Method, device and electronic equipment for flow reinjection

Abstract

The application relates to a traffic back-feeding method, device and electronic equipment. The method comprises the following steps: in response to the fact that distributed denial of service (DDoS) attack traffic exists in service traffic of an access terminal accessing a target server, performing cleaning on the service traffic based on an anti-DDoS defense device to obtain back-feeding traffic; obtaining an Internet protocol (IP) mapping relationship file; configuring an IP of a back-feeding interface of the target server as a back-feeding IP based on the IP mapping relationship file; and sending the back-feeding traffic to the target server according to a back-feeding route corresponding to the back-feeding interface and the back-feeding IP. Based on the above method, the traffic back-feeding can be realized without a GRE tunnel, thereby reducing the risk of traffic loss during traffic back-feeding, improving the effectiveness of traffic back-feeding, and saving routing resources.

Description

A method, apparatus and electronic device for flow reinjection Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and electronic device for traffic reinjection. Background Technology

[0002] Currently, in the DDoS (Distributed Denial of Service) protection market, DDoS protection systems perform injection processing on normal traffic. Injection processing refers to injecting normal traffic, after it has been cleaned by the DDoS protection device, back to the accessed end through injection interfaces and routes. One method for handling normal traffic injection is GRE (Generic Routing Encapsulation) injection. GRE injection achieves the forwarding of normal traffic by configuring GRE tunnels.

[0003] However, GRE tunnels require router support for traffic forwarding and necessitate specific configurations on the router. Since GRE tunnels add GRE headers to the raw traffic, the maximum transmission unit (MTU) is likely to exceed the interface MTU limit, leading to traffic fragmentation. These fragmented packets are highly susceptible to loss during network transmission, ultimately causing disruptions to the traffic reinjection service. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, and electronic device for flow reinjection, so as to make normal flow reinjection more convenient and effective and improve flow reinjection efficiency.

[0005] Firstly, this application provides a method for flow reinjection, the method comprising:

[0006] In response to the presence of Distributed Denial-of-Service (DDoS) attack traffic in the business traffic of the client accessing the target server, the business traffic is cleaned by anti-DDoS defense equipment to obtain reinjected traffic.

[0007] Obtain an Internet Protocol (IP) mapping file, wherein the IP mapping file includes a target server IP, a return IP, and a mapping relationship between the target server IP and the return IP, and the return IP is the IP converted from the target server IP;

[0008] Based on the IP mapping relationship file, the IP of the injection interface of the target server is configured as the injection IP;

[0009] The injection traffic is sent to the target server according to the injection interface and the injection route corresponding to the injection IP.

[0010] This method modifies the target server IP address of the traffic to a redirected IP address when the defense device performs traffic re-injection. This eliminates the need for traffic re-injection through a GRE tunnel, reducing the risk of traffic loss during re-injection, improving the effectiveness of traffic re-injection, and saving routing resources.

[0011] In one possible design, before the DDoS attack traffic exists in the service traffic responding to the access terminal's access to the target server, and before the anti-DDoS defense device cleans the service traffic, the design further includes: establishing a Border Gateway Protocol (BGP) neighbor relationship between the defense device and the router connected to the access terminal, as well as a BGP neighbor relationship between the defense device and the back-injection route; configuring the back-injection interface on the defense device; and providing a configuration entry on the defense device to configure the IP mapping relationship file, parsing the user-provided IP mapping relationship parameters and storing them as the IP mapping relationship file.

[0012] In one possible design, obtaining the Internet Protocol (IP) mapping file includes: obtaining the IP mapping file according to a preset period; or obtaining the IP mapping file in response to receiving a configuration notification that configures the IP mapping file.

[0013] In one possible design, configuring the IP of the target server's re-injection interface to the re-injection IP based on the IP mapping relationship file includes: parsing the IP mapping relationship file to obtain the re-injection IP corresponding to the target server IP; and modifying the target server IP corresponding to the target server's re-injection interface to the re-injection IP.

[0014] In one possible design, after sending the back-in traffic to the target server according to the back-in interface and the back-in route corresponding to the back-in IP, the process includes: obtaining the target server IP corresponding to the back-in IP according to the IP mapping file; encapsulating the traffic data of the target server IP; and transmitting the traffic data to the access terminal.

[0015] Secondly, this application provides a flow reinjection apparatus, the apparatus comprising:

[0016] The cleaning module, in response to the presence of Distributed Denial-of-Service (DDoS) attack traffic in the business traffic of the accessing end to the target server, cleans the business traffic based on anti-DDoS defense equipment to obtain reinjection traffic;

[0017] The acquisition module acquires an Internet Protocol (IP) mapping relationship file, wherein the IP mapping relationship file includes a target server IP, a return IP, and a mapping relationship between the target server IP and the return IP, and the return IP is the IP converted from the target server IP;

[0018] The configuration module configures the IP of the injection interface of the target server as the injection IP based on the IP mapping relationship file;

[0019] The sending module sends the injection traffic to the target server according to the injection interface and the injection route corresponding to the injection IP.

[0020] In one possible design, the apparatus is further configured to: establish a Border Gateway Protocol (BGP) neighbor relationship between the defense device and the router connected to the access end, and a BGP neighbor relationship between the defense device and the back-injection route; configure the back-injection interface on the target server; and provide a configuration entry on the defense device for configuring the IP mapping relationship file.

[0021] In one possible design, the acquisition module is specifically used to: acquire the IP mapping relationship file according to a preset period; or acquire the IP mapping relationship file in response to receiving a configuration notification that configures the IP mapping relationship file.

[0022] In one possible design, the configuration module is specifically used to: parse the IP mapping relationship file to obtain the injection IP corresponding to the target server IP; and modify the target server IP corresponding to the injection interface of the target server to the injection IP.

[0023] In one possible design, the device is further configured to: obtain the target server IP corresponding to the injection IP according to the IP mapping relationship file; encapsulate the traffic data of the target server IP and transmit the traffic data to the access terminal.

[0024] Thirdly, this application provides an electronic device, the electronic device comprising:

[0025] Memory, used to store computer programs;

[0026] When the processor executes the computer program stored in the memory, it implements the above-described method steps for flow reinjection.

[0027] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method steps for traffic reinjection.

[0028] For the various aspects of the second to fourth aspects mentioned above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect or the various possible solutions in the first aspect, which will not be repeated here. Attached Figure Description

[0029] Figure 1 is a schematic diagram of a possible application scenario provided by this application;

[0030] Figure 2 is a flowchart of a flow reinjection method provided in this application;

[0031] Figure 3 is a schematic diagram of a possible application scenario provided by this application;

[0032] Figure 4 is a schematic diagram of a possible application scenario provided by this application;

[0033] Figure 5 is a schematic diagram of a possible application scenario provided by this application;

[0034] Figure 6 is a schematic diagram of a flow reinjection device provided in this application;

[0035] Figure 7 is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operating methods in the method embodiments can also be applied to the device embodiments or system embodiments.

[0037] In the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. A connected to B can represent: A and B directly connected, or A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0038] The design concept of the embodiments of this application will be briefly introduced below.

[0039] Currently, in the DDoS (Distributed Denial of Service Attack) protection market, DDoS protection systems perform injection processing on normal traffic. Injection processing refers to injecting normal traffic, after it has been cleaned by the DDoS protection device, back to the accessed end through injection interfaces and routes. Current protection devices typically handle this injected traffic using methods such as cross-connect injection, policy-based routing injection, and GRE injection.

[0040] In the bridging injection scheme, traffic redirection and traffic re-injection require separate router devices. Configuring a separate router device for redirection and re-injection will increase the user's investment. If router resources are insufficient, the bridging scheme cannot be implemented.

[0041] Policy-based routing injection requires the router to have the ability to configure policies and to have the relevant policy-based routing commands configured on the router. If the router does not have sufficient configuration permissions, the solution cannot be implemented.

[0042] The GRE injection scheme redirects injected traffic by configuring GRE tunnels. Referring to Figure 1, which illustrates an application scenario of normal defense equipment performing traffic redirection, a GRE tunnel is configured to redirect traffic. The specific process of redirecting traffic for redirection is as follows:

[0043] Step 101: As shown in Figure 1, log in to the defense device ADS (Anti-DDoS system). Configure BGP (Border Gateway Protocol) neighbor parameters on both the defense device ADS and the Cisco 3750 router to establish a neighbor relationship between them. Configure the toggle route parameters to ensure that traffic from user ClientA is routed to 10.0.1.1 as the next hop. Additionally, you need to configure the injection interfaces E4, G1 / 0 / 4, and F0 / 0, as well as the injection route.

[0044] Step 102: Configure GRE tunnel connection parameters on the defense device ADS, the Cisco 3750 router, and the Cisco 2600 router to enable GRE tunnel connection. Refer to the commands of each data communication vendor for specific parameters.

[0045] Step 103: Select the injection interface and injection route added in Step 1 on the defense device;

[0046] Step 104: After the traffic is cleaned by the defense device ADS, it is injected back to the routing device Cisco 2600 at the other end of the GRE tunnel through the injection interface and injection route, and then the Cisco 2600 forwards the traffic to the server.

[0047] As can be seen from the above application scenarios, for the GRE injection scheme, the router must support GRE protocol configuration; routers that do not support it cannot implement this scheme. Furthermore, because the GRE tunnel adds GRE headers and other operations to the original traffic, it is highly likely that the traffic MTU (Maximum Transmission Unit) will exceed the interface MTU limit, causing traffic fragmentation and resulting in fragmented packets. These fragmented packets are extremely prone to loss during network transmission, and if fragmented packets are lost, it will ultimately cause anomalies in the traffic reinjection service.

[0048] To address the aforementioned issues, this application provides a traffic re-injection method. When the defense device performs traffic re-injection, the method modifies the target server address of the traffic to a mirror address (re-injection IP) that has been transformed from the target server address. This eliminates the need for traffic re-injection to be achieved through a GRE tunnel, reducing the risk of traffic loss during re-injection, improving the effectiveness of traffic re-injection, and saving routing resources.

[0049] The following describes the method provided by exemplary embodiments of this application in conjunction with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0050] Referring to Figure 2, which is a flowchart of a flow reinjection method provided in an embodiment of this application, the specific implementation process of the method is as follows:

[0051] Step 201: In response to the presence of Distributed Denial-of-Service (DDoS) attack traffic in the business traffic of the client accessing the target server, the business traffic is cleaned based on the anti-DDoS defense device to obtain the reinjected traffic;

[0052] In this embodiment, it is first necessary to establish BGP neighbor relationships between the defense device ADS and the router connecting to the access end, as well as BGP neighbor relationships between the defense device and the injection route. An injection interface is then configured on the defense device. A configuration entry point for configuring IP mapping relationship files is provided on the defense device ADS. Based on the IP mapping information provided by the user, the IP mapping relationship parameters are sent to the device for parsing and storage as an IP mapping relationship file. The IP mapping relationship file includes the target server IP, the injection IP, and the mapping relationship between the target server IP and the injection IP. The injection IP is the IP converted from the target server IP.

[0053] Specifically, users need to log in to the defense device ADS to configure the BGP neighbor parameters and torsion parameters of ADS and router, and realize traffic torsion through BGP routing; configure the injection interface on the target server to realize traffic injection; in addition, the defense device ADS provides a configuration portal based on the web (World Wide Web), through which the IP mapping relationship file is configured to establish a mapping relationship between the target server IP and the injection IP.

[0054] For example, as shown in Figure 3, configure the BGP neighbor parameters of ADS and Router 1, the BGP neighbor parameters of ADS and Router 2, and the towing parameters of Router 1 and Router 2; configure the back-in interface connecting to Router 2 on the target server; configure the IP mapping relationship file on ADS, and fill in the real server IP and back-in IP for the access terminal.

[0055] In this embodiment, when the service traffic from the accessing end to the target server contains Distributed Denial-of-Service (DDoS) attack traffic, the anti-DDoS defense device will clean the service traffic, and after cleaning, obtain the reinjected traffic. This reinjected traffic is used to inject back into the target server.

[0056] Step 202: Obtain the Internet Protocol (IP) mapping file;

[0057] In this embodiment, the IP mapping file includes the target server IP, the injection IP, and the mapping relationship between the target server IP and the injection IP. The injection IP is the IP converted from the target server IP.

[0058] In this embodiment of the application, after the anti-DDoS defense device completes the cleaning of service traffic, the background of the defense device will start a pre-set engine to obtain the IP mapping relationship file. The engine is designed with two working mechanisms, so the methods of obtaining the IP mapping relationship file include the following two.

[0059] Method 1: Obtain the IP mapping file according to a preset period. Specifically, the IP mapping file, which is sent by the user via the web, is read periodically according to a preset period. For example, if the reading period is set to 30 seconds, the IP mapping file will be read once every 30 seconds.

[0060] Method 2: Upon receiving a configuration notification for the IP mapping file, the engine retrieves the IP mapping file. Specifically, users configure the IP mapping file through a web-based configuration portal. Each time a user configures the IP mapping file, the engine receives the configuration notification sent via the web in real time, thereby synchronizing and updating the IP mapping file accordingly.

[0061] Step 203: Based on the IP mapping relationship file, configure the IP of the target server's injection interface as the injection IP;

[0062] In this embodiment of the application, after obtaining the IP mapping relationship file, the IP mapping relationship file is parsed to obtain the injection IP corresponding to the target server IP; the target server IP is then modified to the injection IP.

[0063] Specifically, by parsing the IP mapping file, the injection IP data corresponding to the real server IP accessed by the client is obtained. The checksum value after replacing the real server IP is calculated synchronously for the traffic received by the defense device ADS. Then, the real server IP is modified to the injection IP.

[0064] Step 204: Send the injection traffic to the target server according to the injection interface and the injection route corresponding to the injection IP.

[0065] In this embodiment, the injection route corresponding to the injection IP directs the injection traffic to the injection interface, and finally the injection traffic is injected into the target server.

[0066] For example, as shown in Figure 3, ADS cleans the traffic forwarded by router 1 to obtain reinjection traffic. Then, router 2 directs the reinjection traffic to the reinjection interface, and finally the reinjection traffic is injected into the server through the reinjection interface.

[0067] Furthermore, after sending the injection traffic to the target server according to the injection interface and the injection route corresponding to the injection IP, the target server IP corresponding to the injection IP is obtained according to the IP mapping relationship; the traffic data of the target server IP is encapsulated and the traffic data is passed to the access end.

[0068] Specifically, when the target server receives the injection traffic, it will resolve and identify the injection IP as the target server IP, use this target server IP as the destination IP, encapsulate the traffic data related to the destination IP, and pass the traffic data related to the destination IP to the access terminal.

[0069] For example, as shown in Figure 3, after receiving the injection traffic, the server resolves the injection IP through the IP mapping module to obtain the target server IP, and then encapsulates the traffic data related to the target server IP through the web application and passes the traffic data to the client that initiated the access to the target server.

[0070] In summary, the traffic re-injection methods described above modify the target server IP of the traffic to a re-injection IP that is a translation of the target server address when the defense device performs traffic re-injection. This eliminates the need for the traffic re-injection to go through a GRE tunnel, thereby reducing the risk of traffic loss during re-injection, improving the effectiveness of traffic re-injection, and saving routing resources.

[0071] Based on the traffic reinjection method provided above, the following section elaborates on this method using a possible application scenario shown in Figure 4. It is worth noting that the scenario in Figure 4 is only one application case of the method provided in this application; the method can also be applied to the scenario shown in Figure 5. Figures 4 and 5 are merely one application scenario of the method provided in this application and do not represent all application scenarios.

[0072] As shown in Figure 4, firstly, the user needs to log in to the defense device ADS and configure the BGP neighbor parameters between ADS and Router 1, and the neighbor parameters between ADS and Router 3, to establish neighbor relationships between ADS and Router 1 and Router 3; configure the towing parameters for Router 1, Router 2, and Router 3 to implement traffic towing; configure the injection interface on the server for traffic injection; additionally, a web-based configuration portal is provided on ADS, which is used to configure the IP mapping file to establish a mapping relationship between the real server IP accessed by the user and the injection IP. In Figure 4, the real server IP is 101.204.202.211, and the injection IP is 192.168.202.212.

[0073] In the scenario shown in Figure 4, when there is anomaly in the user's access to the server's business traffic, i.e., a DDoS attack, the business traffic flow follows the direction of the dashed arrow in the figure. The business traffic passes through the ADS defense device, which cleans the traffic to obtain the reinjected traffic. After the ADS defense device completes the cleaning of the business traffic, the ADS background will start a pre-set engine with two working mechanisms. Mechanism 1: The engine periodically reads the IP mapping relationship file sent by the user through the web interface; Mechanism 2: The engine receives IP mapping relationship file configuration notifications sent by the web interface in real time and synchronously loads the latest IP mapping relationship file.

[0074] After ADS reads the IP mapping file, it performs a parsing operation to obtain the injection IP corresponding to the real server IP. In Figure 4, the real server IP is 101.204.202.211, and the injection IP is 192.168.202.212. Then, for the received traffic, the checksum value after replacing the real server IP is calculated synchronously, and the IP at the server's injection interface is modified to the injection IP 192.168.202.212.

[0075] After resolving the injection IP, the engine sends the injection traffic to the server based on the injection interface and the corresponding route, using the network protocol stack provided by the Linux kernel. When the server receives the injection traffic, it resolves the injection IP (192.168.202.212), identifies it as the real server IP (101.204.202.211), and uses 101.204.202.211 as the destination IP, encapsulating the traffic related to the destination IP and sending it to the user end, thus achieving bidirectional normal communication.

[0076] It is worth noting that the application scenario shown in Figure 4 is a direct and separate deployment of a router to communicate with the target server. If users are limited by a lack of routers, they can also use the same network structure as traditional back-injection networking, as shown in Figure 5.

[0077] The traffic reinjection method described above is particularly effective for scenarios where operators find it inconvenient to configure policies on routers, or where routers do not have GRE permissions, and for scenarios where the customer's MTU exceeds the interface MTU limit. It only requires the defense device to modify the target server's IP address, and the defense device and the protected target server can then achieve normal traffic reinjection after cleaning.

[0078] Based on the same inventive concept, this application also provides a traffic reinjection device for effectively reinjecting normal traffic and improving traffic forwarding efficiency. Referring to Figure 6, the device includes:

[0079] The cleaning module 601, in response to the presence of Distributed Denial-of-Service (DDoS) attack traffic in the business traffic of the access terminal to the target server, cleans the business traffic based on the anti-DDoS defense device to obtain the reinjected traffic;

[0080] The acquisition module 602 acquires an Internet Protocol (IP) mapping relationship file, wherein the IP mapping relationship file includes a target server IP, a return IP, and a mapping relationship between the target server IP and the return IP, and the return IP is the IP converted from the target server IP;

[0081] Configuration module 603 configures the IP of the injection interface of the target server as the injection IP based on the IP mapping relationship file;

[0082] The sending module 604 sends the injection traffic to the target server according to the injection interface and the injection route corresponding to the injection IP.

[0083] In one possible design, the apparatus is further configured to: establish a Border Gateway Protocol (BGP) neighbor relationship between the defense device and the router connected to the access end, and a BGP neighbor relationship between the defense device and the back-injection route; configure the back-injection interface on the target server; and provide a configuration entry on the defense device for configuring the IP mapping relationship file.

[0084] In one possible design, the acquisition module 602 is specifically used to: acquire the IP mapping relationship file according to a preset period; or acquire the IP mapping relationship file in response to receiving a configuration notification that configures the IP mapping relationship file.

[0085] In one possible design, the configuration module 603 is specifically used to: parse the IP mapping relationship file to obtain the injection IP corresponding to the target server IP; and modify the target server IP corresponding to the injection interface of the target server to the injection IP.

[0086] In one possible design, the device is further configured to: obtain the target server IP corresponding to the injection IP according to the IP mapping relationship file; encapsulate the traffic data of the target server IP and transmit the traffic data to the access terminal.

[0087] Based on the above device, when the defense device performs traffic re-injection, the target server IP address of the traffic is modified to a re-injection IP address that is converted from the target server address. This eliminates the need for traffic re-injection to go through a GRE tunnel, reducing the risk of traffic loss during re-injection, improving the effectiveness of traffic re-injection, and saving routing resources.

[0088] Based on the same inventive concept, this application also provides an electronic device that can perform the function of the aforementioned flow reinjection device. Referring to FIG7, the electronic device includes:

[0089] At least one processor 701 and a memory 702 connected to at least one processor 701 are included. In this embodiment, the specific connection medium between the processor 701 and the memory 702 is not limited. Figure 7 illustrates an example where the processor 701 and the memory 702 are connected via a bus 700. The bus 700 is represented by a thick line in Figure 7. The connection methods between other components are for illustrative purposes only and are not intended to be limiting. The bus 700 can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in Figure 7, but this does not indicate that there is only one bus or one type of bus. Alternatively, the processor 701 can also be called a controller; the name is not limited.

[0090] In this embodiment, the memory 702 stores instructions executable by at least one processor 701. By executing the instructions stored in the memory 702, the at least one processor 701 can perform the image generation method described above. The processor 701 can implement the functions of each module in the device shown in FIG6.

[0091] The processor 701 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 702 and calling data stored in memory 702, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0092] In one possible design, processor 701 may include one or more processing units. Processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 701. In some embodiments, processor 701 and memory 702 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0093] The processor 701 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the flow reinjection method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0094] Memory 702, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 702 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 702 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 702 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0095] By designing and programming the processor 701, the code corresponding to the flow re-injection method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the steps of the flow re-injection method shown in Figure 2 during operation. How to design and program the processor 701 is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0096] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the image generation method described above.

[0097] In some possible implementations, various aspects of the image generation method provided in this application may also be implemented as a program product comprising program code that, when the program product is run on a device, causes the control device to perform the steps in the image generation method according to the various exemplary embodiments of this application described above.

[0098] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus / systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0099] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0102] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for flow reinjection, characterized in that, The method includes: responding to the presence of Distributed Denial-of-Service (DDoS) attack traffic in the service traffic of an access terminal accessing a target server, cleaning the service traffic based on anti-DDoS defense equipment to obtain reinjection traffic; obtaining an Internet Protocol (IP) mapping file, wherein the IP mapping file includes a target server IP, a reinjection IP, and a mapping relationship between the target server IP and the reinjection IP, and the reinjection IP is the IP converted from the target server IP; configuring the IP of the reinjection interface of the target server as the reinjection IP based on the IP mapping file; sending the reinjection traffic to the target server according to the reinjection interface and the reinjection route corresponding to the reinjection IP; obtaining the target server IP corresponding to the reinjection IP according to the IP mapping file; encapsulating the traffic data of the target server IP, and transmitting the traffic data to the access terminal.

2. The method as described in claim 1, characterized in that, If a Distributed Denial-of-Service (DDoS) attack occurs in the service traffic responding to the access terminal's access to the target server, before the DDoS-based anti-DDoS defense device cleans the service traffic, the process further includes: establishing a Border Gateway Protocol (BGP) neighbor relationship between the defense device and the router connected to the access terminal, as well as a BGP neighbor relationship between the defense device and the injection route; configuring the injection interface on the defense device; and providing a configuration entry on the defense device to configure the IP mapping relationship file, parsing the user-provided IP mapping relationship parameters and storing them as the IP mapping relationship file.

3. The method as described in claim 1, characterized in that, The step of obtaining the Internet Protocol (IP) mapping file includes: obtaining the IP mapping file according to a preset period; or obtaining the IP mapping file in response to receiving a configuration notification that configures the IP mapping file.

4. The method as described in claim 1, characterized in that, The step of configuring the IP of the injection interface of the target server to the injection IP based on the IP mapping relationship file includes: parsing the IP mapping relationship file to obtain the injection IP corresponding to the target server IP; and modifying the target server IP corresponding to the injection interface of the target server to the injection IP.

5. A flow reinjection device, characterized in that, The apparatus includes: a cleaning module, which, in response to the presence of Distributed Denial-of-Service (DDoS) attack traffic in the service traffic of an access terminal accessing a target server, cleans the service traffic based on anti-DDoS defense equipment to obtain reinjection traffic; an acquisition module, which acquires an Internet Protocol (IP) mapping file, wherein the IP mapping file includes a target server IP, a reinjection IP, and a mapping relationship between the target server IP and the reinjection IP, and the reinjection IP is the IP converted from the target server IP; a configuration module, which, based on the IP mapping file, configures the IP of the reinjection interface of the target server as the reinjection IP; and a sending module, which sends the reinjection traffic to the target server according to the reinjection interface and the reinjection route corresponding to the reinjection IP; obtains the target server IP corresponding to the reinjection IP according to the IP mapping file; encapsulates the traffic data of the target server IP; and transmits the traffic data to the access terminal.

6. The apparatus as claimed in claim 5, characterized in that, The acquisition module is specifically used to: acquire the IP mapping relationship file according to a preset period; or acquire the IP mapping relationship file in response to receiving a configuration notification that configures the IP mapping relationship file.

7. The apparatus as claimed in claim 5, characterized in that, The configuration module is specifically used to: parse the IP mapping relationship file to obtain the injection IP corresponding to the target server IP; and modify the target server IP corresponding to the injection interface of the target server to the injection IP.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method steps of any one of claims 1-4.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-4.

Images