A method, device, system, and medium for implementing overspeed alarms for specific messages.

Abstract

This application discloses a method, device, system, and medium for implementing overspeed alarms for specific packets, to solve the following technical problem: how to achieve timely detection of specific packet traffic without wasting CPU computing resources. The method includes: the CPU generating an ACL (Access Control List) issuance command based on user configuration instructions and issuing the ACL issuance command to the switching chip; upon receiving packet traffic, the switching chip, based on the Access Control List (ACL) determined by the ACL issuance command, determines whether the packet traffic is overspeeding, and redirects the overspeeding packet traffic to a preset internal loopback interface; the internal loopback interface triggers an interrupt based on the overspeeding packet traffic and uploads the generated interrupt information to the CPU, enabling the CPU to issue an overspeed alarm based on the interrupt information. This application achieves timely detection of overspeeding of specific packet traffic without wasting CPU computing resources through the above method.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a method, device, system and medium for implementing overspeed alarm for specific messages. Background Technology

[0002] In today's rapidly developing internet era, network security is of paramount importance. To protect core networks and critical equipment from cyberattacks, certain protective measures are essential. Implementing traffic rate limiting on the IP addresses of core networks and critical equipment on switches, and taking appropriate action when traffic reaches the limit, is necessary. Since data traffic on switches is directly forwarded via the switching chip without passing through the CPU, the CPU would typically need to intermittently retrieve relevant statistics and calculate the average rate over the intervals to detect excessive traffic flow. This process is both resource-intensive and not real-time.

[0003] Therefore, how to achieve timely detection of specific packet traffic without wasting CPU computing resources has become an urgent technical problem to be solved. Summary of the Invention

[0004] This application provides a method, device, system, and medium for implementing overspeed alarms for specific packets, in order to solve the following technical problem: how to achieve timely detection of overspeed of specific packet traffic without wasting CPU computing resources.

[0005] In a first aspect, embodiments of this application provide a method for implementing overspeed alarm for specific packets, characterized in that the method includes: a CPU generating an ACL issuance instruction according to a user configuration instruction and issuing the ACL issuance instruction to a switching chip; upon receiving packet traffic, the switching chip, based on the access control list ACL determined by the ACL issuance instruction, determines whether the packet traffic is overspeeding and redirects the overspeeding packet traffic in the packet traffic to a preset internal loopback port; the internal loopback port triggers an interrupt based on the overspeeding packet traffic and uploads the generated interrupt information to the CPU, so that the CPU can issue an overspeed alarm based on the interrupt information.

[0006] In one implementation of this application, after the Access Control List (ACL) is sent to the switching chip, the method further includes: the switching chip writes an interface according to a preset ACL sending instruction, and after receiving the ACL sending instruction, reads the ACL sending instruction to determine the Access Control List (ACL) according to the ACL rules in the ACL sending instruction; and globally fixes the Access Control List (ACL).

[0007] In one implementation of this application, after globally fixing the Access Control List (ACL), the method further includes: disabling the ACL triggering function of the internal loopback interface; setting the internal loopback interface to allow all VLAN tag packets to pass through; and enabling interrupt reporting for packets with unknown source MAC addresses.

[0008] In one implementation of this application, before redirecting the overspeed packet traffic in the packet traffic to a preset internal loopback interface, the method further includes: determining the target VLAN label corresponding to the overspeed packet traffic in the Access Control List (ACL), and determining whether the overspeed packet traffic contains a source VLAN label; if it is determined that each packet in the overspeed packet traffic contains a source VLAN label, replacing the source VLAN label with the target VLAN label; if it is determined that each packet in the overspeed packet traffic does not contain a source VLAN label, adding the target VLAN label to each packet in the overspeed packet traffic.

[0009] In one implementation of this application, the interruption information includes: target VLAN label and address attribute information corresponding to packet traffic; wherein, the address attribute information includes at least: source MAC address.

[0010] In one implementation of this application, after uploading the generated interrupt information to the CPU, the method further includes: the CPU generating alarm information based on the interrupt information and sending the alarm information to the monitoring server; and closing the message traffic transmission port corresponding to the source device.

[0011] In one implementation of this application, the overspeed packet traffic is the portion of the packet traffic that exceeds the rate limit value determined based on the preset rate limit value in the Access Control List (ACL).

[0012] Secondly, embodiments of this application also provide a device for implementing overspeed alarms for specific packets, characterized in that the device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: generate an ACL distribution instruction according to a user configuration instruction, and distribute the ACL distribution instruction to a switching chip; upon receiving packet traffic, the switching chip determines whether the packet traffic is overspeeding based on the Access Control List (ACL) determined by the ACL distribution instruction, and redirects the overspeeding packet traffic in the packet traffic to a preset internal loopback port; the internal loopback port triggers an interrupt based on the overspeeding packet traffic, and uploads the generated interrupt information to the CPU, so that the CPU performs an overspeed alarm based on the interrupt information.

[0013] Thirdly, this application also provides a system for implementing overspeed alarms for specific packets, characterized in that the system includes: a CPU and a switching chip; the CPU is used to generate ACL issuance instructions according to user configuration instructions and issue the ACL issuance instructions to the switching chip; the switching chip is used to determine whether the packet traffic is overspeeding based on the access control list ACL determined by the ACL issuance instructions when receiving packet traffic, and to redirect the overspeeding packet traffic in the packet traffic to a preset internal loopback port; the switching chip is also used to trigger an interrupt based on the overspeeding packet traffic on its internal loopback port and upload the generated interrupt information to the CPU, so that the CPU can issue an overspeed alarm based on the interrupt information.

[0014] Fourthly, this application also provides a non-volatile computer storage medium for implementing overspeed alarms for specific messages, storing computer-executable instructions. The computer-executable instructions are configured as follows: the CPU generates an ACL (Access Control List) issuance instruction based on a user configuration instruction and issues the ACL issuance instruction to the switching chip; upon receiving message traffic, the switching chip determines whether the message traffic is overspeeding based on the Access Control List (ACL) determined by the ACL issuance instruction, and redirects the overspeeding message traffic to a preset internal loopback port; the internal loopback port triggers an interrupt based on the overspeeding message traffic and uploads the generated interrupt information to the CPU, enabling the CPU to issue an overspeed alarm based on the interrupt information.

[0015] This application provides a method for hardware interrupt reporting of overspeed events in specific packet traffic by configuring the switching chip and combining the characteristics of the switching chip's pipeline ACL and MAC table. The CPU only needs to process the overspeed event when it receives it, and does not need to pay attention to the switching chip's status at other times. Moreover, this hardware interrupt reporting method is much faster than the CPU's intermittent active acquisition method, and can detect anomalies more quickly. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 A flowchart illustrating a method for implementing overspeed alarm for a specific message, provided in an embodiment of this application;

[0018] Figure 2 A flowchart of ACL processing is provided for an embodiment of this application;

[0019] Figure 3 This application provides a schematic diagram of the internal structure of a device for implementing overspeed alarms for specific messages.

[0020] Figure 4 This is a schematic diagram of the internal structure of a system for implementing overspeed alarms for specific messages, provided as an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] This application provides a method, device, system, and medium for implementing overspeed alarms for specific packets, in order to solve the following technical problem: how to achieve timely detection of overspeed of specific packet traffic without wasting CPU computing resources.

[0023] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0024] Figure 1 This is a flowchart illustrating a method for implementing overspeed alarms for specific messages, provided as an embodiment of this application. Figure 1 As shown in the figure, an embodiment of this application provides a method for implementing overspeed alarm for a specific message, which specifically includes the following steps:

[0025] Step 101: The CPU generates an ACL distribution instruction based on the user configuration instruction and distributes the ACL distribution instruction to the switching chip.

[0026] In one embodiment of this application, to implement overspeed alarms for specific packets, it is first necessary to configure the switch, setting packet traffic matching conditions, rate limiting rates, and actions to be taken after the packet traffic exceeds the limit. The CPU generates corresponding ACL instructions based on the user-configured commands. For example, the switch configuration might include: matching the destination IP 1.2.3.4, setting the rate limiting rate to 10Mbps, and setting actions to be taken after exceeding the limit such as issuing an alarm and shutting down the corresponding packet traffic transmission port of the source device.

[0027] In one embodiment of this application, after generating the ACL sending command, the CPU determines the ACL sending command writing interface of the switching chip and sends the ACL sending command to the switching chip through the ACL sending command writing interface.

[0028] Furthermore, after the Access Control List (ACL) is sent to the switching chip, the switching chip, upon receiving the ACL sending instruction, reads the instruction and determines the ACL based on the ACL rules within it; then, the ACL is globally persisted. It should be noted that the purpose of globally persisting the ACL is to enable the switching chip to determine the rate of a packet traffic received from a source device as a whole, rather than judging it based on a single interface. For example, if a packet traffic segment uploaded by source device A has a rate of 20 Mbps, and this packet traffic matches an ACL entry specifying a rate limit of 10 Mbps, since this packet traffic is forwarded through the switching chip's four forwarding interfaces, with each forwarding interface handling 5 Mbps packets, the rate exceeding the limit would not be detected without globally persisting the ACL. Therefore, in this embodiment, after determining the ACL, the ACL is globally persisted within the switching chip.

[0029] In one embodiment of this application, after globally fixing the Access Control List (ACL), it is also necessary to disable the ACL triggering function of the internal loopback interface; configure the internal loopback interface to allow all VLAN tag packets to pass through; and configure the interrupt reporting of packets with unknown source MAC addresses to be enabled.

[0030] Step 102: When the switching chip receives packet traffic, it determines whether the packet traffic is overspeeding based on the access control list ACL determined by the ACL issuance instruction, and redirects the overspeed packet traffic in the packet traffic to the preset internal loopback port.

[0031] In one embodiment of this application, after the Access Control List (ACL) is globally fixed in the switching chip, when the switching chip receives packet traffic, it determines whether the packet traffic exceeds the speed limit based on the preset rate limit value in the ACL, and if it is determined that the packet traffic exceeds the speed limit, it determines that the portion of the packet traffic exceeding the rate limit value is the overspeed packet traffic.

[0032] Furthermore, the target VLAN label corresponding to the overspeed packet traffic is determined in the Access Control List (ACL), and it is determined whether the overspeed packet traffic contains a source VLAN label. If it is determined that each packet in the overspeed packet traffic contains a source VLAN label, the source VLAN label is replaced with the target VLAN label. If it is determined that each packet in the overspeed packet traffic does not contain a source VLAN label, the target VLAN label is added to each packet in the overspeed packet traffic.

[0033] Furthermore, the overspeed packet traffic in the packet traffic is redirected to the preset internal loopback port.

[0034] Step 103: The internal loopback port triggers an interrupt based on the overspeed message traffic and uploads the generated interrupt information to the CPU so that the CPU can issue an overspeed alarm based on the interrupt information.

[0035] In one embodiment of this application, after receiving overspeed packet traffic at the internal loopback interface, an interrupt reporting function is triggered based on the set source MAC unknown packet, interrupt information is generated, and the generated interrupt information is uploaded to the CPU. It should be noted that the interrupt information in this application includes: target VLAN tag and address attribute information corresponding to the packet traffic; wherein, the address attribute information includes at least: the source MAC address.

[0036] In one embodiment of this application, after the CPU receives an interrupt, it determines which ACL entry in the Access Control List (ACL) the overspeed packet traffic hits based on the target VLAN tag in the interrupt information. Figure 2 The present application provides an ACL processing flowchart, the specific process of which is shown in Figure 2.

[0037] Furthermore, the CPU generates alarm information based on the interrupt information and sends the alarm information to the alarm server; and closes the message traffic transmission port corresponding to the source device.

[0038] The above are embodiments of the method proposed in this application. Based on the same inventive concept, embodiments of this application also provide a device for implementing overspeed alarm for specific messages, the structure of which is as follows: Figure 2 As shown.

[0039] Figure 3 This is a schematic diagram of the internal structure of a device for implementing overspeed alarms for specific messages, provided as an embodiment of this application. Figure 3 As shown, the device includes:

[0040] At least one processor 301;

[0041] And a memory 302 that is communicatively connected to at least one processor;

[0042] The memory 302 stores instructions executable by at least one processor, which are executed by at least one processor 301 to enable at least one processor 301 to:

[0043] The CPU generates ACL distribution instructions based on the user configuration instructions and distributes the ACL distribution instructions to the switching chip;

[0044] When the switching chip receives packet traffic, it determines whether the packet traffic is overspeeding based on the access control list ACL determined by the ACL issuance command, and redirects the overspeeding packet traffic in the packet traffic to the preset internal loopback interface;

[0045] The internal loopback port triggers an interrupt based on the overspeed message traffic and uploads the generated interrupt information to the CPU so that the CPU can issue an overspeed alarm based on the interrupt information.

[0046] Based on the same inventive concept, this application also provides a system for implementing overspeed alarm for specific messages, the structure of which is as follows: Figure 3 As shown.

[0047] Figure 4 This is a schematic diagram of the internal structure of a system for implementing overspeed alarms for specific messages, provided as an embodiment of this application. Figure 4 As shown, system 400 includes: CPU 401 and switching chip 402.

[0048] In one embodiment of this application, CPU 401 is used to generate ACL issuance instructions according to user configuration instructions and issue the ACL issuance instructions to the switching chip; the switching chip 402 is used to determine whether the packet traffic is speeding based on the access control list ACL determined by the ACL issuance instructions when receiving packet traffic, and redirect the speeding packet traffic in the packet traffic to a preset internal loopback port; the switching chip 402 is also used to trigger an interrupt based on the speeding packet traffic on its internal loopback port, and upload the generated interrupt information to the CPU, so that the CPU can issue an overspeed alarm based on the interrupt information.

[0049] Some embodiments of this application provide corresponding to Figure 1 A non-volatile computer storage medium for implementing overspeed alarms for specific messages, storing computer-executable instructions, wherein the computer-executable instructions are configured as follows:

[0050] The CPU generates ACL distribution instructions based on the user configuration instructions and distributes the ACL distribution instructions to the switching chip;

[0051] When the switching chip receives packet traffic, it determines whether the packet traffic is overspeeding based on the access control list ACL determined by the ACL issuance command, and redirects the overspeeding packet traffic in the packet traffic to the preset internal loopback interface;

[0052] The internal loopback port triggers an interrupt based on the overspeed message traffic and uploads the generated interrupt information to the CPU so that the CPU can issue an overspeed alarm based on the interrupt information.

[0053] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for IoT devices and media are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0054] The systems, media, and methods provided in this application are one-to-one correspondences. Therefore, the systems and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the systems and media will not be repeated here.

[0055] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0056] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0057] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0058] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0059] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0060] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0061] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0062] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0063] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for implementing overspeed alarm for specific messages, characterized in that, The method includes: The CPU generates an ACL distribution instruction based on the user configuration instructions and distributes the ACL distribution instruction to the switching chip. When the switching chip receives packet traffic, it determines whether the packet traffic is overspeeding based on the access control list ACL determined by the ACL issuance instruction, and redirects the overspeeding packet traffic in the packet traffic to a preset internal loopback port. The internal loopback port triggers an interrupt based on the overspeed message traffic and uploads the generated interrupt information to the CPU, so that the CPU can issue an overspeed alarm based on the interrupt information.

2. The method for implementing overspeed alarm for a specific message according to claim 1, characterized in that, After the Access Control List (ACL) is sent to the switching chip, the method further includes: After receiving the ACL issuance instruction through the interface according to the preset ACL issuance instruction, the switching chip reads the ACL issuance instruction to determine the access control list ACL based on the ACL rules in the ACL issuance instruction. Make the Access Control List (ACL) globally persistent.

3. The method for implementing overspeed alarm for a specific message according to claim 2, characterized in that, After globally persisting the Access Control List (ACL), the method further includes: Disable the access control list (ACL) triggering function of the internal loopback interface; Configure the internal loopback port to allow all VLAN tag packets to pass through, and enable interrupt reporting for packets with unknown source MAC addresses.

4. The method for implementing overspeed alarm for a specific message according to claim 1, characterized in that, Before redirecting the overspeed packet traffic in the packet traffic to a preset internal loopback interface, the method further includes: Determine the target VLAN label corresponding to the overspeed packet traffic in the access control list (ACL), and determine whether the overspeed packet traffic contains a source VLAN label; If it is determined that each packet in the overspeed packet traffic contains the source VLAN label, the source VLAN label is replaced with the target VLAN label; If it is determined that none of the packets in the overspeed packet traffic contain the source VLAN label, the target VLAN label is added to each packet in the overspeed packet traffic.

5. A method for implementing overspeed alarm for a specific message according to claim 4, characterized in that, The interruption information includes: the target VLAN label and the address attribute information corresponding to the packet traffic; wherein, the address attribute information includes at least: the source MAC address.

6. A method for implementing overspeed alarm for a specific message according to claim 1, characterized in that, After uploading the generated interrupt information to the CPU, the method further includes: The CPU generates an alarm message based on the interrupt information and sends the alarm message to the monitoring server; and, Close the packet traffic transmission port of the source device corresponding to the overspeed packet traffic.

7. A method for implementing overspeed alarm for a specific message according to claim 1, characterized in that, The overspeed packet traffic is the portion of the packet traffic that exceeds the rate limit value, determined based on the preset rate limit value in the access control list (ACL).

8. A device for implementing overspeed alarm for specific messages, characterized in that, The device includes: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: The CPU generates an ACL distribution instruction based on the user configuration instructions and distributes the ACL distribution instruction to the switching chip. When the switching chip receives packet traffic, it determines whether the packet traffic is overspeeding based on the access control list ACL determined by the ACL issuance instruction, and redirects the overspeeding packet traffic in the packet traffic to a preset internal loopback port. The internal loopback port triggers an interrupt based on the overspeed message traffic and uploads the generated interrupt information to the CPU, so that the CPU can issue an overspeed alarm based on the interrupt information.

9. A system for implementing overspeed alarm for specific messages, characterized in that, The system includes: a CPU and a switching chip; The CPU is used to generate ACL distribution instructions according to user configuration instructions, and distribute the ACL distribution instructions to the switching chip; The switching chip is used to determine whether the packet traffic is overspeeding based on the access control list ACL determined by the ACL issuance instruction when receiving packet traffic, and to redirect the overspeeding packet traffic in the packet traffic to a preset internal loopback port; The switching chip is also used to trigger an interrupt based on the overspeed message traffic through its internal loopback port, and upload the generated interrupt information to the CPU so that the CPU can issue an overspeed alarm based on the interrupt information.

10. A non-volatile computer storage medium for implementing overspeed alarms for specific messages, storing computer-executable instructions, characterized in that, The computer-executable instructions are set as follows: The CPU generates an ACL distribution instruction based on the user configuration instructions and distributes the ACL distribution instruction to the switching chip. When the switching chip receives packet traffic, it determines whether the packet traffic is overspeeding based on the access control list ACL determined by the ACL issuance instruction, and redirects the overspeeding packet traffic in the packet traffic to a preset internal loopback port. The internal loopback port triggers an interrupt based on the overspeed message traffic and uploads the generated interrupt information to the CPU, so that the CPU can issue an overspeed alarm based on the interrupt information.

Images