Access control list information processing method, router, device, network equipment, readable storage medium and program product

Abstract

The invention relates to an access control list information processing method, a router, a device, network equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving a message; searching a matching table item of the message in a second access control list; the second access control list is stored in a cache space of the network processing chip; second table items contained in the second access control list are screened from the original table item set; if the matched table item is not found in the second access control list, searching the matched table item in the first access control list; the first access control list is stored in the internal memory; the first access control list at least comprises a first table item; the first table item is the table item except the second table item in the original table item set. By adopting the method, the searching efficiency of the table items of the access control list can be improved.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to an access control list information processing method, router, device, network equipment, computer-readable storage medium and computer program product. Background Art

[0002] Access Control List (ACL) is an access control technology based on packet filtering. It can filter data packets in device interfaces by establishing matching rules. As network security requirements become increasingly diverse, network devices such as routers need to have large-scale access control list capacity to meet business needs. However, the access control lists in network devices are usually stored in the internal storage space of the device, making it difficult to efficiently search for items in the access control list. Summary of the invention

[0003] Based on this, it is necessary to provide an access control list information processing method, router, device, network equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0004] In a first aspect, the present application provides an access control list information processing method, comprising:

[0005] Receive messages;

[0006] Searching for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second entry included in the second access control list is filtered from an original entry set;

[0007] If the matching entry is not found in the second access control list, the matching entry is searched in the first access control list; the first access control list is stored in the internal memory; the first access control list at least includes the first entry; the first entry is the entry in the original entry set except the second entry.

[0008] In one of the embodiments, the second table item is filtered from the original table item set by the following steps: obtaining traffic statistics information of each table item in the original table item set; and filtering the second table item in the original table item set according to the traffic statistics information of each table item.

[0009] In one of the embodiments, filtering the second table items in the original table item set according to the traffic statistical information of each table item includes: obtaining the cumulative change value of the traffic of each table item according to the traffic statistical information of each table item; and filtering the second table items from the original table item set according to the size of the cumulative change value of the traffic of each table item.

[0010] In one of the embodiments, the traffic statistical information includes the traffic statistical value of the table item at each statistical time point; the traffic cumulative change value of each table item is obtained based on the traffic statistical information of each table item, including: obtaining the traffic change value of each statistical time interval based on the traffic statistical value of the table item at each statistical time point; every two adjacent statistical time points form the statistical time interval; and obtaining the traffic cumulative change value of the table item based on the traffic change value of each statistical time interval.

[0011] In one of the embodiments, obtaining the cumulative change value of the flow of the table item based on the flow change value of each statistical time interval includes: obtaining the time attenuation coefficient of each statistical time interval relative to the current time point; obtaining the cumulative change value of the flow of the table item based on the time attenuation coefficient corresponding to each statistical time interval and the flow change value of each statistical time interval.

[0012] In one of the embodiments, obtaining the time attenuation coefficient of each statistical time interval relative to the current time point includes: obtaining the time attenuation coefficient based on the length of the interval between the later statistical time point and the current time point of two adjacent statistical time points that form the statistical time interval; and / or obtaining the cumulative change value of the flow of the table item based on the time attenuation coefficient corresponding to each statistical time interval and the flow change value of each statistical time interval includes: performing weighted summation of the flow change values ​​of each statistical time interval based on the time attenuation coefficient corresponding to each statistical time interval to obtain the cumulative change value of the flow of the table item.

[0013] In one of the embodiments, after filtering the second table items in the original table item set according to the traffic statistical information of each table item, the method further includes: using the filtered second table items as new second table items; swapping part or all of the table items in the second access control list and the first access control list according to the new second table items, so that the second access control list is composed of the new second table items, and the first access control list at least contains the new first table items; the new first table items are the table items in the original table item set except the new second table items.

[0014] In a second aspect, the present application further provides a router, including:

[0015] Network processing chip and internal memory;

[0016] The network processing chip is used to receive messages;

[0017] The network processing chip is further used to search for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of the network processing chip; the second entry included in the second access control list is screened from the original entry set;

[0018] The network processing chip is also used to search for the matching entry in the first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list at least includes a first entry; the first entry is an entry in the original entry set except the second entry.

[0019] In a third aspect, the present application further provides an access control list information processing device, comprising:

[0020] A message receiving module, used for receiving messages;

[0021] A first search module is used to search for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second entry included in the second access control list is screened from an original entry set;

[0022] A second search module is used to search for the matching entry in the first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list at least includes a first entry; the first entry is an entry in the original entry set except the second entry.

[0023] In a fourth aspect, the present application further provides a network device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0024] Receive messages;

[0025] Searching for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second entry included in the second access control list is filtered from an original entry set;

[0026] If the matching entry is not found in the second access control list, the matching entry is searched in the first access control list; the first access control list is stored in the internal memory; the first access control list at least includes the first entry; the first entry is the entry in the original entry set except the second entry.

[0027] In a fifth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0028] Receive messages;

[0029] Searching for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second entry included in the second access control list is filtered from an original entry set;

[0030] If the matching entry is not found in the second access control list, the matching entry is searched in the first access control list; the first access control list is stored in the internal memory; the first access control list at least includes the first entry; the first entry is the entry in the original entry set except the second entry.

[0031] In a sixth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0032] Receive messages;

[0033] Searching for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second entry included in the second access control list is filtered from an original entry set;

[0034] If the matching entry is not found in the second access control list, the matching entry is searched in the first access control list; the first access control list is stored in the internal memory; the first access control list at least includes the first entry; the first entry is the entry in the original entry set except the second entry.

[0035] The access control list information processing method, router, device, network device, computer-readable storage medium and computer program product first receive a message, then search for a matching table item of the message in the second access control list, the second access control list is stored in the cache space of the network processing chip, and the second table item contained in the second access control list is screened from the original table item set, wherein if a matching table item is not found in the second access control list, then a matching table item is searched in the first access control list, wherein the first access control list is stored in the internal memory, and the first access control list at least contains the first table item, which is the table item other than the second table item in the original table item set. This scheme, by screening the second table item from the original table item set of the access control list and storing it in the second access control list in the cache space of the network processing chip, and storing the remaining first table items in the original table item set in the first access control list of the internal memory, so that after receiving the message, the network processing chip in the network device can preferentially search for matching table items from the cache space, and then search from the internal memory when no matching table item can be found. This process can fully utilize the advantage of fast access speed of the cache space in the network processing chip to realize fast search of control list items, and can effectively reduce the situation where the bandwidth between the network processing chip and the internal memory is continuously occupied by the matching table item search task, effectively reducing business processing delays and improving overall processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] FIG1 is a schematic diagram of storage of an access control list in conventional technology;

[0038] FIG2 is a schematic diagram of a flow chart of a method for processing access control list information in one embodiment;

[0039] FIG3 is a schematic diagram of storage of a second access control list and a first access control list in one embodiment;

[0040] FIG4 is a schematic diagram of the structure of an access control list storage and query device in one embodiment;

[0041] FIG5 is a schematic diagram of storage of an original entry set in one embodiment;

[0042] FIG6 is a schematic diagram of storing the second access control list and the first access control list in another embodiment;

[0043] FIG7 is a schematic diagram of storage of a second access control list and a first access control list in yet another embodiment;

[0044] FIG8 is a flow chart of a method for processing access control list information in another embodiment;

[0045] FIG9 is a schematic diagram of the structure of a router in one embodiment;

[0046] FIG10 is a block diagram of an access control list information processing device according to an embodiment;

[0047] FIG. 11 is a diagram showing the internal structure of a network device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] The method of the embodiment of the present application can be applied to network devices such as routers. In the network, the access control list (ACL) is a commonly used network security mechanism. By using the access control list, the access rights of network traffic can be controlled, and the traffic can be finely controlled and managed to ensure the security and stability of the network.

[0050] In traditional technology, as shown in FIG1, an access control list is usually stored in the internal memory of a network device, such as a ternary content addressable memory (TCAM), and the network processor (NP) chip of the network device is connected to the internal memory. When the network device receives a message that needs to be processed, the network processing chip can perform packet processing on the message and search the access control list in the internal memory according to the ACL key value to obtain the table entry that matches the message. In this process, there is a certain physical distance between the network processing chip and the internal memory, which easily leads to a delay in accessing the access control list. In the process of searching the access control list, the network processing chip needs to frequently read the table entry information of the control list in the internal memory, resulting in the bandwidth from the network processing chip to the internal memory being continuously occupied by the control list search task. In a multi-task high concurrency scenario, there is a risk of business damage due to congestion.

[0051] Based on this, in an exemplary embodiment, as shown in FIG2 , a method for processing access control list information is provided, which can be applied to a network device. In this embodiment, the method includes the following steps:

[0052] Step S201, receiving a message.

[0053] Step S202: searching the second access control list for a matching entry of the message.

[0054] Step S203: If no matching entry is found in the second access control list, then a matching entry is searched in the first access control list.

[0055] As shown in FIG. 3 , the network device in this embodiment may include a network processing chip and an internal memory, the network processing chip may be connected to the internal memory, and the network processing chip is provided with a cache space. A second access control list is stored in the cache space of the network processing chip, the second access control list may include one or more second items, and each second item may correspond to an access control rule. The second items in the second access control list may be a part of items selected from the original item set. Optionally, the original item set may be a collection of all access control list items of the network device. A first access control list is stored in the internal memory, which may include at least a first item. The first item may be an item in the original item set except the second item. Optionally, the number of items in the first access control list may be greater than that in the second access control list. Optionally, in some embodiments, the first access control list may also include a second item.

[0056] In step S201, the network device may receive a message transmitted through the network. Exemplarily, after receiving the message, the network processing chip in the network device may perform packet processing on the message, extract information such as the destination address, and obtain an access control list matching key value (ACL key value) corresponding to the message based on the information. The ACL key value may be used to find an entry in the access control list that matches the message.

[0057] Then, in step S202, the network device may search for a matching entry that matches the aforementioned received message in the second access control list in the cache space. Exemplarily, the network processing chip of the network device may search for a second entry that matches the access control list matching key value corresponding to the message in the second access control list according to the access control list matching key value. If so, the second entry may be used as the matching entry of the message. Otherwise, the process may turn to step S203.

[0058] When a matching entry of the message cannot be found in the second access control list, step S203 may be performed to search for a matching entry of the message in the first access control list in the internal memory.

[0059] In the above-mentioned access control list information processing method, by screening the second table item from the original table item set of the access control list and storing it in the second access control list of the cache space of the network processing chip, and storing the remaining first table items in the original table item set in the first access control list of the internal memory, after receiving the message, the network processing chip in the network device can preferentially search for matching table items from the cache space, and then search from the internal memory when no matching table items can be found. This process can make full use of the advantage of fast access speed of the cache space in the network processing chip, can realize fast search of control list items, and can effectively reduce the situation where the bandwidth between the network processing chip and the internal memory is continuously occupied by the matching table item search task, effectively reduce the service processing delay, and improve the overall processing efficiency.

[0060] In an exemplary embodiment, the second entry may be filtered from the original entry set by the following steps: obtaining traffic statistics information of each entry in the original entry set; and filtering the second entry in the original entry set according to the traffic statistics information of each entry.

[0061] Specifically, when filtering the second table item from the original table item set, the traffic statistics information of each table item in the original table item set can be obtained first, and then the second table item can be filtered according to the traffic statistics information of each table item. Exemplarily, the traffic statistics information of the table item can include information obtained by counting the hit traffic of the table item over a period of time, for example, it can include information such as hit traffic data of the table item at multiple time points.

[0062] Optionally, based on the traffic statistics information of each entry, the entries in the original entry set can be compared with each other, for example, several entries with the largest cumulative hit traffic, or the highest recent hit frequency, or the largest upward trend in hit traffic are selected as the second entry, and the remaining entries are used as the first entry. Exemplarily, the number of second entries can be determined based on the capacity of the cache space that can be allocated to the second access control list.

[0063] In this embodiment, by screening the second table items according to the traffic statistics information of each table item in the original table item set, the table items can be screened according to the hit situation of each table item, so that the table items that are more likely to be hit can be screened as the second table items, which can further improve the search efficiency of the matching table items.

[0064] In an exemplary embodiment, filtering the second table item in the original table item set according to the traffic statistics information of each table item may include: obtaining the cumulative change value of the traffic of each table item according to the traffic statistics information of each table item; and filtering the second table item from the original table item set according to the size of the cumulative change value of the traffic of each table item.

[0065] Among them, the traffic statistics information of each table item in the original table item set may include the hit traffic of the corresponding table item at multiple discrete time points in the statistical period, and according to the increase and decrease of the hit traffic of the table item over time, the cumulative change value of the traffic of each table item in the statistical period can be obtained by statistics. Exemplarily, the larger the cumulative change value of the traffic, the more the hit traffic of the table item increases over time, and the smaller the cumulative change value of the traffic, the less the hit traffic of the table item increases over time.

[0066] Optionally, in this embodiment, the entries in the original entry set may be sorted in descending order according to the accumulated traffic change value, and then a corresponding number of entries at the front may be selected as the second entries according to the preset number of second entries.

[0067] In this embodiment, the traffic statistical information of the table item is processed to obtain the corresponding cumulative traffic change value, so that the cumulative traffic change value can reflect the change of the hit traffic of each table item over time. The second table item is screened according to the size of the cumulative traffic change value, so that the table item whose hit frequency increases with time can be screened as the second table item, which can further improve the hit probability of the second table item and improve the search efficiency of the matching table item.

[0068] In an exemplary embodiment, traffic statistics information may include traffic statistics values ​​of table items at each statistical time point; obtaining the cumulative traffic change value of each table item based on the traffic statistics information of each table item may include: obtaining the traffic change value of each statistical time interval based on the traffic statistics value of the table item at each statistical time point; forming a statistical time interval with every two adjacent statistical time points; and obtaining the cumulative traffic change value of the table item based on the traffic change value of each statistical time interval.

[0069] The traffic statistics information of each table item in the original table item set may include the traffic statistics value of the corresponding table item at each statistical time point. Each statistical time point may be a discrete time point in the statistical period, and its corresponding traffic statistics value may be the hit traffic data counted at the time point. For each statistical time point in the statistical period, the time interval between every two adjacent statistical time points may be taken as a statistical time interval, and then the traffic change value of each statistical time interval is calculated, and the traffic change value may indicate the increment of the hit traffic of the corresponding table item in the statistical time interval.

[0070] For example, it is assumed that the statistical period includes the statistical time point , then the hit traffic data at these statistical time points can be expressed as a sequence Among them, for the statistical time point arrive The statistical time interval between the two, the flow change value can be expressed as . For example, .

[0071] By collecting statistics on the traffic change values ​​at each statistical time interval, the accumulated traffic change value of the entry in the entire statistical period can be obtained, which can reflect the hit traffic change of the entry in the entire statistical period.

[0072] In this embodiment, by taking the time interval between every two adjacent statistical time points as the statistical time interval, first calculating the flow change value of each statistical time interval, and then obtaining the cumulative flow change value by counting these flow change values, the calculation of the cumulative flow change value can be performed efficiently and intuitively.

[0073] In an exemplary embodiment, obtaining the cumulative change value of the flow of a table item based on the flow change value of each statistical time interval may include: obtaining the time attenuation coefficient of each statistical time interval relative to the current time point; obtaining the cumulative change value of the flow of the table item based on the time attenuation coefficient corresponding to each statistical time interval and the flow change value of each statistical time interval.

[0074] Among them, when calculating the cumulative change value of the flow according to the flow change value of the table item in each statistical time interval, the time attenuation coefficient of each statistical time interval can be obtained respectively, and then the cumulative change value of the flow can be counted according to the time attenuation coefficient and flow change value corresponding to each statistical time interval.

[0075] For example, the time attenuation coefficient of the statistical time interval can be determined according to the distance of the time interval relative to the current time. For example, the time attenuation coefficient corresponding to the statistical time interval farther from the current time can be set to be smaller, while the time attenuation coefficient corresponding to the statistical time interval closer to the current time can be set to be larger. Then, the time attenuation coefficient corresponding to each statistical time interval and the flow change value can be combined to perform statistics on the cumulative flow change value, so that the flow change value corresponding to the statistical time interval closer to the current time has a greater contribution to the cumulative flow change value.

[0076] In this embodiment, by setting corresponding time attenuation coefficients for different statistical time intervals, and calculating the cumulative change value of the flow of the table item in combination with the time attenuation coefficient and the flow change value, the contribution of the corresponding flow change value to the cumulative change value of the flow can be adjusted according to the distance of the statistical time interval from the current time point, so that the cumulative change value of the flow obtained by statistics can better reflect the recent changes in the hit flow of the table item.

[0077] In an exemplary embodiment, obtaining the time attenuation coefficient of each statistical time interval relative to the current time point may include: obtaining the time attenuation coefficient based on the length of the interval between the later statistical time point and the current time point of two adjacent statistical time points that form the statistical time interval; and / or, obtaining the cumulative change value of the flow of the table item based on the time attenuation coefficient corresponding to each statistical time interval and the flow change value of each statistical time interval, may include: performing weighted summation of the flow change values ​​of each statistical time interval based on the time attenuation coefficient corresponding to each statistical time interval to obtain the cumulative change value of the flow of the table item.

[0078] Specifically, the time attenuation coefficient of the statistical time interval can be calculated based on the interval between the latter statistical time point and the current time point of two adjacent statistical time points forming the statistical time interval. The current time point may refer to the time when the traffic statistical information of the table item is counted, or may refer to the last time point among the statistical time points.

[0079] For example, assuming that time point t is the current time point, for the statistical time point arrive The statistical time interval between, the corresponding time decay coefficient can be expressed as: Among them, as the statistical time interval is closer to the current time point, the corresponding time attenuation coefficient is larger.

[0080] According to the time attenuation coefficient and flow change value corresponding to each statistical time interval, the time attenuation coefficient can be used as the weight coefficient of the flow change value, and the cumulative flow change value of the table item in the entire statistical period is calculated by weighted summation. For example, the calculation process of the cumulative flow change value can be expressed as:

[0081]

[0082] in, is the cumulative change value of the flow of the table item, is the current time point, For statistical time point arrive The traffic change value corresponding to the statistical time interval between is the time attenuation coefficient corresponding to the statistical time interval.

[0083] In this embodiment, by obtaining the time decay coefficient according to the interval between the subsequent statistical time point of the statistical time interval and the current time point, the corresponding time decay coefficient can be conveniently and quickly set for different statistical time intervals. By using the weighted summation method to calculate the cumulative change value of the flow of the table item using the time decay coefficient and the flow change value, the cumulative effect and the time decay factor can be combined to obtain the cumulative change value of the flow that can objectively reflect the hit activity of the table item.

[0084] In an exemplary embodiment, after filtering the second table item in the original table item set according to the traffic statistics information of each table item, the method may also include: using the filtered second table item as a new second table item; according to the new second table item, swapping part or all of the table items in the second access control list and the first access control list, so that the second access control list is composed of the new second table item, and the first access control list contains at least the new first table item; the new first table item is the table item in the original table item set except the new second table item.

[0085] The network device can re-acquire the traffic statistics information of each item in the original item set at regular intervals, and select a new second item from the original item set according to the new traffic statistics information, and use the remaining items in the original item set as new first items. Then, according to the new second item, some or all items in the second access control list and the first access control list can be exchanged, so that the second access control list can be composed of the new second item, and the new first item is stored in the first access control list. Based on this, the second access control list and the first access control list can be updated.

[0086] Exemplarily, after obtaining the new second entry, the new second entry can be compared with the original second entry in the second access control list. If the new second entry is inconsistent with the original second entry, it means that the new second entry contains the original first entry, and the original second entry contains the new first entry. In this case, the original first entry can be swapped with the original second entry, thereby updating the second access control list and the first access control list.

[0087] In this embodiment, by re-screening the second table item of the original table item set and updating the second access control list and the first access control list according to the new second table item, the second access control list and the first access control list can be dynamically adjusted according to the changes in the hit situation of the table items over time, so that the second access control list can continue to be composed of table items that are more likely to be hit, thereby ensuring the search efficiency of matching table items over a long period of time.

[0088] In order to further explain the access control list information processing method of the present application, the following is a detailed description of the method through an embodiment:

[0089] Exemplarily, the network device can execute the access control list information processing method in this embodiment through the access control list storage and query device shown in Figure 4. As shown in Figure 4, the device includes a table item acquisition storage module, a table item hit statistics module, a table item activity statistics module, a table item update module, and a table item search module.

[0090] The entry acquisition storage module can be used to acquire the initial configuration information of the access control list, generate the entry of the access control list, and store it in the internal memory. As shown in FIG5 , the entry generated according to the initial configuration information can include entry 1, entry 2, entry 3, and entry 4, which can be stored in the internal memory and form an original entry set.

[0091] The table entry hit statistics module can be used to count the hit traffic of each table entry in the original table entry set to obtain traffic statistics information of each table entry. Exemplarily, the traffic statistics information of the table entry can include the traffic statistics value of the table entry at each statistical time point obtained by the table entry hit statistics module counting the hit traffic of the table entry at multiple discrete statistical time points.

[0092] The entry activity statistics module may be used to obtain traffic statistics information of each entry in the original entry set, and obtain the traffic cumulative change value of each entry according to the traffic statistics information of each entry.

[0093] Exemplarily, the table item activity statistics module can calculate the flow change value of the statistical time interval formed by each two adjacent statistical time points based on the flow statistics of the table item at each statistical time point, and obtain the time decay coefficient of each statistical time interval relative to the current time point, and then calculate the cumulative flow change value of the table item based on the flow change value of the table item at each statistical time interval and the time decay coefficient according to the factors combining the cumulative effect and time decay. By calculating the cumulative flow change value of the table item, the activity of each table item can be quantified.

[0094] For example, it is assumed that the statistical period includes the statistical time point The hit traffic data of the table items at these statistical time points is a sequence , then for the statistical time point arrive The statistical time interval between the two, the flow change value can be expressed as , the calculation process of the cumulative change value of flow can be expressed as: ,in, is the cumulative change value of the flow of the table item, is the current time point, Statistical time point arrive The traffic change value corresponding to the statistical time interval between is the time attenuation coefficient corresponding to the statistical time interval.

[0095] The table item update module can be used to filter out the second table item from the original table item set according to the size of the accumulated change value of the flow of each table item in the original table item set, and store it in the second access control list of the cache space of the network processing chip. For the first table item in the original table item set except the second table item, it is stored in the first access control list of the internal memory.

[0096] Exemplarily, taking the original table entry set shown in FIG5 as an example, it is assumed that table entry 1 corresponds to 1.1.1.1 / permit, table entry 2 corresponds to 2.2.2.2 / deny, table entry 3 corresponds to 3.3.3.3 / permit, and table entry 4 corresponds to 4.4.4.4 / deny. In the statistical period T1, data traffic with destination addresses 1.1.1.1 and 3.3.3.3 continues to enter the network device, and the table entry activity statistics module calculates that the cumulative change value of the traffic of table entry 1 and table entry 3 is high, then the table entry update module can use table entry 1 and table entry 3 as the second table entry, and table entry 2 and table entry 4 as the first table entry. As shown in FIG6, the table entry update module can store table entry 1 and table entry 3 as the second table entry in the second access control list of the cache space of the network processing chip, and store table entry 2 and table entry 4 as the first table entry in the first access control list of the internal memory.

[0097] Among them, the table item update module can also be used to update the second access control list and the first access control list. Specifically, the table item activity statistics module can update the traffic statistics information of each table item in the original table item set over time, and the table item update module can obtain the updated traffic statistics information and re-screen the second table item in the original table item set. Then, the screened second table item can be used as a new second table item, and according to the new second table item, part or all of the table items in the second access control list and the first access control list are swapped, so that the second access control list is composed of the new second table item, and the first access control list at least contains the new first table item.

[0098] Exemplarily, assuming that the second access control list and the first access control list before the update are as shown in FIG6, wherein in the statistical period T2, data traffic with destination addresses of 1.1.1.1 and 2.2.2.2 continuously enters the network device, and the table item activity statistics module calculates that the cumulative traffic change values ​​of table items 1 and 2 are relatively high, then the table item update module can use table items 1 and 2 as new second table items, and use table items 3 and 4 with lower cumulative traffic change values ​​as new first table items. As shown in FIG7, the table item update module can swap table item 3 in the original second access control list with table item 2 in the original first access control list, so that the second access control list can be composed of the new second table items (table item 1, table item 2), and the first access control list contains the new first table items (table item 3, table item 4).

[0099] The entry search module may be used to receive a message, and then search for a matching entry of the message in the second access control list; if no matching entry of the message is found in the second access control list, the matching entry is searched in the first access control list.

[0100] Exemplarily, the search process of the table entry search module can be shown in Figure 8. Among them, the table entry search module can be deployed in the network processing chip. It can receive a message, and then search for a second table entry that matches the message in the second access control list of the cache space of the network processing chip. If there is a hit second table entry, it can be used as a matching table entry for the message, and perform related actions, such as statistics, flow control (Committed Access Rate, CAR), discarding, redirection, etc. When the matching table entry is not hit in the second access control list, the ACL key value can be used to query the first access control list in the internal memory. Similarly, if there is a hit first table entry, it can be used as a matching table entry for the message, and related actions can be performed; if there is no hit first table entry, the search for the first access control list can be ended. Exemplarily, still taking the second access control list and the first access control list shown in Figure 6 as an example, since table entry 1 and table entry 3 are stored in the second access control list, for messages with a destination address of 1.1.1.1 or 3.3.3.3, the network processing chip can directly search for its matching table entry in the cache space without having to detour to the memory to search, thereby greatly improving the search efficiency and reducing the search time.

[0101] In this embodiment, the linkage between the second access control list and the first access control list is realized by storing the second access control list in the cache space of the NP chip and by counting and updating the cumulative change value of the traffic of the table items. By storing the commonly used access control list items in the cache space of the NP chip, the advantage of the high-speed access speed of the high-speed cache in the chip can be fully utilized to comprehensively improve the table lookup performance of the ACL table items and reduce the service processing delay. Moreover, in this embodiment, based on the traffic statistics information of the ACL table items in the statistical period, combined with the cumulative effect and time decay factors, the cumulative change value of the traffic is calculated for each ACL table item, which can screen out the ACL table items that are more likely to be hit at present and store them in the second access control list, thereby further improving the table lookup efficiency.

[0102] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0103] Based on the same inventive concept, the embodiment of the present application further provides a router. The implementation scheme for solving the problem provided by the router is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more router embodiments provided below can refer to the limitations of the access control list information processing method above, and will not be repeated here.

[0104] In an exemplary embodiment, as shown in FIG. 9 , a router is provided, including: a network processing chip and an internal memory.

[0105] The network processing chip is used to receive messages;

[0106] The network processing chip is further used to search for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of the network processing chip; the second entry included in the second access control list is screened from the original entry set;

[0107] The network processing chip is also used to search for the matching entry in the first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list at least includes a first entry; the first entry is an entry in the original entry set except the second entry.

[0108] Based on the same inventive concept, the embodiment of the present application also provides an access control list information processing device for implementing the access control list information processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more access control list information processing device embodiments provided below can refer to the limitations on the access control list information processing method above, and will not be repeated here.

[0109] In an exemplary embodiment, as shown in FIG10 , an access control list information processing device 1000 is provided, comprising:

[0110] The message receiving module 1001 is used to receive messages;

[0111] The first search module 1002 is used to search for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second entry included in the second access control list is filtered from an original entry set;

[0112] The second search module 1003 is used to search for the matching entry in the first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list at least includes the first entry; the first entry is the entry in the original entry set except the second entry.

[0113] In an exemplary embodiment, the second table entry is filtered from the original table entry set by the following steps: obtaining traffic statistics information of each table entry in the original table entry set; and filtering the second table entry in the original table entry set according to the traffic statistics information of each table entry.

[0114] In an exemplary embodiment, filtering the second table items in the original table item set according to the traffic statistical information of each of the table items includes: obtaining the cumulative change value of the traffic of each of the table items according to the traffic statistical information of each of the table items; and filtering the second table items from the original table item set according to the size of the cumulative change value of the traffic of each of the table items.

[0115] In an exemplary embodiment, the traffic statistical information includes the traffic statistical value of the table item at each statistical time point; the traffic cumulative change value of each table item is obtained based on the traffic statistical information of each table item, including: obtaining the traffic change value of each statistical time interval based on the traffic statistical value of the table item at each statistical time point; every two adjacent statistical time points form the statistical time interval; and obtaining the traffic cumulative change value of the table item based on the traffic change value of each statistical time interval.

[0116] In an exemplary embodiment, the method of obtaining the cumulative change value of the flow of the table item based on the flow change value of each statistical time interval includes: obtaining the time attenuation coefficient of each statistical time interval relative to the current time point; and obtaining the cumulative change value of the flow of the table item based on the time attenuation coefficient corresponding to each statistical time interval and the flow change value of each statistical time interval.

[0117] In an exemplary embodiment, obtaining the time attenuation coefficient of each statistical time interval relative to the current time point includes: obtaining the time attenuation coefficient based on the length of the interval between the later statistical time point and the current time point of two adjacent statistical time points that form the statistical time interval; and / or obtaining the cumulative change value of the flow of the table item based on the time attenuation coefficient corresponding to each statistical time interval and the flow change value of each statistical time interval, including: performing weighted summation of the flow change values ​​of each statistical time interval based on the time attenuation coefficient corresponding to each statistical time interval to obtain the cumulative change value of the flow of the table item.

[0118] In an exemplary embodiment, the device also includes: an entry update module, used to use the second entry obtained by screening as a new second entry; an entry exchange module, used to exchange part or all of the entries in the second access control list and the first access control list according to the new second entry, so that the second access control list is composed of the new second entry, and the first access control list at least contains the new first entry; the new first entry is the entry in the original entry set except the new second entry.

[0119] Each module in the access control list information processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a network device in the form of hardware, or can be stored in a memory in a network device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0120] In an exemplary embodiment, a network device is provided, which may be a server, and its internal structure diagram may be shown in FIG11. The network device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the network device is used to provide computing and control capabilities. The memory of the network device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the network device is used to exchange information between the processor and an external device. The communication interface of the network device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an access control list information processing method is implemented.

[0121] Those skilled in the art will understand that the structure shown in FIG. 11 is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the network device to which the scheme of the present application is applied. The specific network device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] In an exemplary embodiment, a network device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0123] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0124] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0125] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0126] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0127] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0128] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for processing access control list information, characterized in that: The method comprises: Receive messages; Searching for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second entry included in the second access control list is filtered from an original entry set; If the matching entry is not found in the second access control list, the matching entry is searched in the first access control list; the first access control list is stored in the internal memory; the first access control list at least includes the first entry; the first entry is the entry in the original entry set except the second entry.

2. The method according to claim 1, characterized in that: The second entry is filtered from the original entry set by the following steps: Obtaining traffic statistics information of each entry in the original entry set; The second table entry in the original table entry set is filtered according to the traffic statistics information of each table entry.

3. The method according to claim 2, characterized in that The filtering the second table entry in the original table entry set according to the traffic statistics information of each table entry includes: Obtaining a cumulative change value of traffic of each entry according to the traffic statistics information of each entry; The second table entry is obtained by filtering the original table entry set according to the size of the accumulated change value of the traffic of each table entry.

4. The method according to claim 3, characterized in that The traffic statistics information includes traffic statistics values ​​of the table items at each statistical time point; The obtaining, according to the traffic statistics information of each of the table entries, a traffic cumulative change value of each of the table entries includes: According to the flow statistics value of the table item at each statistical time point, the flow change value of each statistical time interval is obtained; every two adjacent statistical time points form the statistical time interval; The accumulated change value of the flow of the entry is obtained according to the change value of the flow at each statistical time interval.

5. The method according to claim 4, characterized in that The obtaining, according to the traffic change value at each of the statistical time intervals, a traffic cumulative change value of the entry includes: Obtaining a time attenuation coefficient of each statistical time interval relative to the current time point; The accumulated change value of the flow of the entry is obtained according to the time attenuation coefficient corresponding to each statistical time interval and the flow change value of each statistical time interval.

6. The method according to claim 5, characterized in that The obtaining of the time attenuation coefficient of each statistical time interval relative to the current time point includes: Obtaining the time decay coefficient according to the interval between the latter statistical time point and the current time point of two adjacent statistical time points forming the statistical time interval; and / or, The obtaining, according to the time attenuation coefficient corresponding to each of the statistical time intervals and the flow change value of each of the statistical time intervals, the flow cumulative change value of the entry includes: According to the time attenuation coefficient corresponding to each statistical time interval, the flow change value of each statistical time interval is weightedly summed to obtain the accumulated flow change value of the entry.

7. The method according to claim 2, characterized in that: After filtering the second table entry in the original table entry set according to the traffic statistics information of each table entry, the method further includes: The second table item obtained by screening is used as a new second table item; According to the new second entry, some or all of the entries in the second access control list and the first access control list are swapped so that the second access control list is composed of the new second entry, and the first access control list at least contains the new first entry; the new first entry is the entry in the original entry set except the new second entry.

8. A router, characterized in that: include: Network processing chip and internal memory; The network processing chip is used to receive messages; The network processing chip is further used to search for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of the network processing chip; the second entry included in the second access control list is screened from the original entry set; The network processing chip is also used to search for the matching entry in the first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list at least includes a first entry; the first entry is an entry in the original entry set except the second entry.

9. An access control list information processing device, characterized in that: The device comprises: A message receiving module, used for receiving messages; A first search module is used to search for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second entry included in the second access control list is screened from an original entry set; A second search module is used to search for the matching entry in the first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list at least includes a first entry; the first entry is an entry in the original entry set except the second entry.

10. A network device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images