A traffic parallel distribution device based on policy control

Abstract

The present invention proposes a traffic parallel distribution device based on policy control, which issues policies through a policy issuing component to forward designated traffic to a business process. The system includes a policy control component, and a deep message detection component and a policy issuing component respectively connected to the policy control component. The policy issuing component issues a policy group through an API interface provided by a system composed of a deep message detection component and a policy control component. The issued policy issuing component includes an interface group, a six-tuple policy, an action corresponding to the policy group, and a network card bound to the policy group. The present invention accurately identifies specific traffic through a traffic identification strategy, and distributes it to the business process in parallel with zero copy. Compared with serial processing, it can improve concurrent processing capabilities, and the in-and-out policy fusion decision execution processing is different from the traditional unidirectional policy processing method. The unidirectional policy only matches and filters the data message once, and then forwards it to the corresponding interface.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a traffic parallel distribution device based on policy control. Background Art

[0002] In the prior art, flow valves are set according to server names and request processing types to control the upper limit of the number of concurrent flows, and distributed distribution of flows is achieved at the application layer level through functions such as data publishing / subscription, load balancing, and naming services.

[0003] Controlling the upper limit of traffic concurrency through flow valves only limits the number of concurrent flows received by the business server. For a specific server, some concurrent flows are not the processing target flows of the server, and cannot be precisely controlled. Traditional concurrent devices process flows through distributed technology processing at the application layer, and the relevant information of the network layer and the transport layer is isolated, so this type of control is not precise enough. Summary of the invention

[0004] The technical problem to be solved by the present invention is to address the defects of the background technology. The present invention uses a policy-controlled parallel traffic distribution device to extract information from messages, form a six-tuple strategy for matching control, accurately control messages, and process messages concurrently, thereby improving the efficiency of business processing.

[0005] The present invention adopts the following technical solutions to solve the above technical problems:

[0006] A traffic parallel distribution device based on policy control, which issues policies through a policy issuing component to forward specified traffic to a business process, wherein the system includes a policy control component 15, and a deep message inspection component 14 and a policy issuing component 13 respectively connected to the policy control component 15;

[0007] The policy issuing component 13 issues the policy group through the API interface provided by the system composed of the deep packet inspection component 14 and the policy control component 15. The issued policy issuing component 13 includes an interface group, a six-tuple policy, an action corresponding to the policy group, and a network card bound to the policy group;

[0008] The policy control component 15 includes an inbound policy group, an outbound policy group and a distribution interface group;

[0009] The policy control component 15 receives the policy issued by the policy issuing component 13, and the policy issued by the policy issuing component 13 includes an outbound policy group and an inbound policy group; the policy control component 15 forwards and copies the data message to the interface in the interface group by matching the data message with the policy group issued by the policy issuing component;

[0010] The inbound policy group strategy consists of five-tuple information, application ID, inbound interface bound to the policy, post-action corresponding to the policy group is multicast forwarding, and distribution interface group for multicast forwarding according to the hit policy;

[0011] The outbound policy group of the inbound interface is composed of five-tuple information, application ID, outbound interface bound by the policy, and the post-action corresponding to the policy is discard;

[0012] The input interface and the output interface are more than one, the distribution interface group is more than one, and the output interface is one or more interfaces of the distribution interface group;

[0013] The application ID is a unique identification ID provided by the deep packet inspection component 14 for parsing traffic.

[0014] Preferably, the method further comprises the following steps:

[0015] Step 0: Issue an inbound policy, set the five-tuple information, corresponding application ID and distribution interface group that need to be multicast distributed; the action corresponding to the policy in the inbound policy group is multicast distribution; issue an outbound policy group, which is bound to the interface in the distribution interface group, and sets the five-tuple information, application ID and outbound interface that need to be filtered, and the post-action of the outbound policy group is discard;

[0016] Step 1: When the inbound interface receives traffic, the deep packet parsing component parses the application ID corresponding to the packet and passes it to the inbound policy group and the outbound policy group;

[0017] Step 2: Get the application ID and five-tuple information parsed in step 1 to form a six-tuple information. Match it with the five-tuple information in the message;

[0018] Step 3: Determine whether the policy in the inbound policy group is matched. If matched, execute step 4; if not matched, execute step 10;

[0019] Step 4: Update the interface status in the distribution interface group regularly to ensure that the interface status in the distribution interface group is always up;

[0020] Step 5: If a policy in the inbound policy group is hit, the complete information of the message is copied by zero copy, and the number of copies is the number of interfaces in the distribution interface group minus 1;

[0021] Step 6: Get the application ID and five-tuple information parsed in step 1 to form a six-tuple information. Match it with the five-tuple information in the message;

[0022] Step 7: Determine whether the policy in the outbound policy group is matched. If matched, execute step 4; if not matched, execute step 10;

[0023] Step 8: If a policy in the outbound policy group is matched, the interface bound to the policy in the distribution interface group is deleted;

[0024] Step 9: Distribute the message and the copied message according to the interfaces in the distribution interface group;

[0025] Step 10: The business process concurrently processes the received data packets;

[0026] Step 11: discard the message;

[0027] Step 12, end.

[0028] Compared with the prior art, the present invention adopts the above technical solution and has the following beneficial effects:

[0029] 1. The present invention provides a policy-controlled parallel traffic distribution device, which performs precise policy matching and forwarding through six-tuples at the network layer and the transport layer.

[0030] 2. The present invention provides a policy-controlled traffic parallel distribution device, which accurately identifies specific traffic through traffic identification strategies, and distributes it to business processes in parallel with zero copy, which can improve concurrent processing capabilities compared to serial processing.

[0031] 3. The invention provides a traffic parallel distribution device based on policy control, which performs inbound and outbound policy fusion decision execution processing, which is different from the traditional unidirectional policy processing method. The unidirectional policy only performs a matching filter on the data message once, and then forwards it to the corresponding interface.

[0032] 4. The present invention provides a policy-controlled traffic parallel distribution device, which realizes common needs such as policy control, shields underlying complex technologies, and has a standard expansion interface. It can easily integrate the business of various confidentiality systems, quickly form a competitive overall solution, and gradually achieve the unification of development models, communication interfaces, operation and maintenance, and operational support.

[0033] 5. The present invention provides a policy-controlled parallel traffic distribution device, which controls the behavior of the policy control component in a WEB / CLI manner through a standardized interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 It is a schematic diagram of the composition of the present invention;

[0036] Figure 2 Distribute software flow chart for policy control. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] See also Figure 1 The present invention discloses a traffic parallel distribution device based on policy control. The system issues policies through a policy issuing component to forward designated traffic to a business process. The system includes a policy control component 15, and a deep packet inspection component 14 and a policy issuing component 13 respectively connected to the policy control component 15.

[0039] The policy issuing component issues a policy group through an API interface provided by a system composed of a deep packet inspection component and a policy control component. The issued policy group includes an interface group, a six-tuple policy, an action corresponding to the policy group, and a network card bound to the policy group.

[0040] The sextuple can achieve accurate matching of data flows at the network layer, transport layer, and application layer.

[0041] The policy control component 15 includes an inbound policy group, an outbound policy group and a distribution interface group.

[0042] The policy control component receives the policy issued by the policy issuing component 13, and the policy issued by the policy issuing component 13 includes an outbound policy group and an inbound policy group; the policy control component matches the data message with the policy group issued by the policy issuing component, and forwards and copies the data message to the interface in the interface group. The inbound policy group policy consists of five-tuple information (source IP, source port, destination IP, destination port, protocol number), application ID, inbound interface bound to the policy, the post-action corresponding to the policy group is multicast forwarding, and the distribution interface group that hits the policy for multicast forwarding. The inbound interface, the outbound policy group consists of five-tuple information (source IP, source port, destination IP, destination port, protocol number), application ID. The outbound interface bound to the policy, and the post-action corresponding to the policy is discard. The inbound interface and the outbound interface can be one or more. The distribution interface group can be one or more. The outbound interface is one or more interfaces of the distribution interface group;

[0043] The application id is a unique identification id provided by the deep packet inspection component 14 for analyzing the traffic. The deep packet inspection component is a deep inspection technology based on data packets, which performs deep inspection on different network application layer loads and determines the legitimacy of the message by inspecting the payload of the message.

[0044] See also Figure 2 , the following combination Figure 2 A traffic parallel distribution device based on policy control using the above system is introduced, comprising the following steps:

[0045] Step 0: Send the inbound policy, set the five-tuple information, application ID and distribution interface group that need to be multicast distributed. The action corresponding to the policy in the inbound policy group is multicast distribution. Send the outbound policy group, which is bound to the interface in the distribution interface group, and sets the five-tuple information, application ID and outbound interface that need to be filtered. The post-action of the outbound policy group is discard.

[0046] Step 1: When the inbound interface receives traffic, the deep packet parsing component parses the application ID corresponding to the packet and passes it to the inbound policy group and the outbound policy group.

[0047] Step 2: Get the application ID and five-tuple information parsed in step 1 to form a six-tuple information, and match it with the five-tuple information in the message.

[0048] Step 3: Determine whether the policy in the inbound policy group is matched. If matched, execute step 4; if not matched, execute step 10.

[0049] Step 4: Update the interface status in the distribution interface group regularly to ensure that the interface status in the distribution interface group is always up.

[0050] Step 5: If a policy in the inbound policy group is hit, the complete information of the message is replicated in zero copy mode, and the number of copies is the number of interfaces in the distribution interface group minus 1.

[0051] Step 6: Get the application ID and five-tuple information parsed in step 1 to form a six-tuple information, and match it with the five-tuple information in the message.

[0052] Step 7: Determine whether the policy in the outbound policy group is matched. If matched, execute step 4; if not matched, execute step 10.

[0053] Step 8: If the policy in the outbound policy group is matched, the interface bound to the policy in the distribution interface group is deleted. Step 9: The message and the copied message are distributed according to the interfaces in the distribution interface group.

[0054] Step 10: The business process concurrently processes the received data packets.

[0055] Step 11: discard the message.

[0056] Step 12, end.

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A traffic parallel distribution device based on policy control, characterized in that: The policy is issued by the policy issuing component to forward the specified traffic to the business process. The device includes a policy control component 15, and a deep message inspection component 14 and a policy issuing component 13 respectively connected to the policy control component 15; The policy issuing component 13 issues the policy group through the API interface provided by the system composed of the deep packet inspection component 14 and the policy control component 15. The issued policy issuing component 13 includes an interface group, a six-tuple policy, an action corresponding to the policy group, and a network card bound to the policy group; The policy control component 15 includes an inbound policy group, an outbound policy group and a distribution interface group; The policy control component 15 receives the policy issued by the policy issuing component 13, and the policy issued by the policy issuing component 13 includes an outbound policy group and an inbound policy group; the policy control component 15 forwards and copies the data message to the interface in the interface group by matching the data message with the policy group issued by the policy issuing component; The inbound policy group strategy consists of five-tuple information, application ID, inbound interface bound to the policy, post-action corresponding to the policy group is multicast forwarding, and distribution interface group for multicast forwarding according to the hit policy; The outbound policy group of the inbound interface is composed of five-tuple information, application ID, outbound interface bound by the policy, and the post-action corresponding to the policy is discard; The input interface and the output interface are more than one, the distribution interface group is more than one, and the output interface is one or more interfaces of the distribution interface group; The application ID is a unique identification ID provided by the deep packet inspection component 14 for parsing traffic.

2. A traffic parallel distribution device based on policy control according to claim 1, characterized in that: The following steps are also included: Step 0: Issue an inbound policy, set the five-tuple information, corresponding application ID and distribution interface group that need to be multicast distributed; the action corresponding to the policy in the inbound policy group is multicast distribution; issue an outbound policy group, which is bound to the interface in the distribution interface group, and sets the five-tuple information, application ID and outbound interface that need to be filtered, and the post-action of the outbound policy group is discard; Step 1: When the inbound interface receives traffic, the deep packet parsing component parses the application ID corresponding to the packet and passes it to the inbound policy group and the outbound policy group; Step 2: Get the application ID and five-tuple information parsed in step 1, form a six-tuple information, and match it with the five-tuple information in the message; Step 3: Determine whether the policy in the inbound policy group is matched. If matched, execute step 4; if not matched, execute step 10. Step 4: Update the interface status in the distribution interface group regularly to ensure that the interface status in the distribution interface group is always up; Step 5: If a policy in the inbound policy group is hit, the complete information of the message is copied by zero copy, and the number of copies is the number of interfaces in the distribution interface group minus 1; Step 6: Get the application ID and five-tuple information parsed in step 1, form a six-tuple information, and match it with the five-tuple information in the message; Step 7: Determine whether the policy in the outbound policy group is matched. If matched, execute step 4; if not matched, execute step 10. Step 8: If a policy in the outbound policy group is matched, the interface bound to the matched outbound policy in the distribution interface group is deleted; Step 9: Distribute the message and the copied message according to the interfaces in the distribution interface group; Step 10: The business process concurrently processes the received data packets; Step 11: discard the message; Step 12, end.

Images