A control plane protection method and device, a switching device and a storage medium

Abstract

Embodiments of the present application provide a control plane protection method and device, a switching device and a storage medium in the technical field of network security. The method is applied to a switching device, which comprises a control plane and a forwarding plane. The forwarding plane is used to receive a packet and send a target packet determined as unable to be processed to the control plane for processing. The method comprises: obtaining a usage rate of the control plane and a traffic size of the target packet; determining whether the usage rate reaches a preset usage rate threshold and whether the traffic size reaches a preset traffic threshold; if the usage rate reaches the preset usage rate threshold and the traffic size reaches the preset traffic threshold, performing credibility calculation on the target packet, determining whether a node corresponding to the target packet is a trusted node, and limiting the node based on a preset strategy if the node is not a trusted node. The present application can better protect the control plane of the switching device.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a control plane protection method, apparatus, switching device, and storage medium. Background Technology

[0002] With the development of technologies such as chips and the rapid growth in network bandwidth demand, the forwarding and processing capabilities of switching equipment have been greatly improved. In the past decade, network bandwidth has increased tenfold from 10 Mbps to 100 Gbps, leading to a dramatic increase in the processing capacity of the forwarding plane. However, the control plane of switching equipment runs on the CPU (Central Processing Unit), limiting the growth in software processing capabilities. In the ultra-broadband era, the channel between terminals and network elements has been greatly enhanced, making it highly susceptible to denial-of-service attacks based on methods such as traffic flooding.

[0003] Most existing technologies use the CoPP (Control-Plane Protect) mechanism, where administrators manually configure rules to restrict or filter certain packets. However, manual configuration lacks flexibility and security, and cannot adequately protect the control plane. Summary of the Invention

[0004] The present invention aims to, for example, provide a control plane protection method, apparatus, switching device, and storage medium that can at least partially solve the above-mentioned technical problems.

[0005] The embodiments of the present invention can be implemented as follows:

[0006] In a first aspect, embodiments of the present invention provide a control plane protection method applied to a switching device, the switching device including a control plane and a forwarding plane, the forwarding plane being used to receive packets and send target packets determined to be unprocessable to the control plane for processing; the method includes:

[0007] Obtain the utilization rate of the control plane and the traffic volume of the target message;

[0008] Determine whether the usage rate reaches a preset usage rate threshold, and determine whether the traffic volume reaches a preset traffic volume threshold;

[0009] If the utilization rate reaches the preset utilization rate threshold and the traffic volume reaches the preset traffic threshold, then the credibility of the target message is calculated to determine whether the node corresponding to the target message is a trusted node.

[0010] If not, then the node will be restricted based on a preset strategy.

[0011] Optionally, a credibility calculation is performed on the target message to determine whether the node corresponding to the target message is a trusted node, including:

[0012] Parse the target message to obtain multiple target features of the target message;

[0013] At each preset interval, the credibility calculation is performed on multiple target features to obtain the credibility, until the traffic volume is lower than the preset traffic threshold.

[0014] Based on a preset confidence value calculation formula, the confidence value of the target is calculated according to multiple confidence levels.

[0015] Determine whether the trusted value is within a preset trusted value range. If so, determine that the node corresponding to the target message is the trusted node.

[0016] Optionally, the formula for calculating the confidence value is:

[0017]

[0018] Where P is the confidence value, f(n) is the confidence level, and m is the number of times the confidence level is calculated.

[0019] Optionally, the method further includes:

[0020] Different weight values ​​are assigned to multiple target features;

[0021] The credibility is calculated based on the weight of each target feature.

[0022] Optionally, the method further includes:

[0023] Determine whether the node corresponding to the target message is in a preset whitelist;

[0024] If so, then no credibility calculation is performed on the target message;

[0025] If not, then the credibility of the target message is calculated to determine whether the node corresponding to the target message is a trusted node.

[0026] Optionally, the restriction on the node based on a preset strategy includes:

[0027] The rate at which the node uploads packets is controlled to a preset rate, and packets uploaded by the node exceeding the preset rate are discarded.

[0028] Alternatively, the node can be added to a preset blacklist, and all messages uploaded by the node can be rejected.

[0029] Optionally, after restricting the node based on a preset strategy, the method further includes:

[0030] Record the restriction processing of messages uploaded by the node;

[0031] Generate and store the processing log.

[0032] Secondly, embodiments of the present invention provide a control plane protection device applied to a switching device, the switching device including a control plane and a forwarding plane, the forwarding plane being used to receive packets and send target packets determined to be unprocessable to the control plane for processing; the control plane protection device includes:

[0033] A data acquisition unit is used to acquire the utilization rate of the control plane and the traffic volume of the target message;

[0034] The judgment unit is used to determine whether the usage rate reaches a preset usage rate threshold and whether the traffic volume reaches a preset traffic volume threshold.

[0035] A credibility calculation unit is used to perform credibility calculation on the target packet when the utilization rate reaches the preset utilization rate threshold and the traffic volume reaches the preset traffic threshold, and to determine whether the node corresponding to the target packet is a trusted node.

[0036] The node restriction unit is used to restrict the node based on a preset strategy when determining whether the node corresponding to the target message is a trusted node.

[0037] Thirdly, embodiments of the present invention provide a switching device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the methods described above.

[0038] Fourthly, embodiments of the present invention provide a computer-readable storage medium, the computer-readable storage medium including a computer program, wherein the computer program, when executed, controls a server where the computer-readable storage medium is located to implement the steps of any of the methods described above.

[0039] The beneficial effects of the embodiments of the present invention include, for example:

[0040] By monitoring the utilization rate of the control plane and the traffic volume of target packets, the system calculates the credibility of target packets when certain conditions are met, and restricts nodes corresponding to target packets that fail the credibility calculation based on preset policies. This automatically processes packets uploaded from the forwarding plane to the control plane, thus better protecting the control plane and making it more flexible and secure. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 An internal architecture diagram of a switching device provided in an embodiment of the present invention;

[0043] Figure 2 A hardware architecture diagram of a switching device provided in an embodiment of the present invention;

[0044] Figure 3 A flowchart illustrating the steps of a control plane protection method provided in an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of a control plane protection device provided in an embodiment of the present invention.

[0046] Icons: 100-Switching device; 110-Memory; 120-Processor; 130-Communication module; 300-Device; 301-Data acquisition unit; 302-Judgment unit; 303-Confidence calculation unit; 304-Node restriction unit. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0048] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0049] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0050] Furthermore, the terms "first" and "second" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0051] It should be noted that, where there is no conflict, the features in the embodiments of the present invention can be combined with each other.

[0052] To ensure the normal operation of the switching equipment, a control plane and a forwarding plane are separated within the equipment. The forwarding plane forwards various types of data from different interfaces on the device, while the control plane handles specific tasks that the forwarding plane cannot process. The processing capacity of the forwarding plane, compared to the control plane, can be considered virtually unlimited; it can easily send massive amounts of packets, potentially overloading the control plane. To prevent the forwarding plane from sending too many packets to the control plane while ensuring normal service operation, certain restrictions need to be placed on the data being sent.

[0053] The existing solutions generally fall into the following two categories:

[0054] 1. Administrators manually configure some corresponding filtering or rate limiting rules statically. The rules are used to match the relevant packets that need to be sent to the CPU for processing. When a packet matches the configured rule, the packet is processed accordingly.

[0055] 2. By using Cpu-Traffic technology, the rate of packets ultimately received by the CPU is limited, and packets exceeding the set rate are discarded. The rate value is also manually specified by the administrator.

[0056] like Figure 1 The diagram shown is an architecture diagram of an existing switching device. Based on the above solution, the existing technology handles the following:

[0057] (1) When the port of the switching device receives a service message, it will perform corresponding decoding operations on the message. The decoded message will be sent to the forwarding plane through different data paths.

[0058] (2) When the forwarding plane receives a data packet that needs to be processed, it will perform corresponding parsing and classification operations on the packet, and then perform further processing on the packet, such as packet inspection, ACL matching, storm control, learning, BSR, etc. For packets that can be processed, they are directly sent to the corresponding port through the corresponding data path and forwarded. When a packet that cannot be processed or a packet that needs to be sent to the control plane for processing is encountered during processing, it will be sent to the control plane for processing.

[0059] (3) When the switching device is configured with the corresponding CoPP policy, it will match the policy, and the matched packets will be rate-limited or dropped.

[0060] (4) The message that is finally processed by the forwarding plane will be sent to the control plane through the data path. When the sending rate is greater than the limit of Cpu-Traffic, the message exceeding the rate will be discarded to ensure that the rate at which the final control plane receives the message is controlled.

[0061] As can be seen, due to the manual configuration, the above solution has very low flexibility in practical applications and places high demands on network administrators' management and maintenance skills. Furthermore, manual configuration has low security and cannot address sudden traffic spikes or malicious attacks.

[0062] Based on the above, embodiments of this specification provide a control plane protection method, apparatus, switching device, and storage medium, which can effectively alleviate the above-mentioned technical problems.

[0063] Please refer to Figure 2 This is a block diagram of a switching device 100 provided in this application. The switching device 100 can be any device capable of data processing, and this embodiment does not limit this. The switching device 100 includes a memory 110, a processor 120, and a communication module 130. The memory 110, processor 120, and communication module 130 are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0064] The memory 110 is used to store programs or data. The memory 110 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0065] The processor 120 is used to read / write data or programs stored in memory and to perform corresponding functions.

[0066] The communication module 130 is used to establish a communication connection between the server and other communication terminals through the network, and to send and receive data through the network.

[0067] It should be understood that, Figure 2The structure shown is only a schematic diagram of the switching device 100. The switching device 100 may also include a... Figure 2 The more or fewer components shown, or having the same Figure 2 Different configurations are shown, for example: the switching device 100 may also include a CPU (Central Processing Unit), etc. Figure 2 The components shown can be implemented using hardware, software, or a combination thereof. The switching device 100 can be installed in a switching system or as a standalone device between the switch and other devices.

[0068] Corresponding to the aforementioned switching equipment, this specification provides a control plane protection method applied to a switching equipment. The switching equipment includes a control plane and a forwarding plane. The forwarding plane receives packets and sends target packets determined to be unprocessable to the control plane for processing. The method includes, for example: Figure 3 The following steps are shown:

[0069] Step S110: Obtain the utilization rate of the control plane and the traffic volume of the target message.

[0070] Step S120: Determine whether the usage rate reaches a preset usage rate threshold, and determine whether the traffic volume reaches a preset traffic volume threshold.

[0071] Step S130: If the utilization rate reaches the preset utilization rate threshold and the traffic volume reaches the preset traffic threshold, then the credibility of the target packet is calculated to determine whether the node corresponding to the target packet is a trusted node.

[0072] Step S140: If not, then restrict the node based on a preset strategy.

[0073] First, step S110 is executed to obtain the utilization rate of the control plane and the traffic volume of the target message.

[0074] The target message is the message that the forwarding plane receives from various nodes but cannot process directly and needs to be uploaded to the control plane for processing; in other words, it is a message that the forwarding plane determines cannot be processed. The utilization rate of the control plane can be the current CPU utilization rate of the switching equipment.

[0075] In actual operation, the utilization rate of the control plane can be monitored in real time, as well as the traffic volume of target packets uploaded by each node received by the forwarding plane.

[0076] When monitoring the utilization rate of the control plane and the traffic volume of the target message, step S120 is executed to determine whether the utilization rate reaches a preset utilization rate threshold and whether the traffic volume reaches a preset traffic volume threshold.

[0077] After obtaining the control plane utilization rate and the target packet traffic size, it is determined whether the control plane utilization rate has reached the developer's preset utilization rate threshold, and at the same time, it is determined whether the target packet traffic size has reached the developer's preset traffic threshold.

[0078] For example, if the preset utilization threshold is 85% and the preset traffic threshold is 3G, if the obtained control plane utilization is greater than or equal to 85% and the traffic size of the target packet is greater than or equal to 3G, then the determination is successful. The target packet needs to be processed in step S130 to calculate the credibility of the target packet and determine whether the node corresponding to the target packet is a trusted node.

[0079] Trustworthiness calculation can be performed by acquiring multiple features of the target message, calculating the features, summing the scores of each feature, and finally obtaining the trustworthiness of the target message. Then, based on the trustworthiness of the target message, it is determined whether the node sending the target message is a trustworthy node, i.e., whether the message sent by that node can be uploaded to the control plane.

[0080] Optionally, the step of performing a credibility calculation on the target message and determining whether the node corresponding to the target message is a trusted node includes:

[0081] The target message is parsed to obtain multiple target features of the target message.

[0082] At each preset interval, the credibility calculation is performed on multiple target features to obtain the credibility, until the traffic volume is lower than the preset traffic threshold.

[0083] Based on a preset confidence value calculation formula, the confidence value of the target is calculated according to multiple confidence levels.

[0084] Determine whether the trusted value is within a preset trusted value range. If so, determine that the node corresponding to the target message is the trusted node.

[0085] As an optional implementation, when it is determined that a credibility calculation is required, the target packet can be parsed first to obtain a series of target characteristics, such as the target packet's IP address, MAC address, traffic received on the port, number of packets on the CPU, the proportion of CPU utilization for this type of packet, and the type of packet sent to the control plane. Based on these target characteristics, feature calculation (i.e., credibility calculation) is performed to obtain a credibility level.

[0086] To improve the accuracy of trustworthiness calculations and avoid restricting normal nodes experiencing sudden traffic spikes, a preset interval can be set. At each preset interval, a trustworthiness calculation is performed using a preset formula. The calculated trustworthiness values ​​are then combined to obtain a final trustworthiness value. This value is then used to determine if it falls within a preset trustworthiness value range. If the trustworthiness value is within the preset range, the node corresponding to the target packet is considered a trustworthy node; otherwise, it is considered an untrustworthy node.

[0087] Optionally, the formula for calculating the confidence value is:

[0088]

[0089] Where P is the confidence value, f(n) is the confidence level, and m is the number of times the confidence level is calculated.

[0090] For example, the preset interval is 3 seconds, the preset traffic threshold is 4G, and the preset trust value range is (0, 35). Then, when the control plane utilization reaches the preset utilization threshold and the target packet's traffic size reaches 4G, a trust value calculation begins, and a trust value calculation is performed every 3 seconds. If the target packet's traffic size decreases below 4G after 10 seconds, m = 4 trust value calculations are performed, and then the trust value is obtained according to the aforementioned trust value calculation formula. It is then determined whether the trust value is within the range (0, 35). If it is, the node corresponding to the target packet is determined to be a trustworthy node; if the trust value exceeds the range (0, 35), the node corresponding to the target packet is determined to be an untrustworthy node.

[0091] Optionally, the method further includes:

[0092] Different weight values ​​are assigned to the multiple target features. The credibility is calculated based on the weight of each target feature.

[0093] For credibility calculation, the following principles can be followed when selecting features: Associate features with factors that are quantifiable by traffic volume, using these factors as key differentiators between feature classes. Select features with low redundancy to minimize correlation between features. Selecting too many features does not necessarily improve performance; therefore, to improve computational efficiency and ensure optimal results, avoid selecting an excessive number of features.

[0094] Therefore, in order to further increase the accuracy of credibility judgment, different weight values ​​can be assigned to each parsed target feature, and then the credibility of each target feature can be weighted and summed to obtain the credibility calculated each time.

[0095] Optionally, the method further includes:

[0096] Determine whether the node corresponding to the target message is in a preset whitelist. If so, do not perform a credibility calculation on the target message.

[0097] If not, then the credibility of the target message is calculated to determine whether the node corresponding to the target message is a trusted node.

[0098] Similarly, to prevent legitimate nodes from being blocked or restricted by the mechanism, it can be determined whether the node corresponding to the target message is in the developer's pre-defined whitelist before performing the trustworthiness calculation. If it is, then the trustworthiness calculation for that target message will not be performed, thus ensuring the accuracy of the mechanism's restrictions while also saving some computing resources.

[0099] In step S140, if the node corresponding to the target message is not a trusted node, then the node is restricted based on a preset policy.

[0100] Once it is determined through trustworthiness calculations and trust value calculations that the node corresponding to the target message is not a trusted node, various preset strategies can be used to restrict that node. For example, the upload traffic of that node can be controlled; all messages from that node can be rejected; the upload rate of that node can be limited, etc. This achieves the purpose of protecting the control plane.

[0101] As an optional implementation, the restriction on the node based on a preset strategy includes:

[0102] The rate at which the node uploads packets is controlled to a preset rate, and packets uploaded by the node exceeding the preset rate are discarded.

[0103] Alternatively, the node can be added to a preset blacklist, and all messages uploaded by the node can be rejected.

[0104] A preset strategy for restricting untrusted nodes could be to limit the rate at which the node uploads packets to a preset rate. If the rate at which the node uploads packets exceeds the preset rate, the packets exceeding the preset rate will be discarded.

[0105] Another preset strategy for restricting untrusted nodes is to add nodes identified as untrusted to a blacklist and reject all messages uploaded by that node, whether currently or subsequently.

[0106] Optionally, after restricting the node based on a preset strategy, the method further includes:

[0107] Record the restriction processing applied to the messages uploaded by the node. Generate a processing log and store the processing log.

[0108] To facilitate administrators' analysis of the timing and origin of sudden traffic spikes, thus supporting network optimization, various restrictions imposed on untrusted nodes can be recorded and processed, generating processing logs stored in the switching device's storage space. When administrators need to access these logs, they can directly retrieve them from the switching device's storage.

[0109] Based on the same inventive concept, such as Figure 4 As shown in the figure, an embodiment of the present invention provides a control plane protection device 300, applied to a switching device. The switching device includes a control plane and a forwarding plane. The forwarding plane is used to receive packets and send target packets determined to be unprocessable to the control plane for processing. The control plane protection device 300 includes:

[0110] The data acquisition unit 301 is used to acquire the utilization rate of the control plane and the traffic volume of the target message.

[0111] The judgment unit 302 is used to determine whether the usage rate reaches a preset usage rate threshold and whether the traffic volume reaches a preset traffic volume threshold.

[0112] The credibility calculation unit 303 is used to perform credibility calculation on the target packet when the utilization rate reaches the preset utilization rate threshold and the traffic volume reaches the preset traffic threshold, and to determine whether the node corresponding to the target packet is a trusted node.

[0113] The node restriction unit 304 is used to restrict the node based on a preset strategy when determining whether the node corresponding to the target message is a trusted node.

[0114] Regarding the control plane protection device 300 described above, the specific functions of each unit have been described in detail in the embodiments of the control plane protection method provided in this specification, and will not be elaborated here.

[0115] Based on the same inventive concept, embodiments of this specification provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods of the control plane protection method described above.

[0116] The present invention has at least the following beneficial effects:

[0117] By monitoring the utilization rate of the control plane and the traffic volume of target packets, the system calculates the credibility of target packets when certain conditions are met, and restricts nodes corresponding to target packets that fail the credibility calculation based on preset policies. This automatically processes packets uploaded from the forwarding plane to the control plane, thus better protecting the control plane and making it more flexible and secure.

[0118] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0119] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0120] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0121] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A control plane protection method, characterized in that, The method is applied to a switching device, which includes a control plane and a forwarding plane. The forwarding plane receives packets and sends target packets that are determined to be unprocessable to the control plane for processing. The method includes: Obtain the utilization rate of the control plane and the traffic volume of the target message; Determine whether the usage rate reaches a preset usage rate threshold, and determine whether the traffic volume reaches a preset traffic volume threshold; If the utilization rate reaches the preset utilization rate threshold and the traffic volume reaches the preset traffic volume threshold, then a credibility calculation is performed on the target packet to determine whether the node corresponding to the target packet is a trusted node. This includes: parsing the target packet to obtain multiple target features of the target packet; assigning different weight values ​​to each target feature, and performing the credibility calculation on multiple target features once every preset interval according to the weight of each target feature to obtain a credibility value, until the traffic volume is lower than the preset traffic volume threshold; calculating the credibility value of the target feature based on a preset credibility value calculation formula and the multiple credibility values; determining whether the credibility value is within the preset credibility value range, and if so, determining that the node corresponding to the target packet is a trusted node. If not, then the node will be restricted based on a preset strategy.

2. The control plane protection method as described in claim 1, characterized in that, The formula for calculating the confidence value is: Where P is the confidence value, f(n) is the confidence level, and m is the number of times the confidence level is calculated.

3. The control plane protection method as described in claim 1, characterized in that, The method further includes: Determine whether the node corresponding to the target message is in a preset whitelist; If so, then no credibility calculation is performed on the target message; If not, then the credibility of the target message is calculated to determine whether the node corresponding to the target message is a trusted node.

4. The control plane protection method as described in claim 1, characterized in that, The restriction on the node based on the preset strategy includes: The rate at which the node uploads packets is controlled to a preset rate, and packets uploaded by the node exceeding the preset rate are discarded. Alternatively, the node can be added to a preset blacklist, and all messages uploaded by the node can be rejected.

5. The control plane protection method as described in claim 1, characterized in that, After restricting the node based on the preset strategy, the method further includes: Record the restriction processing of messages uploaded by the node; Generate and store the processing log.

6. A control plane protection device, characterized in that, This is applied to a switching device, which includes a control plane and a forwarding plane. The forwarding plane is used to receive packets and send target packets that are determined to be unprocessable to the control plane for processing. The control plane protection device includes: A data acquisition unit is used to acquire the utilization rate of the control plane and the traffic volume of the target message; The judgment unit is used to determine whether the usage rate reaches a preset usage rate threshold and whether the traffic volume reaches a preset traffic volume threshold. A credibility calculation unit is configured to perform credibility calculation on a target packet when the utilization rate reaches the preset utilization rate threshold and the traffic volume reaches the preset traffic threshold, and to determine whether the node corresponding to the target packet is a trusted node. The calculation includes: parsing the target packet to obtain multiple target features of the target packet; assigning different weight values ​​to each target feature, and performing the credibility calculation on the multiple target features once every preset interval based on the weight of each target feature to obtain a credibility score, until the traffic volume is lower than the preset traffic threshold; calculating the credibility value of the target feature based on a preset credibility value calculation formula and the multiple credibility scores; and determining whether the credibility value is within a preset credibility value range. If so, the node corresponding to the target packet is determined to be a trusted node. The node restriction unit is used to restrict the node based on a preset strategy when determining whether the node corresponding to the target message is a trusted node.

7. A switching device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a computer program, which, when executed, controls the server where the computer-readable storage medium is located to implement the steps of the method according to any one of claims 1 to 5.

Images