An industrial Internet identification processing method and system based on eBPF technology

Abstract

The present invention discloses an industrial Internet identification processing method and system based on eBPF technology. By using a four-layer BPF hash nested table to store cache data of identification resolution addresses at all levels, when the query end initiates a request for identification resolution, the industrial Internet identification to be resolved entering the industrial Internet identification processing technology will be filtered hierarchically and filtered into corresponding node data, and the data at each level will be compared with the BPF hash table of the corresponding level concurrently. If there is no result in the hit table, an identification resolution query will be initiated to the next level resolution node, and the returned resolution result will be filled in and supplemented into the hash table. The system of this method can be directly deployed to a recursive node or a resolution node of any level. Deploying the eBPF program to the recursive node can reduce intermediate components and reduce the complexity of the system. By simplifying the two-layer cache architecture to one layer, the business process can be simplified and the system performance can be improved.

Description

Technical Field

[0001] The present invention relates to the field of information technology processing, and in particular to an industrial Internet identification processing method and system based on eBPF technology. Background Art

[0002] The Industrial Internet's identity resolution system is a crucial component of the Industrial Internet network and serves as the nerve center supporting its interconnectivity. It consists of identification codes, identification carriers, an identification resolution system, and identification data services. The identification resolution system is a system that can query the network location or related information of a target object based on its identification code. This system uniquely locates and retrieves information about both physical and virtual objects. It is the prerequisite and foundation for the precise integration of global supply chains and enterprise production systems, product lifecycle management, and intelligent services. Its function is similar to the Domain Name System (DNS) in the internet. By establishing a unified identification system, it connects all industrial production factors, including equipment, machinery, and materials. This system connects fragmented data and applications, enabling understanding of data sources, flows, and uses. my country's Industrial Internet identity resolution system consists of an international root node, national top-level nodes, second-level nodes, enterprise nodes, and recursive nodes. Each node at each level must connect with its superior node and allocate identification codes and provide services such as identity registration and resolution. Recursive nodes are key entry points into the identity resolution system. When receiving an identity resolution request, the recursive node will first check whether there is a query result in the local cache. If not, it will query through the answer path returned by the identity resolver, recursively query the address associated with the identity and its related information from top to bottom, return the result and cache it.

[0003] At present, in order to avoid repeated recursive queries from top to bottom in response to the natural tree-like hierarchical structure of industrial Internet identifiers, the existing technical approach is to add an additional cache node before the business process of the recursive node on the basis of the existing identifier resolution system. This cache node will cache the identifiers of the industrial Internet identifier resolution business level by level. In this way, when the identifier to be resolved enters the second-level cache from the first-level cache, and when the identifier after being resolved by the recursive node enters the second-level cache from the recursive node, the cache node control decoder needs to decode the identifier multiple times and store it hierarchically in the cache data of the sequential table, which leads to high repetitiveness of the business process. In the second-level cache, the three sub-tables using the sequential table data storage method lack the nested relationship that reflects the upper and lower architectures of the industrial Internet identifiers. The existing technical solutions will have a certain impact on the system's performance overhead, cache maintenance, cache consistency and scalability limitations. Summary of the Invention

[0004] In order to overcome the above technical defects, the present invention provides an industrial Internet identification processing method and system based on eBPF technology, which can improve the performance of the system.

[0005] In order to solve the above problems, the present invention is implemented according to the following technical solutions:

[0006] In a first aspect, the present invention provides an industrial Internet identification processing method based on eBPF technology, comprising the steps of:

[0007] Compare the identifier to be resolved with the least recently used strategy BPF hash table that has a complete resolution result in the cache to determine whether the identifier to be resolved matches the key in the least recently used strategy BPF hash table. If so, return the identifier resolution result with the value corresponding to the key value that matches the identifier to be resolved. If not, split and filter the identifier to be resolved into the international top-level identifier, the second-level node identifier, the enterprise node identifier, and the product identifier.

[0008] Determine whether the national top-level identifier matches the key of the first-level hash nested table that stores the association between the first-level identifier code and the address information of the national top-level node. If not, query the international root node, add the parsing result returned by the international root node to the first-level hash nested table, and establish a corresponding second-level hash nested table.

[0009] Determine whether the secondary node identifier matches the key of the secondary hash nested table that stores the association between the secondary identifier code and the industry secondary node address information. If not, query the national top-level node, add the parsing result returned by the national top-level node to the secondary hash nested table, and establish a corresponding third-level hash nested table.

[0010] Determine whether the enterprise node identifier matches the key of the third-level hash nested table that stores the association between the third-level identifier code and the enterprise node address information. If not, query the second-level node, add the parsing result returned by the second-level node to the third-level hash nested table, and establish a corresponding fourth-level hash nested table.

[0011] Determine whether the product identification information matches the key of the four-level hash nested table that stores the complete parsing result. If not, query the enterprise node, update the query result returned by the enterprise node into the four-level hash nested table, and return the parsing result to the distributed filter. If so, return the value corresponding to the key in the four-level hash nested table that matches the product identification information as the parsing result to the distributed filter;

[0012] Update the parsing result into the least recently used strategy BPF hash table and return the parsing result to the query end.

[0013] As an improvement to the above solution, the industrial Internet identification processing method based on eBPF technology also includes:

[0014] When the key-value pairs in the least recently used BPF hash table exceed the set value, the key-value pairs that have not been accessed for the longest time in the least recently used BPF hash table are removed.

[0015] As an improvement to the above solution, the industrial Internet identification processing method based on eBPF technology also includes:

[0016] When receiving the identity resolution request from the query end, the user's identity is authenticated according to the BPF hash table that stores the user's authentication information. If the verification key-value pair matches, the user is allowed to use this service. If the verification key-value pair does not match, the user's access is denied and an error code is returned.

[0017] As an improvement to the above solution, the industrial Internet identification processing method based on eBPF technology also includes:

[0018] The querying end IP address is compared with the querying end IP source firewall BPF hash table. If the querying end IP address matches a key in the querying end IP source firewall BPF hash table and the value is 0, the querying end IP is a blacklisted IP and access is denied.

[0019] When the querying end IP address matches a key in the querying end IP source firewall BPF hash table and the value is 1, it means that the IP is a whitelist IP and access is allowed.

[0020] As an improvement to the above solution, the industrial Internet identification processing method based on eBPF technology also includes:

[0021] When the querying IP address does not match any key in the BPF hash table of the querying IP source firewall, the allowOtherIP value in the BPF hash table storing the security policy is determined;

[0022] If the allowOtherIP value is 0, the query client is denied access; if the allowOtherIP value is 1, the query client is allowed access.

[0023] As an improvement to the above solution, the industrial Internet identification processing method based on eBPF technology also includes:

[0024] The address of the accessed port is compared with the port firewall BPF hash table. When the address of the accessed port matches one of the keys in the port firewall BPF hash table and the value is 0, the port is not open and access is denied; when the address of the accessed port matches one of the keys in the port firewall BPF hash table and the value is 1, the port is open and access is allowed.

[0025] As an improvement to the above solution, the industrial Internet identification processing method based on eBPF technology also includes:

[0026] When the address of the accessed port does not match any key in the port firewall BPF hash table, the allowOtherIP value in the BPF hash table that stores the security policy is determined. If the allowOtherIP value is 0, access to the port is denied; if the allowOtherIP value is 1, access to the port is allowed.

[0027] As an improvement to the above solution, the industrial Internet identification processing method based on eBPF technology also includes

[0028] The identifier to be resolved is compared with the BPF hash table that stores basic identifier syntax information. If the identifier to be resolved does not conform to the China Industrial Internet identifier syntax, the identifier resolution request is rejected; if the identifier to be resolved conforms to the China Industrial Internet identifier syntax, the identifier resolution request is allowed.

[0029] In the second aspect, the present invention provides an industrial Internet identification processing system based on eBPF technology, which is applied to the industrial Internet identification processing method based on eBPF technology as described in the first aspect. The system can be directly deployed to a recursive node or a resolution node at any level. The system has a distributed filter and a first-level cache area. The distributed filter is used to compare the identification to be resolved with the least recently used strategy BPF hash table that caches a complete resolution result, and determine whether the identification to be resolved matches the key in the least recently used strategy BPF hash table. If so, the value corresponding to the key value that matches the identification to be resolved is returned to the identification resolution result. If not, the identification to be resolved is split and filtered into an international top-level identification, a second-level node identification, an enterprise node identification, and a product identification.

[0030] The first-level cache area is used to determine whether the national top-level identification matches the key of the first-level hash nested table that stores the association relationship between the first-level identification code and the address information of the national top-level node. If not, query the international root node, add the parsing result returned by the international root node to the first-level hash nested table, and establish a corresponding second-level hash nested table;

[0031] The first-level cache area is also used to determine whether the second-level node identifier matches the key of the second-level hash nested table that stores the association relationship between the second-level identification code and the industry second-level node address information. If not, query the national top-level node, add the parsing result returned by the national top-level node to the second-level hash nested table, and establish a corresponding third-level hash nested table;

[0032] The first-level cache area is also used to determine whether the enterprise node identifier matches the key of the third-level hash nested table that stores the association relationship between the third-level identifier code and the enterprise node address information. If not, query the second-level node, add the parsing result returned by the second-level node to the third-level hash nested table, and establish a corresponding fourth-level hash nested table;

[0033] The first-level cache area is also used to determine whether the product identification information matches the key of the four-level hash nested table that stores the complete parsing result. If not, a query is made to the enterprise node, the query result returned by the enterprise node is updated into the four-level hash nested table, and the parsing result is returned to the distributed filter. If so, the value corresponding to the key of the four-level hash nested table that matches the product identification information is returned as the parsing result to the distributed filter;

[0034] The distributed filter is also used to update the parsing result into the least recently used strategy BPF hash table and return the parsing result to the query end.

[0035] As an improvement to the above solution, the cache area stores a first-level hash nested table that shows the association between the first-level identification code and the address information of the national top-level node. Each key under the first-level hash nested table corresponds to a corresponding second-level hash nested table.

[0036] The secondary hash nested table stores the association between the secondary identification code and the secondary node address information of the industry. Each key under the secondary hash nested table corresponds to a corresponding third-level hash nested table.

[0037] The three-level hash nested table stores the association between the three-level identification code and the enterprise node address. Each key under the three-level hash nested table has a corresponding four-level hash nested table, which stores the complete parsing results.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] By deploying eBPF programs within recursive nodes, this system can reduce intermediate components and lower system complexity. By simplifying the two-tier cache architecture to a single tier, it can streamline business processes and improve system performance. This method can reduce CPU usage, lower system load, and increase data processing speed when processing large-scale network traffic. Compared to traditional message caching middleware solutions, it can significantly reduce performance overhead and provide higher processing speed and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings, wherein:

[0041] Figure 1 This is a flowchart of an industrial Internet identification processing method based on eBPF technology in one embodiment of the present application;

[0042] Figure 2 This is a flow chart of step S010 in one embodiment of the present application;

[0043] Figure 3 This is a flow chart of step S020 in one embodiment of the present application;

[0044] Figure 4 This is a flow chart of step S030 in one embodiment of the present application;

[0045] Figure 5 This is a flow chart of step S040 in one embodiment of the present application;

[0046] Figure 6 This is a deployment structure diagram of the industrial Internet identification processing system based on eBPF technology in an embodiment of the present application;

[0047] Figure 7 This is a node diagram of the industrial Internet identification processing system based on eBPF technology in an embodiment of the present application;

[0048] Figure 8 This is a schematic diagram of the parent-child relationship of the nested hash table in the embodiment of the present application;

[0049] Figure 9 This is a schematic diagram of the recursive nodes of the industrial Internet identification processing system based on eBPF technology in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0051] It should be noted that the serial numbers mentioned in this article, such as S1, S2, etc., are only used to distinguish between steps and do not mean that the steps must be strictly executed in the order of the serial numbers.

[0052] In one embodiment, Figure 1 As shown, an industrial Internet identification processing method based on eBPF technology includes the following steps:

[0053] S100: Compare the identifier to be resolved with the least recently used strategy BPF hash table that caches the complete resolution result to determine whether the identifier to be resolved matches the key in the least recently used strategy BPF hash table.

[0054] Specifically, if the identifier to be resolved matches the Key in the BPF hash table of the least recently used strategy, the corresponding Value is directly used to return the identifier resolution result, and the process ends; if the identifier to be resolved does not match any Key in the BPF hash table of the least recently used strategy, the distributed filter will further split and filter the identifier into the international top-level identifier, the second-level node identifier, the enterprise node identifier, and the product identifier, and enter the next step of the resolution process.

[0055] S200: Determine whether the national top-level identification matches the key of the first-level hash nested table storing the association relationship between the first-level identification code and the national top-level node address information;

[0056] Specifically, the national top-level identification information is compared with the key of the BPF nested hash table that stores the association between the first-level identification code and the national top-level node address information. If it does not match the key in the table, a query is made to the international root node, and the parsed result is returned and filled into the BPF nested hash table, a corresponding sub-hash nested table is established, and the query of the next-level second-level node identification information is entered; if it matches the key in the table, the sub-hash nested table corresponding to this key is entered, and the query of the next-level second-level node identification information is entered.

[0057] S300: Determine whether the secondary node identifier matches the key of the secondary hash nested table storing the association relationship between the secondary identification code and the industry secondary node address information;

[0058] Specifically, the secondary node identification information is compared with the key of the BPF nested hash table that stores the association between the secondary identification code and the industry secondary node address information. If it does not match the key in the table, a query is made to the national top-level node, and the parsed result is returned and filled into the BPF nested hash table. A corresponding sub-hash nested table is established, and the query for the next-level enterprise node identification information is entered; if it matches the key in the table, the sub-hash nested table corresponding to this key is entered, and the query for the next-level enterprise node identification information is entered.

[0059] S400: Determine whether the enterprise node identifier matches the key of the three-level hash nested table storing the association relationship between the three-level identifier code and the enterprise node address information;

[0060] Specifically, the enterprise node identification information is compared with the key of the BPF nested hash table that stores the association between the third-level identification code and the enterprise node address information. If it does not match the key in the table, a query is made to the second-level node, and the parsing result is returned and filled into the BPF nested hash table, a corresponding sub-hash nested table is established, and the query of the next-level product identification information is entered; if it matches the key in the table, the sub-hash nested table corresponding to this key is entered, and the query of the next-level product identification information is entered.

[0061] S500: Determine whether the product identification information matches the key of the four-level nested hash table storing the complete parsing result;

[0062] Specifically, the product identification information is compared with the key of the BPF hash table that stores the complete parsing result. If it does not match the key in the table, a query is made to the enterprise node, the parsing result is returned and filled into the BPF nested hash table, and the parsing result is returned; if it matches the key in the table, the parsing result is returned using the corresponding value.

[0063] S600: Update the parsing result into the least recently used strategy BPF hash table, and return the parsing result to the query end.

[0064] In one embodiment, the step S600 further includes the steps of:

[0065] S610: When the number of key-value pairs in the least recently used BPF hash table exceeds a set value, the key-value pair that has not been accessed the longest in the least recently used BPF hash table is removed.

[0066] Specifically, the LRU (Least Recently Used) strategy determines the maximum capacity of the BPF hash table cache—that is, the maximum number of parsing results that can be stored. This capacity is used to control the cache size, triggering the LRU (Least Recently Used) strategy when the capacity limit is reached. When a parsing request is received, the BPF hash table is first checked to see if the corresponding key-value pair exists. If so, the result of the parsing request is already in the cache and can be used directly. The access time of the key in the hash table is also updated. After inserting a new parsing result, the BPF hash table size is checked. If the size exceeds the pre-set cache capacity, the LRU strategy is triggered. Based on the LRU strategy, the least recently accessed key-value pair in the BPF hash table is found. This can be achieved using an additional tracking data structure (such as a counter or linked list). This least recently accessed key-value pair is removed from the hash table to make room for new parsing results. To maintain the LRU strategy, the access time of the corresponding key-value pair is updated whenever a new parsing request or a cached request is accessed again to ensure that the most recently accessed key-value pair is not replaced.

[0067] Among them, by replacing the "BPF_MAP_TYPE_HASH" data type with "BPF_MAP_TYPE_LRU_HASH", this is a hash table based on the least recently used (LRU) strategy, which is suitable for scenarios where the Map size needs to be limited and the least recently used elements need to be automatically deleted. It can be used to automatically delete infrequently used identity resolution cache results. Each element in the LRU (Least Recently Used) hash table records the time of the last access. When memory is insufficient, the elements that have not been accessed for the longest time will be removed first. This type of Map is particularly suitable for scenarios where you need to cache some recently or frequently used elements, but you don't want to occupy too much memory. You can set max_entries to limit the maximum number of identity cache results that the map can store. Once this limit is reached, the element that has not been accessed for the longest time will be removed to make room for the new identity cache.

[0068] In one embodiment, Figure 2 As shown, the industrial Internet identification processing method based on eBPF technology also includes the following steps:

[0069] S010: When receiving the identity resolution request from the query end, authenticate the user according to the BPF hash table storing the user authentication information;

[0070] Specifically, install libbpf's dependencies, compile and run the eBPF program, and import the relevant eBPF maps as needed. Upon receiving an identity resolution request from a client, authentication is performed based on the BPF hash table storing user authentication information, where the key is the username and the value is the password. If the key-value pair matches, access to the service is allowed, and the next step is performed. If the key-value pair does not match, access is denied, an error code is returned, and the process ends.

[0071] In one embodiment, Figure 3 As shown, the industrial Internet identification processing method based on eBPF technology also includes the following steps:

[0072] S020: Compare the querying end IP address with the querying end IP source firewall BPF hash table.

[0073] Specifically, the query end address is compared with the IP source firewall BPF hash table. If the query end address matches a Key in the table and the Value is 0, it means that the IP is a blacklist IP, and access is denied; if the query end address matches a Key in the table and the Value is 1, it means that the IP is a whitelist IP, and access is allowed. Among them, if the query end address does not match any Key in the table, it means that the IP is neither a blacklist IP nor a whitelist IP. If the allowOtherIP value in the BPF hash table storing the security policy is 0, it means that IPs not in the IP source whitelist are not allowed to access, and access is denied. If the allowOtherIP value in the BPF hash table storing the security policy is 1, it means that IPs not in the IP source whitelist are allowed to access, and access is allowed.

[0074] In this embodiment, the eBPF toolchain and API are used to create a BPF hash table. This hash table is used to store the querying IP source and the corresponding firewall rules or identifiers. The firewall rules or identifiers and the querying IP address source are populated into the BPF hash table as key-value pairs. These rules or identifiers can be used to identify the source of the querying IP, such as the internal network, external network, or trusted network. When a query request is received, the querying IP address is obtained. The query is matched against the BPF hash table using the querying IP address as the key. If a firewall rule or identifier matching the querying IP address is found, the source of the querying IP address is defined in the hash table. Depending on the matching firewall rule or identifier, different actions can be performed. For example, if the matching rule allows access, the query request continues to be processed; if the matching rule denies access, the query request is rejected or blocked. If no matching rule or identifier is found in the BPF hash table for the querying IP address, a default action, such as a default allow or default deny, can be performed as required.

[0075] In one embodiment, Figure 4 As shown, the industrial Internet identification processing method based on eBPF technology also includes the following steps:

[0076] S030: Compare the address of the accessed port according to the port firewall BPF hash table.

[0077] Specifically, the address of the accessed port is compared with the port firewall BPF hash table. If the address of the accessed port matches a Key in the table and the Value is 0, it means that the port is not open, and access is denied; if the address of the accessed port matches a Key in the table and the Value is 1, it means that the port is open and access is allowed; among them, if the address of the accessed port does not match any Key in the table, it means that whether the port is open or not is unclear, and the allowOtherIP value in the BPF hash table storing the security policy needs to be judged. If the allowOtherPort value in the BPF hash table storing the security policy is 0, it means that access to ports not in the port whitelist is not allowed, and access is denied; if the allowOtherPort value in the BPF hash table storing the security policy is 1, it means that access to ports not in the port whitelist is allowed, and access is allowed.

[0078] In one embodiment, Figure 5 As shown, the industrial Internet identification processing method based on eBPF technology also includes the following steps:

[0079] S040: Compare the identifier to be parsed according to the BPF hash table storing basic identifier syntax information.

[0080] Specifically, a preliminary comparison is performed on the identifier to be resolved based on the BPF hash table that stores basic identifier syntax information. If the identifier to be resolved obviously does not conform to the China Industrial Internet identifier syntax, the identifier resolution request is rejected; if the identifier to be resolved obviously conforms to the China Industrial Internet identifier syntax, the request is allowed.

[0081] In one embodiment, Figure 6As shown, an industrial Internet identification processing system based on eBPF technology can be directly deployed to a recursive node or a parsing node at any level based on eBPF technology. The industrial Internet identification processing system based on eBPF technology uses a four-layer BPF hash nested table, which has a distributed filter and a first-level cache area. The distributed filter is used to compare the identification to be resolved with the least recently used strategy BPF hash table that caches a complete parsing result, and to determine whether the identification to be resolved matches the key in the least recently used strategy BPF hash table. If so, the identification parsing result is returned to the Value corresponding to the key value that matches the identification to be resolved. If not, the identification to be resolved is split and filtered into an international top-level identification, a second-level node identification, an enterprise node identification, and a product identification.

[0082] The first-level cache area is used to determine whether the national top-level identification matches the key of the first-level hash nested table that stores the association relationship between the first-level identification code and the address information of the national top-level node. If not, query the international root node, add the parsing result returned by the international root node to the first-level hash nested table, and establish a corresponding second-level hash nested table;

[0083] The first-level cache area is also used to determine whether the second-level node identifier matches the key of the second-level hash nested table that stores the association relationship between the second-level identification code and the industry second-level node address information. If not, query the national top-level node, add the parsing result returned by the national top-level node to the second-level hash nested table, and establish a corresponding third-level hash nested table;

[0084] The first-level cache area is also used to determine whether the enterprise node identifier matches the key of the third-level hash nested table that stores the association relationship between the third-level identifier code and the enterprise node address information. If not, query the second-level node, add the parsing result returned by the second-level node to the third-level hash nested table, and establish a corresponding fourth-level hash nested table;

[0085] The first-level cache area is also used to determine whether the product identification information matches the key of the four-level hash nested table that stores the complete parsing result. If not, a query is made to the enterprise node, the query result returned by the enterprise node is updated into the four-level hash nested table, and the parsing result is returned to the distributed filter. If so, the value corresponding to the key of the four-level hash nested table that matches the product identification information is returned as the parsing result to the distributed filter;

[0086] The distributed filter is also used to update the parsing result into the least recently used strategy BPF hash table and return the parsing result to the query end.

[0087] In this embodiment, if Figure 7As shown, the four-layer BPF hash nested table cached in the first-level cache area stores cached data of the identification resolution addresses at all levels. When the query end initiates a request for identification resolution, the industrial Internet identification to be resolved entering the industrial Internet identification processing technology will be hierarchically filtered by the distributed filter and filtered into the corresponding national top-level node data, second-level industry node data, enterprise node data, and object data. The distributed filter will concurrently compare the data at all levels with the BPF hash table of the corresponding level. If there is no result in the hit table, an identification resolution query will be initiated to the next-level resolution node, and the returned resolution result will be filled in and supplemented into the hash table. After the complete identification code is resolved, the result will be returned to the query end.

[0088] Distributed filters can manage network access policies by designing multiple hash tables based on business scenarios. BPF hash tables can include user authentication hash tables, IP source hash tables, port hash tables, basic identification syntax filtering hash tables, and security policy hash tables, and these can be increased or decreased based on actual business needs. When the query end initiates an identification resolution request, the distributed filter can perform the corresponding user authentication operation and, in accordance with security policies, manage blacklists and whitelists for source IP addresses, ports, etc., as well as terminate identification requests that clearly do not conform to the Industrial Internet identification syntax structure.

[0089] In this embodiment, the distributed filter can optionally design a BPF_MAP_TYPE_LRU_HASH least recently used strategy hash table to store recently parsed complete resolution results for business scenarios. Identities that are repeatedly parsed on a large scale within a short period of time can directly return the corresponding identifier resolution results through this cache. We can set max_entries to limit the maximum number of identifier cache results that the map can store. Once this limit is reached, assuming max_entries = 200000, when the key-value pairs exceed 200000, the elements that have not been accessed for the longest time will be removed to make room for new identifier caches.

[0090] In this embodiment, the cache area stores a first-level hash nested table of the association relationship between the first-level identification code and the national top-level node address information, and each key under the first-level hash nested table corresponds to a corresponding second-level hash nested table; the second-level hash nested table stores the association relationship between the second-level identification code and the industry second-level node address information, and each key under the second-level hash nested table corresponds to a corresponding third-level hash nested table; the third-level hash nested table stores the association relationship between the third-level identification code and the enterprise node address, and each key under the third-level hash nested table has a corresponding fourth-level hash nested table, and the fourth-level hash nested table will store the complete parsing results.

[0091] Specifically, such as Figures 8 and 9As shown, the four-layer BPF hash nested table cached in the first-level cache stores cached data for each level of identification resolution addresses. The highest-level BPF hash nested table stores the association between the first-level identification code and the national top-level node address information. Each key under the first-level table corresponds to a corresponding second-level sub-BPF nested hash table, which stores the association between the second-level identification code and the industry's second-level node address information. Correspondingly, each key under each second-level sub-table that stores the association between the second-level identification code and the industry's second-level node address information has a corresponding third-level sub-BPF nested hash table, which stores the association between the third-level identification code and the enterprise node address. Correspondingly, each key under each third-level sub-table that stores the association between the third-level identification code and the enterprise node address has a corresponding fourth-level sub-BPF hash table (BPF_MAP_TYPE_HASH), which stores the complete resolution results.

[0092] This application utilizes eBPF technology, a powerful and flexible filtering mechanism that runs in kernel mode. This eliminates the need for frequent switching between user and kernel modes during operation. Therefore, when processing large amounts of network traffic, it can reduce CPU usage, lower system load, and improve data processing speed. Compared to traditional message caching middleware solutions, this significantly reduces performance overhead, providing higher processing speed and efficiency. By deploying eBPF programs within recursive nodes, intermediate components can be reduced, reducing system complexity. By simplifying the two-tier cache architecture to a single tier, business processes can be streamlined and system performance improved. Furthermore, eBPF technology can process requests in real time, effectively reducing query latency and improving resolution speed. Fast query performance: Hash tables can query, insert, and delete data in constant time, while sequential table query performance depends on the data volume and data storage order. Hash tables generally outperform sequential tables in the case of large amounts of data. Hash tables can dynamically resize as needed, while sequential tables typically require pre-allocated fixed-size storage space. Therefore, hash tables can more flexibly adapt to varying data volumes. Using BPF_MAP_TYPE_HASH_OF_MAPS makes it easy to represent complex nested relationships, which in a sequential table might require additional indexing and lookup logic.

[0093] This application uses BPF technology with high programmability, which can flexibly customize parsing strategies and logic according to business needs. This architecture is extremely flexible and can reduce the number of layers of hash nested tables according to business needs; through eBPF Map, data can be easily managed and updated, reducing the burden of maintenance work; through BPF Filter, the filtering of identifiers can avoid the repeated decompilation of identifiers by the publish / subscribe message middleware, thereby improving system performance; applying eBPF kernel-mode network processing technology in the field of industrial Internet identifier resolution can not only improve its efficiency in terms of performance, but also combine with industrial high-end embedded equipment running Linux systems, providing possible new technical possibilities for the future development of the industrial Internet.

[0094] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. An industrial Internet identification processing method based on eBPF technology, characterized in that: Including steps: Compare the identifier to be resolved with the least recently used strategy BPF hash table that has a complete resolution result in the cache to determine whether the identifier to be resolved matches the key in the least recently used strategy BPF hash table. If so, return the identifier resolution result with the value corresponding to the key value that matches the identifier to be resolved. If not, split and filter the identifier to be resolved into the international top-level identifier, the second-level node identifier, the enterprise node identifier, and the product identifier. Determine whether the national top-level identifier matches the key of the first-level hash nested table that stores the association between the first-level identifier code and the address information of the national top-level node. If not, query the international root node, add the parsing result returned by the international root node to the first-level hash nested table, and establish a corresponding second-level hash nested table. Determine whether the secondary node identifier matches the key of the secondary hash nested table that stores the association between the secondary identifier code and the industry secondary node address information. If not, query the national top-level node, add the parsing result returned by the national top-level node to the secondary hash nested table, and establish a corresponding third-level hash nested table. Determine whether the enterprise node identifier matches the key of the third-level hash nested table that stores the association between the third-level identifier code and the enterprise node address information. If not, query the second-level node, add the parsing result returned by the second-level node to the third-level hash nested table, and establish a corresponding fourth-level hash nested table. Determine whether the product identification information matches the key of the four-level hash nested table that stores the complete parsing result. If not, query the enterprise node, update the query result returned by the enterprise node into the four-level hash nested table, and return the parsing result to the distributed filter. If so, return the value corresponding to the key in the four-level hash nested table that matches the product identification information as the parsing result to the distributed filter; Update the parsing result into the least recently used strategy BPF hash table and return the parsing result to the query end.

2. The industrial Internet identification processing method based on eBPF technology according to claim 1 is characterized in that: When the key-value pairs in the least recently used BPF hash table exceed the set value, the key-value pairs that have not been accessed for the longest time in the least recently used BPF hash table are removed.

3. The industrial Internet identification processing method based on eBPF technology according to claim 1 is characterized in that: Also includes: When receiving the identity resolution request from the query end, the user's identity is authenticated according to the BPF hash table that stores the user's authentication information. If the verification key-value pair matches, the user is allowed to use this service. If the verification key-value pair does not match, the user's access is denied and an error code is returned.

4. The industrial Internet identification processing method based on eBPF technology according to claim 1 is characterized in that: It also includes comparing the querying end IP address with the querying end IP source firewall BPF hash table. When the querying end IP address matches a key in the querying end IP source firewall BPF hash table and the value is 0, the querying end IP is a blacklisted IP, and access is denied. When the querying end IP address matches a key in the querying end IP source firewall BPF hash table and the value is 1, it means that the IP is a whitelist IP and access is allowed.

5. The industrial Internet identification processing method based on eBPF technology according to claim 4 is characterized in that: When the querying IP address does not match any key in the BPF hash table of the querying IP source firewall, the allowOtherIP value in the BPF hash table storing the security policy is determined; If the allowOtherIP value is 0, the query client is denied access; if the allowOtherIP value is 1, the query client is allowed access.

6. The industrial Internet identification processing method based on eBPF technology according to claim 1 is characterized in that: It also includes comparing the address of the accessed port according to the port firewall BPF hash table. When the address of the accessed port matches one of the keys in the port firewall BPF hash table and the value is 0, the port is not open and access is denied; when the address of the accessed port matches one of the keys in the port firewall BPF hash table and the value is 1, the port is open and access is allowed.

7. The industrial Internet identification processing method based on eBPF technology according to claim 6 is characterized in that: When the address of the accessed port does not match any key in the port firewall BPF hash table, the allowOtherIP value in the BPF hash table that stores the security policy is determined. If the allowOtherIP value is 0, access to the port is denied; if the allowOtherIP value is 1, access to the port is allowed.

8. The industrial Internet identification processing method based on eBPF technology according to claim 1 is characterized in that: It also includes comparing the identifier to be resolved based on the BPF hash table that stores basic identifier syntax information. If the identifier to be resolved does not conform to the China Industrial Internet identifier syntax, the identifier resolution request is rejected; if the identifier to be resolved conforms to the China Industrial Internet identifier syntax, the identifier resolution request is allowed.

9. An industrial Internet identification processing system based on eBPF technology, characterized in that: It can be directly deployed to recursive nodes or parsing nodes at any level. The system has a distributed filter and a first-level cache area. The distributed filter is used to compare the identifier to be parsed with the least recently used strategy BPF hash table that has a complete parsing result in the cache, and to determine whether the identifier to be parsed matches the key in the least recently used strategy BPF hash table. If so, the identifier parsing result is returned with the value corresponding to the key value that matches the identifier to be parsed. If not, the identifier to be parsed is split and filtered into the international top-level identifier, the second-level node identifier, the enterprise node identifier, and the product identifier. The first-level cache area is used to determine whether the national top-level identification matches the key of the first-level hash nested table that stores the association relationship between the first-level identification code and the address information of the national top-level node. If not, query the international root node, add the parsing result returned by the international root node to the first-level hash nested table, and establish a corresponding second-level hash nested table; The first-level cache area is also used to determine whether the second-level node identifier matches the key of the second-level hash nested table that stores the association relationship between the second-level identification code and the industry second-level node address information. If not, query the national top-level node, add the parsing result returned by the national top-level node to the second-level hash nested table, and establish a corresponding third-level hash nested table; The first-level cache area is also used to determine whether the enterprise node identifier matches the key of the third-level hash nested table that stores the association relationship between the third-level identifier code and the enterprise node address information. If not, query the second-level node, add the parsing result returned by the second-level node to the third-level hash nested table, and establish a corresponding fourth-level hash nested table; The first-level cache area is also used to determine whether the product identification information matches the key of the four-level hash nested table that stores the complete parsing result. If not, a query is made to the enterprise node, the query result returned by the enterprise node is updated into the four-level hash nested table, and the parsing result is returned to the distributed filter. If so, the value corresponding to the key of the four-level hash nested table that matches the product identification information is returned as the parsing result to the distributed filter; The distributed filter is also used to update the parsing result into the least recently used strategy BPF hash table and return the parsing result to the query end.

10. The industrial Internet identification processing system based on eBPF technology according to claim 9 is characterized in that: The cache area stores a first-level hash nested table that shows the association between the first-level identification code and the address information of the national top-level node. Each key under the first-level hash nested table corresponds to a corresponding second-level hash nested table. The secondary hash nested table stores the association between the secondary identification code and the secondary node address information of the industry. Each key under the secondary hash nested table corresponds to a corresponding third-level hash nested table. The three-level hash nested table stores the association between the three-level identification code and the enterprise node address. Each key under the three-level hash nested table has a corresponding four-level hash nested table, which stores the complete parsing results.

Images