Flow blocking method based on distributed DPI system and related equipment

Abstract

The invention provides a flow blocking method based on a distributed DPI system and related equipment, and the method comprises the steps: a main control board receives and analyzes a first blocking rule issued through a northbound interface, and issues a non-quintuple matching rule in the first blocking rule to a message processing unit in a full-quantity manner; the programmable switching chip forwards the network message to a message processing unit; the message processing unit performs matching judgment on the network message according to a non-quintuple matching rule; when identifying that the network message hits the non-quintuple matching rule, reporting the corresponding key feature information to the main control board; the main control board generates a second blocking rule according to the key feature information and issues the second blocking rule to the programmable switching chip; and the programmable switching chip writes the received second blocking rule into an internal configurable rule table, and executes traffic blocking when a subsequent network message hits the second blocking rule. According to the invention, accurate classification, identification and plugging of complex, encrypted or dynamically changed traffic in a network can be realized.

Description

Technical Field

[0001] This application relates to the field of computer network technologies, and particularly to a traffic blocking method and related devices based on a distributed DPI system. Background Art

[0002] With the wide application of Internet technologies, the global network communication traffic shows an explosive growth trend. Against the background of the continuous expansion of the data transmission scale, enterprises and operators are facing increasingly severe network security threats and compliance management challenges, such as bandwidth abuse control, service priority guarantee, malicious traffic identification and control, etc.

[0003] Meanwhile, the existing network environment structure and communication protocol form have also changed significantly. Especially, the proportion of encrypted communication traffic represented by HTTPS continues to rise, making it difficult for traditional blocking methods that rely on five-tuple features (i.e., source / destination IP, source / destination port, transport protocol, etc.) for static matching to work, resulting in an increase in the blocking misjudgment rate and even being unable to effectively prevent and control encrypted malicious communications.

[0004] In addition, traditional blocking systems mostly adopt a centralized structure. When facing a high-concurrency, high-throughput, and high-complexity network environment, there are problems such as processing bottlenecks, response delays, and untimely rule updates, and it is difficult to meet the actual needs of current network operation and maintenance and security protection. Therefore, there is an urgent need for a network traffic blocking solution with stronger recognition ability, higher throughput performance, and more flexible deployment architecture. Summary of the Invention

[0005] Aiming at the deficiencies of the existing technology, this application provides a traffic blocking method and related devices based on a distributed DPI system, aiming to achieve efficient identification and accurate blocking of network traffic in a high-throughput and complex traffic environment, so as to improve the processing throughput and response real-time performance of the system.

[0006] To achieve the above object and other advantages, this application is implemented by adopting the following technical solutions: In a first aspect, some embodiments of this application provide a traffic blocking method based on a distributed DPI system. The DPI system includes a main control board and multiple service boards. The main control board communicates with the multiple service boards through a system control bus. Each service board integrates at least one programmable switching chip and multiple packet processing units. The method includes: The main control board receives a first blocking rule sent through a northbound interface and parses it, and distributes the non-five-tuple matching rules in the first blocking rule to multiple packet processing units in a full-volume manner; The programmable switching chip receives a network packet entering the DPI system and forwards the network packet to any one of the packet processing units; The packet processing unit performs matching and judgment on the network packet according to the non-five-tuple matching rule; When it is recognized that the network packet hits the non-five-tuple matching rule, the corresponding key feature information is reported to the main control board, and the key feature information includes the destination IP address, destination port number, and protocol type of the network packet; The main control board generates a second blocking rule that can be recognized by the programmable switching chip according to the key feature information, and issues it to the programmable switching chip; The programmable switching chip writes the received second blocking rule into an internally configurable rule table, and performs traffic blocking when a subsequent network packet hits the second blocking rule.

[0007] According to a traffic blocking method based on a distributed DPI system provided by the present application, the step that the main control board receives the first blocking rule issued through the northbound interface and performs parsing, and issues the non-five-tuple matching rule in the first blocking rule to multiple packet processing units in a full amount manner includes: When parsing the first blocking rule, the main control board determines the rule issuing path according to the field type included in the first blocking rule; If the first blocking rule only contains field information based on five tuples, the first blocking rule is directly issued to the programmable switching chip, and the programmable switching chip performs the corresponding blocking operation; If the first blocking rule contains non-five-tuple application layer field information, the first blocking rule is issued to multiple packet processing units in a full amount manner as a non-five-tuple matching rule.

[0008] According to a traffic blocking method based on a distributed DPI system provided by the present application, the non-five-tuple application layer field information includes one or more of: URL field, SNI field, application feature field.

[0009] According to a traffic blocking method based on a distributed DPI system provided by the present application, the step that the packet processing unit performs matching and judgment on the network packet according to the non-five-tuple matching rule includes: The packet processing unit analyzes and obtains at least one application layer field information from the network packet; Compare the application layer field information item by item with the non-five-tuple matching rule; If the application layer field information meets any set matching condition in the non-five-tuple matching rule, it is regarded that the network packet hits the non-five-tuple matching rule, and the matching conditions include: string equal value matching, prefix matching, inclusion relationship matching, or pattern matching based on regular expressions.

[0010] According to a traffic blocking method based on a distributed DPI system provided by the present application, the step in which the main control board generates a second blocking rule recognizable by the programmable switching chip according to the key feature information and sends it to the programmable switching chip includes: The main control board uses the destination IP address, destination port number, and protocol type in the key feature information as matching fields, and sets corresponding blocking action fields; Based on the matching fields and the blocking action fields, a second blocking rule is constructed, and the blocking action fields include at least one operation of discarding, redirecting, or mirroring; The main control board calls the control interface of the programmable switching chip and sends the second blocking rule.

[0011] According to a traffic blocking method based on a distributed DPI system provided by the present application, the step in which the programmable switching chip writes the received second blocking rule into an internally configurable rule table and performs traffic blocking when a subsequent network packet hits the second blocking rule includes: Write the matching fields and corresponding blocking actions in the second blocking rule into the rule table of the programmable switching chip; When the programmable switching chip subsequently receives a new network packet, it determines whether the new network packet conforms to the second blocking rule according to the matching conditions in the rule table; If the new network packet hits the second blocking rule, the programmable switching chip performs corresponding blocking actions on the network packet. If the new network packet does not hit the second blocking rule, the programmable switching chip continues to forward the network packet along the original forwarding path.

[0012] According to a traffic blocking method based on a distributed DPI system provided by the present application, each packet processing unit determines the composite identification information of the packet processing unit through its own identification ID in the service board, the identification ID of the service board where it is located, and the IP address of the main control board communicating with the service board; The composite identification information is used to uniquely identify each packet processing unit in the DPI system, so that the main control board can implement rule sending, hit result tracking, and status management for multiple packet processing units.

[0013] In a second aspect, some embodiments of the present application further provide an electronic device, where the electronic device includes: One or more processors; and a memory storing computer program instructions, and when the computer program instructions are executed, the processors execute the traffic blocking method based on a distributed DPI system as described in any of the above.

[0014] In a third aspect, some embodiments of the present application further provide a computer-readable storage medium, on which computer programs and / or instructions are stored. When the computer programs and / or instructions are executed by a processor, the traffic blocking method based on a distributed DPI system as described in any one of the above is implemented.

[0015] In a fourth aspect, some embodiments of the present application further provide a computer program product, including computer programs and / or instructions. When the computer programs / instructions are executed by a processor, the traffic blocking method based on a distributed DPI system as described in any one of the above is implemented.

[0016] Compared with the related art, in the solution provided by the embodiments of the present application, the limitation of the existing DPI system that only performs static matching and blocking based on five-tuple fields is broken through, and the recognition and matching of non-five-tuple application layer fields such as URLs, SNIs, and application identification fields are supported, enabling the system to perform deeper analysis and accurate identification for encrypted traffic, non-standard protocols, or dynamic port behaviors, and adapting to the development trend of highly complex modern network traffic. At the same time, based on the matrix-type message processing unit structure on multiple service boards, the received network messages can be parsed in parallel and high-speed matching judgments can be made, realizing the distributed execution of the blocking logic on multiple processing units, significantly improving the overall processing throughput capacity and response speed of the system, and meeting the real-time traffic blocking requirements in large-scale concurrent scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present application. For those of ordinary skill in the art, other embodiments can be obtained based on these drawings without creative efforts.

[0018] Figure 1 is a schematic diagram of the system architecture of the distributed DPI system provided by the embodiments of the present application; Figure 2 is a schematic flowchart of a traffic blocking method based on a distributed DPI system provided by the embodiments of the present application; Figure 3 is a schematic diagram of the logic for issuing the configured blocking rules; Figure 4 is a schematic diagram of the logic for the DPU to report key information of the hit traffic and issue a programmable switching chip to execute traffic blocking; Figure 5 is a schematic diagram of the structure of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will clearly and completely describe the technical solutions in the embodiments of this application in conjunction with the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, rather than all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in this application without creative efforts belong to the scope of protection of this application.

[0020] The following terms are used in this article.

[0021] DPI (Deep Packet Inspection) is a content-based network data analysis technology that can perform multi-level content parsing and field extraction on data packets during the network data forwarding process. Compared with the traditional matching method based only on the five-tuple (source / destination IP address, source / destination port, protocol type), DPI technology can further identify application layer feature information in data packets, such as URL fields, SNI fields, HTTP header fields, application protocol types, etc.

[0022] First Embodiment The first embodiment of this application relates to a traffic blocking method based on a distributed DPI system. The DPI system includes a main control board and multiple service boards. The main control board communicates with multiple service boards through a system control bus, and each service board integrates at least one programmable switching chip and multiple message processing units.

[0023] Refer to Figure 1 As shown, the DPI system mainly includes a front-end frame device and multiple XDR general application servers. The front-end frame device is the hardware platform responsible for network traffic analysis and preliminary blocking in this system. It adopts an overall modular board structure and is composed of a main control board and multiple service boards. Each service board is installed in a unified frame structure by means of slots and establishes a communication connection with the main control board through a system control bus. Multiple message processing units are integrated on each service board, and each message processing unit communicates with the programmable switching chip on the same board through an internal interconnection structure to achieve flow control and task distribution of network messages.

[0024] The main control board is the centralized management unit of the system, mainly used to receive policy control instructions from the northbound interface, complete the parsing of blocking rules, the identification and judgment of non-five-tuple fields, and the synchronous distribution of rules and the processing and feedback of hit information. The main control board communicates with multiple service boards through a system control bus to achieve unified management and control of data processing nodes throughout the system.

[0025] Multiple service boards are the execution units for blocking operations and are deployed at different slot positions within a unified chassis. Each service board integrates at least one programmable switch chip (Switch) for receiving incoming external network packet traffic and performing forwarding, pre-matching, and packet distribution. Multiple packet processing units (DPUs), as the computing units for performing deep packet inspection, are used to identify protocols, extract fields, and match and judge blocking rules for network packets.

[0026] Each packet processing unit determines its composite identification information through its own identification ID in the service board, the identification ID of the service board it is in, and the IP address of the master control board communicating with the service board; the composite identification information is used to uniquely identify each packet processing unit in the DPI system, thereby enabling the master control board to implement rule distribution, hit result tracking, and status management for multiple packet processing units.

[0027] For example, by combining the master control board IP address: "10.1.0.1", service board ID: "Slot03", and packet processing unit ID: "DPU02", a specific packet processing unit instance can be uniquely determined throughout the distributed DPI system. The master control board can issue precise non-five-tuple blocking rules to specific packet processing units as needed. When a certain DPU reports blocking hit information, the master control board can quickly identify its origin. Therefore, the master control board can monitor the operating status of the DPU, archive logs, and collect performance based on the composite identification information.

[0028] Optionally, each service board further includes a local CPU control module for assisting in scheduling DPU nodes to perform operations such as flow control management, status awareness, and rule execution status feedback.

[0029] The DPU nodes on multiple service boards together form a distributed parallel processing architecture, that is, a matrix processing structure composed of several packet processing units is formed in the system, and this structure can perform multi-channel concurrent parsing, field matching, and blocking judgment on the network packets flowing into the system.

[0030] Through the above architecture deployment, the system realizes horizontally scalable packet processing capabilities, that is, each DPU independently executes matching tasks, and multiple DPUs cooperate to complete distributed parsing and determination under high-traffic conditions, thus possessing high-throughput concurrent processing capabilities and precise matching capabilities for diverse blocking rules.

[0031] This matrix architecture not only improves the system's processing efficiency for complex traffic environments (such as high concurrency, multiple protocols, encrypted traffic), but also supports hardware deployment strategies that can be scaled as needed, making this system have good adaptability and maintainability in dealing with network traffic governance scenarios at the carrier level, enterprise level, or data center level.

[0032] Refer toFigure 2 As shown in the figure, the method may include the following steps: Step S1: The main control board receives the first blocking rule sent through the northbound interface and parses it, and distributes the non-five-tuple matching rules in the first blocking rule to multiple packet processing units in a full-scale manner.

[0033] Among them, the northbound interface refers to an interface located above the system control plane or management plane, which is used to receive control instructions, configuration data or policy rules from an external control system, policy platform or management center. In this embodiment, the northbound interface is used for the main control board to receive the first blocking rule from an upper-layer policy control platform (such as an XDR server, a security management system, a policy server, etc.), and supports structured data interaction based on protocols such as RESTful API, NetConf, gRPC.

[0034] The first blocking rule is a traffic blocking rule (blocking rule configuration package) sent by the upper-layer policy control system to the main control board of the DPI system through the northbound interface. This rule is usually described in a structured format, and its content includes several blocking condition items and their blocking action information. The blocking conditions can cover network layer and application layer fields, including both traditional five-tuple information (source IP, destination IP, source port, destination port, protocol type), and non-five-tuple fields (such as URL field, SNI field, AppInfo application feature field, etc.).

[0035] The management process tap_master on the main control board listens to and maintains the northbound interface connection, and periodically or in real time receives the blocking rules sent by the policy control platform. After the received blocking rules are parsed, field extraction and type judgment are performed. If the rule item contains application layer fields, such as non-five-tuple fields such as URL and SNI, it is determined as a "non-five-tuple matching rule".

[0036] Since a programmable switching chip (such as based on the P4 programmable language) has a hardware-accelerated rule table designed specifically for static field matching of five-tuples, which supports directly writing rules into TCAM or SRAM table entries to achieve fast judgment and execution of blocking actions. Therefore, when the blocking rule is only a basic five-tuple rule (such fields are located in the network layer and transport layer and can be directly parsed and matched by the programmable switching chip), the tap_master process can skip the DPU processing link and directly convert the rule item into a matching command recognizable by the programmable switching chip for fast distribution. Directly writing into the rule table entry of the switching chip realizes immediate blocking at the data layer, reduces the system blocking response delay, releases the DPU computing resources, and improves the overall machine blocking efficiency and rule processing throughput.

[0037] In the distributed architecture of a DPI system, network packets first arrive at the programmable switching chip, which then forwards the traffic to any DPU. This means that after entering the system, network traffic may be forwarded to any DPU for processing, and it's uncertain which DPU will receive the traffic. To ensure that any DPU receiving the traffic can promptly identify and execute non-quintuple rules, these rules must be distributed simultaneously to all DPUs in full. This ensures accurate blocking and consistent system response, simplifies traffic scheduling logic, and enables parallel identification and seamless blocking under distributed conditions.

[0038] Step S2: The programmable switching chip receives the network message entering the DPI system and forwards the network message to any message processing unit.

[0039] Regarding step S2, specifically, the network messages entering the system can originate from mirrored flows, bypass flows, or main link import flows. The programmable switching chip performs basic header parsing on each received message, and then forwards the message according to the traffic distribution strategy. Traffic distribution strategies may include hash load balancing scheduling, polling scheduling, flow table-based pre-allocation mechanisms, or random scheduling mechanisms, etc., which distribute network traffic in a balanced or policy-oriented manner to any message processing unit for deep packet inspection. In this way, the switching chip is responsible for traffic reception and distribution, and the message processing unit performs deep inspection and rule matching, realizing the decoupling of the control layer and the data layer in the DPI system.

[0040] Step S3: The message processing unit performs matching judgment on the network message according to the non-five-tuple matching rule.

[0041] Regarding step S3, specifically, during the parsing process, the message processing unit extracts key information from the application layer fields for blocking matching, including but not limited to application layer feature fields such as URL fields, SNI fields, and App Info fields. Subsequently, the DPU matches the extracted field information with the locally stored non-five-tuple matching rules one by one. Matching methods may include: exact matching, prefix matching, inclusion relationship matching, regular expression matching, etc. If a field in the network message hits a non-five-tuple rule, it is considered that the message meets the blocking conditions. In this way, by performing the extraction and matching judgment of the non-five-tuple field in the message processing unit, not only can the deep fields such as pre-encryption information and application feature information be identified, but the scope of application of the blocking strategy can also be greatly expanded, so that the DPI system has the ability to identify and respond to complex, encrypted, and diversified traffic, thereby achieving a more accurate and adaptable traffic blocking mechanism.

[0042] Step S4: When it is recognized that a network packet hits a non-five-tuple matching rule, report the corresponding key feature information to the main control board. The key feature information includes the destination IP address, destination port number, and protocol type of the network packet.

[0043] Regarding Step S4, specifically, when a certain network packet is considered to belong to the blocked object traffic, in order to further quickly construct a hardware-recognizable blocking rule for blocking on the data plane, the packet processing unit extracts the key feature information in the packet and reports it to the main control board. The key feature information includes but is not limited to the following fields. For example, the destination IP address: refers to the destination node address of the current network packet; the destination port number: refers to the target service port; the protocol type: such as TCP, UDP, ICMP, etc., which is used to identify the upper-layer transport protocol. The packet processing unit sends the above key feature information as a blocking hit event to the policy scheduling module (such as the tap_master management process) of the main control board through the control link established with the main control board (such as an internal message queue, bus message, shared memory, or event notification mechanism). Through the design of this step, the complex rule hit result recognized by the packet processing unit can be converted into a multi-tuple feature that the main control board can use to construct a simplified blocking rule, reducing the complexity and execution cost of the subsequent data-plane blocking rule and improving the overall blocking efficiency and adaptation ability of the system.

[0044] Step S5: The main control board generates a second blocking rule that can be recognized by the programmable switch chip based on the key feature information and sends it to the programmable switch chip.

[0045] Regarding Step S5, specifically, when the main control board receives the key feature information reported by any packet processing unit, it is regarded as there being suspicious or target traffic hitting a certain non-five-tuple blocking rule. At this time, the main control board constructs a second blocking rule applicable to the programmable switch chip based on the key feature information. The second blocking rule is a simplified matching rule generated based on the execution requirements at the data layer, and its fields usually include: destination IP address, destination port number, protocol type, matching action, priority, or effective parameters. The main control board encapsulates and sends the second blocking rule to the switch chip through the control interface established with the programmable switch chip. Since the second blocking rule has the characteristics of clear structure, high matching efficiency, and easy chip entry loading, it can be directly written into the storage structure (such as TCAM, SRAM) of the programmable switch chip. In this way, there is no need to process through the DPU node again later, and immediate blocking of the hit traffic at the hardware level can be achieved, greatly reducing the overall processing delay of the system. The main control board can set cancellation rules, effective time limits, or linkage trigger adjustments for responding to other system events for the sent second blocking rule, thereby enhancing the flexibility, intelligence, and security policy closed-loop ability of the entire system.

[0046] Step S6: The programmable switch chip writes the received second blocking rule into the internally configurable rule table and performs traffic blocking when the subsequent network packets match the second blocking rule.

[0047] Regarding Step S6, specifically, after the master control board generates the second blocking rule and sends it to the programmable switch chip on the service board through the control channel, the switch chip receives the blocking rule and writes it into its own internally configurable rule table. This rule table is the hardware-level matching execution mechanism of the switch chip and is usually based on the TCAM or SRAM storage structure inside the chip, constituting the rule table within the switch chip. Since the programmable switch chip has the ability to dynamically modify the matching table entries during runtime, that is, it can directly add, delete, or modify the rule table entries without powering down, restarting, or interrupting the current forwarding process of the system, it has the hot-insertion ability and can achieve the online effectiveness and update of the blocking policy.

[0048] Each second blocking rule is written as an entry, including matching fields (such as destination IP address, destination port number, protocol type, etc.), action fields (such as discard, redirect, mirror, marking, etc.), priority fields (used to distinguish the execution order when multiple rules are matched simultaneously), etc. The writing process is completed through the control interface protocol supported by the switch chip (such as P4Runtime, OpenFlow, NetConf, private driver API, etc.) to ensure that the rules can be executed in the data path with low latency and at line speed. After the rule writing is completed, the switch chip automatically loads it into the flow table. Subsequently, when a new network packet enters the switch chip, the chip quickly matches and judges the header fields of the packet. If the matching condition of the second blocking rule is met, the blocking process is immediately executed according to the action defined in the rule (such as directly discarding the packet); if not, the matching continues according to other entries, or the default action is executed (such as forwarding or handing it over to the DPU for further processing). This avoids the repeated transmission of the hit traffic back to the master control board or the DPU, improving the overall system throughput and resource efficiency.

[0049] It is not difficult to find that, compared with the related art, the solution provided in the embodiment of the present application proposes an inventive concept of elevating the blocking action to the hardware layer of the switching chip, breaking through the limitation of the existing DPI system that only performs static matching and blocking based on the five-tuple field, and supports the identification and matching of non-five-tuple application layer fields such as URL, SNI, and application identification fields, so that the system can conduct deeper analysis and accurate identification of encrypted traffic, non-standard protocols or dynamic port behaviors, and adapt to the development trend of highly complex modern network traffic. At the same time, based on the matrix message processing unit structure on multiple business boards, the received network messages can be parsed in parallel and matched at high speed, realizing the distributed execution of blocking logic on multiple processing units, significantly improving the overall processing throughput and response speed of the system, and being suitable for the real-time traffic blocking needs in large-scale concurrent scenarios.

[0050] Second embodiment The second embodiment of the present application relates to a traffic blocking method based on a distributed DPI system. The second embodiment is an improvement on the first embodiment. The specific improvement is that: in the second embodiment of the present application, a specific implementation method is provided in which a main control board receives and parses the first blocking rule sent through the northbound interface, and sends the non-five-tuple matching rules in the first blocking rule in full to multiple message processing units. That is, step S1 can further include the following steps: Step S101: When parsing the first blocking rule, the main control board determines the rule delivery path according to the field type included in the first blocking rule; Step S102: If the first blocking rule only includes field information based on the quintuple, the first blocking rule is directly sent to the programmable switching chip, and the programmable switching chip performs the corresponding blocking operation; Step S103: If the first blocking rule includes non-quintuple application layer field information, the first blocking rule is sent to multiple message processing units in full as a non-quintuple matching rule.

[0051] For example, after receiving the first blocking rule sent via the northbound interface, the main control board can identify the matching field type involved in the rule through field parsing. This identification process can extract and classify the field content in the rule based on a structured rule format (such as JSON, YAML, or a dedicated protocol format). If, as determined in step S101, the first blocking rule only contains five-tuple field information, the main control board can directly convert the rule into a hardware blocking instruction suitable for the P4 switch chip and send it to the programmable switch chip on the corresponding service board via the control channel. After receiving the rule, the switch chip can load it into its internal rule table and immediately execute the blocking action when a subsequent network message hits it.

[0052] Furthermore, this distribution process supports hot plugging during runtime, avoiding service interruptions, and can support policy parameters such as rule priority configuration, scheduled effectiveness, and version management.

[0053] If it is determined in step S101 that the first blocking rule contains non-five-tuple field information, that is, the rule involves application layer fields (such as URL, SNI, App Info, etc.), the main control board processes this rule as a non-five-tuple matching rule. To ensure that traffic can be accurately identified when passing through any packet processing unit, the main control board distributes this type of rule to all packet processing units in a full volume manner, such as Figure 3 shown, which shows the control relationship, data processing path, and configuration broadcast mechanism between the main control board and the service board.

[0054] Furthermore, this distribution can be implemented through the tap_master process of the main control board by means of batch broadcast or rule synchronization mechanism, ensuring that each DPU has a complete matching ability to avoid blocking omissions or path dependence problems.

[0055] Exemplarily, the non-five-tuple field information includes any one of the following or a combination thereof: URL field, SNI field, application feature field. The URL field is used to represent the resource location address in the HTTP request packet, the SNI field is used to identify the target server domain name field in the TLS handshake stage, the application feature field: refers to the field information that can identify the application type, and the App Info field refers to the field information that can identify the application type, such as User-Agent, Host, App ID, fingerprint feature, etc.

[0056] It is not difficult to find that in the embodiments of the present application, by dynamically selecting a suitable distribution path according to the field type, for the basic five-tuple rules, the hardware direct-through path is taken, and the blocking action can be generated and executed immediately, reducing the processing link and being applicable to high-speed blocking scenarios. And the complex non-five-tuple rules are distributed to each DPU in a full volume manner to ensure that any DPU has a complete recognition ability, preventing blocking omissions or recognition path dependence. It improves the adaptability and flexibility of the execution of the blocking rules to maximize the utilization of computing resources and switching resources.

[0057] Third Embodiment The third embodiment of the present application relates to a traffic blocking method based on a distributed DPI system. The third embodiment is an improvement based on the first or second embodiment. The specific improvement lies in: in the third embodiment of the present application, a specific implementation manner for a packet processing unit to perform matching judgment on network packets according to non-five-tuple matching rules is provided. That is, step S3 can further include the following steps: Step S301: The packet processing unit analyzes and obtains at least one application layer field information from the network packet; Step S302: Compare the application layer field information item by item with the non-five-tuple matching rules; Step S303: If the application layer field information meets any of the set matching conditions in the non-five-tuple matching rules, it is regarded that the network packet hits the non-five-tuple matching rules. The matching conditions include: string equal value matching, prefix matching, inclusion relationship matching or pattern matching based on regular expressions.

[0058] Exemplarily, after receiving a network packet forwarded by a switching chip, a packet processing unit (DPU) first performs a protocol decoding operation on the packet, and analyzes it layer by layer to the application layer content to extract one or more field information that can be used for identification. Each non-five-tuple matching rule contains at least one matching field and its corresponding matching pattern for defining the hit condition. After extracting the application layer fields, the packet processing unit will match and judge them item by item with the non-five-tuple matching rules stored locally.

[0059] Furthermore, the matching process can be implemented by a high-performance rule engine and supports the following comparison methods: such as string equal value matching, prefix matching, inclusion relationship matching or pattern matching based on regular expressions, etc.

[0060] During the field comparison process, if any application layer field in the network packet meets the set conditions in a certain non-five-tuple matching rule, the packet processing unit will determine that the network packet hits the non-five-tuple matching rule and output the hit status as the matching result.

[0061] Furthermore, the DPU forms structured data including the matching rule ID, the hit field value, the hit type, and the key triple information (destination IP, destination port, protocol type) extracted from the network packet, and reports it as a hit event to the main control board to trigger the subsequent generation and rapid distribution process of the second blocking rule. See steps S4 and S5.

[0062] It is not difficult to find that in the embodiment of the present application, the packet processing unit can accurately analyze the application layer fields in the network packet, no longer limited to the traditional five-tuple rules, enabling the system to identify encrypted communication traffic, proxy forwarding traffic, traffic generated by mobile applications, and traffic that hides the true access intention based on a content distribution network, etc. Since the identification is based on deep fields and semantic structures, it avoids the limitations of the five-tuple static rules (judging only by IP address or port number), making the blocking operation more targeted, effectively reducing the risk of mis-blocking, and improving the accurate identification ability for target traffic.

[0063] Fourth Embodiment The fourth embodiment of this application relates to a traffic blocking method based on a distributed DPI system. The fourth embodiment is an improvement based on the first embodiment. The specific improvement lies in that: in the fourth embodiment of this application, a specific implementation manner is provided in which the main control board constructs a second blocking rule according to key feature information and issues it to achieve fast blocking at the hardware level. That is, step S5 can further include the following steps: Step S501: The main control board uses the destination IP address, destination port number, and protocol type in the key feature information as matching fields and sets the corresponding blocking action fields; Step S502: Based on the matching fields and blocking action fields, construct a second blocking rule. The blocking action fields include at least one of the operations: discard, redirect, or mirror; Step S503: The main control board calls the control interface of the programmable switching chip and issues the second blocking rule.

[0064] Exemplarily, as Figure 4 shown, the DPU reports the key feature information of the blocking hit to the main control board. The main control board uses the three fields of the key feature information (destination IP address, destination port number, and protocol type) as the matching fields in the subsequent blocking rule to construct the matching conditions in the second blocking rule to identify the target traffic to be blocked subsequently. The main control board determines the corresponding blocking action fields according to the current system policy configuration or hit rule level, that is, the processing actions to be performed when the network packet hits the above matching fields. The action fields include but are not limited to: discard (Drop), redirect (Redirect), mirror (Mirror), mark (Mark), etc. The tap_master process of the main control board encapsulates the matching fields and blocking action fields into a second blocking rule and issues it to the programmable switching chip for execution to achieve fast blocking of subsequent traffic.

[0065] The main control board can set the action type according to a preset policy template, hit frequency, user behavior level, device alarm policy, etc. For example, the mirror processing action is adopted for hitting low-risk rules, the redirect action is adopted for hitting medium-risk rules, and the discard action is adopted for hitting high-risk or attack-type rules. <H

[0066] Furthermore, to ensure that the rule can be hot-inserted without affecting the current service, the main control board can perform incremental writing operations in an online configuration manner and can ensure the rule effective state through an asynchronous callback or write confirmation mechanism.

[0067] It should be noted that the fourth embodiment of this application can also be an improvement based on any one or more of the first embodiment to the third embodiment.

[0068] It is easy to find that in the embodiments of the present application, the main control board dynamically constructs a structured blocking rule based on the hit result reported by the message processing unit, and sends the rule to the programmable switching chip for execution. The hierarchical decoupling of recognition and execution is achieved. After receiving the hit information, the main control board can generate a rule in real time and hot insert it into the matching table of the switching chip, so that subsequent traffic can be blocked by the hardware in the data path in the first time, greatly reducing the response delay.

[0069] The fifth embodiment The fifth embodiment of the present application relates to a traffic blocking method based on a distributed DPI system. The fifth embodiment is an improvement based on the first embodiment. The specific improvement lies in that: in the fifth embodiment of the present application, a specific implementation manner of traffic blocking based on the second blocking rule is provided on the programmable switching chip side. That is, step S6 may further include the following steps: Step S601: Write the matching fields and corresponding blocking actions in the second blocking rule into the rule table of the programmable switching chip; Step S602: When the programmable switching chip receives a new network message subsequently, determine whether the new network message conforms to the second blocking rule according to the matching conditions in the rule table; If the new network message hits the second blocking rule, then execute step S603: The programmable switching chip executes the corresponding blocking action on the network message. If the new network message does not hit the second blocking rule, then execute step S604: The programmable switching chip continues to forward the network message along the original forwarding path.

[0070] Exemplarily, after generating the second blocking rule, the main control board sends the rule to the programmable switching chip on the corresponding service board through the control interface. The programmable switching chip internally maintains a rule table, which can be implemented based on TCAM, SRAM or other high-speed addressable storage structures. The main control board writes the rule in the form of a structured table entry through a control channel interface such as P4Runtime, OpenFlow, NetConf, etc. This process supports runtime hot insertion without restarting the service or interrupting the service flow.

[0071] Refer to Figure 4As shown in the figure, after the rule table is loaded, the programmable switching chip starts to perform fast matching judgment on each subsequent network packet entering the system. After the packet enters, the chip automatically extracts its header information fields (such as destination IP, destination port, protocol type), and compares this field with the matching fields in the loaded rule table item by item. If the current network packet does not match any entry in the second blocking rule, the programmable switching chip will continue to send the packet to the next-hop network node or the destination node according to the original forwarding path. If the current network packet matches the matching field of any valid entry in the second blocking rule, the programmable switching chip will immediately perform a blocking process on the packet according to the action field corresponding to this rule. This blocking action takes effect immediately in the data plane hardware, has the ability to process at line speed, and can complete the blocking judgment and processing within the microsecond level.

[0072] It should be noted that the fifth embodiment of this application can also be an improvement based on any one or more of the first to fourth embodiments.

[0073] It is not difficult to find that in the embodiments of this application, through the high-speed matching judgment and action execution of the blocking rule on the programmable switching chip side, a closed-loop control path from recognition to response is realized, improving the system's ability to handle high-concurrency complex traffic. The programmable switching chip supports flexible configuration of various blocking strategies, enhancing the diversity of the system's blocking strategies. The unhit traffic remains unobstructed, ensuring the continuity and stability of the system services.

[0074] The step division of the above various methods is only for clear description. When implemented, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are within the protection scope of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs, but not changing the core design of its algorithm and process are within the protection scope of this application.

[0075] In addition, some embodiments of this application also provide an electronic device. The electronic device can be various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and so on. The electronic device can also be various forms of mobile devices, such as personal digital processors, cellular phones, smart phones, wearable devices, and other similar computing devices.

[0076] The electronic device includes: one or more processors; and a memory storing computer program instructions, and when the computer program instructions are executed, the processors execute the traffic blocking method based on the distributed DPI system provided by any one or more of the above embodiments. Figure 5An exemplary structural diagram of the electronic device is disclosed. The electronic device includes: one or more processors 1101, a memory 1102, and interfaces for connecting various components, including a high-speed interface and a low-speed interface. Each component is interconnected using different buses and can be mounted on a common motherboard or otherwise installed as required. The processor can process instructions executed within the electronic device, including instructions stored in the memory or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some other embodiments, if needed, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides part of the necessary operations. Among them, the components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0077] The electronic device may further include: an input device 1103 and an output device 1104. The processor 1101, the memory 1102, the input device 1103, and the output device 1104 can be connected via a bus or other means. Figure 5 Taking the connection via the bus as an example.

[0078] The input device 1103 can receive input digital or character information and generate key signal inputs related to the user settings and function controls of the electronic device, such as input devices like a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointing stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 1104 can include a display device, an auxiliary lighting device (such as an LED), and a haptic feedback device (such as a vibration motor), etc. The display device can include, but is not limited to, a liquid crystal display, a light-emitting diode display, and a plasma display. In some embodiments, the display device can be a touch screen.

[0079] To provide interaction with the user, the electronic device can be a computer. The computer has: a display device for displaying information to the user (such as a cathode ray tube or an LCD monitor); and a keyboard and a pointing device (such as a mouse), through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (such as visual feedback, auditory feedback); and the input from the user can be received in any form (such as voice input or tactile input).

[0080] In the embodiments of the present application, a computer program / instruction is stored on a computer-readable medium. When the computer program / instruction is executed by a processor, it implements the traffic blocking method based on a distributed DPI system provided by any one or more of the above embodiments. The computer-readable medium may be included in the electronic device described in the above embodiments; or it may exist separately without being assembled into the device. The above computer-readable medium carries one or more computer-readable instructions.

[0081] The memory 1102 can be used as a non-transitory computer-readable storage medium for storing non-transitory software programs, non-transitory computer-executable programs, and modules. By running the non-transitory software programs, instructions, and modules stored in the memory 1102, the processor 1101 executes various functional applications and data processing of the server to implement the program instructions / modules corresponding to the methods provided by any one or more of the above embodiments in the embodiments of the present application.

[0082] The memory 1102 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system and application programs required for at least one function; the data storage area can store data created according to the use of the electronic device, etc. In addition, the memory 1102 may include a high-speed random access memory and may also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory 1102 may optionally include a memory remotely provided relative to the processor 1101, and these remote memories can be connected to the electronic device through a network. Examples of the above network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0083] It should be noted that the computer-readable medium described in the present application may be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. The computer-readable medium may be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of the computer-readable storage medium may include but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable medium may be any tangible medium that contains or stores a program, and this program can be used by or combined with an instruction execution system, apparatus, or device.

[0084] A computer-readable medium includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory, static random access memory, dynamic random access memory, other types of random access memory, read-only memory, electrically erasable programmable read-only memory, flash memory or other memory technologies, compact disc read-only memory, digital versatile disc or other optical storage, magnetic cassette tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0085] Computer program code for performing the operations of the present application can be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as C or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network or a wide area network, or can be connected to an external computer (e.g., by using an Internet service provider to connect through the Internet).

[0086] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. For example, a dedicated integrated circuit, a general-purpose computer, or any other similar hardware device can be used. In some embodiments, the software program of the present application can be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) can be stored in a computer-readable recording medium, such as a RAM memory, a magnetic or optical drive, or a floppy disk and similar devices. Additionally, some steps or functions of the present application can be implemented by hardware, for example, as a circuit that cooperates with a processor to execute each step or function.

[0087] The computer program product provided by the embodiments of the present application includes one or more computer programs / instructions. When the computer programs / instructions are executed by a processor, they wholly or partly generate the processes or functions described in the embodiments of the present application. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired means (such as coaxial cable, optical fiber, digital subscriber line) or wireless means (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrating one or more available media. The available medium may be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state drive), etc.

[0088] The flowcharts or block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of devices, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that, in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combinations of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware system for performing the specified functions or operations, or by a combination of dedicated hardware and computer instructions.

[0089] The scope of the present application is defined by the appended claims rather than the above description. Therefore, all changes that fall within the meaning and scope of the equivalent elements of the claims are intended to be included in the present application. Any reference signs in the claims should not be regarded as limiting the claims concerned. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units or devices stated in the apparatus claims may also be implemented by one unit or device through software or hardware. The words "first", "second", etc. are only used for distinguishing descriptions and do not represent any specific order, nor can they be understood as indicating or implying relative importance.

[0090] As described above, it is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily make changes or substitutions, which should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims, and the above embodiments should be regarded as exemplary and non-restrictive.

Claims

1. A traffic blocking method based on a distributed DPI system, characterized in that: The DPI system includes a main control board and multiple service boards, wherein the main control board communicates with the multiple service boards via a system control bus, and the service boards integrate at least one programmable switching chip and multiple message processing units. The method includes: The main control board receives and parses the first blocking rule sent through the northbound interface, and sends the non-quintuple matching rule in the first blocking rule to the multiple message processing units in full; The programmable switching chip receives the network message entering the DPI system and forwards the network message to any of the message processing units; The message processing unit performs matching judgment on the network message according to the non-five-tuple matching rule; When it is identified that the network message hits the non-five-tuple matching rule, the corresponding key feature information is reported to the main control board, the key feature information including the destination IP address, destination port number and protocol type of the network message; The main control board generates a second blocking rule that can be identified by the programmable switching chip according to the key feature information, and sends the second blocking rule to the programmable switching chip; The programmable switching chip writes the received second blocking rule into an internal configurable rule table, and performs traffic blocking when subsequent network packets hit the second blocking rule.

2. The traffic blocking method based on the distributed DPI system according to claim 1 is characterized in that: The main control board receives and parses the first blocking rule sent through the northbound interface, and sends the non-quintuple matching rule in the first blocking rule to the multiple message processing units in full, including: When parsing the first blocking rule, the main control board determines a rule delivery path according to a field type included in the first blocking rule; If the first blocking rule only includes field information based on the quintuple, the first blocking rule is directly sent to the programmable switching chip, and the programmable switching chip performs the corresponding blocking operation; If the first blocking rule includes non-quintuple application layer field information, the first blocking rule is sent to multiple message processing units in full as a non-quintuple matching rule.

3. The traffic blocking method based on the distributed DPI system according to claim 2 is characterized in that: The non-quintuple application layer field information includes: one or more of a URL field, an SNI field, and an application feature field.

4. The traffic blocking method based on a distributed DPI system according to claim 1 or 2, characterized in that: The step of the message processing unit performing matching judgment on the network message according to the non-five-tuple matching rule includes: The message processing unit parses the network message to obtain at least one application layer field information; Comparing the application layer field information with the non-quintuple matching rules item by item; If the application layer field information meets any matching condition set in the non-quintuple matching rule, the network message is deemed to hit the non-quintuple matching rule, and the matching condition includes: string equality matching, prefix matching, inclusion relationship matching or regular expression-based pattern matching.

5. The traffic blocking method based on the distributed DPI system according to claim 1 is characterized in that: The step of generating, by the main control board, a second blocking rule that can be identified by the programmable switching chip based on the key feature information, and sending the second blocking rule to the programmable switching chip includes: The main control board uses the destination IP address, destination port number and protocol type in the key feature information as matching fields and sets a corresponding blocking action field; constructing a second blocking rule based on the matching field and the blocking action field, wherein the blocking action field includes at least one of discarding, redirecting, or mirroring; The main control board calls the control interface of the programmable switching chip and issues the second blocking rule.

6. The traffic blocking method based on a distributed DPI system according to claim 1 or 5, characterized in that: The programmable switching chip writes the received second blocking rule into an internal configurable rule table, and performs traffic blocking when a subsequent network message hits the second blocking rule, including: Writing the matching field and the corresponding blocking action in the second blocking rule into the rule table of the programmable switching chip; When the programmable switching chip subsequently receives a new network message, it determines whether the new network message meets the second blocking rule according to the matching condition in the rule table; If the new network message hits the second blocking rule, the programmable switching chip performs a corresponding blocking action on the network message; if the new network message does not hit the second blocking rule, the programmable switching chip continues to forward the network message along the original forwarding path.

7. The traffic blocking method based on the distributed DPI system according to claim 1 is characterized in that: Each of the message processing units determines the composite identification information of the message processing unit by its own identification ID in the business board, the identification ID of the business board where it is located, and the IP address of the main control board communicating with the business board; The composite identification information is used to uniquely identify each of the message processing units in the DPI system, thereby enabling the main control board to implement rule issuance, hit result tracking and status management for multiple message processing units.

8. An electronic device, characterized in that: The electronic device comprises: One or more processors; and a memory storing computer program instructions, wherein when the computer program instructions are executed, the processor executes the traffic blocking method based on the distributed DPI system as described in any one of claims 1-7.

9. A computer-readable storage medium having a computer program and / or instructions stored thereon, characterized in that: When the computer program and / or instructions are executed by the processor, the traffic blocking method based on the distributed DPI system as described in any one of claims 1 to 7 is implemented.

10. A computer program product comprising a computer program and / or instructions, characterized in that When the computer program and / or instruction is executed by a processor, the traffic blocking method based on the distributed DPI system as described in any one of claims 1 to 7 is implemented.

Images