Processor speed limiting method, device, equipment and machine-readable storage medium

Abstract

The present disclosure provides a processor speed limiting method, device, equipment and machine readable storage medium, the method comprising: obtaining the working state of each processor; obtaining the processor under attack according to the proportion of the number of busy processors in the total number of processors; obtaining the speed limiting enable state of the processor under attack, and enabling the speed limiting function of the processor if the processor under attack does not enable speed limiting. Through the technical solution of the present disclosure, the state of each processor is obtained, if there are a small number of processors busy and other processors idle, it is considered that these busy processors are under attack at this time, then the speed limiting function of the processor under attack is enabled to maintain a relatively low speed and avoid affecting other processors.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication technology, and in particular, to a processor rate limiting method, device, equipment and machine readable storage medium. BACKGROUND

[0002] When the firewall device is in the actual working environment of the customer, it often encounters attacks of malicious traffic. At this time, in order to ensure that the device can work normally to the greatest extent, it is necessary to limit the rate and drop the packet of the malicious traffic. Therefore, the firewall device has a rate limiting function to provide for the customer. If the traffic of the message exceeds the rate limiting threshold configured by the customer, the message will be directly discarded to save CPU (processor) resources. This method belongs to a static rate limiting method, and the defect is that it cannot analyze the attack traffic in detail. The firewall device generally uses a flow-by-flow method to process messages. The five-tuple (source IP, destination IP, source port, destination port, protocol number) of the message is used to calculate which CPU to send for forwarding processing. Attackers often use messages with the same five-tuple to attack a few CPUs. Due to the characteristics of multi-core devices, when a certain CPU is highly occupied, the performance of other CPUs will also be seriously affected. SUMMARY

[0003] Therefore, the present disclosure provides a processor rate limiting method, device, electronic equipment and machine readable storage medium to improve the problem that the performance of a few processors attacked is affected.

[0004] The specific technical solutions are as follows:

[0005] The present disclosure provides a processor rate limiting method applied to a multi-processor device. The method comprises: obtaining the working state of each processor; obtaining the attacked processor according to the proportion of the number of busy processors in the total number of processors; obtaining the rate limiting enabled state of the attacked processor, and enabling the rate limiting function of the processor if the rate limiting of the attacked processor is not enabled.

[0006] As a technical solution, the rate limiting enabled state of the attacked processor is obtained, and the rate limiting function of the processor is enabled if the rate limiting of the attacked processor is not enabled. The method comprises: if the rate limiting of the attacked processor is enabled, the rate limiting proportion of the processor is reduced.

[0007] As a technical solution, the working state of each processor is obtained. The method comprises: obtaining the working state of each processor according to a preset period.

[0008] As a technical solution, the processor number in the busy state accounts for a proportion in the total number of processors, the current attacked processor is obtained, and the method comprises the following steps: if there is a processor in the busy state at present, and the number of processors in the busy state accounts for a proportion in the total number of processors less than or equal to a threshold value, the processor in the busy state at present is considered as the attacked processor.

[0009] The processor limiting speed device provided by the present application is applied to a multi-processor device, and the device comprises a state module, a security module and a speed limiting module.

[0010] As a technical solution, the speed limiting function of the attacked processor is enabled if the speed limiting function of the attacked processor is not enabled, and the method comprises the following steps: if the speed limiting function of the attacked processor is enabled, the speed limiting proportion of the processor is reduced.

[0011] As a technical solution, the working state of each processor at present is obtained, and the method comprises the following step: the working state of each processor at present is obtained according to a preset period.

[0012] As a technical solution, the processor number in the busy state accounts for a proportion in the total number of processors, the current attacked processor is obtained, and the method comprises the following steps: if there is a processor in the busy state at present, and the number of processors in the busy state accounts for a proportion in the total number of processors less than or equal to a threshold value, the processor in the busy state at present is considered as the attacked processor.

[0013] The electronic device provided by the present application comprises a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions capable of being executed by the processor, and the processor executes the machine executable instructions to realize the processor limiting speed method.

[0014] The machine readable storage medium provided by the present application stores machine executable instructions, and the machine executable instructions enable the processor to realize the processor limiting speed method when the machine executable instructions are called and executed by the processor.

[0015] The above technical solution provided by the present application at least brings the following beneficial effects:

[0016] The state of each processor is acquired, and if a few processors are busy while other processors are idle, it is considered that the processors in the busy state are attacked, and then the attacked processors are ensured to start the speed limiting function to keep a relatively low speed to avoid affecting other processors. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present disclosure. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can also be obtained by those skilled in the art according to these drawings of the embodiments of the present disclosure.

[0018] Figure 1 is a flowchart of a processor speed limiting method in an embodiment of the present disclosure;

[0019] Figure 2 is a structural diagram of a processor speed limiting device in an embodiment of the present disclosure;

[0020] Figure 3 is a hardware structural diagram of an electronic device in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0021] The terms used in the embodiments of the present disclosure are only for the purpose of describing particular embodiments and are not intended to limit the present disclosure. The singular forms "a", "an" and "the" used in the present disclosure and claims are intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to any or all possible combinations of one or more associated listed items.

[0022] It should be understood that although the terms first, second, third, etc. can be used in the embodiments of the present disclosure to describe various information, these information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, the first information can also be referred to as the second information without departing from the scope of the present disclosure, and similarly, the second information can also be referred to as the first information. In addition, the word "if" used can be interpreted as "when" or "upon" or "in response to determining" depending on the context.

[0023] The present disclosure provides a processor speed limiting method, device, electronic device, and machine readable storage medium to improve the problem that the overall performance of a few processors is affected by attacks.

[0024] Specifically, the technical solutions are as follows.

[0025] In one embodiment, the present disclosure provides a processor speed limiting method applied to a multi-processor device, the method comprising: obtaining a working state of each processor; obtaining a processor under attack according to a proportion of the number of processors in a busy state in the total number of processors; obtaining a speed limiting enabling state of the processor under attack, and enabling the speed limiting function of the processor if the speed limiting of the processor under attack is not enabled.

[0026] Specifically, as Figure 1 comprises the following steps:

[0027] Step S11, obtaining a working state of each processor;

[0028] Step S12, obtaining a processor under attack according to a proportion of the number of processors in a busy state in the total number of processors;

[0029] Step S13, obtaining a speed limiting enabling state of the processor under attack, and enabling the speed limiting function of the processor if the speed limiting of the processor under attack is not enabled.

[0030] The states of the current processors are obtained, if there are a small number of processors in a busy state and other processors are idle, it is considered that these processors in a busy state are under attack, and then the speed limiting function of the processor under attack is enabled to keep a relatively low speed to avoid affecting other processors.

[0031] In the present disclosure, the multi-processor device can be a multi-core CPU device, a multi-CPU device, or a multi-core multi-CPU device, and the processor can be a core of a multi-core CPU or a single-CPU. By setting an occupancy rate threshold, when the occupancy rate of a processor exceeds the threshold, it is considered that the processor is in a busy state. Enabling the speed limiting function enables the processor to independently start speed limiting, keeps the set running speed or occupancy rate as the upper limit, and performs packet dropping processing on the packets allocated to the processor when the processor runs beyond the upper limit.

[0032] In one embodiment, the obtaining of the speed limiting enabling state of the processor under attack, and the enabling of the speed limiting function of the processor if the speed limiting of the processor under attack is not enabled, comprises: if the speed limiting of the processor under attack is enabled, reducing the speed limiting proportion of the processor.

[0033] In one embodiment, the obtaining of the working state of each processor comprises: obtaining the working state of each processor according to a preset period.

[0034] In one embodiment, the ratio of the number of processors in the busy state to the total number of processors is used to obtain the processor currently under attack, including: if there is a processor in the busy state, and the ratio of the number of processors in the busy state to the total number of processors is less than or equal to a threshold value, then the processor currently in the busy state is considered to be the processor under attack.

[0035] In one embodiment, the number of all processors M is collected, and the number of processors N with an occupancy rate greater than a user-configured threshold value is counted, and the N processors are considered to be in the busy state. The number of busy processors N and the number of idle processors (M-N) are compared. If N / M or N / (M-N) is not 0 and is less than or equal to a preset threshold value, the device is considered to be in a few processor attack state, and if it is greater than the threshold value, the device is considered to be in an overall busy state.

[0036] If the device is in an overall busy state, all processors cancel the speed limit. If the device is in a few processor attack state, the speed limit flag bit of the processor core is judged. If the speed limit flag bit is not enabled, the speed limit is enabled. If the speed limit flag bit is already enabled, the total number of token buckets is reduced, i.e. the speed limit ratio of the processor is reduced to further limit the speed and enhance the speed limit capability.

[0037] If neither of the above two conditions is met, i.e. N / M or N / (M-N) is 0, it means that the device is in a relatively idle state. At this time, it is checked whether there is a processor under speed limit. If there is, and the packet loss rate of the processor under speed limit in the last statistical period is less than a threshold value, the speed limit is removed. Otherwise, the number of tokens is increased, and the degree of speed limit is reduced.

[0038] In one embodiment, the present disclosure also provides a processor speed limiting device, which is applied to a multi-processor device and includes a state module 21 configured to obtain the working state of each processor; a security module 22 configured to obtain the processor currently under attack according to the ratio of the number of processors in the busy state to the total number of processors; and a speed limiting module 23 configured to obtain the speed limit enable state of the processor under attack, and enable the speed limit function of the processor under attack if the speed limit of the processor under attack is not enabled. Figure 2

[0039] In one embodiment, the obtaining of the speed limit enable state of the processor under attack and the enabling of the speed limit function of the processor under attack if the speed limit of the processor under attack is not enabled includes: if the speed limit of the processor under attack is enabled, the speed limit ratio of the processor under attack is reduced.

[0040] In one embodiment, the obtaining of the working state of each processor includes: obtaining the working state of each processor according to a preset period.

[0041] ​In an embodiment, the processor number ratio of the processors in the busy state in the total number of processors is used to obtain the processor currently under attack, including: if there is a processor in the busy state currently, and the processor number ratio of the processors in the busy state in the total number of processors is less than or equal to a threshold value, the processor currently in the busy state is considered as the processor under attack.

[0042] The device embodiments are the same as or similar to the corresponding method embodiments, and will not be described here.

[0043] In an embodiment, the present disclosure provides an electronic device, including a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions capable of being executed by the processor, and the processor executes the machine executable instructions to implement the aforementioned processor speed limiting method. From the hardware level, the hardware architecture diagram can be seen from Figure 3 .

[0044] In an embodiment, the present disclosure provides a machine readable storage medium, the machine readable storage medium stores machine executable instructions, and when the machine executable instructions are called and executed by a processor, the machine executable instructions cause the processor to implement the aforementioned processor speed limiting method.

[0045] Here, the machine readable storage medium can be any electronic, magnetic, optical or other physical storage device, and can contain or store information such as executable instructions, data, etc. For example, the machine readable storage medium can be: RAM (Radom Access Memory, Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state disk, any type of storage disk (such as optical disk, dvd, etc.), or similar storage medium, or a combination thereof.

[0046] The system, device, module or unit illustrated in the above embodiments can be specifically implemented by a computer chip or entity, or by a product with certain functions. A typical implementation device is a computer, and the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0047] For the convenience of description, the above device is described as various units respectively described in functions. Of course, the functions of each unit can be implemented in the same or more software and / or hardware when implementing the present disclosure.

[0048] Those skilled in the art will appreciate that embodiments of the disclosure can be readily used as a method, a system or an computer program product. Accordingly, the disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the disclosure embodiments can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer-readable program code.

[0049] The disclosure is described in reference to the flowchart and / or block diagrams of the method, apparatus (system) and computer program product according to the embodiments of the disclosure. It should be understood that each flow and / or block in the flowchart and / or block diagrams, and a combination of flows and / or blocks in the flowchart and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing apparatus to produce a machine, so that the instructions, which are executed via the processor of the computer or other programmable data processing apparatus, generate a means for implementing the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus with a function specified in one or more flows and / or blocks.

[0050] Also, these computer program instructions can be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus with a function specified in one or more flows and / or blocks.

[0051] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which are executed on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus with a function specified in one or more flows and / or blocks.

[0052] Those skilled in the art will appreciate that embodiments of the disclosure can be supplied as a method, a system, or a computer program product. Accordingly, the disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the disclosure can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer-readable program code thereon for use by a computer or processor.

[0053] The above description is merely illustrative of the embodiments of the disclosure and is not intended to limit the disclosure. The disclosure can have various modifications and alterations, and can be constructed in various ways without departing from the spirit and scope of the disclosure. Any modification, equivalent replacement, improvement, and the like made in the spirit and principle of the disclosure should be included in the scope of the claims of the disclosure.

Claims

1. A processor speed limiting method, characterized in that: Applied to a multi-processor device, the method includes: Get the current working status of each processor; Obtain the currently attacked processor based on the ratio of the number of busy processors to the total number of processors. Specifically, if there is a busy processor and the ratio of the number of busy processors to the total number of processors is less than or equal to a threshold, the currently busy processor is considered to be the attacked processor. Obtain the speed limit enable status of the attacked processor. If the attacked processor does not have speed limit enabled, enable the speed limit function of the processor.

2. The method according to claim 1, characterized in that The acquiring of the speed limit enabling status of the attacked processor and enabling the speed limit function of the processor if the attacked processor is not enabled for speed limit includes: If the attacked processor has speed limit enabled, reduce the speed limit ratio of the processor.

3. The method according to claim 1, characterized in that The obtaining of the current working status of each processor includes: According to the preset cycle, the current working status of each processor is obtained.

4. A processor speed limiting device, characterized in that: Applied to a multi-processor device, the apparatus comprises: Status module, used to obtain the current working status of each processor; a security module, configured to obtain a currently attacked processor based on a ratio of the number of busy processors to the total number of processors. Specifically, if a busy processor currently exists and the ratio of the number of busy processors to the total number of processors is less than or equal to a threshold, the currently busy processor is considered to be the attacked processor; The speed limit module is used to obtain the speed limit enable status of the attacked processor, and if the attacked processor is not enabled with speed limit, enable the speed limit function of the processor.

5. The device according to claim 4, characterized in that The acquiring of the speed limit enabling status of the attacked processor and enabling the speed limit function of the processor if the attacked processor is not enabled for speed limit includes: If the attacked processor has speed limit enabled, reduce the speed limit ratio of the processor.

6. The device according to claim 4, characterized in that The obtaining of the current working status of each processor includes: According to the preset cycle, the current working status of each processor is obtained.

7. An electronic device, characterized in that: include: A processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the method according to any one of claims 1 to 3.

8. A machine-readable storage medium, characterized in that The machine-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement the method according to any one of claims 1 to 3.

Images