Packet identification transmission method and device and storage medium

Abstract

The application relates to the field of message exchange, and discloses a message identification transmission method, equipment and a storage medium. The method comprises the following steps: an upper computer control system reads a target protocol corresponding hardware characteristic value, generates a characteristic database according to the target protocol corresponding hardware characteristic value; an ACL rule is generated based on the characteristic database; port data is read, the port data is mapped to the ACL rule, a mapped ACL rule is generated, and the mapped ACL rule is sent to a hardware exchange system; the hardware exchange system receives the mapped ACL rule; when an input message of a port is listened to, the input message is subjected to identification matching processing according to the mapped ACL rule, and a matched message is obtained; and the upper computer control system distributes the matched message to a corresponding target port according to a preset information distribution algorithm. In the embodiment of the application, programmable message identification filtering and uploading are realized at the hardware end, upper computer resources are released, and the overall performance and stability of the equipment are improved.

Description

Technical Field

[0001] This invention relates to the field of message switching, and more particularly to a message identification and transmission method, device, and storage medium. Background Technology

[0002] In existing Ethernet switching devices, the switching chip typically performs Layer 2 line-speed forwarding in the data plane based on the MAC address table. However, some special network packets need to be sent to the device's central processing unit (CPU) for control plane processing, which is a critical step in network protocol operation and device management.

[0003] In existing technologies, the mechanisms for uploading such packets have significant limitations. Switching chips often perform preliminary screening based solely on packet type or simple access control lists, lacking fine-grained classification and priority scheduling capabilities based on traditional MAC address recognition. This can lead to the uploading of non-target protocol packets to the CPU, consuming CPU resources, resulting in poor real-time performance, and packet loss is prone to occur in scenarios with high CPU uploading traffic. When the network experiences broadcast storms or scanning attacks, massive amounts of invalid packets flood the CPU ports, easily causing channel congestion. The CPU must expend significant resources polling, receiving, and discarding these packets, leading to a decrease in its ability to process legitimate protocol packets, and potentially even causing protocol oscillations or management interruptions, severely impacting network stability and device performance. Therefore, a new technology is needed to address the current technical problems of insufficient packet recognition fine-grainedness and low CPU packet reception efficiency. Summary of the Invention

[0004] The main objective of this invention is to solve the technical problems of insufficient message recognition precision and low CPU packet reception efficiency.

[0005] The first aspect of this invention provides a message identification and transmission method, which is applied to a message identification and transmission system. The message identification and transmission system includes: a host computer control system and a hardware switching system. The steps of the message identification and transmission method include:

[0006] The host computer control system reads the hardware feature values ​​corresponding to the target protocol and generates a feature database based on the hardware feature values ​​corresponding to the target protocol.

[0007] Based on the feature database, generate ACL rules;

[0008] Read port data, map the port data to the ACL rule, generate the mapped ACL rule, and send the mapped ACL rule to the hardware switching system;

[0009] The hardware switching system receives the mapped ACL rules and listens for packet input on the port;

[0010] When an input packet is detected on the port, the input packet is identified and matched according to the mapping ACL rules to obtain a matching packet, and the matching packet is transmitted to the host computer control system.

[0011] The host computer control system receives the matching message and, according to a preset information distribution algorithm, sends the matching message to the corresponding target port.

[0012] Optionally, in a first implementation of the first aspect of the present invention, the step of the host computer control system receiving the matching message and sending the matching message to the corresponding target port according to a preset information distribution algorithm includes:

[0013] The host computer control system receives the matching message, parses the matching message, and obtains the target port identifier and the parsed message.

[0014] Send the target port identifier and the parsed message to the hardware switching system;

[0015] The hardware switching system receives the target port identifier and the parsing message, and sends the parsing message to the port corresponding to the target port identifier.

[0016] Optionally, in a second implementation of the first aspect of the present invention, the step of reading port data, mapping the port data to the ACL rule, and generating the mapping ACL rule includes:

[0017] Read port data and generate a port bitmap based on the port data;

[0018] Based on the port bitmap, the ACL rules are mapped and bound to generate mapped ACL rules.

[0019] Optionally, in a third implementation of the first aspect of the present invention, the step of generating a feature database based on the hardware feature values ​​corresponding to the target protocol includes:

[0020] A feature database is generated based on the MAC address and Ethernet Type field corresponding to the target protocol.

[0021] Optionally, in a fourth implementation of the first aspect of the present invention, the step of generating ACL rules based on the feature database includes:

[0022] Based on the preset variable placeholder template, the feature database is subjected to variable feature matching processing to generate a variable replacement template;

[0023] The engine generates ACL rules by driving the variable replacement template to load the engine according to preset rules.

[0024] Optionally, in a fifth implementation of the first aspect of the present invention, the variable placeholder template includes: a protocol placeholder, a port placeholder, and a signature placeholder.

[0025] Optionally, in a sixth implementation of the first aspect of the present invention, sending the parsed message to the port corresponding to the target port identifier includes:

[0026] Based on the preset L2PT protocol, the parsed message is sent to the port corresponding to the target port identifier.

[0027] Optionally, in a seventh implementation of the first aspect of the present invention, the hardware switching system includes a CTC7132 switching chip.

[0028] A second aspect of the present invention provides a message identification and transmission device, comprising: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a line; the at least one processor invokes the instructions in the memory to cause the message identification and transmission device to perform the above-described message identification and transmission method.

[0029] A third aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the above-described message identification and transmission method.

[0030] In this embodiment of the invention, a feature database for a dedicated protocol is established using hardware feature values, and ACL rules are generated based on the feature database. Port data is mapped and combined with ACL rules to generate mapped ACL rules. These mapped ACL rules are written into the hardware switching system. In the hardware interaction system, the mapped ACL rules are used to parse and match received packet information. The identified packets are uploaded to the host computer control system, which then controls the packet information and forwards it to the corresponding port. This achieves refined packet identification and accurate filtering at the hardware end, enabling programmable packet identification, filtering, and uploading at the hardware end. This significantly reduces the number of packets uploaded, frees up host computer resources, improves the overall performance and stability of the device, and solves the technical problems of insufficient packet identification precision and low CPU packet reception efficiency. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of one embodiment of the message identification and transmission method in this invention;

[0032] Figure 2This is a schematic diagram of a specific embodiment of step 102 of the message identification and transmission method in this invention;

[0033] Figure 3 This is a schematic diagram of a specific embodiment of step 103 of the message identification and transmission method in this invention;

[0034] Figure 4 This is a schematic diagram of a specific embodiment of the 106 steps of the message identification and transmission method in this invention.

[0035] Figure 5 This is a schematic diagram of one embodiment of the message identification and transmission device in this invention. Detailed Implementation

[0036] This invention provides a message identification and transmission method, device, and storage medium.

[0037] The embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0038] In the description of the embodiments disclosed in this invention, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0039] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 This is a schematic diagram of an embodiment of the message identification and transmission method in this invention. The message identification and transmission method is applied to a message identification and transmission system, which includes: a host computer control system and a hardware switching system. The steps of the message identification and transmission method include:

[0040] 101. The host computer control system reads the hardware feature values ​​corresponding to the target protocol and generates a feature database based on the hardware feature values ​​corresponding to the target protocol;

[0041] In this embodiment, the host computer control system reads the hardware feature values ​​corresponding to the target protocol and establishes a feature value identification database for the corresponding protocol, which is used for hardware identification of protocol messages. Hardware feature values ​​include, but are not limited to, source MAC address, destination MAC address, Ethernet type, and Ethernet Type field. An example of the content of the feature database is as follows:

[0042] feat_id | Protocol | Port | IP Range | Signature | Source MAC Address | Destination MAC Address |

[0043] 1001| TCP| 445 | null| aslpk | 02:00:00:00:00:01 | 01:80:C2:00:00:00|

[0044] 1002| UDP |23|Empty| xdfxc |02:00:06:00:00:01 |FF-FF-FF-FF-FF-FF|

[0045] 1003| SSL | 94 | Null | oxf8663 |02:00:08:00:00:01 |FF-FF-FF-FF-FF-FF|

[0046] Similarly, information such as matching protocol, port location, MAC address, Ethernet type, and Ethernet Type field can be set according to requirements.

[0047] Specifically, step 101 includes the following specific implementation methods:

[0048] 1011. Generate a feature database based on the MAC address and Ethernet Type field corresponding to the target protocol.

[0049] In this embodiment, a feature database is generated based on detailed data such as the MAC address and Ethernet Type field corresponding to the relevant protocols.

[0050] 102. Based on the feature database, generate ACL rules;

[0051] In this embodiment, data from the feature database is mapped to the ACL in the host computer control system to generate ACL rules.

[0052] Please see Figure 2 , Figure 2 This is a schematic diagram of a specific embodiment of step 102 of the message identification and transmission method in this invention. Step 102 includes the following specific implementation methods:

[0053] 1021. Based on the preset variable placeholder template, perform variable feature matching processing on the feature database to generate a variable replacement template;

[0054] 1022. Generate ACL rules by driving the loading of the variable replacement template according to the preset rules generation engine.

[0055] In steps 1021-1022, each feature of the variable placeholder template corresponds to a segment with variable placeholders. The variables are written using Mustache / Go templates. Variable features are matched from the feature database, and the matched data is written into the corresponding position in the original variable placeholder template to generate a variable replacement template.

[0056] Based on the rule generation engine, the template with input data features is driven to load and generate ACL rules.

[0057] Specifically, the variable placeholder template includes: protocol placeholder, port placeholder, and signature placeholder. The content of the variable can be the protocol type, port data, and the message signature characteristics that constitute the identification rules for message detection.

[0058] 103. Read port data, map the port data to the ACL rule, generate the mapping ACL rule, and send the mapping ACL rule to the hardware switching system;

[0059] In this embodiment, the port is activated and port data is read. The port data is bound to ACL rules, a mapping ACL rule is generated, and the mapping ACL rule is sent to the hardware switching system so that the hardware switching system can perform relevant packet identification processing based on the mapping ACL rule.

[0060] Please see Figure 3 , Figure 3 This is a schematic diagram of a specific embodiment of step 103 of the message identification and transmission method in this invention. Step 103 includes the following specific implementation methods:

[0061] 1031. Read port data, and generate a port bitmap based on the port data;

[0062] 1032. Based on the port bitmap, perform mapping and binding processing on the ACL rules to generate mapped ACL rules.

[0063] In steps 1031-1032, based on port data, the port scope bitmap is typically 64 bits, corresponding to 64 physical ports. Bit=1 indicates that "this ACL / TCAM rule applies to this port number", and bit=0 indicates that it does not apply. A single bitmap allows the policy to be bound to any set of ports simultaneously, saving ACL entries. The ACL rules are then mapped and bound to the port bitmap to generate mapped ACL rules.

[0064] 104. The hardware switching system receives the mapped ACL rules and listens for packet input on the port;

[0065] In this embodiment, the hardware switching system is also the MCU on the hardware side. The hardware switching system receives the mapped ACL rules, writes the mapped ACL rules into the hardware MCU, and listens for the packet input of each port.

[0066] Specifically, the hardware switching system includes the CTC7132 switching chip. The CTC7132 switching chip is the sixth-generation core switching chip launched by Centec Networks for the cloud era and edge computing. It can cover full-rate ports from 100 Mbit / s to 100 Gbit / s and has multi-rate, multi-protocol, and highly integrated functions.

[0067] 105. When an input message is detected on the port, the input message is identified and matched according to the mapping ACL rules to obtain a matching message, and the matching message is transmitted to the host computer control system.

[0068] In this embodiment, when an input packet is detected at the port, the packet feature value of the mapped ACL rule is used to identify and match the input packet. If a packet that matches the feature identification ACL is found, the matched packet is uploaded to the packet CPU of the host computer control system.

[0069] 106. The host computer control system receives the matching message and, according to a preset information distribution algorithm, sends the matching message to the corresponding target port.

[0070] In this embodiment, after receiving the matching message, the host computer control system parses the matching message to determine the target port and target MAC address to which the matching message needs to be sent, and then sends the matching message to the corresponding target port.

[0071] Please see Figure 4 , Figure 4 This is a schematic diagram of a specific embodiment of the message identification and transmission method in this invention, which includes the following specific implementation methods in the 106 steps:

[0072] 1061. The host computer control system receives the matching message, parses the matching message, and obtains the target port identifier and the parsed message;

[0073] 1062. Send the target port identifier and the parsed message to the hardware switching system;

[0074] 1063. The hardware switching system receives the target port identifier and the parsing message, and sends the parsing message to the port corresponding to the target port identifier.

[0075] In steps 1061-1063, the host computer control system receives the matching message, parses the matching message, and obtains the target port identifier and the parsed message.

[0076] The target port identifier and the parsed message are sent to the hardware switching system, which then forwards the parsed message to the target port identifier, thus realizing the forwarding of the switching protocol message.

[0077] Furthermore, step 106, "sending the parsed message to the port corresponding to the target port identifier," also includes the following specific implementation:

[0078] 1064. Based on the preset L2PT protocol, the parsed message is sent to the port corresponding to the target port identifier.

[0079] In step 1064, the received matching packets are distributed to the corresponding L2PT application for processing and parsing. The generated parsed packets are sent to the hardware switching system using the L2PT protocol. The hardware switching system then forwards the parsed packets to the port corresponding to the target port identifier, thus realizing the process of hardware filtering, software processing, and hardware execution forwarding of data packets.

[0080] In this embodiment of the invention, a feature database for a dedicated protocol is established using hardware feature values, and ACL rules are generated based on the feature database. Port data is mapped and combined with ACL rules to generate mapped ACL rules. These mapped ACL rules are written into the hardware switching system. In the hardware interaction system, the mapped ACL rules are used to parse and match received packet information. The identified packets are uploaded to the host computer control system, which then controls the packet information and forwards it to the corresponding port. This achieves refined packet identification and accurate filtering at the hardware end, enabling programmable packet identification, filtering, and uploading at the hardware end. This significantly reduces the number of packets uploaded, frees up host computer resources, improves the overall performance and stability of the device, and solves the technical problems of insufficient packet identification precision and low CPU packet reception efficiency.

[0081] Figure 5This is a schematic diagram of a message identification and transmission device 500 provided in an embodiment of the present invention. The message identification and transmission device 500 can vary significantly due to different configurations or performance characteristics. It may include one or more central processing units (CPUs) 510 and memory 520, and one or more storage media 530 for storing application programs 533 or data 532. The memory 520 and storage media 530 can be temporary or persistent storage. The program stored in the storage media 530 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the message identification and transmission device 500. Furthermore, the processor 510 may be configured to communicate with the storage media 530 and execute the series of instruction operations in the storage media 530 on the message identification and transmission device 500.

[0082] The message identification-based transmission device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input / output interfaces 560, and / or one or more operating systems 531, such as Windows Server, Mac OS X, Unix, Linux, Free BSD, etc. Those skilled in the art will understand that... Figure 5 The illustrated message identification transmission device structure does not constitute a limitation on message identification-based transmission devices and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0083] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the message identification and transmission method.

[0084] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0085] Furthermore, although the operations are described in a specific order, this should be understood as requiring that such operations be performed in the specific order shown or in sequential order, or requiring that all illustrated operations be performed to achieve the desired result. In certain environments, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation may also be implemented individually or in any suitable sub-combination in multiple implementations.

[0086] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A message identification and transmission method, characterized in that, The message identification and transmission method is applied to a message identification and transmission system, which includes: a host computer control system and a hardware switching system. The steps of the message identification and transmission method include: The host computer control system reads the hardware feature values ​​corresponding to the target protocol and generates a feature database based on the hardware feature values ​​corresponding to the target protocol. Based on the feature database, generate ACL rules; Read port data, map the port data to the ACL rule, generate the mapped ACL rule, and send the mapped ACL rule to the hardware switching system; The hardware switching system receives the mapped ACL rules and listens for packet input on the port; When an input packet is detected on the port, the input packet is identified and matched according to the mapping ACL rules to obtain a matching packet, and the matching packet is transmitted to the host computer control system. The host computer control system receives the matching message and sends the matching message to the corresponding target port according to the preset information distribution algorithm; The step of the host computer control system receiving the matching message and sending the matching message to the corresponding target port according to a preset information distribution algorithm includes: The host computer control system receives the matching message, parses the matching message, and obtains the target port identifier and the parsed message. Send the target port identifier and the parsed message to the hardware switching system; The hardware switching system receives the target port identifier and the parsing message, and sends the parsing message to the port corresponding to the target port identifier; The steps of reading port data, mapping the port data to the ACL rule, and generating the mapping ACL rule include: Read port data and generate a port bitmap based on the port data; Based on the port bitmap, the ACL rules are mapped and bound to generate mapped ACL rules.

2. The message identification and transmission method according to claim 1, characterized in that, The step of generating a feature database based on the hardware feature values ​​corresponding to the target protocol includes: A feature database is generated based on the MAC address and Ethernet Type field corresponding to the target protocol.

3. The message identification and transmission method according to claim 1, characterized in that, The step of generating ACL rules based on the feature database includes: Based on the preset variable placeholder template, the feature database is subjected to variable feature matching processing to generate a variable replacement template; The engine generates ACL rules by driving the variable replacement template to load the engine according to preset rules.

4. The message identification and transmission method according to claim 3, characterized in that, The variable placeholder templates include: protocol placeholders, port placeholders, and signature placeholders.

5. The message identification and transmission method according to claim 1, characterized in that, The step of sending the parsed message to the port corresponding to the target port identifier further includes: Based on the preset L2PT protocol, the parsed message is sent to the port corresponding to the target port identifier.

6. The message identification and transmission method according to claim 1, characterized in that, The hardware switching system includes: CTC7132 switching chip.

7. A message identification and transmission device, characterized in that, The message identification and transmission device includes: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor invokes the instructions in the memory to cause the message identification and transmission device to perform the message identification and transmission method as described in any one of claims 1-6.

8. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the message identification and transmission method as described in any one of claims 1-6.

Images