, the data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; and the transceiver is configured to:

[0200] receive the first SYN data packet sent by the terminal-side device, the header of the first SYN data packet carrying the flow identification information.

[0201] Optionally, the data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; and the transceiver is configured to:

[0202] receive the UDP data packet and a first guide UDP data packet sent by the terminal-side device, the first guide UDP data packet carrying the flow identification information, and the five-tuple information of the first guide UDP data packet being the same as the target five-tuple information.

[0203] Optionally, the flow identification information further includes traffic characteristic information and authentication characteristic information of the first data packet; and the processor is further configured to:

[0204] in a case where the authentication characteristic information indicates that the authentication mode is a strong authentication mode, authenticate the user-side device;

[0205] in a case where a second data packet of the data stream is received, the five-tuple information of the second data packet is the same as the target five-tuple information, and the user-side device is authenticated successfully, perform traffic scheduling on the second data packet according to the source identification information.

[0206] Optionally, in a case where the data stream is a TCP data stream, the processor is configured to:

[0207] generate a first target random number sequence;

[0208] encrypt the first target random number sequence according to target key information to obtain first encrypted authentication information, the target key information matching the user identification information;

[0209] add the first encrypted authentication information in an optional field of a header of a second SYN data packet, the second SYN data packet being a second SYN data packet in the TCP handshake phase and being a response data packet of the first SYN data packet;

[0210] the transceiver is further configured to:

[0211] send the second SYN data packet to the user-side device;

[0212] the processor is configured to:

[0213] In a case where the third SYN data packet sent by the user-side device is received, second encryption authentication information carried in a header of the third SYN data packet is acquired;

[0214] According to the target key information, the second encryption authentication information is decrypted to obtain a second difference sequence and a third random sequence;

[0215] The first target random sequence and the second difference sequence are added to obtain a first target sequence;

[0216] In a case where the first target sequence is the same as the third random sequence, it is determined that the user-side device is authenticated successfully.

[0217] Optionally, in a case where the data stream is a UDP data stream, the processor is configured to:

[0218] generate a second target random sequence;

[0219] According to target key information, the second target random sequence is encrypted to obtain third encryption authentication information, and the target key information matches the user identifier information;

[0220] construct a second guide UDP data packet; wherein the second guide UDP data packet carries the third encryption authentication information, and five-tuple information of the second guide UDP data packet is the same as the target five-tuple information;

[0221] The transceiver is further configured to:

[0222] send the second guide UDP data packet to the user-side device;

[0223] The processor is configured to:

[0224] In a case where the third guide UDP data packet sent by the user-side device is received, fourth encryption authentication information carried in the third guide UDP data packet is acquired;

[0225] According to the target key information, the fourth encryption authentication information is decrypted to obtain a fourth difference sequence and a sixth random sequence;

[0226] The second target random sequence and the fourth difference sequence are added to obtain a second target sequence;

[0227] In a case where the second target sequence is the same as the sixth random sequence, it is determined that the user-side device is authenticated successfully.

[0228] Optionally, the processor is configured to:

[0229] According to the source identification information, the second data packet is subjected to traffic scheduling based on a HQoS scheduling model.

[0230] Optionally, the processor is configured to:

[0231] According to the source identification information, a traffic scheduling strategy of the second data packet is determined, the traffic scheduling strategy including a traffic scheduling level and a traffic scheduling algorithm.

[0232] A HQoS label indicating the traffic scheduling strategy is generated.

[0233] The HQoS label is added to metadata of a target Mbuf structure corresponding to the second data packet.

[0234] The target Mbuf structure is input into the HQoS scheduling model, so that the HQoS scheduling model performs traffic scheduling processing on the target Mbuf structure according to the HQoS label carried by the target Mbuf structure.

[0235] In a seventh aspect, an embodiment of the present application further provides a user-side device, including a processor, a memory, and a program stored in the memory and executable on the processor, and when the program is executed by the processor, the steps of the traffic scheduling method in the first aspect are implemented.

[0236] In an eighth aspect, an embodiment of the present application further provides a network-side device, including a processor, a memory, and a program stored in the memory and executable on the processor, and when the program is executed by the processor, the steps of the traffic scheduling method in the second aspect are implemented.

[0237] In a ninth aspect, an embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the traffic scheduling method in the first aspect are implemented, or when the computer program is executed by a processor, the steps of the traffic scheduling method in the second aspect are implemented.

[0238] In the embodiment of the present application, by adding flow identification information to a data stream, the source of the data stream is identified by a network-side device according to the flow identification information, different network protocols of multiple generations can be better compatible, and based on the characteristics of the data stream, no identification information needs to be added to each data packet, the amount of data modification is small, and the computational overhead and data transmission burden of the user-side device and the network-side device can be reduced. BRIEF DESCRIPTION OF DRAWINGS

[0239] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the description of the embodiments of the present application will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0240] Figure 1 is one of the flow diagrams of the flow scheduling method provided by the embodiments of the present application;

[0241] Figure 2 is the second flow diagram of the flow scheduling method provided by the embodiments of the present application;

[0242] Figure 3 is one of the interaction diagrams of the flow identification process provided by the embodiments of the present application;

[0243] Figure 4 is the second interaction diagram of the flow identification process provided by the embodiments of the present application;

[0244] Figure 5 is the general structure of the TCP option added with flow identification provided by the embodiments of the present application;

[0245] Figure 6 is the general structure of the guide UDP data packet added with flow identification provided by the embodiments of the present application;

[0246] Figure 7 is the structural diagram of the flow scheduling system provided by the embodiments of the present application;

[0247] Figure 8 is the modular diagram of the SD-WAN edge device provided by the embodiments of the present application;

[0248] Figure 9 is one of the structural diagrams of the user side device provided by the embodiments of the present application;

[0249] Figure 10 is one of the structural diagrams of the network side device provided by the embodiments of the present application;

[0250] Figure 11 is the second structural diagram of the user side device provided by the embodiments of the present application;

[0251] Figure 12 is the second structural diagram of the network side device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0252] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those ordinarily skilled in the art without creative efforts should fall into the scope of the present application.

[0253] The capability of the network side device to identify the user application program (APP) can also be referred to as the awareness capability of the network to the APP. In the IPv6 application scenario, the programmable space provided by the IPv6 data packet is usually utilized, and the APP supporting APN6 adds application information in the programmable space of the IPv6 extension header. The network side device can perceive the application program and its demand by analyzing the IPv6 extension header, so as to perform traffic scheduling and resource adjustment on the data flow of the application program by the network side device. However, the above traffic identification scheme is only based on the IPv6 network, cannot adapt to the update and development of network technology, and needs to add a protocol header for each packet, which results in large data redundancy.

[0254] The embodiments of the present application provide a traffic scheduling method, which is not limited to the APN6 scheme in the IPv6 network, and does not need to add a protocol header for each packet, so the data modification amount is low and the calculation amount is small.

[0255] Please refer to Figure 1 , all of the drawings are flowcharts of a traffic scheduling method provided by the embodiments of the present application, the traffic scheduling method is applied to a user side device, and the method comprises the following steps:

[0256] Step 101: In the case of listening to a first data packet of a data flow, identify the source identification information of the first data packet. The source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is originated, and the application identification information is used to identify an application program from which the first data packet is originated.

[0257] In the specific implementation, the user side device can query and determine the user terminal and the application program from which the first data packet is originated according to the type of the transport layer protocol and the port number of the first data packet in the local operating system.

[0258] Step 102: Generate flow identification information. The flow identification information comprises the source identification information.

[0259] In the specific implementation, the implementation form of the flow identification information is not limited, and can be specifically determined according to the network protocol characteristics to which the data flow belongs.

[0260] Step 103: Send the first data packet and the flow identification information to a network side device.

[0261] The flow identification information is used to instruct the network side device to perform flow scheduling on the second data packet according to the source identification information in the case that the network side device receives the second data packet of the data flow and the five-tuple information of the second data packet is the same as the target five-tuple information, the target five-tuple information being the five-tuple information of the first data packet, and the second data packet including the first data packet.

[0262] The embodiments of the present application can be applied to a software-defined wide area network (SD-WAN). Specifically, the network side device can be an SD-WAN edge device. When the network side device receives the first data packet and the flow identification information, the network side device can read the user identification information and the application identification information in the flow identification information and record the connection. The network side device can also associate the flow identification information with the target five-tuple information and establish a mapping relationship between the flow identification information and the five-tuple information, i.e., a mapping relationship from a certain user and a certain application to the five-tuple information. In addition, the network side device can determine the application requirement by analyzing the source identification information, thereby determining the flow scheduling strategy for the first data packet. The network side device can also associate the flow scheduling strategy with the target five-tuple information and establish a mapping relationship between the five-tuple information and the flow scheduling strategy. In this way, based on the data flow and the five-tuple information as the medium, when the network side device receives other data packets of the data flow with the same five-tuple information as the first data packet, the network side device can determine the corresponding flow scheduling strategy according to the target five-tuple, without the need for the user side device to perform source identification on each data packet. In other words, the flow identification information is used to identify the data flow, which is no longer limited to the IPv6 network, but can use multiple generations of network protocols, and does not need to add identification information to each data packet, has a small amount of data modification, and can reduce the computational overhead and data transmission burden of the user side device and the network side device.

[0263] In a specific implementation, the implementation form of the flow identification information can be designed according to the protocol characteristics of different network protocols. For example, for a Transmission Control Protocol (TCP), the TCP protocol is a connection-oriented protocol, and has a relatively clear and stable processing flow. Both parties need to establish, maintain and disconnect the TCP connection through the handshake and waving stages. Optionally, the flow identification information can be added in the optional field of the TCP header in the TCP handshake stage, so as to establish the flow identification for the TCP data flow in the connection establishment process. For a User Datagram Protocol (UDP), the UDP is a connectionless protocol, and the data flow has no obvious start or end mark. In addition, the UDP header is simple, and no optional field is set. Considering that the UDP packet loss, out-of-order and other problems need to be processed by the upper layer protocol, if unknown data packets appear in the UDP data flow, it usually does not affect the user side device and the network side device. Optionally, the self-constructed UDP data packet can be mixed in the original UDP data flow, and the constructed UDP data packet is used to establish the flow identification for the UDP data flow.

[0264] The implementation forms of the flow identification for the TCP and UDP network protocols are described below.

[0265] For the TCP network protocol, the data flow is a TCP data flow.

[0266] Optionally, the first data packet is a first Synchronize Sequence Numbers (SYN) data packet, and the first SYN data packet is the first SYN data packet in the TCP handshake stage.

[0267] Before step 103, the traffic scheduling method further includes:

[0268] The flow identification information is added in the optional field of the header of the first SYN data packet.

[0269] Step 103 includes:

[0270] The first SYN data packet is sent to the network side device.

[0271] In this embodiment, when the TCP initiates the connection, the first data packet is a SYN data packet. The user side device can add a self-defined optional field in the header of the SYN data packet, including user identification information, such as an Identity document (ID), and application identification information, such as an APP ID.

[0272] In a specific implementation, the TCP header is located behind the Internet header, stores information specific to the TCP protocol, and can add optional fields with a length of no more than 60 bytes at the end to support new protocols. The flow identification information involved in the embodiment can be added to the optional fields.

[0273] In an optional embodiment, the user-side device is a user agent device. Using the user agent device, each user terminal does not need to be configured, is compatible with the currently commonly used APP, and supports personalized configuration of agents for different users and has strong controllability.

[0274] In a specific implementation, the user agent device can set a proxy on the user terminal and intercept a local communication process. For a monitored data flow, the user agent device can intercept a local packet sending protocol stack, intercept a first SYN data packet sent from the local terminal, and determine a user terminal and an application program from which the first SYN data packet is sent according to a transmission layer protocol type and a port number in a local operating system. If the APP is a protected APP, a flow identification process can be started: flow identification information is added to a header of the SYN data packet.

[0275] It should be noted that for the TCP network protocol, if a Finish (FIN) data packet is received by the network-side device, it indicates that the data flow transmission is completed. The network-side device can delete the corresponding traffic scheduling configuration.

[0276] For the UDP network protocol, the data flow is a UDP data flow.

[0277] Optionally, the first data packet is a UDP data packet.

[0278] Before the first data packet and the flow identification information are sent to the network-side device, the method further includes:

[0279] The first guide UDP data packet is constructed, where the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is the same as the target five-tuple information.

[0280] The first data packet and the flow identification information are sent to the network-side device, including:

[0281] The UDP data packet and the first guide UDP data packet are sent to the network-side device.

[0282] In the embodiment, when the user-side device monitors that there is a UDP data flow, a guide UDP data packet can be constructed using the same five-tuple information as the current UDP data packet, and carries user identification information such as a user ID and application identification information such as an APP ID. In a specific implementation, the user identification information and the application identification information do not need to be encapsulated in the TCP header, but can be directly placed in the payload of the guide UDP data packet.

[0283] In an optional embodiment, the user-side device is a user agent device. The user agent device can monitor a local packet sending protocol stack, monitor UDP packets sent from or to the local, but does not intercept the processing of the packets by the kernel protocol stack.

[0284] It should be noted that for the UDP network protocol, the network-side device can exit based on a timeout mechanism, and if the network-side device does not receive any UDP packet within a certain time, it indicates that the data stream transmission is complete. The network-side device can delete the corresponding traffic scheduling configuration.

[0285] Optionally, after step 101, the traffic scheduling method further comprises:

[0286] According to the user preset information, the traffic characteristic information and the authentication characteristic information corresponding to the source identification information are determined. The flow identification information further includes the traffic characteristic information and the authentication characteristic information, and the authentication characteristic information is used for the network-side device to authenticate the user-side device in the case that the authentication characteristic information represents that the authentication mode is a strong authentication mode.

[0287] In this embodiment, the network-side device can determine whether to authenticate the user-side device according to the actual situation. In specific implementation, the user-side device can select the corresponding traffic characteristic information, such as the traffic level, for the user terminal and the APP according to the user preset traffic scheduling related information, and select the corresponding authentication mode, such as the strong authentication mode or the simple authentication mode. The user-side device can write the traffic characteristic information and the authentication characteristic information into the flow identification information, for example, in the TCP protocol, the traffic characteristic information and the authentication characteristic information are also added to the optional field of the TCP header and sent to the network-side device together with the data packet; or in the UDP protocol, the traffic characteristic information and the authentication characteristic information are written into the payload of the constructed guide UDP packet.

[0288] In the strong authentication mode, the network-side device needs to authenticate the user-side device first to improve the security of subsequent data transmission and traffic scheduling. In an optional embodiment, the TCP protocol or the UDP protocol supports encrypted data transmission, which is different from the APN6 scheme that can only transmit APP and user information in plaintext. In this embodiment, authentication can be based on encrypted data, without exposing APP and user information in the network.

[0289] In the case that the network-side device successfully authenticates the user-side device, the network-side device can perform traffic scheduling on the data packets in the data stream of the user-side device according to the mapping relationship between the source identification information and the five-tuple information, and the mapping relationship between the five-tuple information and the traffic scheduling strategy.

[0290] The authentication implementation forms of the two network protocols TCP and UDP are described below:

[0291] For the TCP network protocol:

[0292] Optionally, the traffic scheduling method further includes the following steps:

[0293] In the case of receiving the second SYN data packet sent by the network side device, the first encrypted authentication information carried in the header of the second SYN data packet is obtained. The second SYN data packet is the second SYN data packet in the TCP handshake stage, and is the response data packet of the first SYN.

[0294] According to the target key information, the first encrypted authentication information is decrypted to obtain the first random number sequence, and the target key information matches the user identifier information.

[0295] The first difference value sequence is randomly generated, and the first random number sequence and the first difference value sequence are added to obtain the second random number sequence.

[0296] According to the target key information, the first difference value sequence and the second random number sequence are encrypted to obtain the second encrypted authentication information.

[0297] In the case of listening to the third SYN data packet of the data stream, the second encrypted authentication information is added to the optional field of the header of the third SYN data packet. The third SYN data packet is the third SYN data packet in the TCP handshake stage, and is the response data packet of the second SYN data packet.

[0298] The third SYN data packet is sent to the network side device. The third SYN data packet is used for the network side device to authenticate the user side device according to the first encrypted authentication information and the second encrypted authentication information.

[0299] In this embodiment, in the TCP handshake stage, the user side device sends the first SYN data packet to the network side device, the network side device can return the second SYN data packet as a response, and the user side device sends the third SYN data packet to the network side device again to complete the handshake. The authentication of the user side device can be realized by using the three times handshake message.

[0300] In a specific implementation, after receiving the first SYN data packet, the network-side device can read the user identifier information and the application identifier information in the flow identifier information to record the connection. In addition, the network-side device also reads the authentication feature information in the flow identifier information. In the case that the authentication feature information represents that the authentication mode is the strong authentication mode, the network-side device needs to authenticate the user-side device. Specifically, the network-side device can add the first encrypted authentication information required for authentication to the optional field of the header of the second SYN data packet. In an optional implementation, the first encrypted authentication information can be an encrypted random number sequence. The network-side device can randomly generate a first target random number sequence A, and use the symmetric key Φ user encrypt the first target random number sequence A to obtain the first encrypted authentication information A'.

[0301] After receiving the second SYN data packet sent by the network-side device, the user-side device can read the first encrypted authentication information A' carried in the header, and use the symmetric key Φ user decrypt the first encrypted authentication information A' to obtain the first random number sequence As. The user-side device can randomly generate a first difference value sequence Δs1, and add the first difference value sequence Δs1 to the second random number sequence Bs obtained by decrypting to obtain a second random number sequence Bs. Then, the user-side device can use the symmetric key Φ user encrypt the first difference value sequence Δs1 and the second random number sequence Bs to obtain the second encrypted authentication information B', and add the second encrypted authentication information B' to the optional field of the header of the third SYN data packet to be sent to the network-side device.

[0302] After receiving the third SYN data packet, the network-side device can read the second encrypted authentication information B' carried in the header, and use the symmetric key Φ user decrypt the second encrypted authentication information B' to obtain the second difference value sequence Δ1 and the third random number sequence B. If the first target number sequence obtained by adding the first target random number sequence A and the second difference value sequence Δ1 is the same as the third random number sequence B, that is, A+Δ1=B, the encrypted information is matched successfully, which represents that the user-side device is authenticated successfully.

[0303] For the UDP network protocol:

[0304] Optionally, the traffic scheduling method further includes the following steps:

[0305] In the case that the second guide UDP data packet sent by the network-side device is received, the third encrypted authentication information carried in the second guide UDP data packet is obtained.

[0306] According to the target key information, the third encrypted authentication information is decrypted to obtain a fourth random number sequence, and the target key information matches the user identifier information.

[0307] A third difference value sequence is randomly generated, and the third difference value sequence is added to a fourth random number sequence to obtain a fifth random number sequence.

[0308] The third difference value sequence and the fifth random number sequence are encrypted according to target key information to obtain fourth encrypted authentication information.

[0309] A third guide UDP packet is constructed. The quintuple information of the third guide UDP packet is the same as the target quintuple information, and the third guide UDP packet carries the fourth encrypted authentication information.

[0310] The third guide UDP packet is sent to a network side device. The third guide UDP packet is used for the network side device to authenticate the user side device according to the third encrypted authentication information and the fourth encrypted authentication information.

[0311] In a specific implementation, after receiving the first guide UDP packet, the network side device can read the user identifier information and the application identifier information in the stream identifier information to record the connection. In addition, the network side device also reads the authentication feature information in the stream identifier information. In the case where the authentication feature information represents a strong authentication mode, the network side device needs to authenticate the user side device. Specifically, the network side device can construct a second guide UDP packet, and write the third encrypted authentication information required for authentication into the payload of the second guide UDP packet. The third encrypted authentication information can be an encrypted random number sequence. The network side device can randomly generate a second target random number sequence C, and use a symmetric key Φ user The second target random number sequence C is encrypted to obtain the third encrypted authentication information C'.

[0312] After receiving the second guide UDP packet sent by the network side device, the user side device can read the third encrypted authentication information C' carried in the header, and use its own symmetric key Φ user The third encrypted authentication information C' is decrypted to obtain a fourth random number sequence Cs. The user side device can randomly generate a third difference value sequence Δs2, and add the third difference value sequence Δs2 to the fourth random number sequence Cs obtained by decryption to obtain a fifth random number sequence Ds. Then, the user side device can use Φ user encrypt the third difference value sequence Δs2 and the fifth random number sequence Ds to obtain fourth encrypted authentication information D', and construct a third guide UDP packet, and write the fourth encrypted authentication information D' into the payload of the third guide UDP packet.

[0313] After receiving the third guide UDP packet, the network side device can read the fourth encrypted authentication information D' carried therein, and use the symmetric key Φ userThe fourth encrypted authentication information D' is decrypted to obtain the fourth difference sequence Δ2 and the sixth random number sequence D. If the second target random number sequence C and the fourth difference sequence Δ2 added together are the same as the sixth random number sequence D, that is, C+Δ2=D, the encrypted information is matched successfully, indicating that the user side device authentication is successful.

[0314] It should be noted that, optionally, the flow identification information is used to indicate that the network side device, in the case of receiving a second data packet of a data flow and the five-tuple information of the second data packet being the same as the target five-tuple information, performs flow scheduling on the second data packet according to the source identification information based on a hierarchical quality of service (HQoS) scheduling model.

[0315] In other words, in an optional implementation, the network side device is configured with an HQoS scheduling model, and after identifying the source of the data flow, the data packets in the data flow can be scheduled based on the pre-configured HQoS scheduling model. In specific implementation, the HQoS scheduling model can rely on the HQoS function provided by the Data Plane Development Kit (DPDK). The DPDK can provide a five-layer scheduling model including Ethernet ports, sub-ports, pipes, traffic classes, queues, etc.

[0316] The DPDK HQoS function relies on the computer bottom layer, and all scheduling strategies need to be determined in the configuration file at compile time, and need to be reloaded when changed. To reduce the burden of frequent updates, in an optional implementation, in the HQoS scheduling model configured by the network side device, multiple scheduling schemes can be preset, such as bandwidth limitation at each level, token bucket size and rate, weighted values of round-robin scheduling, etc. Based on the first layer mapping relationship of "a user a APP" to the five-tuple information and the second layer mapping relationship of the five-tuple information to the flow scheduling strategy, users can freely select and combine scheduling strategies, and adapt to the highly dynamic settings of user terminals through two-layer mapping.

[0317] In specific implementation, the process of the network side device performing flow scheduling on the data packet based on the HQoS scheduling model can include the following steps:

[0318] According to the source identification information, determine the flow scheduling strategy of the second data packet, and the flow scheduling strategy includes a flow scheduling level and a flow scheduling algorithm;

[0319] Generate an HQoS label for indicating the flow scheduling strategy;

[0320] Add the HQoS label to the metadata of the target Mbuf structure corresponding to the second data packet;

[0321] The target Mbuf structure HQoS scheduling model is set so that the HQoS scheduling model performs traffic scheduling processing on the target Mbuf structure according to the HQoS tag carried by the target Mbuf structure.

[0322] In order to efficiently access data, the DPDK can encapsulate the memory into an m_buf structure, which is the carrier of packet processing and is transferred among various processing modules of the network side device. It mainly includes metadata and packet data. Among them, the metadata part is used to store the information required by the DPDK for processing the packet.

[0323] In the embodiment, when specifically implemented, the network side device can add a 12-bit HQoS tag in the m_buf metadata of the DPDK original, which is used to correspond to the multiple traffic scheduling strategies preset in the HQoS scheduling model. After the network side device identifies the flow identification information in the data stream and establishes the two-layer mapping relationship from "a user and an APP" to the five-tuple information and from the five-tuple information to the traffic scheduling strategy, it can process all subsequent second data packets matching the target five-tuple information to generate the HQoS tag and add it to the metadata of the target Mbuf structure, which is used to indicate the HQoS scheduling strategy and the HQoS scheduling level allocated in the DPDK five-layer scheduling structure, and provide scheduling basis for the HQoS scheduling model.

[0324] In the embodiment of the application, by adding flow identification information to the data stream, the network side device can identify the source of the data stream according to the flow identification information, be more compatible with multiple different network protocols, and based on the characteristics of the data stream, without adding identification information to the data packets one by one, the data modification amount is small, which can reduce the computational overhead and data transmission burden of the user side device and the network side device.

[0325] Please refer to Figure 2 , all are flowcharts of a traffic scheduling method provided by the embodiment of the application, the traffic scheduling method is applied to a network side device, and the method comprises the following steps:

[0326] Step 201, receiving a first data packet and flow identification information of a data stream sent by a terminal side device.

[0327] The flow identification information comprises source identification information of the first data packet, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is sourced, and the application identification information is used to identify an application program from which the first data packet is sourced.

[0328] Step 202, obtaining target five-tuple information of the first data packet and associating the target five-tuple information with the source identification information.

[0329] Step 203: in a case where a second data packet of the data stream is received and five-tuple information of the second data packet is same as target five-tuple information, performing traffic scheduling on the second data packet according to the source identification information, the second data packet comprising the first data packet.

[0330] Optionally, the network-side device is a network edge device.

[0331] Optionally, the data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; step 201 comprises:

[0332] receiving the first SYN data packet sent by the terminal-side device, a header of the first SYN data packet carrying the flow identification information.

[0333] Optionally, the data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; step 201 comprises:

[0334] receiving the UDP data packet and a first guide UDP data packet sent by the terminal-side device; wherein the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is same as the target five-tuple information.

[0335] Optionally, the flow identification information further comprises traffic characteristic information and authentication characteristic information of the first data packet; after step 201, the method further comprises:

[0336] in a case where the authentication characteristic information indicates that an authentication mode is a strong authentication mode, performing authentication on the user-side device.

[0337] Step 203 comprises:

[0338] in a case where a second data packet of the data stream is received and five-tuple information of the second data packet is same as target five-tuple information, and authentication on the user-side device is successful, performing traffic scheduling on the second data packet according to the source identification information.

[0339] Optionally, in a case where the data stream is a TCP data stream, the authentication on the user-side device comprises:

[0340] generating a first target random number sequence;

[0341] encrypt the first target random number sequence according to target key information, to obtain first encrypted authentication information, the target key information matching the user identification information;

[0342] add the first encrypted authentication information in an optional field of a header of a second SYN data packet; wherein the second SYN data packet is a second SYN data packet in a TCP handshake stage, and is a response data packet of the first SYN data packet;

[0343] send the second SYN data packet to the user-side device;

[0344] in a case where a third SYN data packet sent by the user-side device is received, obtain second encrypted authentication information carried in a header of the third SYN data packet;

[0345] decrypt the second encrypted authentication information according to the target key information, to obtain a second difference value sequence and a third random number sequence;

[0346] add the first target random number sequence and the second difference value sequence, to obtain a first target sequence;

[0347] in a case where the first target sequence is the same as the third random number sequence, determine that the user-side device is authenticated successfully.

[0348] optionally, in a case where the data stream is a UDP data stream, the authenticating the user-side device comprises:

[0349] generate a second target random number sequence;

[0350] encrypt the second target random number sequence according to target key information, to obtain third encrypted authentication information, the target key information matching the user identification information;

[0351] construct a second guide UDP data packet; wherein the second guide UDP data packet carries the third encrypted authentication information, and five-tuple information of the second guide UDP data packet is the same as the target five-tuple information;

[0352] send the second guide UDP data packet to the user-side device;

[0353] in a case where a third guide UDP data packet sent by the user-side device is received, obtain fourth encrypted authentication information carried in the third guide UDP data packet;

[0354] decrypt the fourth encrypted authentication information according to the target key information, to obtain a fourth difference value sequence and a sixth random number sequence;

[0355] Add the second target random number sequence and the fourth difference value sequence to obtain a second target sequence;

[0356] In a case where the second target sequence is the same as the sixth random number sequence, it is determined that the user-side device is authenticated successfully.

[0357] Optionally, the traffic scheduling of the second data packet according to the source identification information comprises:

[0358] The traffic scheduling of the second data packet according to the source identification information comprises:

[0359] Optionally, the traffic scheduling of the second data packet according to the source identification information comprises:

[0360] The traffic scheduling of the second data packet according to the source identification information comprises:

[0361] The HQoS label for indicating the traffic scheduling strategy is generated.

[0362] The HQoS label is added to the metadata of a target Mbuf structure corresponding to the second data packet.

[0363] The target Mbuf structure is input into the HQoS scheduling model, so that the HQoS scheduling model performs traffic scheduling processing on the target Mbuf structure according to the HQoS label carried by the target Mbuf structure.

[0364] It should be noted that the present embodiment is an implementation corresponding to the network-side device in the above method embodiment, and the specific implementation can be referred to the related description in the above method embodiment. To avoid repetition, the present embodiment will not be described again.

[0365] A specific implementation of the present embodiment is described below.

[0366] I. Traffic identification part

[0367] (I) Flow identification design for TCP protocol

[0368] TCP protocol is a connection-oriented protocol, and has a relatively clear and stable processing flow. Both parties need to establish, maintain and disconnect TCP connection through the handshake and waving stage. In the TCP handshake stage, the TCP header option is added, and the HQoS guarantee is established in the process of connection establishment. Compared with the method of adding identification to each packet, the present method only processes in the handshake stage, which can save the packet repair operation cost and data transmission amount.

[0369] In a specific implementation, the TCP packet is sent from the user terminal APP, flows through the user terminal agent, the SD-WAN edge device (edge router), and finally reaches the server. The processing flow can be as shown in the following figure. Figure 3

[0370] Step 1: When TCP initiates a connection, the first data packet is a SYN data packet. The user agent device adds a custom optional header (type I) in the TCP header, including authentication mode identification information (simple mode or strong authentication mode), user ID, APP ID, expected HQoS scheduling level, authentication information (optional), and the like. If it is a simple mode, it jumps to step 4, and if it is a strong authentication mode, it jumps to step 2.

[0371] Step 2: After the SD-WAN edge device receives the SYN data packet, the user ID in the authentication information field in the header is read, and the connection is recorded. The server sends back a SYN response (Acknowledge, ACK) data packet, which is represented as SYN+ACK in the figure, and adds a custom optional header (type II) in the TCP header, including a string of random numbers encrypted using the symmetric key of the user.

[0372] Step 3: After the user agent device receives the SYN+ACK packet, the encrypted random number is read and decrypted using the symmetric key of the user, and then a certain difference is added, which is encrypted using the symmetric key of the user and attached to the custom optional header (type III) of the third handshake data packet SYN. The SD-WAN edge device receives the packet, decrypts it using the symmetric key of the user, and performs matching authentication. The specific authentication method can refer to the description in the above embodiment, which is not repeated here. If it matches, the authentication is successful, and it jumps to step 4.

[0373] Step 4: The SD-WAN edge device establishes HQoS guarantee and starts data (Data) transmission based on HQoS guarantee.

[0374] Step 5: If the SD-WAN edge device receives a FIN data packet, it indicates that the transmission is complete, and the current corresponding HQoS configuration is deleted.

[0375] (II) Design of flow identification for UDP protocol

[0376] ​UDP protocol is a connectionless protocol, and the data stream has no obvious start or end mark, and the UDP header is simple and has no optional header. The problems such as message loss and disorder are handled by the upper layer protocol. Based on this, the occurrence of unknown messages in the UDP data stream will not affect the sending and receiving parties. For the data stream of the UDP protocol, the form of mixing the guide data packet in the original message is used to establish the corresponding HQoS guarantee for the APP, and the processing flow can be as shown in Figure 4

[0377] Step 1: When the user agent device monitors that there is a UDP data stream, it checks whether the HQoS guarantee has been established according to the five-tuple information, and if not, it uses the same five-tuple to construct a guide UDP data packet (type I), authentication mode identification information (simple mode or strong authentication mode), user ID, APP ID, expected HQoS scheduling level, authentication information (optional), and mixes them in the original data stream and sends them together. If it is a simple mode, it jumps to step 4, and if it is a strong authentication mode, it jumps to step 2.

[0378] Step 2: After the SD-WAN edge device receives the guide UDP data packet (type I), it reads the user ID of the authentication information, records the connection, and constructs a guide UDP data packet (type II) carrying a string of random numbers encrypted using the symmetric key of the user, and sends it to the user agent device.

[0379] Step 3: After the user agent device receives the guide UDP data packet (type II), it reads the encrypted random number and uses the symmetric key of the user to decrypt it, then adds a certain difference randomly generated, and then uses the symmetric key of the user to encrypt it to construct a guide UDP data packet (type III) and send it to the user agent device, while discarding the guide UDP data packet (type II) and not sending it to the user agent device. The SD-WAN edge device receives the guide UDP data packet (type III), uses the symmetric key of the user to decrypt it, and performs matching authentication. The specific authentication method can refer to the description in the above embodiment, which will not be repeated here. If it matches, the authentication is successful, and it jumps to step 4.

[0380] Step 4: The SD-WAN edge device establishes the HQoS guarantee and starts the data (Data) transmission based on the HQoS guarantee.

[0381] Step 5: Timeout exit mechanism. If the SD-WAN edge device does not receive the UDP data packet within a period of time, it deletes the current corresponding HQoS configuration.

[0382] (Three) Protocol details and message format

[0383] ​The TCP header follows the internet header and provides information specific to the TCP protocol. Optional fields of up to 60 bytes in length can be added at the end to support new protocols. Among them, experimental options are used for protocol testing. The Internet Engineering Task Force (IETF) reserves TCP options with labels 253 and 254 for experimental use and specifies the related format to ensure the robustness of experimental TCP options and avoid incompatible or conflicting situations.

[0384] The TCP option has a general structure, with the first byte being the code point (kind) and the second byte being the option length. In experimental TCP options, the code point is set to 253 and 254. Followed by a 2-byte or 4-byte experimental identifier (ExID) to distinguish the experimental category. In this embodiment, the general structure of the TCP option designed for HQoS flow identification can be as shown in Figure 5 , and the specific description is as follows:

[0385] Code point (Kind): 1 byte, in this embodiment, it is selected as the experimental code point 243.

[0386] Length (Length): 1 byte, used to indicate the length of the TCP option.

[0387] Experimental identifier (ExID): 2 bytes.

[0388] Authentication mode (Type): 1 byte, used to identify the authentication mode, 0x01 represents the simple authentication mode, and 0x02 represents the strong authentication mode.

[0389] Flag bit (Flags): 1 byte, in the strong authentication mode, used to identify the interaction process. From right to left, the first three bits respectively identify types I to III mentioned in the previous process. The rest are not defined.

[0390] Service class (Service Class): 2 bytes, 4-bit HQoS level plus 12-bit APP ID. Corresponding to the required HQoS scheduling level and APP identification. In this embodiment, according to the preset DPDK scheduling model, each user has 13 TCs (traffic classes) and a total of 16 queues, and the agent can select the queue level by itself, identified by 4 bits. The 12-bit APP ID is used to record the APP information.

[0391] User ID (User ID): 3 bytes, unique user identification.

[0392] Reserved bit (Reserved): 1 byte, not defined at present.

[0393] Authentication information (Encryption): 4 bytes, optional field, used to store authentication information, in type II, it is the encrypted random number generated by the SD-WAN edge device, in type III, it is the result returned after the random number is calculated by the user agent device and then encrypted again.

[0394] The content of the guide UDP packet is similar to the TCP HQoS option header, but does not need to be encapsulated in the TCP header, but directly put into the UDP payload, as shown in Figure 6 , the specific description can refer to the corresponding description of the TCP option general structure as shown in Figure 5 , which will not be repeated here. It should be noted that the guide UDP packet is not limited by the TCP option header format, and does not need the Kind field, but considering the field alignment problem, and for unified formatting and simple processing, the Kind=253 field can be reserved, and the Kind+ExID field can be used as a specific flag, which facilitates the SD-WAN edge device to quickly identify the HQoS guide packet.

[0395] (Four) System architecture of protocol implementation

[0396] The traffic scheduling system implemented by the protocol includes user agent devices corresponding to user terminals, SD-WAN edge devices corresponding to network side servers, and controllers, as shown in Figure 7 . Among them, the controller is responsible for negotiating with the user agent device when a new user registers, completing user registration and issuing symmetric keys. And communicate with the SD-WAN edge device, issue user authentication information, and control the traffic identification and forwarding strategy of the SD-WAN edge device. The user agent device is located on the user terminal side, and obtains the local APP information through the user terminal device operating system, intercepts the protocol stack and proxies the local TCP or UDP communication process, and adds a private protocol to the user-specified APP to identify the corresponding flow information. The SD-WAN edge device and the user agent device complete the authentication process, identify the flow identification, and perceive the traffic information of different users and different APPs in the network. The specific description is as follows:

[0397] (1) User agent device

[0398] Set up a proxy on the user terminal to intercept the local communication process. For the monitored data flow, according to the local port, query the APP belonging to the local system. If it is a protected APP, start the flow identification process. No cooperation is needed on the APP side, and it has strong compatibility for current various APPs.

[0399] For TCP flow, the processing flow is as follows:

[0400] Step 1: Intercept the local packet protocol stack: intercept the TCP SYN data packet sent from the local machine.

[0401] Step 2: Determine the APP to which the data stream belongs: According to the type of transport layer protocol and port number, the relevant APP is queried through the local operating system. If it is a protected APP traffic, go to Step 3 for processing. Otherwise, go to Step 4.

[0402] Step 3: Add TCP optional header (Type I): According to the user's intended policy, select the traffic level and authentication method for the APP. Construct a TCP optional header of Type I and attach it to the SYN packet.

[0403] Step 4: Send message: Hand over the message to the kernel protocol stack for processing. If the authentication method is strong authentication mode, record the data stream information and go to Step 5, otherwise end the process.

[0404] Step 5: Listen to the local packet protocol stack: If it is a TCP optional header (Type II), go to Step 6, otherwise loop Step 5.

[0405] Step 6: Authentication phase 1: Read the random number A in the authentication information (Encryption) field of the header, use the secret key Φ user After decryption, a certain difference Δ is randomly generated, and the result B is obtained by adding Δ to the random number A. Use Φ user Encrypt Δ and B, construct a TCP optional header (Type III). Return the SYN+ACK packet to the protocol stack for processing, and wait for the third handshake message from the user terminal to arrive.

[0406] Step 7: Authentication phase 2: Intercept the third handshake message, attach the TCP optional header (Type III) to it, return it to the protocol stack for processing, and end the process.

[0407] For UDP streams, the processing flow is as follows:

[0408] Step 1: Listen to the local packet protocol stack: Listen to the UDP packets sent from or to the local machine, but do not interrupt the kernel protocol stack's processing of the packets.

[0409] Step 2: Check if a stream identifier has been established for the data stream. If not, go to Step 3, otherwise loop Step 1.

[0410] Step 3: Determine the APP to which the data stream belongs: According to the type of transport layer protocol and port number, the relevant APP is queried through the local operating system. If it is a protected APP traffic, go to Step 4 for processing. Otherwise, loop Step 5.

[0411] Step 4: Constructing the guide UDP packet (Type I): According to the user's intended strategy, select the traffic level and authentication method for the APP. Construct the Type I guide message and send it. If the authentication method is strong authentication, jump to Step 5, otherwise end the process.

[0412] Step 5: Listening to the local packet protocol stack: If it is a guide UDP packet (Type II), jump to Step 6, otherwise loop Step 5.

[0413] Step 6: Authentication phase 1: Read the random number A in the Encryption field of the message, use the user's secret key Φ user After decryption, randomly generate a difference Δ and add it to the random number A to get the result B. Use Φ user Encrypt Δ and B, construct a guide UDP packet (Type III).

[0414] Step 7: Authentication phase 2: Send the guide UDP packet (Type III) and end the process.

[0415] (2) SD-WAN edge device

[0416] Responsible for completing the authentication process with the user agent device, implementing flow identification function, and establishing the mapping of APP-pentuple. Its processing flow is as follows:

[0417] Step 1: Receive TCP SYN packet with additional option header (or guide UDP packet Type I), record UserID, Service Class field, and current IP pentuple information. If the authentication mode is strong authentication mode, jump to Step 2, otherwise jump to Step 4.

[0418] Step 2: Authentication phase 1: Generate a string of random numbers A, use the user's secret key Φ user After encryption, use it as the Encryption field to construct the optional header Type II, wait for the server to send back the SYN+ACK packet, and write the header (or construct the guide UDP packet Type II and send it directly to the user terminal).

[0419] Step 3: Authentication phase 2: Receive handshake packet with additional option header Type III (or guide UDP packet Type III), read the Encryption field, use the user's secret key Φ user After decryption, obtain Δ and B, if A+Δ=B, then authentication is successful, jump to Step 4, otherwise jump to Step 5.

[0420] Step 4: Identify traffic: According to the identification result, implement flow identification according to the user type and APP type, and end the process.

[0421] Step 5: Default level: authentication failed traffic, use the mapping to the default level, end the process.

[0422] II. HQoS scheduling part

[0423] After the SD-WAN edge device completes flow identification, it needs to specifically implement differentiated scheduling processing for different users and different APP traffic. In this embodiment, the SD-WAN edge device takes the DPDK HQoS module as the bottom layer implementation, establishes a "flow identification module-Access Control List (ACL) module-HQoS module" double-layer mapping mechanism, to solve the mismatching problem between the highly dynamic user characteristics and the relatively fixed DPDK HQoS policy.

[0424] As shown in Figure 8 , the flow identification module establishes the first layer mapping of "a certain user a certain APP" to "IP five-tuple"; the ACL module establishes the second layer mapping of "IP five-tuple" to "HQoS scheduling policy and level"; and the HQoS module determines the HQoS scheduling policy to implement specific scheduling according to the HQoS label mapped by the ACL module. In the two-layer mapping relationship, since the ACL module can be dynamically configured by users and managers, the dynamic nature of the first layer mapping relationship can be achieved, the configuration can take effect quickly at the moment of change, and the relative static of the second layer mapping result can be achieved, to ensure stable operation of the system. The specific description is as follows:

[0425] (1) Flow identification module. The flow identification module can implement the function of traffic identification, and can complete the authentication process in cooperation with the user agent device when necessary. For details, please refer to the description of the first part-traffic identification part above, which will not be repeated here. The flow identification module establishes the first layer mapping, i.e. the mapping of "a certain user a certain APP" to "IP five-tuple", through the above-mentioned traffic identification protocol.

[0426] (2) HQoS module. This module relies on the HQoS function provided by DPDK. DPDK can provide a five-layer scheduling model of Ethernet port, sub-port, pipe, traffic class, and queue, among which only the Ethernet port corresponds to a specific physical port, and the remaining four layers are logical structures without corresponding physical meaning. In this embodiment, each logical level is mapped to the physical meaning in SD-WAN, as shown in Table 1.

[0427] DPDK logical hierarchy SD-WAN scheduling hierarchy port physical network card subport tunnel pipe user traffic class APP queue buffer queue

[0428] Table 1 Mapping between DPDK logical levels and SDWAN scheduling levels

[0429] The DPDK HQoS function relies on the computer bottom layer, and all scheduling strategies need to be determined by a configuration file at the time of compilation, and need to be reloaded when changed. To reduce the burden of frequent updates, the present embodiment can preset multiple scheduling schemes in the HQoS module, such as bandwidth limitation at each level, token bucket size and rate, weighted values of round-robin scheduling, etc. Different mappings are generated through the ACL module, so that users can freely select and combine scheduling strategies, and adapt to the highly dynamic settings of user terminals through two-layer mapping.

[0430] (3) ACL module. The ACL module is an access control module provided by DPDK, which can classify input data packets according to a set of classification rules. In order to efficiently access data, DPDK encapsulates memory into an Mbuf structure, which is the carrier of packet processing and flows through various processing modules. It mainly includes metadata and packet data. The metadata part is used to store the information required by DPDK for processing the packet.

[0431] In the present embodiment, the ACL module is located after the flow identification module, and plays a transitional role between flow identification and DPDK HQoS, and makes up for the difference in dynamic changes. In the original Mbuf metadata of DPDK, a 12-bit HQoS tag is added, which is used to correspond to the multiple scheduling schemes preset in the HQoS module. After the flow identification module establishes the mapping from “a user a APP” to “IP five-tuple”, the ACL module adds the corresponding HQoS tag to the metadata of the Mbuf of all data packets matching the five-tuple, indicating the allocated HQoS strategy and level in the DPDK five-layer scheduling structure, and providing scheduling basis for the HQoS module. The ACL module can be dynamically configured by users and managers to map the dynamic characteristics of user behavior to relatively stable HQoS model strategies.

[0432] The key points of the present embodiment are as follows:

[0433] (1) For TCP protocol, an optional header is inserted in the handshake phase to identify the flow at APP granularity, and the header format and interaction process are designed accordingly. For UDP protocol, a guide packet is mixed in the data stream to identify the flow at APP granularity, and the packet format and interaction process are designed accordingly.

[0434] (2) A strong authentication mode is provided, and an encrypted authentication process between the user agent device and the SD-WAN edge device is designed accordingly.

[0435] (3) A user agent device is used on the user terminal side to intercept the local communication protocol, and a private protocol is added to it, so as to realize the flow identification function at APP level under the compatibility of current APP and network protocol.

[0436] (4) For the SD-WAN edge device, a double-layer mapping scheduling system of a flow identification module-ACL module-HQoS module is designed, the ACL module with a dynamic mapping relationship is used to map the dynamic characteristics of user behaviors to the relatively stable HQoS model strategy, and the mismatching of the dynamic characteristics of the two is solved.

[0437] The protocol of the embodiment has strong applicability, can support networks such as IPv4 and IPv6, has strong compatibility, does not need to be adaptively configured for a user terminal by using a user agent device on the user terminal side, is compatible with multiple types of APPs, supports user personalized configuration agents, has strong controllability, has improved lightness, has low data modification amount and small calculation amount, and has improved security by providing an encryption authentication scheme, and user and APP information cannot be exposed in a network.

[0438] Please refer to Figure 9 , Figure 9 is a user side device provided by an embodiment of the application.

[0439] As shown in Figure 9 , the user side device 900 includes:

[0440] A first identification module 901 is configured to identify source identification information of a first data packet of a data flow when the first data packet is listened to, wherein the source identification information includes user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is sourced, and the application identification information is used to identify an application program from which the first data packet is sourced.

[0441] A first generation module 902 is configured to generate flow identification information, wherein the flow identification information includes the source identification information.

[0442] A first sending module 903 is configured to send the first data packet and the flow identification information to a network side device.

[0443] The flow identification information is used to instruct the network side device to perform flow scheduling on a second data packet of the data flow according to the source identification information when the second data packet is received and five tuple information of the second data packet is the same as target five tuple information, the target five tuple information is five tuple information of the first data packet, and the second data packet includes the first data packet.

[0444] Optionally, the user side device is a user agent device.

[0445] Optionally, the data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; and the device further includes:

[0446] a first adding module, configured to add the flow identification information in an optional field of a header of the first SYN data packet;

[0447] the first sending module 903 is configured to:

[0448] send the first SYN data packet to the network-side device.

[0449] Optionally, the data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; and the device further includes:

[0450] a first constructing module, configured to construct a first guide UDP data packet; wherein the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is the same as the target five-tuple information;

[0451] the first sending module 903 is configured to:

[0452] send the UDP data packet and the first guide UDP data packet to the network-side device.

[0453] Optionally, the device further includes:

[0454] a first determining module, configured to determine, according to user preset information, traffic characteristic information and authentication characteristic information corresponding to the source identification information;

[0455] wherein the flow identification information further includes the traffic characteristic information and the authentication characteristic information, and the authentication characteristic information is used to instruct the network-side device to authenticate the user-side device in a case where the authentication characteristic information represents that an authentication mode is a strong authentication mode.

[0456] Optionally, in a case where the data stream is a TCP data stream, the device further includes:

[0457] a first obtaining module, configured to, in a case where a second SYN data packet sent by the network-side device is received, obtain first encrypted authentication information carried in a header of the second SYN data packet; wherein the second SYN data packet is a second SYN data packet in a TCP handshake phase, and is a response data packet of the first SYN data packet;

[0458] The first decryption module is configured to decrypt the first encrypted authentication information according to target key information, to obtain a first random number sequence, wherein the target key information matches the user identifier information;

[0459] The second generation module is configured to randomly generate a first difference value sequence, and add the first random number sequence and the first difference value sequence to obtain a second random number sequence;

[0460] The first encryption module is configured to encrypt the first difference value sequence and the second random number sequence according to the target key information, to obtain second encrypted authentication information;

[0461] The second addition module is configured to add the second encrypted authentication information in an optional field of a header of a third SYN data packet of the data stream, in a case that the third SYN data packet is listened to, wherein the third SYN data packet is a third SYN data packet in a TCP handshake stage, and is a response data packet of the second SYN data packet;

[0462] The second sending module is configured to send the third SYN data packet to the network side device;

[0463] The third SYN data packet is used for the network side device to authenticate the user side device according to the first encrypted authentication information and the second encrypted authentication information.

[0464] Optionally, in a case that the data stream is a UDP data stream, the device further comprises:

[0465] The second acquisition module is configured to acquire third encrypted authentication information carried in a second guide UDP data packet in a case that the second guide UDP data packet sent by the network side device is received;

[0466] The second decryption module is configured to decrypt the third encrypted authentication information according to target key information, to obtain a fourth random number sequence, wherein the target key information matches the user identifier information;

[0467] The third generation module is configured to randomly generate a third difference value sequence, and add the third difference value sequence and the fourth random number sequence to obtain a fifth random number sequence;

[0468] The second encryption module is configured to encrypt the third difference value sequence and the fifth random number sequence according to the target key information, to obtain fourth encrypted authentication information;

[0469] a second construction module, configured to construct a third guided UDP data packet; wherein a five-tuple information of the third guided UDP data packet is same as the target five-tuple information, and the third guided UDP data packet carries the fourth encrypted authentication information;

[0470] a third sending module, configured to send the third guided UDP data packet to the network side device;

[0471] The third guided UDP data packet is used for the network side device to authenticate the user side device according to the third encrypted authentication information and the fourth encrypted authentication information.

[0472] Optionally, the flow identification information is used to instruct the network side device to perform flow scheduling on a second data packet of the data flow according to the source identification information based on an HQoS scheduling model in a case that the second data packet is received and a five-tuple information of the second data packet is same as target five-tuple information, the target five-tuple information being the five-tuple information of the first data packet.

[0473] The user side device 900 can implement Figure 1 each process of the method embodiment shown in the figure, and can achieve the same beneficial effects. To avoid repetition, details are not described here.

[0474] Please refer to Figure 10 , Figure 10 is a network side device provided by an embodiment of the application.

[0475] As Figure 10 shown, the network side device 1000 comprises:

[0476] a first receiving module 1001 configured to receive a first data packet and flow identification information of a data flow sent by a terminal side device; wherein the flow identification information comprises source identification information of the first data packet, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is sourced, and the application identification information is used to identify an application program from which the first data packet is sourced;

[0477] a third obtaining module 1002 configured to obtain target five-tuple information of the first data packet and associate the target five-tuple information with the source identification information;

[0478] a flow scheduling module 1003 configured to perform flow scheduling on a second data packet of the data flow according to the source identification information in a case that the second data packet is received and a five-tuple information of the second data packet is same as target five-tuple information, the second data packet comprising the first data packet.

[0479] Optionally, the network-side device is a network edge device.

[0480] Optionally, the data flow is a transmission control protocol (TCP) data flow, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the first receiving module 1001 is configured to:

[0481] receive the first SYN data packet sent by the terminal-side device, and a header of the first SYN data packet carries the flow identification information.

[0482] Optionally, the data flow is a user datagram protocol (UDP) data flow, and the first data packet is a UDP data packet; the first receiving module 1001 is configured to:

[0483] receive the UDP data packet and a first guide UDP data packet sent by the terminal-side device, wherein the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is the same as the target five-tuple information.

[0484] Optionally, the flow identification information further includes traffic characteristic information and authentication characteristic information of the first data packet; the device further includes:

[0485] an authentication module configured to, in a case where the authentication characteristic information represents that an authentication mode is a strong authentication mode, authenticate the user-side device.

[0486] The traffic scheduling module 1003 is configured to:

[0487] in a case where a second data packet of the data flow is received, five-tuple information of the second data packet is the same as the target five-tuple information, and the user-side device is authenticated successfully, perform traffic scheduling on the second data packet according to the source identification information.

[0488] Optionally, in a case where the data flow is a TCP data flow, the authentication module includes:

[0489] a first generation unit configured to generate a first target random number sequence;

[0490] a first encryption unit configured to encrypt the first target random number sequence according to target key information to obtain first encrypted authentication information, wherein the target key information matches the user identification information.

[0491] The first adding unit is configured to add the first encrypted authentication information in an optional field of a header of a second SYN packet; the second SYN packet is a second SYN packet in a TCP handshake stage, and is a response packet of the first SYN packet;

[0492] The first sending unit is configured to send the second SYN packet to the user-side device;

[0493] The first obtaining unit is configured to, in a case where a third SYN packet sent by the user-side device is received, obtain second encrypted authentication information carried in a header of the third SYN packet;

[0494] The first decrypting unit is configured to decrypt the second encrypted authentication information according to the target key information, to obtain a second difference sequence and a third random sequence;

[0495] The first calculating unit is configured to add the first target random sequence and the second difference sequence, to obtain a first target sequence;

[0496] The first authentication unit is configured to, in a case where the first target sequence is the same as the third random sequence, determine that the user-side device is authenticated successfully.

[0497] Optionally, in a case where the data stream is a UDP data stream, the authentication module comprises:

[0498] The second generating unit is configured to generate a second target random sequence;

[0499] The second encrypting unit is configured to encrypt the second target random sequence according to target key information, to obtain third encrypted authentication information; the target key information matches the user identifier information;

[0500] The first constructing unit is configured to construct a second guide UDP packet; the second guide UDP packet carries the third encrypted authentication information, and five-tuple information of the second guide UDP packet is the same as the target five-tuple information;

[0501] The second sending unit is configured to send the second guide UDP packet to the user-side device;

[0502] The second obtaining unit is configured to, in a case where a third guide UDP packet sent by the user-side device is received, obtain fourth encrypted authentication information carried in the third guide UDP packet;

[0503] The second decrypting unit is configured to decrypt the fourth encrypted authentication information according to the target key information, to obtain a fourth difference sequence and a sixth random sequence;

[0504] a second calculation unit, configured to add the second target random number sequence and the fourth difference value sequence to obtain a second target sequence;

[0505] a second authentication unit, configured to determine that the user-side device is authenticated successfully in a case where the second target sequence is same as the sixth random number sequence.

[0506] Optionally, the traffic scheduling module 1003 is configured to:

[0507] scheduling the second data packet based on a HQoS scheduling model according to the source identification information.

[0508] Optionally, the traffic scheduling module 1003 includes:

[0509] a first determination unit, configured to determine a traffic scheduling strategy of the second data packet according to the source identification information, the traffic scheduling strategy including a traffic scheduling level and a traffic scheduling algorithm;

[0510] a third generation unit, configured to generate a HQoS label used for indicating the traffic scheduling strategy;

[0511] a second adding unit, configured to add the HQoS label to metadata of a target Mbuf structure corresponding to the second data packet;

[0512] a traffic scheduling unit, configured to input the target Mbuf structure into the HQoS scheduling model, so that the HQoS scheduling model performs traffic scheduling processing on the target Mbuf structure according to the HQoS label carried by the target Mbuf structure.

[0513] The network-side device 1000 can implement Figure 2 each process implemented by the method embodiments shown in the drawings, and can achieve the same beneficial effects. To avoid repetition, details are not described here.

[0514] Specifically, referring to Figure 11 The embodiments of the present application also provide a user-side device, which includes a bus 1101, a transceiver 1102, an antenna 1103, a bus interface 1104, a processor 1105 and a memory 1106.

[0515] The processor 1105 is configured to:

[0516] In a case that a first data packet of the data flow is listened to, source identification information of the first data packet is identified; wherein the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal of the first data packet source, and the application identification information is used to identify an application program of the first data packet source;

[0517] The flow identification information is generated, and the flow identification information comprises the source identification information;

[0518] The transceiver 1102 is configured to:

[0519] The transceiver 1102 is configured to:

[0520] The flow identification information is used to instruct the network side device to perform flow scheduling on a second data packet of the data flow according to the source identification information in a case that the second data packet is received and five tuple information of the second data packet is same as target five tuple information, the target five tuple information is five tuple information of the first data packet, and the second data packet comprises the first data packet.

[0521] Optionally, the user side device is a user agent device.

[0522] Optionally, the data flow is a transmission control protocol (TCP) data flow, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the processor 1105 is further configured to:

[0523] The flow identification information is added in an optional field of a header of the first SYN data packet.

[0524] The transceiver 1102 is configured to:

[0525] The transceiver 1102 is configured to:

[0526] Optionally, the data flow is a user datagram protocol (UDP) data flow, and the first data packet is a UDP data packet; the processor 1105 is further configured to:

[0527] A first guide UDP data packet is constructed; the first guide UDP data packet carries the flow identification information, and five tuple information of the first guide UDP data packet is same as the target five tuple information.

[0528] The transceiver 1102 is configured to:

[0529] The transceiver 1102 is configured to:

[0530] Optionally, the processor 1105 is further configured to:

[0531] determine, according to the user preset information, the traffic feature information and the authentication feature information corresponding to the source identification information;

[0532] The flow identification information further includes the traffic feature information and the authentication feature information, and the authentication feature information is used to instruct the network side device to perform authentication on the user side device in the case where the authentication feature information represents that the authentication mode is a strong authentication mode.

[0533] Optionally, in the case where the data flow is a TCP data flow, the processor 1105 is further configured to:

[0534] In the case where the second SYN data packet sent by the network side device is received, first encrypted authentication information carried in a header of the second SYN data packet is acquired; the second SYN data packet is a second SYN data packet in a TCP handshake stage, and is a response data packet of the first SYN data packet;

[0535] According to target key information matched with the user identification information, the first encrypted authentication information is decrypted to obtain a first random number sequence;

[0536] A first difference value sequence is randomly generated, and the first random number sequence and the first difference value sequence are added to obtain a second random number sequence;

[0537] According to the target key information, the first difference value sequence and the second random number sequence are encrypted to obtain second encrypted authentication information;

[0538] In the case where a third SYN data packet of the data flow is listened to, the second encrypted authentication information is added to an optional field of a header of the third SYN data packet; the third SYN data packet is a third SYN data packet in a TCP handshake stage, and is a response data packet of the second SYN data packet;

[0539] The transceiver 1102 is further configured to:

[0540] The third SYN data packet is sent to the network side device;

[0541] The third SYN data packet is used for the network side device to perform authentication on the user side device according to the first encrypted authentication information and the second encrypted authentication information.

[0542] Optionally, in the case where the data flow is a UDP data flow, the processor 1105 is further configured to:

[0543] In a case where the second guide UDP packet sent by the network side device is received, third encrypted authentication information carried in the second guide UDP packet is acquired;

[0544] According to target key information, the third encrypted authentication information is decrypted to obtain a fourth random number sequence, and the target key information matches the user identifier information;

[0545] A third difference value sequence is randomly generated, and the third difference value sequence is added to the fourth random number sequence to obtain a fifth random number sequence;

[0546] According to the target key information, the third difference value sequence and the fifth random number sequence are encrypted to obtain fourth encrypted authentication information;

[0547] A third guide UDP packet is constructed; wherein the quintuple information of the third guide UDP packet is the same as the target quintuple information, and the third guide UDP packet carries the fourth encrypted authentication information;

[0548] The transceiver 1102 is further configured to:

[0549] Send the third guide UDP packet to the network side device;

[0550] The third guide UDP packet is used for the network side device to authenticate the user side device according to the third encrypted authentication information and the fourth encrypted authentication information.

[0551] Optionally, the flow identifier information is used to instruct the network side device to perform flow scheduling on a second packet of the data flow according to the source identifier information based on an HQoS scheduling model in a case where the second packet is received and quintuple information of the second packet is the same as target quintuple information, and the target quintuple information is quintuple information of the first packet.

[0552] In Figure 11In particular, the bus architecture (represented by bus 1101) can include any number of interconnecting buses and bridges, allowing for a variety of configurations of bus 1101 linking the various circuits of the application, including processor 1105 and memory 1106 represented by bus 1101. Bus 1101 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, all of which are well known in the art, and therefore, will not be described further. Bus interface 1104 provides an interface between bus 1101 and transceiver 1102. Transceiver 1102 can be a single element or multiple elements, such as a plurality of receivers and transmitters, providing a means for communicating with various other apparatus over a transmission medium. Data processed by processor 1105 is transmitted over a wireless medium via antenna 1103, and further, antenna 1103 receives data and communicates the data to processor 1105.

[0553] Processor 1105 is responsible for managing bus 1101 and general processing, and can also provide various functions including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 1106 can be used to store data used by processor 1105 during execution of program instructions.

[0554] Optionally, processor 1105 can be a CPU, ASIC, FPGA, or CPLD.

[0555] In particular, referring to Figure 12 The application also provides a user-side device, including bus 1201, transceiver 1202, antenna 1203, bus interface 1204, processor 1205, and memory 1206.

[0556] The transceiver 1202 is configured to:

[0557] receive a first data packet and flow identification information of a data stream transmitted by a terminal-side device; the flow identification information includes source identification information of the first data packet, the source identification information includes user identification information and application identification information, the user identification information is used to identify a user terminal of the first data packet source, and the application identification information is used to identify an application program of the first data packet source;

[0558] The processor 1205 is configured to:

[0559] obtain target quintuple information of the first data packet, and associate the target quintuple information with the source identification information;

[0560] receive a second data packet of the data stream, and the five-tuple information of the second data packet is same as the target five-tuple information, the second data packet includes the first data packet, and perform traffic scheduling on the second data packet according to the source identification information.

[0561] Optionally, the network side device is a network edge device.

[0562] Optionally, the data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the transceiver 1202 is configured to:

[0563] receive the first SYN data packet sent by the terminal side device, and a header of the first SYN data packet carries the flow identification information.

[0564] Optionally, the data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; the transceiver 1202 is configured to:

[0565] receive the UDP data packet and a first guide UDP data packet sent by the terminal side device, wherein the first guide UDP data packet carries the flow identification information, and five-tuple information of the first guide UDP data packet is same as the target five-tuple information.

[0566] Optionally, the flow identification information further includes traffic characteristic information and authentication characteristic information of the first data packet; the processor 1205 is further configured to:

[0567] in a case where the authentication characteristic information indicates that an authentication mode is a strong authentication mode, perform authentication on the user side device;

[0568] in a case where a second data packet of the data stream is received, the five-tuple information of the second data packet is same as the target five-tuple information, and the authentication on the user side device is successful, perform traffic scheduling on the second data packet according to the source identification information.

[0569] Optionally, in a case where the data stream is a TCP data stream, the processor 1205 is configured to:

[0570] generate a first target random number sequence;

[0571] encrypt the first target random number sequence according to target key information to obtain first encrypted authentication information, wherein the target key information matches the user identification information;

[0572] adding the first encrypted authentication information in an optional field of a header of a second SYN packet; wherein the second SYN packet is a second SYN packet in a TCP handshake stage, and is a response packet of the first SYN packet;

[0573] The transceiver 1202 is further configured to:

[0574] send the second SYN packet to the user-side device;

[0575] The processor 1205 is configured to:

[0576] in a case where a third SYN packet sent by the user-side device is received, acquire second encrypted authentication information carried in a header of the third SYN packet;

[0577] decrypt the second encrypted authentication information according to the target key information, to obtain a second difference sequence and a third random sequence;

[0578] add the first target random sequence and the second difference sequence to obtain a first target sequence;

[0579] in a case where the first target sequence is the same as the third random sequence, determine that the authentication to the user-side device is successful.

[0580] Optionally, in a case where the data stream is a UDP data stream, the processor 1205 is configured to:

[0581] generate a second target random sequence;

[0582] encrypt the second target random sequence according to target key information to obtain third encrypted authentication information, the target key information matching the user identifier information;

[0583] construct a second guide UDP packet; wherein the second guide UDP packet carries the third encrypted authentication information, and five-tuple information of the second guide UDP packet is the same as the target five-tuple information;

[0584] The transceiver 1202 is further configured to:

[0585] send the second guide UDP packet to the user-side device;

[0586] The processor 1205 is configured to:

[0587] in a case where a third guide UDP packet sent by the user-side device is received, acquire fourth encrypted authentication information carried in the third guide UDP packet;

[0588] According to the target key information, the fourth encrypted authentication information is decrypted to obtain a fourth difference sequence and a sixth random number sequence;

[0589] The second target random number sequence is added to the fourth difference sequence to obtain a second target sequence.

[0590] In a case where the second target sequence is the same as the sixth random number sequence, it is determined that the user-side device is authenticated successfully.

[0591] Optionally, the processor 1205 is configured to:

[0592] According to the source identification information, the second data packet is subjected to flow scheduling based on an HQoS scheduling model.

[0593] Optionally, the processor 1205 is configured to:

[0594] According to the source identification information, a flow scheduling strategy of the second data packet is determined, the flow scheduling strategy including a flow scheduling level and a flow scheduling algorithm.

[0595] An HQoS label used for indicating the flow scheduling strategy is generated.

[0596] The HQoS label is added to metadata of a target Mbuf structure corresponding to the second data packet.

[0597] The target Mbuf structure is input into the HQoS scheduling model, so that the HQoS scheduling model performs flow scheduling processing on the target Mbuf structure according to an HQoS label carried by the target Mbuf structure.

[0598] In Figure 12 The bus architecture (represented by bus 1201) can include any number of interconnecting buses and bridges, the bus 1201 links together various circuits including the processor 1205 represented by one or more processors 1205 and the memory represented by the memory 1206. The bus 1201 can also link together various other circuits such as peripheral devices, voltage stabilizers, and power management circuits, which are well known in the art, and therefore, are not further described herein. The bus interface 1204 provides an interface between the bus 1201 and the transceiver 1202. The transceiver 1202 can be one element or multiple elements, such as multiple receivers and transmitters, which provide a unit for communicating with various other devices on a transmission medium. The data processed by the processor 1205 is transmitted on a wireless medium through the antenna 1203, and further, the antenna 1203 also receives data and transmits the data to the processor 1205.

[0599] The processor 1205 is responsible for managing the bus 1201 and general processing, and can also provide various functions including timing, peripheral interfaces, voltage regulation, power management, and other control functions. The memory 1206 can be used to store data used by the processor 1205 in performing operations.

[0600] Optionally, the processor 1205 can be a CPU, an ASIC, an FPGA, or a CPLD.

[0601] The embodiments of the present application also provide a computer readable storage medium, and the computer readable storage medium stores a computer program. The computer program is executed by the processor to implement the processes of the above-mentioned traffic scheduling method embodiments, and can achieve the same technical effects. To avoid repetition, details are not described here. The computer readable storage medium includes, for example, a ROM, a RAM, a magnetic disk, or an optical disk.

[0602] It should be noted that in this document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusions, so that processes, methods, articles, or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article, or device that includes the element.

[0603] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and necessary general hardware platforms, of course, they can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk), and includes a plurality of instructions for causing a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

[0604] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific embodiments, which are only illustrative and not limiting. Those skilled in the art can make many forms under the inspiration of the present application without departing from the purpose of the present application and the scope protected by the claims, which all belong to the protection of the present application.

Claims

1. A method of flow scheduling, the method comprising: The method is applied to a user side device, and comprises the following steps: In a case that a first data packet of a data stream is listened to, source identification information of the first data packet is identified; wherein, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal where the first data packet comes from, and the application identification information is used to identify an application program where the first data packet comes from; Flow identification information is generated, and the flow identification information comprises the source identification information; The first data packet and the flow identification information are sent to a network side device; Wherein, the flow identification information is used to instruct the network side device to perform flow scheduling on a second data packet according to the source identification information in a case that the second data packet of the data stream is received and five tuple information of the second data packet is same as target five tuple information, the target five tuple information is five tuple information of the first data packet, and the second data packet comprises the first data packet; The data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake stage; before the first SYN data packet and the flow identification information are sent to the network side device, the method further comprises adding the flow identification information in an optional field of a header of the first SYN data packet; the first SYN data packet and the source identification information are sent to the network side device, which comprises sending the first SYN data packet to the network side device; or, The data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; before the first data packet and the flow identification information are sent to the network side device, the method further comprises constructing a first guide UDP data packet; wherein, the first guide UDP data packet carries the flow identification information, and five tuple information of the first guide UDP data packet is same as the target five tuple information; the first data packet and the flow identification information are sent to the network side device, which comprises sending the UDP data packet and the first guide UDP data packet to the network side device.

2. The method of claim 1, wherein, The user side device is a user agent device.

3. The method of claim 1, wherein, After the source identification information of the first data packet is identified, the method further comprises the following steps: According to user preset information, flow characteristic information and authentication characteristic information corresponding to the source identification information are determined; Wherein, the flow identification information further comprises the flow characteristic information and the authentication characteristic information, and the authentication characteristic information is used to instruct the network side device to perform authentication on the user side device in a case that the authentication characteristic information represents that an authentication mode is a strong authentication mode.

4. The method of claim 3, wherein, In a case that the data stream is a TCP data stream, the method further comprises the following steps: In a case that the second SYN packet sent by the network side device is received, first encrypted authentication information carried in a header of the second SYN packet is acquired; wherein the second SYN packet is a second SYN packet in a TCP handshake stage, and is a response packet of the first SYN packet; According to target key information, the first encrypted authentication information is decrypted to obtain a first random number sequence, and the target key information matches the user identifier information; A first difference value sequence is randomly generated, and the first random number sequence and the first difference value sequence are added to obtain a second random number sequence; According to the target key information, the first difference value sequence and the second random number sequence are encrypted to obtain second encrypted authentication information; In a case that the third SYN packet of the data stream is listened to, the second encrypted authentication information is added to an optional field of a header of the third SYN packet; wherein the third SYN packet is a third SYN packet in a TCP handshake stage, and is a response packet of the second SYN packet; The third SYN packet is sent to the network side device; The third SYN packet is used for the network side device to authenticate the user side device according to the first encrypted authentication information and the second encrypted authentication information.

5. The method of claim 3, wherein, In a case that the data stream is a UDP data stream, the method further comprises: In a case that the second guide UDP packet sent by the network side device is received, third encrypted authentication information carried in the second guide UDP packet is acquired; According to target key information, the third encrypted authentication information is decrypted to obtain a fourth random number sequence, and the target key information matches the user identifier information; A third difference value sequence is randomly generated, and the third difference value sequence and the fourth random number sequence are added to obtain a fifth random number sequence; According to the target key information, the third difference value sequence and the fifth random number sequence are encrypted to obtain fourth encrypted authentication information; A third guide UDP packet is constructed; wherein five tuple information of the third guide UDP packet is same as the target five tuple information, and the third guide UDP packet carries the fourth encrypted authentication information; The third guide UDP packet is sent to the network side device; The third guide UDP packet is used for the network side device to authenticate the user side device according to the third encrypted authentication information and the fourth encrypted authentication information.

6. The method of claim 1, wherein, The flow identifier information is used to instruct the network side device to perform flow scheduling on a second packet of the data stream according to the source identifier information based on an HQoS scheduling model in a case that the second packet is received, and five tuple information of the second packet is same as target five tuple information, and the target five tuple information is five tuple information of the first packet.

7. A method of flow scheduling, characterized by, Applied to a network side device, the method comprises: receiving a first data packet and flow identification information of a data stream sent by a user-side device; wherein the flow identification information comprises source identification information of the first data packet, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is sourced, and the application identification information is used to identify an application program from which the first data packet is sourced; obtaining target quintuple information of the first data packet, and associating the target quintuple information with the source identification information; in a case where a second data packet of the data stream is received and quintuple information of the second data packet is the same as the target quintuple information, performing traffic scheduling on the second data packet according to the source identification information, the second data packet comprising the first data packet; the data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the receiving of the first data packet and the flow identification information of the data stream sent by the user-side device comprises: receiving the first SYN data packet sent by the user-side device, and a header of the first SYN data packet carrying the flow identification information; or the data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; the receiving of the first data packet and the flow identification information of the data stream sent by the user-side device comprises: receiving the UDP data packet and a first guide UDP data packet sent by the user-side device; wherein the first guide UDP data packet carries the flow identification information, and quintuple information of the first guide UDP data packet is the same as the target quintuple information.

8. The method of claim 7, wherein, the network-side device is a network edge device.

9. The method of claim 7, wherein, the flow identification information further comprises traffic characteristic information and authentication characteristic information of the first data packet; after the receiving of the first data packet and the flow identification information of the data stream sent by the user-side device, the method further comprises: in a case where the authentication characteristic information represents that an authentication mode is a strong authentication mode, performing authentication on the user-side device; the performing of the traffic scheduling on the second data packet according to the source identification information in the case where the second data packet of the data stream is received and the quintuple information of the second data packet is the same as the target quintuple information comprises: in a case where the second data packet of the data stream is received, the quintuple information of the second data packet is the same as the target quintuple information, and the authentication on the user-side device is successful, performing the traffic scheduling on the second data packet according to the source identification information.

10. The method of claim 9, wherein, in a case where the data stream is a TCP data stream, the performing of the authentication on the user-side device comprises: generating a first target random number sequence; encrypting the first target random number sequence according to target key information to obtain first encrypted authentication information, the target key information matching the user identification information; and in a case where the data stream is a UDP data stream, the performing of the authentication on the user-side device comprises: generating a first target random number sequence; encrypting the first target random number sequence according to target key information to obtain first encrypted authentication information, the target key information matching the user identification information; and in a case where the data stream is a UDP data stream, the performing of the authentication on the user-side device comprises: generating a first target random number sequence; encrypting the first target random number sequence according to target key information to obtain first encrypted authentication information, the target key information matching the user identification information; and adding the first encrypted authentication information in an optional field of a header of a second SYN packet; wherein the second SYN packet is a second SYN packet in a TCP handshake stage, and is a response packet of the first SYN packet; sending the second SYN packet to the user-side device; in a case where a third SYN packet sent by the user-side device is received, obtaining second encrypted authentication information carried in a header of the third SYN packet; decrypting the second encrypted authentication information according to the target key information, to obtain a second difference number sequence and a third random number sequence; adding the first target random number sequence and the second difference number sequence, to obtain a first target number sequence; in a case where the first target number sequence is the same as the third random number sequence, determining that the user-side device is authenticated successfully.

11. The method of claim 9, wherein, in a case where the data stream is a UDP data stream, the authenticating the user-side device comprises: generating a second target random number sequence; encrypting the second target random number sequence according to target key information, to obtain third encrypted authentication information, wherein the target key information matches the user identifier information; constructing a second guide UDP packet; wherein the second guide UDP packet carries the third encrypted authentication information, and five-tuple information of the second guide UDP packet is the same as the target five-tuple information; sending the second guide UDP packet to the user-side device; in a case where a third guide UDP packet sent by the user-side device is received, obtaining fourth encrypted authentication information carried in the third guide UDP packet; decrypting the fourth encrypted authentication information according to the target key information, to obtain a fourth difference number sequence and a sixth random number sequence; adding the second target random number sequence and the fourth difference number sequence, to obtain a second target number sequence; in a case where the second target number sequence is the same as the sixth random number sequence, determining that the user-side device is authenticated successfully.

12. The method of claim 7, wherein, the scheduling the second data packet according to the source identifier information comprises: scheduling the second data packet according to the source identifier information, based on an HQoS scheduling model.

13. The method of claim 12, wherein, the scheduling the second data packet according to the source identifier information, based on an HQoS scheduling model, comprises: determining a traffic scheduling strategy of the second data packet according to the source identifier information, wherein the traffic scheduling strategy comprises a traffic scheduling level and a traffic scheduling algorithm; generating an HQoS label used for indicating the traffic scheduling strategy; adding the HQoS label to metadata of a target Mbuf structure corresponding to the second data packet; inputting the target Mbuf structure into the HQoS scheduling model, so that the HQoS scheduling model performs traffic scheduling processing on the target Mbuf structure according to the HQoS label carried by the target Mbuf structure.

14. A user-side device, characterized by the device comprises: The first identification module is configured to identify source identification information of the first data packet when the first data packet of the data stream is monitored, wherein the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is originated, and the application identification information is used to identify an application program from which the first data packet is originated. The first generation module is configured to generate stream identification information, wherein the stream identification information comprises the source identification information. The first sending module is configured to send the first data packet and the stream identification information to a network side device. The stream identification information is used to instruct the network side device to perform traffic scheduling on a second data packet of the data stream according to the source identification information when the second data packet is received and five tuple information of the second data packet is the same as target five tuple information, the target five tuple information is five tuple information of the first data packet, and the second data packet comprises the first data packet. The data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the device further comprises a first adding module configured to add the stream identification information in an optional field of a header of the first SYN data packet; and the first sending module is configured to send the first SYN data packet to the network side device; or The data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; the device further comprises a first construction module configured to construct a first guide UDP data packet, wherein the first guide UDP data packet carries the stream identification information, and five tuple information of the first guide UDP data packet is the same as the target five tuple information; and the first sending module is configured to send the UDP data packet and the first guide UDP data packet to the network side device.

15. A network-side device, comprising: The device comprises: The first receiving module is configured to receive a first data packet of a data stream and stream identification information sent by a user side device, wherein the stream identification information comprises source identification information of the first data packet, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal from which the first data packet is originated, and the application identification information is used to identify an application program from which the first data packet is originated. The third obtaining module is configured to obtain target five tuple information of the first data packet and associate the target five tuple information with the source identification information. The traffic scheduling module is configured to perform traffic scheduling on a second data packet of the data stream according to the source identification information when the second data packet is received and five tuple information of the second data packet is the same as target five tuple information, and the second data packet comprises the first data packet. The data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase. The data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet.

16. A user-side device, comprising: The transceiver and the processor are included, The processor is configured to: in a case where a first data packet of a data stream is listened to, identify source identification information of the first data packet; the source identification information includes user identification information and application identification information, the user identification information is used to identify a user terminal where the first data packet is from, and the application identification information is used to identify an application program where the first data packet is from; generate flow identification information, the flow identification information including the source identification information; The transceiver is configured to: send the first data packet and the flow identification information to a network side device; The flow identification information is used to instruct the network side device to perform traffic scheduling on a second data packet of the data stream according to the source identification information in a case where the second data packet is received and five tuple information of the second data packet is the same as target five tuple information, the target five tuple information being five tuple information of the first data packet, and the second data packet including the first data packet. The data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase. The processor is further configured to add the flow identification information in an optional field of a header of the first SYN data packet, and the transceiver is configured to send the first SYN data packet to the network side device; or 17. A network-side device, comprising: The data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet. The transceiver and the processor are included, The transceiver is configured to: receive a first data packet and flow identification information of a data stream sent by a user-side device; wherein the flow identification information comprises source identification information of the first data packet, the source identification information comprises user identification information and application identification information, the user identification information is used to identify a user terminal where the first data packet comes from, and the application identification information is used to identify an application program where the first data packet comes from; the processor is configured to: obtain target quintuple information of the first data packet, and associate the target quintuple information with the source identification information; in a case where a second data packet of the data stream is received and quintuple information of the second data packet is the same as the target quintuple information, perform traffic scheduling on the second data packet according to the source identification information, the second data packet comprises the first data packet; the data stream is a transmission control protocol (TCP) data stream, the first data packet is a first synchronization sequence number (SYN) data packet, and the first SYN data packet is a first SYN data packet in a TCP handshake phase; the transceiver is configured to: receive the first SYN data packet sent by the user-side device, and a header of the first SYN data packet carries the flow identification information; or the data stream is a user datagram protocol (UDP) data stream, and the first data packet is a UDP data packet; the transceiver is configured to: receive the UDP data packet and a first guide UDP data packet sent by the user-side device; wherein the first guide UDP data packet carries the flow identification information, and quintuple information of the first guide UDP data packet is the same as the target quintuple information.

18. A user-side device, comprising: comprise: a processor, a memory, and a program stored in the memory and executable on the processor, the program being executed by the processor to implement the steps of the traffic scheduling method according to any one of claims 1-6.

19. A network-side device, comprising: comprise: a processor, a memory, and a program stored in the memory and executable on the processor, the program being executed by the processor to implement the steps of the traffic scheduling method according to any one of claims 7-13.

20. A computer-readable storage medium, characterized in that, a computer program is stored in the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the traffic scheduling method according to any one of claims 1-6, or the computer program is executed by the processor to implement the steps of the traffic scheduling method according to any one of claims 7-13.

Images