A packet data matching method and device

Abstract

The application discloses a packet data matching method and device, comprising: receiving packet data; the packet data comprises a matching object; indexing a first rule set and a second rule set corresponding to the matching object according to the matching object; the first rule set is a rule sub-set indexed by a DFA state transition table based on an array form continuous memory space; the second rule set is a rule sub-set indexed by an RFC hash mapping table based on a rule priority bitmap form; matching a first rule corresponding to the packet data from the first rule set; matching a second rule corresponding to the packet data from the second rule set; selecting a high-priority rule from the first rule and the second rule according to the priority to process the packet data. The application realizes rule matching of different packet data types, guarantees data plane packet data matching efficiency, and reduces time and space complexity of configuring plane rule construction.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, and particularly relates to a message data matching method and device. BACKGROUND

[0002] An access control list (ACL) is a message filtering technology based on five tuples (source IP, destination IP, source port, destination port and protocol field). By matching the ACL rule and the fixed data field of the message data in the network layer and the transport layer, the message data in the network is filtered.

[0003] At present, the algorithm for matching the ACL rule and the message data generally includes an exhaustive algorithm, a rule library division technology and a dimension decomposition technology.

[0004] However, the above algorithms have their own characteristics, and there are certain advantages and disadvantages in different scenarios. For example, the rule library division technology does not support the inverse matching of the ACL rule, and cannot match all types of message data; the exhaustive algorithm cannot meet the performance requirements of the data surface; the dimension decomposition technology requires a large amount of memory space resources. In summary, the current matching method has poor universality, low accuracy and efficiency, and cannot customize the rule field for the matching object. SUMMARY

[0005] The embodiments of the present application provide a message data matching method and device, which improves the message matching and filtering performance and efficiency of the data surface while reducing the time and space complexity of the configuration surface.

[0006] In a first aspect, the embodiments of the present application provide a message data matching method, comprising:

[0007] receiving message data; the message data comprises a matching object;

[0008] indexing a first rule set and a second rule set corresponding to the matching object according to the matching object; the first rule set is a rule sub-set indexed by a DFA state transition table based on an array form continuous memory space; the second rule set is a rule sub-set indexed by an RFC hash mapping table based on a rule priority bitmap form;

[0009] matching a first rule of the message data from the first rule set;

[0010] matching a second rule of the message data from the second rule set;

[0011] selecting a high-priority rule from the first rule and the second rule according to the priority to process the message data.

[0012] In the technical solution, the first rule set and the second rule set are used to determine the protection rule corresponding to the message data, so that the IPv4 and IPv6 message data characteristics are quickly and adaptively matched in different tenant environments. The rule includes an exact match type field, a range match type field, a mask match type field, a wildcard type field, and an arbitrary binary data or ASCII character type data match, so as to improve the flexibility of the message data matching rule.

[0013] The first rule set and the second rule set are constructed for the matching object, so as to ensure that the message data matching rules between tenants are isolated and not disturbed, and the efficiency of message data matching is improved.

[0014] Optionally, the method further comprises:

[0015] Receiving a rule configuration based on the matching object;

[0016] For any protection rule in the rule configuration, if the protection rule does not include a field of the negation matching flag, the protection rule is classified into a DFA state transition table constructed based on the first rule set;

[0017] If the protection rule includes at least one field of the negation matching flag, it is classified into an RFC hash mapping table constructed based on the second rule set.

[0018] In the technical solution, the data structure management unit for tenant creation is used to construct the first rule set and the second rule set for the tenant, so as to ensure that the message data matching rules between tenants are not disturbed, and the efficiency of message data matching is improved.

[0019] The user-defined extended message data characteristic matching field range and the protection rule of the message data are supported, so as to improve the flexibility of message data matching. The message data characteristic field matching and the negation matching are supported, and various message data characteristic matching algorithms are fused to take into account the time complexity and space complexity of the control plane, so as to guarantee the performance of the data plane.

[0020] Optionally, the first rule set is constructed based on the protection rule, comprising:

[0021] For any protection rule, the rule field of the protection rule is calculated;

[0022] The node is determined according to the rule field;

[0023] The node is added to the rule tree preset based on the DFA algorithm;

[0024] The rule tree is compressed in an array form to obtain a first rule set pointed to by a DFA state transition table index in a continuous memory space based on the array form.

[0025] Optionally, a second rule set is constructed based on the protection rules, comprising:

[0026] A hash value of the protection rule of the matching object is calculated;

[0027] Based on the RFC algorithm, the second rule set pointed to by the RFC hash mapping table index based on the rule priority bitmap form is obtained according to the identification of the matching object.

[0028] In a second aspect, an embodiment of the present application provides a packet data matching device, comprising:

[0029] A receiving module is configured to receive packet data; the packet data comprises a matching object;

[0030] A processing module is configured to index a first rule set and a second rule set corresponding to the matching object according to the matching object; the first rule set is a rule sub-set pointed to by a DFA state transition table based on an array form continuous memory space; the second rule set is a rule sub-set pointed to by an RFC hash mapping table based on a rule priority bitmap form;

[0031] A first rule of the packet data is matched from the first rule set;

[0032] A second rule of the packet data is matched from the second rule set;

[0033] A high-priority rule is selected from the first rule and the second rule according to the priority, and the packet data is processed by the high-priority rule.

[0034] Optionally, the receiving module is further configured to:

[0035] Before receiving the packet data, a rule configuration based on the matching object is received;

[0036] The processing module is further configured to:

[0037] For any protection rule in the rule configuration, if the protection rule does not comprise a field of a negated matching flag, the protection rule is classified into a DFA state transition table constructed based on the first rule set;

[0038] If the protection rule comprises at least one field of a negated matching flag, it is classified into an RFC hash mapping table constructed based on the second rule set.

[0039] Optionally, the processing module is specifically configured to:

[0040] For any protection rule, a rule field of the protection rule is calculated;

[0041] A node is determined according to the rule field.

[0042] add the node to a rule tree preset based on the DFA algorithm;

[0043] compress the rule tree in an array form to obtain a first rule set indexed by a DFA state transition table index based on a continuous memory space in an array form.

[0044] Optionally, the processing module is specifically configured to:

[0045] calculate a hash value of the protection rule of the matching object;

[0046] obtain a second rule set indexed by an RFC hash mapping table based on a rule priority bitmap form based on the RFC algorithm and the identification of the matching object.

[0047] In a third aspect, an embodiment of the present application further provides a computer device, comprising:

[0048] a memory configured to store program instructions;

[0049] a processor configured to invoke the program instructions stored in the memory to perform the packet data matching method according to the obtained program.

[0050] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium, which stores computer executable instructions, and the computer executable instructions are configured to cause a computer to perform the packet data matching method. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0052] Figure 1 a system architecture schematic diagram provided by the embodiment of the present application;

[0053] Figure 2 a flowchart of the packet data matching method provided by the embodiment of the present application;

[0054] Figure 3 a schematic diagram of constructing a rule tree provided by the embodiment of the present application;

[0055] Figure 4 a schematic diagram of constructing a rule tree provided by the embodiment of the present application;

[0056] Figure 5A schematic diagram of a merged rule tree provided for an embodiment of the present application;

[0057] Figure 6 A schematic diagram of a rule tree merging different rule priorities provided for an embodiment of the present application;

[0058] Figure 7 A schematic diagram of another rule tree merging different rule priorities provided for an embodiment of the present application;

[0059] Figure 8 A schematic diagram of compressed metadata provided for an embodiment of the present application;

[0060] Figure 9 A schematic diagram of compressed metadata provided for an embodiment of the present application;

[0061] Figure 10 A schematic diagram of a chunk00 mapping relationship provided for an embodiment of the present application;

[0062] Figure 11 A schematic diagram of a chunk01 mapping relationship provided for an embodiment of the present application;

[0063] Figure 12 A structural schematic diagram of a packet data matching device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0065] In order to better set forth the technical solutions of the present application, the following explains the terms appearing.

[0066] DFA (Deterministic Finite Automaton, finite state automaton) refers to an automaton for state transition.

[0067] RFC (Recursive Flow Classification, recursive flow classification algorithm) refers to a multi-dimensional packet classification algorithm based on software implementation.

[0068] Access Control List (ACL) is a packet filtering technology based on five-tuple (including source IP, destination IP, source port, destination port and protocol field), which realizes the filtering of packet data in the network by matching the ACL rule with the fixed data field of the packet data network layer and the transport layer.

[0069] Wherein, the port refers to the port in TCP / IP protocol; the IP refers to the unique identifier of computer in Internet, which is a unique identifier, including 32-bit IPv4 type and 128-bit IPv6 type. The port and the IP are used for data transmission service, the IP address guarantees the position of computer in Internet, and the port determines the position of software. For example, “3306” represents the port number of MySQL; “21” represents the file download port; “1521” represents the Oracle port.

[0070] The current ACL packet filtering technology is generally implemented based on the following algorithms: exhaustive algorithm, rule library division technology, dimension decomposition technology and other packet classification technologies.

[0071] However, the above algorithms have their own characteristics, and there are certain advantages and disadvantages in different scenarios. Specifically, the ACL based on finite state automaton algorithm does not support the inverse matching operation of the rule field.

[0072] The ACL based on linear matching algorithm cannot meet the performance requirements of the data plane.

[0073] The ACL based on hash algorithm needs a large amount of memory space resources as a cost, which affects the hardware performance.

[0074] The ACL based on the packet classification technology of spatial geometric region segmentation has limitations on the number of rule fields, and cannot meet the needs of user-defined rule fields.

[0075] In addition, the rule field of the access control list is fixed and cannot be customized according to the business needs, which affects the flexibility and accuracy of packet data matching. And the extended access control list technology supports the extension of rule matching fields, but has limitations on the type of packet data (such as IPv4 packet and IPv6 packet) of the data plane.

[0076] Therefore, there is an urgent need for a packet data matching method that improves the efficiency of packet data matching under the premise of meeting the basic functions of algorithm in business application scenarios.

[0077] Figure 1 An exemplary system architecture to which embodiments of the application are applicable is shown, which includes a server 100, which can include a processor 110, a communication interface 120 and a memory 130.

[0078] The communication interface 120 is configured to receive the configuration rules and the packet data of the matching object sent by the user.

[0079] The processor 110 is the control center of the server 100, and is connected with various parts of the server 100 through various interfaces and routes, and performs various functions of the server 100 and processes data by running or executing software programs / modules stored in the memory 130 and calling data stored in the memory 130. Optionally, the processor 110 can include one or more processing units.

[0080] The memory 130 is configured to store software programs and modules, and the processor 110 performs various function applications and data processing by running the software programs and modules stored in the memory 130. The memory 130 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required by at least one function, and the like; and the data storage area can store data created according to business processing and the like. In addition, the memory 130 can include a high-speed random access memory, and can also include a nonvolatile memory such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device.

[0081] It should be noted that the above Figure 1 The structure shown in the figure is only an example, and the embodiments of the present application are not limited thereto.

[0082] Based on the above description, Figure 2 An exemplary flowchart of a packet data matching method provided by the embodiments of the present application is shown, and the flowchart can be executed by a packet data matching device.

[0083] As Figure 2 shown, the flowchart specifically includes:

[0084] In step 210, packet data is received; the packet data includes a matching object.

[0085] In the embodiments of the present application, the packet data can include a plurality of matching objects, and the number of the matching objects is not limited herein.

[0086] In step 220, a first rule set and a second rule set corresponding to the matching object are indexed according to the matching object.

[0087] In the embodiments of the present application, the first rule set is a rule sub-set indexed by a DFA state transition table based on an array form continuous memory space; and the second rule set is a rule sub-set indexed by an RFC hash mapping table based on a rule priority bitmap form.

[0088] Step 230, matching a first rule of the packet data from the first rule set.

[0089] Step 240, matching a second rule of the packet data from the second rule set.

[0090] Step 250, selecting a high priority from the first rule and the second rule according to the priority to process the packet data.

[0091] In the embodiment of the present application, the protection rules configured by the user under the control plane are classified into the first rule set or the second rule set according to whether the field containing the negation flag is included in the protection rule, and the DFA state transition table based on the array form of the indexable first rule set and the RFC hash mapping table based on the rule priority bitmap form of the indexable second rule set are constructed.

[0092] That is, if the protection rule corresponding to the matching object exists in the first rule set or the second rule set, the matched rule in the rule set can be indexed through the DFA state transition table and the RFC hash mapping table. Wherein, the matching object refers to the packet data characteristics and the like under different tenant spaces.

[0093] Further, the rule configuration based on the matching object is received; wherein, the configuration rule includes the field name, the field type, the field length, the field offset, the key field, the negation matching flag, the valid flag, the protocol type, the priority, the tenant name, the protection policy and the like information.

[0094] For any protection rule in the rule configuration, if the protection rule does not include the field of the negation matching flag, it is classified into the first rule set of the protection rule to construct the DFA state transition table; if the protection rule includes at least one field of the negation matching flag, it is classified into the second rule set of the protection rule to construct the RFC hash mapping table.

[0095] For example, the user issues the rule configuration under the aclcontrol command line; the rule configuration includes the protection rule priority based on the packet data characteristics of a certain tenant, the field name of the protection rule, the field type, the protection policy and the like information.

[0096] Then, the configuration delivery channel is sent to the protection engine, the protection rule in the aclcontrol command is received by the configuration thread in the protection engine, and the tenant information to which the protection rule belongs is parsed, and it is delivered to the context data structure management unit of the tenant. Wherein, the management unit and the tenant are in a one-to-one correspondence; the management unit stores the first rule set and the second rule set.

[0097] The management unit extracts field information of the protection rule, if there is no field with negation flag in the protection rule, the protection rule is classified into the first rule set, and a DFA state transition table based on array form pointing to the first rule set is constructed. If there is at least one field with negation matching in the protection rule, the protection rule is classified into the second rule set, and an RFC hash mapping table based on rule priority bitmap form pointing to the second rule set is constructed.

[0098] Finally, the first rule set and the second rule set under the control plane, and the DFA state transition table pointing to the first rule set and the RFC hash mapping table pointing to the second rule set are updated to the data plane.

[0099] Further, the data structure management unit of the tenant includes two same primary and standby contexts working and standby; wherein, the working context works in the data plane, and the standby context works in the control plane.

[0100] The management unit of the tenant guarantees the data running safety and the smooth service switching of the data plane and the control plane through "reference counting" and "exchange context pointer pointing". Wherein, the working and the standby maintain a counting array, and each thread is allocated a counting unit which is exclusively written by the thread. The thread only needs to simply add the counts in all counting units when checking the standby context count, so as to realize the reference counting "read" operation of the context. In this way, the sharp decline of the protection performance of the data plane caused by the CPU competition of multi-thread is avoided, and the matching performance of the message data is ensured.

[0101] In the embodiment of the application, the DFA state transition table pointing to the first rule set is constructed based on DFA algorithm. Specifically, for any protection rule, the rule field of the protection rule is calculated; the node is determined according to the rule field; the node is added to the rule tree preset based on DFA algorithm; and the rule tree is compressed in array form to obtain the DFA state transition table pointing to the first rule set.

[0102] In some embodiments, the calculation of the rule field can be calculated according to the byte unit alignment. For example, all fields in the protection rule are analyzed, and all fields are aligned according to the preset byte length and sorted. Specifically, for example, all fields are sorted according to 4 byte unit alignment (wherein, the field with only one byte length is defaulted as the first field, such as the protocol field). For example, the sorted fields are: protocol field, source IP, destination IP, source port, destination port.

[0103] For any field in the protection rule, if the matching range of the field is all, the field is marked as a wildcard field. For example, if the source IP address field in the protection rule is 0.0.0.0 / 0, or the source and destination ports are both 0-65535, etc., the field is marked as a wildcard field.

[0104] The fields in the protection rule except the wildcard field are added to a Trie tree (i.e., a rule tree) with a bit width of 8 bits. That is, each node in the Trie tree represents 1 byte of data content, and a 4-byte length field is divided into 4 1-byte data nodes.

[0105] In some implementable manners, the 1-byte length protocol field (such as 0x06 / 0xff) and the 4-byte length field (such as 192.168.1.0 / 24) can be determined in a mask manner to determine the wildcard bit information; the source port and the destination port can be determined according to the range width to determine the wildcard bit information. In this way, the construction efficiency of the rule tree is improved, and the rule matching efficiency of the packet data is also improved.

[0106] Further, the 4-byte length mask type field is divided into 4 1-byte mask fields to construct nodes respectively. For example, 192.168.1.0 / 24 is divided into 0xc0 / 0xff, 0xa8 / 0xff, 0x01 / 0xff, and 0x0 / 0x0, etc. Among them, the bit 0 in the mask represents "wildcard", and the bit 1 represents "exact" matching node. Therefore, 0xc0 / 0xff represents the exact matching node 0xc0, and 0x0 / 0x0 is wildcard for any value between 0x0-0xff.

[0107] The 2-byte length range type (source port and / or destination port) field is divided into 2 1-byte fields to construct nodes respectively. Assuming that the upper limit value of the port is hi, and the lower limit value of the port is lo, the hexadecimal form of the upper and lower limit values of the port is lo[0]-hi[0], lo[1]-hi[1] respectively.

[0108] Among them, lo[0] and hi[0] represent the lower limit and the upper limit of the high byte respectively, and lo[1] and hi[1] represent the lower limit and the upper limit of the low byte respectively. Taking the port range 342-564 as an example, the hexadecimal form of the upper and lower limit values of the port is lo[2] = {0x1, 0x56}, hi[2] = {0x2, 0x34} respectively.

[0109] Figure 3 A schematic diagram of constructing a rule tree is exemplarily shown for the embodiments of the present application, as shown in Figure 3As shown, in order to ensure that the low byte of the upper limit is greater than the high byte of the lower limit, the upper and lower limit ranges are split into 2 segments. Namely, port range 1 is "0x156~0x1ff", and port range 2 is "0x200~0x234". The port range 1 and the port range 2 are divided into high and low bytes to construct two Trie nodes, and then two Trie branch trees are formed. Finally, the two Trie branch trees are merged.

[0110] In another implementable manner, as shown in Table 1 below, the port ranges of different span ranges are split differently to ensure that the low byte of the upper limit of the port range is greater than the high byte of the lower limit.

[0111] Table 1

[0112]

[0113]

[0114] In order to better illustrate the above technical solutions, Figure 4 A schematic diagram of constructing a rule tree is exemplarily shown for the embodiment of the present application, as shown in Figure 4 As shown, a Trie tree constructed according to the above process based on the five-tuple fields (sip: 0.0.0.0 / 0, dip: 192.168.1.0 / 24, sport: 0-65535, dport: 80-80, proto: 0x06 / 0xff) is a tree, and each node on the tree records bit map information of all child nodes corresponding to the node except leaf nodes. Therefore, the leaf nodes can be quickly indexed by the bit map, and DFA state conversion is realized.

[0115] In the embodiment of the present application, after the Trie branch trees are constructed, the Trie branch trees are merged to obtain a rule tree. The specific merging rule is to first determine the intersection of the Trie branch trees, and then merge according to the intersection.

[0116] Figure 5 A schematic diagram of merging a rule tree is exemplarily shown for the embodiment of the present application, as shown in Figure 5 As shown, the dashed node in the Trie tree (0x0 / 0x0 192.168.1.110 / 32) will be moved to the position of the solid node, and the dashed node in the Trie branch tree (0x0 / 0x6 192.168.2.111 / 32) will be deleted.

[0117] Figure 6 A schematic diagram of merging a rule tree of different rule priorities is exemplarily shown for the embodiment of the present application, as shown in Figure 6As shown, the dashed node in the Trie tree (0x0 / 0x0 192.168.1.110 / 32) will move to the position of the solid node, and the dashed node in the Trie branch tree (0x0 / 0x6 192.168.1.0 / 24) will be deleted. Here, the symbol # represents all states in the range of 0-255 except 110 or 111.

[0118] Figure 7 Another schematic diagram of merging rule trees of different rule priorities is exemplarily shown for an embodiment of the present application, as shown in Fig. 6. Figure 7 As shown, the dashed node in the Trie tree (0x0 / 0x0 192.168.1.110 / 32) will move to the position of the solid node, and the dashed node in the Trie branch tree (0x0 / 0x6 192.168.1.0 / 24) will be deleted.

[0119] Based on the above description, after merging the Trie trees, the Trie trees are compressed, and the Trie trees are converted into a DFA state transition table in the form of an array. Because the degree of sparsity of the Trie tree space is high, by compression, a DFA state transition table in the form of an array pointing to the first rule set is formed, which is compact in space.

[0120] Specifically, for a Trie tree with a bit width of 8, in the case that the child nodes of any node are full, the out-edge number of the node of the Trie tree is 2 8 = 256. However, the bit bitmap of the node will be divided into several segments of continuous 0 and / or 1, and therefore a data structure of a metadata type can be used to record the continuous 0 and / or 1. For example, the index values of all child nodes corresponding to the 0 / 1 values of the bit bitmap, the length of the segment (the number of included child nodes), the starting node and the ending node (the next starting node minus 1) of the segment, and the index jump information of the child node with a bit of 1 can be represented by a data structure of a metadata type, so as to reduce the out-edge number of the node, thereby realizing compression of the redundant space of the Trie tree.

[0121] Specifically, the nodes are classified according to the number of out-edge segments of the nodes, such as the following classification rules:

[0122] Compact node: 5 < number of out-edge segments ≤ 256;

[0123] Sparse node: 1 < number of out-edge segments ≤ 5;

[0124] Wildcard node: number of out-edge segments = 1, and the bit bitmap is all 1;

[0125] It should be noted that the above classification rules are only examples, and the specific classification rules are not limited herein. The leaf node is the accepting (terminal state) state of the DFA, and does not need to be state transitioned.

[0126] The out-edge segment number of a node is the sum of the number of continuous 0s and the number of continuous 1s in the bit bitmap of all child nodes of the node. For example, the bit bitmap of all child nodes of the node 192 in 192.168.1.0 / 24 is "0x0 0x0 0x0 0x0 0x0 0x100 0x00x0". The bit bitmap of the node 192 is divided into two continuous 0 segments by the 168th bit 1, and only one child node 168 has the same bit value, and the number of continuous 1s is 1. Therefore, the out-edge segment number of the node 192 is 3.

[0127] For another example, for a node including three child nodes 10, 11 and 192, the bit bitmap of all child nodes of the node is "0xc00 0x0 0x0 0x0 0x0 0x0 0x1 0x0". Based on the above description, the number of continuous 0s in the bit bitmap of the three child nodes of the node is 3, and the bit bitmap of each of the three child nodes is "0x400 0x00x0 0x0 0x0 0x0 0x0 0x0", "0x800 0x0 0x00x0 0x0 0x0 0x0 0x0" and "0x0 0x0 0x0 0x00x0 0x0 0x1 0x0" respectively, that is, the number of continuous 1s of each of the three child nodes is 1. Therefore, the out-edge segment number of the node is 3+1+1+1=6.

[0128] The leaf node has no child node, and the bit bitmap of the leaf node is all 0. According to the above rule, the out-edge segment number of the leaf node is also 1. However, the leaf node is the accepting (terminal state) state of the DFA, and does not need to perform DFA state transition. Therefore, the wildcard node must be the node with all 1s in the bit bitmap.

[0129] After classifying the nodes according to the above classification rule, the segment metadata of each type of node is calculated.

[0130] Specifically, calculating the segment metadata of the compact node includes: dividing the bit bitmap of the compact node into 4 segments with 64 bits as a unit, that is, each segment has 64 metadata. Each metadata includes the index information of the child node pointed to by the compact node.

[0131] If the compact node has child nodes, the different child node index information (such as the access index of the compression array) is different from each other. If the compact node has no child node, the index of the compact node must point to the "non-existent" child node of the "trap" state. That is, when there are the same segments in the 4 segments of metadata, the 64 metadata in the same segment all point to the "non-existent" child node of the "trap" state.

[0132] At this point, only the first piece of metadata is retained, and subsequent identical segments only record a "pointer" to the first piece of metadata, thereby reducing memory space allocation.

[0133] Figure 8 A schematic diagram of compressed metadata is shown as an example of an embodiment of the present invention, such as... Figure 8 As shown, the DFA node with outgoing edge 6 contains 3 child nodes with data of 10, 11 and 192, belonging to segment 0 and segment 3 respectively; both segment 2 and segment 1 point to the "trap" state, so segment 2 reuses the metadata information of segment 1 and shifts the spatial position index of the metadata of each child node in segment 2 and segment 3 forward by 64 positions, thereby reducing 256 redundant array elements to 192, achieving space compression of compact nodes.

[0134] In some embodiments, segmented metadata of sparse nodes is calculated; Figure 9 A schematic diagram of compressed metadata is shown as an example of an embodiment of the present invention, such as... Figure 9 As shown, the bitmap of the 256 child nodes of the Trie tree is divided into two segments: 0–127 and 128–255. Segment 128–255 is placed in the first half. The values ​​of the child nodes are converted from 8-bit unsigned numbers to signed numbers, resulting in child node data values ​​ranging from -128 to 127.

[0135] based on Figure 9 It can be seen that there is only one child node in the Trie tree pointing to 192. Therefore, the bit map is divided into 3 segments: segment 0 with a value of -128 to -65, segment 1 with a value of -64, and segment 2 with a value of -63 to 127.

[0136] Based on the above description, the metadata records the start and end positions and length of segments composed of child nodes with the same state (existence or non-existence), as well as the state jump index information of each child node in the segment. Since the number of outgoing edge segments of sparse nodes is (1,5], a metadata array with 4 elements can be used to record the information of up to 5 segments. The data range of each segment is as follows: [-128,transmeta[0]), [transmeta[0],transmeta[1]), [transmeta[1],transmeta[2]), [transmeta[2],transmeta[3]), [transmeta[3],127).

[0137] When performing DFA matching, the segment can be quickly determined by performing logical operations on the start and end ranges of the input data and each metadata segment, and then the sub-nodes of that segment can be quickly switched to the next layer node, thereby improving the matching efficiency of message data.

[0138] In some embodiments, the segment metadata of the wildcard node is calculated; specifically, the segment metadata of the wildcard node is calculated in the same way as the segment metadata of the sparse node, which is not limited herein.

[0139] In the embodiments of the present application, the DFA state transition table pointing to the first rule set is obtained by compressing the rule tree based on the above-described manner of calculating the segment metadata. As can be seen, each memory unit in the DFA state transition table (node_array array) is a 64-bit integer, and each memory unit records all the child node state transition information of a node. Since the bitmaps of all the child nodes of a node are divided into multiple different segments, each segment represents the same child node state (0 / 1, i.e., the child node exists or does not exist). Therefore, the high 4 bytes of the 64-bit node_array element represent the segment information, and each byte of data represents the start data of the segment. Based on the above description, the bitmap of all the child nodes (child node 168) of the node 192 in 192.168.1.0 / 24 is "0x0 0x0 0x0 0x0 0x0 0x100 0x0 0x0", and the sparse node 192 has 3 segments of out edges. The state of all the child nodes of the node is divided into 3 segments, including "0~167", "168" and "169~255". From the perspective of signed numbers, it is 4 segments, including "-128~-89", "-88", "-87~-1" and "0~127".

[0140] Therefore, the high 4 bytes of node_array[i] (i represents the i-th node) in the node_array array record the segment positions in turn from low to high as follows: "node_array[i][4]=167=-89=0xa7", "node_array[i][5]=168=-88=0xa8", "node_array[i][6]=127=0xf7", "node_array[i][7]=127=0xf7".

[0141] In addition, the low 4 bytes of node_array[i] in the node_array array record the type of the first node in the segment type node and the index value (i.e., the array subscript of node_array) pointing to the child node of the node, and node_array[i] to node_array[i+2] record the 3 segment child node state transition information of the node 192.

[0142] In the embodiments of the present application, the RFC hash mapping table pointing to the second rule set is constructed based on the RFC algorithm. Specifically, the hash value of the protection rule of the matching object is calculated; and the RFC hash mapping table is constructed based on the RFC algorithm according to the identification of the matching object.

[0143] Specifically, assuming that the message data classification rule has d dimensions, a bit string data total length S is formed according to d domains in the message data. S bit key information in the message data is mapped into T bit equivalent class identification (eqID) (wherein, T = log n , T << S, n represents the number of protection rules).

[0144] In order to better illustrate the RFC hash mapping table construction process of the second rule set, the following is described with a specific example. As shown in Table 2 below.

[0145] Table 2

[0146]

[0147]

[0148] Based on the above Table 2, the destination IP is divided into chunk00 and chunk01 according to 16 bits, and then the chunk00 and chunk01 are projected onto the number axis to form two equivalent sets, including: ces00 = { {other}, {29754}, {32073}, {34766}, {42614}}, ces01 = { {other}, {31744~32767}, {32808~38271}, {42526}}.

[0149] Then the mapping relationship between the chunkid of chunk00 and chunk01 respectively and eqID, ces (chunk equivalence set) and cbm (chunk bitmap) is calculated. Figure 10 A schematic diagram of a chunk00 mapping relationship exemplarily shown by an embodiment of the present application. Figure 11 A schematic diagram of a chunk01 mapping relationship exemplarily shown by an embodiment of the present application.

[0150] Based on the above Figure 10 , the mapping relationship between chunk00 and eqID, ces (chunk equivalence set) and cbm (chunk bitmap) is obtained as shown in Table 3 below.

[0151] Table 3

[0152]

[0153] Based on the above Figure 11, the mapping relationship between chunk01 and eqID, ces (chunk equivalence set) and cbm (chunk bitmap) is shown in Table 4 below.

[0154] Table 4

[0155]

[0156] After obtaining chunk00 and chunk01 as shown in Table 3 and Table 4 above, the cross product of chunk00 and chunk01 is calculated, and through the mapping relationship between the cross product and eqID, the mapping relationship between the cross product and the protection rule is further obtained. The RFC hash mapping table pointing to the second rule set is constructed based on the mapping relationship between the cross product and eqID and the mapping relationship between the cross product and the protection rule.

[0157] In step 230, after receiving the packet data, the eqID_0 and eqID_1 corresponding to chunk00 and chunk01 are obtained by twice array indexing of the destination IP of the packet data, and then eqID_0*ces_num(chunk02)+eqID_1 is calculated to obtain the operation result. The operation result has a mapping relationship with the protection rule, and then the rule corresponding to the packet data can be indexed from the second rule set.

[0158] In the embodiments of the present application, the above embodiments take the 32-bit IPv4 type destination IP as an example. In some embodiments, the RFC hash mapping table pointing to the second rule set can be constructed based on the 128-bit IPv6 type destination IP. For the IPv6 type destination IP, each level of cross product is the recursion of the IPv4 type destination IP, and 7 times of cross product operation will increase the preprocessing time to 7 times, further increasing the time and space complexity of the configuration surface.

[0159] Therefore, the 128-bit IPv6 address is extracted as 32-bit data according to the mask relationship, and the RFC hash mapping table pointing to the second rule set is constructed according to the processing method for the IPv4 type destination IP described above. When receiving the packet data, the 32-bit data of the IPv6 address is extracted according to the same bit position to index the rule in the second rule set, realizing the rule matching of the IPv6 packet data and ensuring the matching efficiency of the packet data.

[0160] It should be noted that the method of constructing the RFC hash mapping table pointing to the second rule set for the IPv6 destination IP is the same as the above-mentioned construction method for the IPv4 destination IP, and will not be described in detail here.

[0161] In step 230, the information corresponding to the packet data is extracted according to the field information defined in the rule, and state transition of the DFA state transition table is performed according to the information, and finally the first rule corresponding to the packet data is indexed. In the embodiment of the present application, the packet data can be any type of packet under IPv4 and IPv6. In the DFA state transition process, the matching difference between IPv4 and IPv6 lies in the different number of DFA state transitions, but the transition mode is the same. The specific transition mode is described above, and will not be repeated here.

[0162] In step 240, the destination IP of the packet data is extracted, and then the destination IP is used as a key to perform 2 array accesses in the RFC hash mapping table pointing to the second rule set, and the eqID_0 and eqID_1 respectively mapped by the high and low 16-bit data of the destination IP are indexed. Then the cross product cesID is obtained through cross product operation, and the eqID mapped by the destination IP is obtained by using the cross product as an index subscript. Finally, the eqID is used as an array subscript to index the rule bitmap information corresponding to the packet data from the second rule set, and the mapping process from the destination IP to the second rule set is completed. Then the rule is matched from the rule bitmap information according to the priority order. Wherein, the packet can be an IPv4 packet or an IPv6 packet, which is not limited here.

[0163] In step 250, after the first rule and the second rule are obtained, the protection rule with high priority is selected from the first rule and the second rule based on the priority of the first rule and the second rule, and then the packet data is processed by the protection rule through "release", "speed limit", "discard", "discard+black", "discard+interrupt connection", "discard+black+interrupt connection" or "ignore" decision processing.

[0164] In the embodiment of the present application, the context data structure management unit of the matching object can freely operate (read and write) the rule configuration of the matching object, such as adding the protection rule to the first rule set or the second rule set, and constructing the DFA state transition table pointing to the first rule set or the RFC hash mapping table pointing to the second rule set, and updating them to the data plane, so as to ensure the real-time performance, accuracy and security of the packet data matching.

[0165] The protection rule of the packet data matching is indexed through the DFA state transition table pointing to the first rule set and the RFC hash mapping table pointing to the second rule set, so as to realize the rule matching of the packet data of any protocol type under IPv4 / IPv6. At the same time, different packet feature fields are supported according to the rule set, including the exact matching type field, the range matching type field, the mask matching type field, the wildcard type field, and the matching of any binary data or ASCII character type data, so as to ensure the flexibility of the packet data matching rule.

[0166] Supporting user-defined packet data characteristic matching rule field, improving packet data matching rule scalability, and supporting packet data characteristic field negation matching operation.

[0167] The tenant-based context data structure management unit realizes mutual isolation of different tenant rule sets in the control plane and the data plane, guarantees that packet data rule configuration and data plane matching of each tenant do not interfere with each other, and improves tenant data security.

[0168] Based on the same technical concept, Figure 12 An exemplary structure diagram of a packet data matching device provided by the embodiment of the application is shown, which can execute the flow of the packet data matching method.

[0169] As Figure 12 shown, the device specifically includes:

[0170] The receiving module 1210 is configured to receive packet data; the packet data includes a matching object;

[0171] The processing module 1220 is configured to index a first rule set and a second rule set corresponding to the matching object according to the matching object; the first rule set is a rule subset indexed by a DFA state transition table based on an array form continuous memory space; and the second rule set is a rule subset indexed by an RFC hash mapping table based on a rule priority bitmap form.

[0172] The processing module 1220 is further configured to match a first rule of the packet data from the first rule set;

[0173] The processing module 1220 is further configured to match a second rule of the packet data from the second rule set;

[0174] The processing module 1220 is further configured to select a high-priority rule from the first rule and the second rule according to the priority, and process the packet data.

[0175] Optionally, the receiving module 1210 is further configured to:

[0176] Before receiving the packet data, receive a rule configuration based on the matching object;

[0177] The processing module 1220 is further configured to:

[0178] For any protection rule in the rule configuration, if the protection rule does not include a field of a negation matching flag, the protection rule is classified into a DFA state transition table constructed based on the first rule set;

[0179] If the protection rule includes at least one field of a negation matching flag, the protection rule is classified into an RFC hash mapping table constructed based on the second rule set.

[0180] Optionally, the processing module 1220 is specifically configured to:

[0181] For any protection rule, a rule field of the protection rule is calculated;

[0182] A node is determined according to the rule field;

[0183] The node is added to a rule tree preset based on the DFA algorithm;

[0184] The rule tree is compressed in an array form, and a first rule set indexed by a DFA state transition table of a continuous memory space in the array form is obtained.

[0185] Optionally, the processing module 1220 is specifically configured to:

[0186] A hash value of a protection rule of the matching object is calculated;

[0187] Based on an RFC algorithm, a second rule set indexed by an RFC hash mapping table in a rule priority bitmap form is obtained according to an identifier of the matching object.

[0188] Based on the same technical concept, the embodiments of the present application further provide a computer device, comprising:

[0189] A memory for storing program instructions;

[0190] A processor for invoking the program instructions stored in the memory to execute the above-mentioned packet data matching method according to obtained program.

[0191] Based on the same technical concept, the embodiments of the present application further provide a computer readable storage medium, which stores computer executable instructions, and the computer executable instructions are used for making a computer execute the above-mentioned packet data matching method.

[0192] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt a computer program product in the form of one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.

[0193] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0194] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0195] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 Figure 1 one or more flow or blocks

[0196] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A method of matching packet data, characterized by, include: Receive message data; the message data includes a matching object; The first rule set and the second rule set corresponding to the matching object are indexed according to the matching object index; the first rule set is a subset of rules pointed to by the DFA state transition table index in the contiguous memory space in array form; the second rule set is a subset of rules pointed to by the RFC hash map index in the form of rule priority bitmap; the first rule set and the second rule set are classified according to whether the protection rule contains a field with an inverted flag; Match the first rule of the message data from the first rule set; Match the second rule of the message data from the second rule set; The message data is processed by selecting the higher priority rule from the first rule and the second rule according to the priority.

2. The method of claim 1, wherein, Before receiving message data, it also includes: Receive rule configurations based on the matching object; For any protection rule in the rule configuration, if the protection rule does not include a field for negating the matching flag, then the protection rule is classified into the DFA state transition table built based on the first rule set; If the protection rule includes at least one field that negates a matching flag, then it is classified into the RFC hash map table constructed by the protection rule based on the second rule set.

3. The method of claim 2, wherein, Based on the aforementioned protection rules, a first rule set is constructed, including: For any given protection rule, calculate the rule field of that protection rule; Nodes are determined based on the rule fields; Add the node to the rule tree pre-defined based on the DFA algorithm; The rule tree is compressed in array form to obtain the first rule set pointed to by the DFA state transition table index in contiguous memory space in array form.

4. The method of claim 2, wherein, A second rule set is constructed based on the aforementioned protection rules, including: Calculate the hash value of the protection rule for the matched object; Based on the RFC algorithm, a second rule set is obtained by indexing the RFC hash map table in the form of a rule priority bitmap, according to the identifier of the matching object.

5. A packet data matching apparatus characterized by comprising: include: A receiving module is used to receive message data; the message data includes a matching object. The processing module is used to index the first rule set and the second rule set corresponding to the matching object based on the matching object; the first rule set is a subset of rules pointed to by the DFA state transition table index in the contiguous memory space in array form; the second rule set is a subset of rules pointed to by the RFC hash map index in the form of rule priority bitmap; the first rule set and the second rule set are classified according to whether the protection rule contains a field with an inverted flag; Match the first rule of the message data from the first rule set; Match the second rule of the message data from the second rule set; The message data is processed by selecting the higher priority rule from the first rule and the second rule according to the priority.

6. The apparatus as claimed in claim 5, characterized in that, The receiving module is also used for: Before receiving message data, receive rule configurations based on matching objects; The processing module is also used for: For any protection rule in the rule configuration, if the protection rule does not include a field for negating the matching flag, then the protection rule is classified into the DFA state transition table built based on the first rule set; If the protection rule includes at least one field that negates a matching flag, then it is classified into the RFC hash map table constructed by the protection rule based on the second rule set.

7. The apparatus as claimed in claim 5, characterized in that, The processing module is specifically used for: For any given protection rule, calculate the rule field of that protection rule; Nodes are determined based on the rule fields; Add the node to the rule tree pre-defined based on the DFA algorithm; The rule tree is compressed in array form to obtain the first rule set pointed to by the DFA state transition table index in contiguous memory space in array form.

8. The apparatus as claimed in claim 5, characterized in that, The processing module is specifically used for: Calculate the hash value of the protection rule for the matched object; Based on the RFC algorithm, a second rule set is obtained by indexing the RFC hash map table in the form of a rule priority bitmap, according to the identifier of the matching object.

9. A computer device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the method according to any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing a computer to perform the method according to any one of claims 1 to 4.

Images