Message processing method and device, related equipment and storage medium
Patent Information
- Application Number
- CN202210652601.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-06-07
- Publication Date
- 2026-11-03
- Estimated Expiration
- 2042-06-07
Smart Images
Figure CN117240781B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and in particular to a message processing method, apparatus, related equipment and storage medium. Background Technology
[0002] In addition to providing network bandwidth services, network operators can also offer value-added security services. Providing security services on the operator's network requires the network to have the capability to direct customer traffic to a security resource pool for cleaning before reinjecting it back to the customer.
[0003] However, in the relevant technologies, the implementation of traffic reinjection solutions requires the deployment of a large amount of resources. Summary of the Invention
[0004] To address the related technical issues, embodiments of this application provide a message processing method, apparatus, related equipment, and storage medium.
[0005] The technical solution of this application embodiment is implemented as follows:
[0006] This application provides a message processing method applied to a first device, including:
[0007] Receive a message, the message containing first information, the first information indicating whether the message has been cleaned;
[0008] Determine the second information, which includes the routing information of the message, and the routing information may or may not include the third information, wherein the third information indicates that the corresponding route includes a traction route;
[0009] Using the first information and / or the second information, the message is sent to a second device for cleaning or forwarding.
[0010] In the above scheme, if the routing information in the second information includes the third information, and the first information indicates that the packet has not been cleaned, the packet is sent to the second device for cleaning.
[0011] In the above scheme, if the routing information in the second information includes the third information, and the first information indicates that the packet has been cleaned, the packet is forwarded.
[0012] In the above scheme, if the routing information in the second information does not contain the third information, the message is forwarded.
[0013] The method in the above scheme further includes:
[0014] Obtain fourth information, wherein the fourth information indicates that the sending device of the message is a source routing device; wherein,
[0015] If the fourth piece of information is obtained, the first piece of information indicates that the message has not been cleaned.
[0016] The method in the above scheme further includes:
[0017] Obtain the first identifier from the message; wherein,
[0018] If the first identifier is obtained, the first information indicates that the message has been cleaned;
[0019] or,
[0020] Without obtaining the first identifier, the first information indication message was not cleaned.
[0021] In the above scheme, obtaining the first identifier from the message includes:
[0022] The first identifier is obtained from the reserved bits in the Message Service Type (TOS) field.
[0023] In the above scheme, determining the second information includes:
[0024] The routing information of the packet is retrieved from the routing table, which contains at least one entry for routing information; wherein,
[0025] For each piece of routing information in at least one routing information, if the routing information corresponds to a tractor route, the routing information contains third information; if the routing information corresponds to a forwarding route, the routing information does not contain third information.
[0026] This application also provides a message processing method, applied to a second device, including:
[0027] Receive the first message;
[0028] The first message is cleaned to obtain a second message, which contains first information indicating that the message has been cleaned.
[0029] The second message is sent to the first device.
[0030] In the above scheme, upon receiving the second message, the method further includes:
[0031] A first identifier is set in the second message, and the first information indicates that the message has been cleaned.
[0032] In the above scheme, setting the first identifier in the second message includes:
[0033] The first identifier is set in the reserved bits in the TOS field of the second message.
[0034] This application also provides a message processing apparatus, including:
[0035] A first receiving unit is configured to receive a message, the message containing first information, the first information indicating whether the message has been cleaned;
[0036] A determining unit is configured to determine second information, the second information including routing information of the message, the routing information including third information or not including third information, the third information indicating that the corresponding route includes a traction route;
[0037] The first sending unit is configured to use the first information and / or the second information to send the message to the second device for cleaning or to forward the message.
[0038] This application also provides a message processing apparatus, including:
[0039] The second receiving unit is used to receive the first message;
[0040] A cleaning unit is used to clean the first message to obtain a second message, the second message containing first information, the first information indicating that the message has been cleaned;
[0041] The second sending unit is used to send the second message to the first device.
[0042] This application also provides a first device, including a first communication interface and a first processor; wherein,
[0043] The first communication interface is configured to receive a message containing first information indicating whether the message has been cleaned; and to send the message to a second device for cleaning or forwarding the message using the first information and / or second information.
[0044] The first processor is configured to determine the second information, the second information including routing information of the message, the routing information including or not including third information, the third information indicating that the corresponding route includes a traction route.
[0045] This application also provides a second device, including a second communication interface and a second processor; wherein,
[0046] The second communication interface is used to receive the first message and send the second message to the first device;
[0047] The second processor is used to clean the first message to obtain the second message, the second message containing first information indicating that the message has been cleaned.
[0048] This application also provides a first device, including: a first processor and a first memory for storing a computer program capable of running on the processor.
[0049] Wherein, when the first processor is used to run the computer program, it executes the steps of any of the methods described above on the first device side.
[0050] This application also provides a second device, including: a second processor and a second memory for storing a computer program capable of running on the processor.
[0051] Wherein, when the second processor is used to run the computer program, it executes the steps of any of the methods described above on the second device side.
[0052] This application embodiment also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the methods described above on the first device side, or implements the steps of any of the methods described above on the second device side.
[0053] The message processing method, apparatus, related devices, and storage medium provided in this application embodiment include: a first device receiving a message containing first information indicating whether the message has been cleaned; determining second information, which includes routing information of the message, and the routing information may or may not include third information, where the third information indicates that the corresponding route includes a tout route; and using the first information and / or the second information, sending the message to a second device for cleaning or forwarding the message. The solution provided in this application embodiment utilizes the message's routing information and cleaning status information to tout or forward the message, enabling accurate identification and forwarding of back-injection messages. The solution provided in this application embodiment only optimizes the routing matching algorithm, eliminating the need for additional configuration of virtual private network (VPN) channels and back-injection networks, thus reducing resource deployment. Attached Figure Description
[0054] Figure 1 This is a flowchart illustrating the first reinjection method in the relevant technology;
[0055] Figure 2 This is a flowchart illustrating the second reinjection method in the relevant technology;
[0056] Figure 3This is a schematic flowchart of a first message processing method according to an embodiment of this application;
[0057] Figure 4 This is a schematic flowchart of the second message processing method according to an embodiment of this application;
[0058] Figure 5 This is a schematic flowchart of a third message processing method according to an embodiment of this application;
[0059] Figure 6 This is a schematic diagram of the architecture of the example message processing system used in this application;
[0060] Figure 7 This is a flowchart illustrating the method for processing example messages in this application.
[0061] Figure 8 This is a schematic diagram of a message processing device according to an embodiment of this application;
[0062] Figure 9 This is a schematic diagram of another message processing device structure according to an embodiment of this application;
[0063] Figure 10 This is a schematic diagram of the structure of the first device according to an embodiment of this application;
[0064] Figure 11 This is a schematic diagram of the structure of the second device according to an embodiment of this application;
[0065] Figure 12 This is a schematic diagram of the message processing system structure according to an embodiment of this application. Detailed Implementation
[0066] To provide network services to users, network operators each build a vast transport network. Through this transport network, operators can provide users with primarily broadband services, but these services remain basic infrastructure. To meet users' demands for network security services, operators also leverage the advantages of their transport networks (such as large channels and high bandwidth) to provide value-added security services, such as Distributed Denial-of-Service (DDoS) traffic scrubbing, website traffic protection, and intrusion prevention detection. Providing security services on the operator's network requires scrubbing customer traffic through security resource pools. However, due to the cost of building security resource pools, they cannot be deployed across the entire network. The common deployment approach is to deploy only one pool or multiple pools distributed across the network. For example, when deploying multiple security resource pools, the country can be divided into several regions, with one pool deployed in each region. Therefore, the network needs the ability to direct customer traffic to the security resource pool for scrubbing and then redirect the scrubbed traffic back to the customer. This process typically uses dynamic routing for traffic redirection and redirection because dynamic routing has strong scheduling capabilities. However, during the process of driving and injecting traffic through dynamic routing, there is a problem that the injected traffic may be driven back to the security resource pool, resulting in a network loop.
[0067] To address the above issues, the following two injection methods are commonly used in related technologies to inject flow:
[0068] The first method of back-injection involves establishing a VPN tunnel to inject traffic back to the destination network in a point-to-point manner; specifically, back-injecting to a back-injection point within the destination network. When using this method, since there are no steer routes in the destination network, the injected traffic will not be directed to the security resource pool.
[0069] However, when using this method for flow reinjection, the reinjection points must be clearly defined as one or several locations, requiring configuration of the transmission channel between the traction equipment and the reinjection points. As the number of reinjection points increases, the configuration difficulty also increases.
[0070] For example, such as Figure 1As shown, when using edge routers in a carrier network for traffic redirection, a Generic Routing Encapsulation (GRE) tunnel can be established between the edge router and the destination router (i.e., the injection point). The edge router redirects customer traffic to a security resource pool for cleaning, and then uses the GRE tunnel to send the customer traffic to the destination router. Since it is necessary to establish a GRE tunnel between the edge router and each destination router in advance, the configuration is relatively complex, and the more destination routers there are, the more obvious this problem becomes.
[0071] In addition, when using this back-injection method to inject traffic, since the back-injection device needs to directly inject the traffic back into the network on the destination side, the back-injection device generally needs to be deployed close to the destination side for security protection near the destination side, and cannot be deployed close to the source routing side; however, the deployment method close to the destination side requires a large amount of resources to be deployed for the transmission of illegal traffic, since illegal traffic can only be identified after it is transmitted to the destination side, resulting in the occupation and waste of link resources.
[0072] The second type of return betting method, such as Figure 2 As shown, traffic is injected back by constructing a dedicated injection network. The only difference between the constructed injection network and the original network is the presence of traction routes. Specifically, the injection network imports all routes from the carrier network except for the traction routes, thus ensuring that the injected traffic is not redirected back. Here, the constructed injection network can be a real physical network rebuilt using physical devices, or a virtual network constructed on top of the carrier network using a VPN multi-instance approach.
[0073] When using this traffic reinjection method, the traction equipment can be deployed close to the source routing side, enabling near-source security protection and solving the problem of excessive resource deployment when performing near-destination security protection. However, building a new physical reinjection network requires a large number of new physical devices, thus increasing resource deployment costs; while building a new virtual reinjection network would double the number of existing network routes, thus consuming a large amount of routing table resources. Therefore, it places high demands on the routing capabilities of existing network routing devices, further increasing the deployment costs of existing network devices.
[0074] In summary, among the related technologies, the implementation of traffic reinjection solutions requires the deployment of a significant amount of resources.
[0075] Based on this, in various embodiments of this application, the routing information and cleaning status information of the packets are used to guide or forward the packets, which can accurately identify and forward the back-injection packets. The solution provided by the embodiments of this application only optimizes the routing matching algorithm and does not require additional configuration of VPN tunnels and back-injection networks, thus reducing resource deployment.
[0076] Meanwhile, because the first device employs a mechanism that automatically guides or forwards packets using first and second information, it can perform traffic guidance at any node in the bearer network. This allows the first device to be deployed close to the source routing device, achieving near-source security protection and reducing the resources required for packet transmission.
[0077] This application provides a message processing method applied to a first device, which may be a device with routing capabilities, such as a switch with routing capabilities, an edge routing device in a carrier network, etc. Figure 3 As shown, the method includes:
[0078] Step 301: Receive a message, the message containing first information, the first information indicating whether the message has been cleaned;
[0079] Step 302: Determine the second information, which includes the routing information of the message. The routing information may or may not include the third information, and the third information indicates that the corresponding route includes a traction route.
[0080] Step 303: Using the first information and / or the second information, send the message to the second device for cleaning or forward the message.
[0081] In practical applications, the received messages may include cleaned messages and uncleaned messages. In order to distinguish between cleaned and uncleaned messages, an identifier can be added to the cleaned messages. When a message is received and parsed, the identifier obtained from the parsed data can be used to determine the first information, that is, to determine whether the first information indicates that the message has been cleaned or that the first information indicates that the message has not been cleaned.
[0082] Based on this, in one embodiment, the method may further include obtaining a first identifier from the message; wherein,
[0083] When the first identifier is obtained, it indicates that the message has been cleaned. Therefore, the first information indicates that the message has been cleaned.
[0084] Of course, if the first identifier is not obtained, it means that the message has not been cleaned. Therefore, the first information indicates that the message has not been cleaned.
[0085] In practical applications, to minimize changes to the message format and ensure compatibility with related technologies, the identifier can be set in a reserved bit within the message.
[0086] Based on this, in one embodiment, the first identifier can be obtained from the reserved bits in the TOS field of the message.
[0087] In practical applications, the high three bits of the TOS field of the message are in an unused state. The high three bits of the TOS field refer to the first three bits from left to right in the TOS field. In other words, these bits are reserved. Therefore, the reserved high three bits of the TOS field can be used to set the first identifier. Specifically, at least one of the high three bits of the message's TOS field can be used to set the first identifier.
[0088] Based on this, in one embodiment, the first identifier can be obtained from at least one of the high three bits of the message TOS field; for example, the first identifier can be obtained from the third bit of the high three bits.
[0089] For example, the first identifier can be set in the third bit of the high three bits of the message TOS field. After parsing the message, the value of the third bit of the high three bits of the message TOS field is obtained from the parsed data. When the value is "1", it indicates that the first identifier has been obtained and the first information indicates that the message has been cleaned. When the value is "0", it indicates that the first identifier has not been obtained and the first information indicates that the message has not been cleaned.
[0090] In practical applications, before the packet enters the first device, an unauthorized user may tamper with the packet, causing the first information in the packet to indicate that the packet has been cleaned. This would lead the first device to determine that the packet does not require routing, thus evading the cleaning process. Therefore, to prevent unauthorized users from tampering with the packet before it enters the first device, the first device can assume that the first information of all packets sent by the source routing device indicates that the packet has not been cleaned. This ensures that all packets sent by the source routing device, when their corresponding routes include routing routes, can be correctly routed to the first device for cleaning.
[0091] Based on this, in one embodiment, the method may further include:
[0092] Obtain fourth information, wherein the fourth information indicates that the sending device of the message is a source routing device; wherein,
[0093] When the fourth piece of information is obtained, it indicates that the sending device of the message is the source routing device, therefore the first piece of information indicates that the message has not been cleaned.
[0094] In practical applications, in order to ensure that the first information can indicate that the packet has not been cleaned when the fourth information is obtained, the packet sent by the source routing device can be processed before entering the first device, so that the first information indicates that the packet has not been cleaned.
[0095] Based on this, in one embodiment, the method may further include:
[0096] After obtaining the fourth information, the message is processed, and the processed message does not contain the first identifier; correspondingly, the first identifier cannot be obtained from the processed message; when the first identifier cannot be obtained, it indicates that the message has not been cleaned, therefore, the first information indicates that the message has not been cleaned.
[0097] For example, if the third bit of the high three bits of the message TOS field is "1", it indicates that the first identifier has been obtained. Therefore, processing the message can be achieved by setting the third bit of the high three bits of the message TOS field to "0". Accordingly, the first identifier cannot be obtained from the processed message. If the first identifier cannot be obtained, it means that the message has not been cleaned. Therefore, the first information indicates that the message has not been cleaned.
[0098] In the absence of the fourth information, it can be explained that the message may be an uncleaned message sent by another routing device, a cleaned message sent by another routing device, or a cleaned message sent by the first device. In this case, there is no need to process the received message, that is, there is no need to process the first identifier contained in the message.
[0099] In practical applications, the sending device of the message can be determined through the ingress interface to see if it is the source routing device, which is the interface between the first device and other routing devices.
[0100] In practical applications, after receiving the message, it is necessary to determine whether the message needs to be redirected, that is, to determine the second information. The second information can be determined by determining whether the route corresponding to the message contains a redirection route.
[0101] Based on this, in one embodiment, determining the second information includes:
[0102] The routing information of the packet is retrieved from the routing table, which contains at least one entry for routing information; wherein,
[0103] For each piece of routing information in at least one routing information, if the routing information corresponds to a tractor route, the routing information contains third information; if the routing information corresponds to a forwarding route, the routing information does not contain third information.
[0104] The term "traction route" refers to a route that needs to be tracted to the security resource pool. When the route information includes a traction route (i.e., the corresponding route is a traction route), it indicates that the packet needs to be tracted to the security resource pool for cleaning. The term "forward route" refers to a route that needs to be forwarded, which can be understood as a route that does not need to be tracted to the security resource pool. When the route information includes a forward route (i.e., the corresponding route is a forward route), it indicates that the packet does not need to be tracted to the security resource pool for cleaning.
[0105] In practical applications, to distinguish between traction routes and forwarding routes in the routing table, and thus determine whether the route corresponding to the routing information includes a traction route or a forwarding route, a marker can be added to the routing table. Specifically, a second identifier can be added to the traction route. Correspondingly, when searching for the routing information of the packet in the routing table, by obtaining the second identifier from the corresponding route, it is determined whether the corresponding route is a traction route, thereby determining whether the route corresponding to the routing information includes a traction route or a forwarding route. Specifically, if the second identifier is obtained, the route corresponding to the routing information includes a traction route; if the second identifier is not obtained, the route corresponding to the routing information includes a forwarding route.
[0106] For example, a marker "T" can be added to the routes in the routing table that need to be redirected. When looking up the routing information of the packet in the routing table, if the route corresponding to the routing information contains the identifier "T", it indicates that the corresponding route needs to be redirected. Therefore, the routing information of the packet contains third information. However, if the route corresponding to the routing information does not contain the identifier "T", it indicates that the corresponding route needs to be forwarded, that is, the corresponding route does not need to be redirected. Therefore, the routing information of the packet does not contain third information.
[0107] In practical applications, when the message does not contain a traction route, the message needs to be forwarded. However, when the route corresponding to the message contains a traction route, i.e., when the routing information in the second information contains the third information, the message may be a message that needs to be cleaned by the security resource pool, a message that is injected back into the security resource pool, or a cleaned message forwarded by other devices. Therefore, it is necessary to determine whether the message needs to be tractioned or forwarded based on the first and second information. That is, the first device performs the operation of traction or forwarding the message based on the first and / or second information of the message. The operation can specifically include three situations.
[0108] In the first scenario, the message is one that needs to be towed and has not been cleaned, meaning it needs to be towed to the second device for cleaning. In this case, the message needs to be sent to the second device for cleaning.
[0109] Based on this, in one embodiment, if the routing information in the second information includes the third information and the first information indicates that the packet has not been cleaned, the packet is sent to the second device for cleaning.
[0110] In practical applications, the second device refers to a device used for traffic cleaning, such as a cloud platform containing security components. When a packet is directed to the cloud platform, it is cleaned through the security resource pool within the cloud platform.
[0111] In practical applications, uncleaned packets may be sent by the source routing device or forwarded to the first device by other routing devices. For example, they may be uncleaned packets sent by other edge routing devices.
[0112] In the second scenario, the message is one that needs to be pulled, but the message has been cleaned, meaning the message is a message re-injected by the first device. In this case, the message needs to be forwarded.
[0113] Based on this, in one embodiment, if the routing information in the second information includes the third information and the first information indicates that the packet has been cleaned, the packet is forwarded.
[0114] In the third scenario, the packet is a route that does not require traction, meaning that the routing information of the packet does not contain a traction route. In this case, regardless of whether the packet has been cleaned, it only needs to be forwarded.
[0115] Based on this, in one embodiment, if the routing information in the second information does not contain the third information, the message is forwarded.
[0116] In this embodiment, the routing or forwarding of packets based on the first and second information can be understood as an optimization of the routing matching algorithm of the routing device. Specifically, in related technologies, routing and forwarding are performed based on the destination IP configuration. However, in this embodiment, not only does the destination address need to match (i.e., the routing information in the second information includes the third information), but the packet cleaning status also needs to match (i.e., the first information indicates that the packet has not been cleaned), thereby ensuring that the injected traffic can be correctly identified and forwarded.
[0117] For example, all routing devices in the operator network, including edge routing devices, query the routing table for the routing information of the received packet. When the routing information corresponds to a traction route (i.e., the corresponding route is a traction route), they determine whether the third bit of the TOS field of the packet is "1". If it is "1", it indicates that the packet has been cleaned and is a back-injected packet, so the packet needs to be forwarded; if it is not "1", it indicates that the packet has not been cleaned and the packet needs to be forwarded.
[0118] Accordingly, this application also provides a message processing method applied to a second device, specifically a cloud platform, such as... Figure 4 As shown, the method includes:
[0119] Step 401: Receive the first message;
[0120] Step 402: Clean the first message to obtain a second message. The second message contains first information, which indicates that the message has been cleaned.
[0121] Step 403: Send the second message to the first device.
[0122] In practical applications, the first message is the message that the first device pulls to the second device; the first message may contain first information, which indicates that the message has not been cleaned.
[0123] In practical applications, the first device needs to receive both cleaned and uncleaned packets. In order for the first device to accurately distinguish between cleaned and uncleaned packets and thus accurately forward the second packet, an identifier can be added to the second packet to indicate that the packet has been cleaned.
[0124] Based on this, in one embodiment, when the second message is received, the method further includes:
[0125] A first identifier is set in the second message; after the first identifier is set in the second message, the first information indicates that the message has been cleaned.
[0126] In practical applications, the reserved bits in the TOS field of the message can be used to set the identifier.
[0127] Based on this, in one embodiment, setting the first identifier in the second message includes:
[0128] The first identifier is set in the reserved bits in the TOS field of the second message.
[0129] In practical applications, the first identifier can be set in the high three bits of the TOS field of the second message. Specifically, the first identifier can be set in at least one of the high three bits of the TOS field of the second message.
[0130] This application also provides a message processing method, such as... Figure 5 As shown, the method includes:
[0131] Step 501: The first device receives a message containing first information, which indicates whether the message has been cleaned.
[0132] Step 502: The first device determines the second information, which includes the routing information of the message. The routing information may or may not include the third information, and the third information indicates that the corresponding route includes a traction route.
[0133] Step 503: The first device uses the first information and / or the second information to send the message to the second device for cleaning or to forward the message.
[0134] Step 504: The second device receives the first message, cleans the first message to obtain a second message, the second message contains first information, the first information indicating that the message has been cleaned;
[0135] Step 505: The second device sends the second message to the first device.
[0136] It should be noted that the specific processing procedures of the first and second devices have been detailed above and will not be repeated here.
[0137] The message processing method provided in this application embodiment includes: a first device receiving a message containing first information indicating whether the message has been cleaned; determining second information, which includes routing information of the message, and the routing information may or may not include third information, where the third information indicates that the corresponding route includes a towing route; using the first information and / or the second information, sending the message to a second device for cleaning or forwarding the message; the second device receiving the first message, cleaning the first message to obtain a second message, the second message containing the first information indicating that the message has been cleaned; and sending the second message to the first device. The solution provided in this application embodiment utilizes the message's routing information and cleaning status information to tow or forward the message, accurately identifying and forwarding back-injection messages. The solution provided in this application embodiment only optimizes the routing matching algorithm, eliminating the need for additional VPN tunnel and back-injection network configuration, thus reducing resource deployment.
[0138] The following section provides a more detailed description of this application with reference to application examples.
[0139] Figure 6 This is a schematic diagram of the architecture of the example message processing system used in this application, as shown below. Figure 6 As shown, the system includes a source router 601, a tractor router 602, a security pool 603, a forwarding router 604, and a destination router 605. The tractor router 602 and the forwarding router 604 can be edge routers located at the edge of the carrier network (i.e., the network operator's bearer network).
[0140] The functions of the source router 601, the towing router 602, the security pool 603, the forwarding router 604, and the target router 605 are described below.
[0141] Source router 601 is used to send messages to tractor router 602, such as messages that need to be tracted by tractor router 602 to security pool 603 for cleaning, or messages that need to be forwarded by tractor router 602.
[0142] The tractor router 602 is used to receive packets sent by the source router 601 and the security pool 603, or to receive packets forwarded by other routers, and to tract packets that need to be cleaned in the received packets to the security pool 603, or to forward packets that have been cleaned in the received packets.
[0143] Here, whether a message needs to be cleaned can be determined by whether the third bit of the high three bits of the TOS field is "0". Specifically, when the value of this bit is "0", it means that the message has not been cleaned, and when the value of this bit is "1", it means that the message has been cleaned.
[0144] In practical applications, to prevent packets from being tampered with before entering the tractor router 602 (i.e., the third bit of the high three bits of the packet's TOS field is set to "1" to evade the tractor router 602), for all packets originating from the source router 601, the tractor router 602 can set the third bit of the high three bits of the packet's TOS field to "0". In other words, all packets sent to the source router 601 are sent to the security pool 603 for cleaning.
[0145] Security pool 603 is used to receive uncleaned packets sent by traction router 602, clean the uncleaned packets, and send the cleaned packets back to traction router 602.
[0146] Forwarding router 604 is used to receive packets forwarded by towing router 602 and send the packets to the destination router 605. It can receive packets forwarded by towing router 602 through dynamic routing within the carrier network.
[0147] The target router 605 is used to receive and forward packets sent by router 604.
[0148] Based on the above architecture diagram, the example message processing method applied in this application mainly includes two parts: message forwarding and back-injection; such as Figure 7 As shown, the message forwarding in the example message processing method of this application may include the following steps:
[0149] Step 701: The traction router 602 receives the message and determines whether the message hits the traction route. That is, the first device receives the message and determines the second information, which includes the routing information of the message. The routing information may or may not include the third information. The third information indicates that the corresponding route includes the traction route. If the message hits the route, step 702 is executed. If the message misses the route, step 708 is executed.
[0150] When a packet hits a traction route (meaning the packet's route includes the traction route), it indicates that the packet needs to be cleaned. Further determination is needed to determine whether the packet has already been cleaned, and thus whether to traction or forward the packet. When a packet does not hit a traction route (meaning the packet's route does not include the traction route), it indicates that the packet does not need to be cleaned, and therefore, the packet can be forwarded directly.
[0151] For example, as shown in Table 1, a new identifier "T" is added to the routing table to represent a traction route; accordingly, when querying a route from the routing table, it can be determined whether the route is a traction route based on whether the route contains the identifier "T".
[0152]
[0153] Table 1
[0154] Specifically, after receiving a packet, the traction router 602 queries the routing table for the packet's routing information. If the route corresponding to the routing information contains the identifier "T", it determines that the route corresponding to the routing information contains the traction route, meaning the packet has hit the traction route. Conversely, if the route corresponding to the routing information does not contain the identifier "T", it determines that the route corresponding to the routing information contains the forwarding route, meaning the packet has not hit the traction route.
[0155] One approach is to configure the routing table across the entire network using static routing, where the configured tractor routes contain the marker "T". Alternatively, one approach is to configure the routing table for each router using dynamic routing, where the configured tractor routes also contain the marker "T".
[0156] Step 702: The tractor router 602 determines whether the sender of the packet is the source router 601 through the ingress interface. If the sender is the source router 601, step 703 is executed. If the sender is not the source router 601, step 704 is executed.
[0157] Step 703: The towing router 602 sets the third bit of the high three bits of the message TOS field to "0", and then executes step 705;
[0158] Here, since unauthorized users may illegally set the third bit of the TOS field in the packet to "1" to allow the unauthorized packet to evade traction and cleaning, setting the third bit of the TOS field in all packets from the source router 601 to "0" can effectively prevent the packet from failing to hit the traction route due to illegal tampering and avoid unauthorized packets evading security monitoring.
[0159] Step 704: The tractor router 602 determines whether the third bit of the high three bits of the message TOS field is "0". If the third bit of the high three bits is "0", proceed to step 705; if the third bit of the high three bits is "1", proceed to step 708.
[0160] Specifically, if the third bit of the high three bits is "0", it indicates that the packet has not yet been processed by the security resource pool and needs to be redirected to security pool 603 for cleaning; if the third bit of the high three bits is "1", it indicates that the packet has been processed by the security resource pool and needs to continue to look up the routing table and forward it according to the next hit routing table entry.
[0161] Step 705: The tractor router 602 tracts the packet to the security pool 603 for cleaning, i.e., executes step 706; that is, the tractor router 602 uses the first information and the second information to send the packet to the second device for cleaning.
[0162] Step 706: Security pool 603 receives the message and parses it to determine whether the message is valid. If the message is valid, step 707 is executed. If the message is invalid, the message is discarded and the current processing flow ends.
[0163] Step 707: Security pool 603 sets the third bit of the high three bits of the message TOS field to "1" and sends the message to tractor router 602, and then executes step 701.
[0164] Specifically, the third bit of the high three bits of the TOS field in the message is set to "1", which means that the security pool 603 has performed identification processing on the message. After identification processing, the message carries the cleaned identifier, that is, the value of the third bit is "1". Therefore, after the message with identification processing is sent to the tractor router 602, the tractor router 602 can determine from the value of the third bit that the message is a message injected back by the security pool 603, so it can accurately forward the injected message and avoid redirecting the injected message back to the security pool 603.
[0165] Step 708: Forward the message and end the current processing flow.
[0166] After the forwarded message is sent to the forwarding router 604 via the operator's network, the forwarding router 604 sends the message to the target router 605.
[0167] In the application example of this application, the security pool 603 sets the third bit of the TOS field of the cleaned packet to "1". The traction router 602 will then look up the traction route based on the state of this bit. Specifically, when the third bit of the TOS field is "1", the packet will not hit the traction route, thereby preventing the traction router 602 from sending the cleaned traffic back to the security pool and thus creating a traffic loop.
[0168] The solution provided in the application example of this application has the following two main technical advantages:
[0169] First, zero hardware additions and zero capacity expansion.
[0170] Specifically, this application example uses a combination of traction route marking and IP packet marking. Based on the existing edge routing equipment, only a software upgrade is needed to solve the looping problem of reinjected traffic. For example, an identifier is added to the routing table, and the third bit of the TOS field of the packet is set to "1". No additional hardware deployment is required. At the same time, since the reinjected traffic carries a mark indicating whether it has been processed by the security resource pool, the reinjected traffic cannot hit the traction route when performing route matching. It does not need to rely on configuring network routes to complete the reinjection. Therefore, there is no need to build a physical reinjection network or a virtual reinjection network, avoiding a large amount of redundant construction and reducing resource deployment.
[0171] Second, the entire network features free and near-source traction, resulting in high maintainability.
[0172] Specifically, this application example uses IP packet marking to match the routing table, without relying on network routing to complete the back injection. Therefore, it can drive and inject traffic at any node in the network, realizing traffic diversion on the near-source side, thereby enabling better handling of attack traffic. At the same time, since the traffic is directly injected back into the original network, only the version of the original network needs to be upgraded, without modifying the existing network, resulting in high maintainability.
[0173] To implement the method on the first device side of the embodiments of this application, the embodiments of this application also provide a message processing apparatus, disposed on the first device, such as... Figure 8 As shown, the device includes:
[0174] The first receiving unit 801 is used to receive a message, the message containing first information, the first information indicating whether the message has been cleaned;
[0175] The determining unit 802 is used to determine second information, the second information including the routing information of the message, the routing information including third information or not including third information, the third information indicating that the corresponding route includes a traction route;
[0176] The first sending unit 803 is used to send the message to the second device for cleaning or to forward the message using the first information and / or the second information.
[0177] In one embodiment, the first sending unit 803 is configured to send the packet to a second device for cleaning when the routing information in the second information includes third information and the first information indicates that the packet has not been cleaned.
[0178] In one embodiment, the first sending unit 803 is configured to forward the packet when the routing information in the second information contains third information and the first information indicates that the packet has been cleaned.
[0179] In one embodiment, the first sending unit 803 is configured to forward the message if the routing information in the second information does not contain the third information.
[0180] In one embodiment, the first receiving unit 801 is further configured to:
[0181] Obtain fourth information, wherein the fourth information indicates that the sending device of the message is a source routing device; wherein,
[0182] If the fourth piece of information is obtained, the first piece of information indicates that the message has not been cleaned.
[0183] In one embodiment, the first receiving unit 801 is configured to:
[0184] Obtain the first identifier from the message; wherein,
[0185] If the first identifier is obtained, the first information indicates that the message has been cleaned;
[0186] or,
[0187] Without obtaining the first identifier, the first information indication message was not cleaned.
[0188] In one embodiment, the first receiving unit 801 is specifically used for:
[0189] The first identifier is obtained from the reserved bits in the TOS field of the message.
[0190] In one embodiment, the determining unit 802 is configured to:
[0191] The routing information of the packet is retrieved from the routing table, which contains at least one entry for routing information; wherein,
[0192] For each piece of routing information in at least one routing information, if the route includes a tractor route, the routing information contains third information; if the route includes a forwarding route, the routing information does not contain third information.
[0193] In one embodiment, the determining unit 802 is further configured to:
[0194] For each of the at least one routing information, if the routing information contains a second identifier, it is determined that the corresponding route contains a traction route.
[0195] In practical applications, the first receiving unit 801 and the first sending unit 803 can be implemented by a processor in the message processing device combined with a communication interface, and the determining unit 802 can be implemented by a processor in the message processing device.
[0196] To implement the method on the second device side of the embodiments of this application, the embodiments of this application also provide a message processing apparatus, disposed on the second device, such as... Figure 9 As shown, the device includes:
[0197] The second receiving unit 901 is used to receive the first message;
[0198] The cleaning unit 902 is used to clean the first message to obtain a second message, the second message containing first information, the first information indicating that the message has been cleaned;
[0199] The second sending unit 903 is used to send the second message to the first device.
[0200] In one embodiment, upon receiving the second message, the cleaning unit 902 is further configured to:
[0201] A first identifier is set in the second message; after the first identifier is set in the second message, the first information indicates that the message has been cleaned.
[0202] In one embodiment, the cleaning unit 902 is specifically used for:
[0203] The first identifier is set in the reserved bits in the TOS field of the second message.
[0204] In practical applications, the second receiving unit 901 and the second sending unit 903 can be implemented by a processor in the message processing device combined with a communication interface, and the cleaning unit 902 can be implemented by a processor in the message processing device.
[0205] It should be noted that the message processing device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the message processing device and message processing method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.
[0206] Based on the hardware implementation of the above program modules, and in order to implement the method on the first device side of the embodiments of this application, the embodiments of this application also provide a first device, specifically, which may be an edge router; such as Figure 10As shown, the first device 1000 includes:
[0207] The first communication interface 1001 is capable of exchanging information with the second device; for example, sending a first message to the second device and receiving a second message sent by the second device.
[0208] The first processor 1002 is connected to the first communication interface 1001 to enable information interaction with the second device and to execute the methods provided by one or more technical solutions on the first device side when running a computer program.
[0209] The computer program is stored in the first memory 1003.
[0210] Specifically, the first communication interface 1001 is used to receive a message containing first information, the first information indicating whether the message has been cleaned; and to send the message to a second device for cleaning or to forward the message using the first information and / or the second information.
[0211] The first processor 1002 is configured to determine the second information, the second information including the routing information of the message, the routing information including or not including third information, the third information indicating that the corresponding route includes a traction route.
[0212] In one embodiment, the first communication interface 1001 is used to send the packet to a second device for cleaning when the routing information in the second information includes third information and the first information indicates that the packet has not been cleaned.
[0213] In one embodiment, the first communication interface 1001 is used to forward the packet when the routing information in the second information contains third information and the first information indicates that the packet has been cleaned.
[0214] In one embodiment, the first communication interface 1001 is used to forward the message when the routing information in the second information does not contain the third information.
[0215] In one embodiment, the first communication interface 1001 is further configured to:
[0216] Obtain fourth information, wherein the fourth information indicates that the sending device of the message is a source routing device; wherein,
[0217] If the fourth piece of information is obtained, the first piece of information indicates that the message has not been cleaned.
[0218] In one embodiment, the first communication interface 1001 is further configured to:
[0219] Obtain the first identifier from the message; wherein,
[0220] If the first identifier is obtained, the first information indicates that the message has been cleaned;
[0221] or,
[0222] Without obtaining the first identifier, the first information indication message was not cleaned.
[0223] In one embodiment, the first communication interface 1001 is specifically used to obtain the first identifier from the reserved bits in the TOS field of the message.
[0224] In one embodiment, the first processor 1002 is configured to look up routing information of the packet from a routing table, the routing table containing at least one routing record; wherein,
[0225] For each of the at least one routing information entries, if the route includes a tractor route, the routing information contains third information; if the route includes a forwarding route, the routing information does not contain third information.
[0226] In one embodiment, the first router 902 is further configured to:
[0227] For each route in at least one route in the routing policy, if the corresponding route contains a second identifier, the corresponding route is used as the tractor route.
[0228] It should be noted that the specific processing procedures of the first processor 1002 and the first communication interface 1001 can be understood by referring to the above method.
[0229] Of course, in practical applications, the various components in the first device 1000 are coupled together through the bus system 1004. It can be understood that the bus system 1004 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 11 The general labeled all buses as Bus System 1004.
[0230] The first memory 1003 in this embodiment is used to store various types of data to support the operation of the first device 1000. Examples of such data include any computer program used to operate on the first device 1000.
[0231] The methods disclosed in the embodiments of this application can be applied to the first processor 1002, or implemented by the first processor 1002. The first processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the first processor 1002. The first processor 1002 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 1002 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the first memory 1003. The first processor 1002 reads the information in the first memory 1003 and completes the steps of the aforementioned method in combination with its hardware.
[0232] In an exemplary embodiment, the first device 1000 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.
[0233] Based on the hardware implementation of the above program modules, and in order to implement the method on the second device side of the embodiments of this application, the embodiments of this application also provide a second device, specifically, which may be a cloud platform; such as Figure 11 As shown, the second device 1100 includes:
[0234] The second communication interface 1101 is capable of exchanging information with the first device; for example, sending a second message to the first device and receiving a first message sent by the first device.
[0235] The second processor 1102 is connected to the second communication interface 1101 to enable information interaction with the first device and to execute the methods provided by one or more technical solutions on the second device side when running a computer program.
[0236] The computer program is stored in the second memory 1103.
[0237] Specifically, the second communication interface is used to receive the first message and send the second message to the first device;
[0238] The second processor is used to clean the first message to obtain the second message, the second message containing first information indicating that the message has been cleaned.
[0239] In one embodiment, the second processor 1102 is further configured to:
[0240] When the second message is obtained through the second communication interface 1101, a first identifier is set in the second message; after the first identifier is set in the second message, the first information indicates that the message has been cleaned.
[0241] In one embodiment, the second processor 1102 is specifically used for:
[0242] The first identifier is set in the reserved bits in the TOS field of the second message.
[0243] It should be noted that the specific processing procedures of the second processor 1102 and the second communication interface 1101 can be understood by referring to the above method.
[0244] Of course, in practical applications, the various components in the second device 1100 are coupled together via the bus system 1104. It can be understood that the bus system 1104 is used to implement communication between these components. In addition to a data bus, the bus system 1104 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 12 The general designated all buses as Bus System 1104.
[0245] The second memory 1103 in this embodiment is used to store various types of data to support the operation of the second device 1100. Examples of such data include any computer program used to operate on the second device 1100.
[0246] The methods disclosed in the above embodiments of this application can be applied to the second processor 1102, or implemented by the second processor 1102. The second processor 1102 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the second processor 1102. The second processor 1102 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 1102 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the second memory 1103. The second processor 1102 reads the information in the second memory 1103 and completes the steps of the aforementioned method in conjunction with its hardware.
[0247] In an exemplary embodiment, the second device 1100 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.
[0248] It is understood that the memories (first memory 1003, second memory 1103) in the embodiments of this application can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.
[0249] To implement the method of the embodiments of this application, the embodiments of this application also provide a message processing system, such as... Figure 12 As shown, the system includes: a first device 1201 and a second device 1202; wherein,
[0250] The first device 1201 is used for:
[0251] Receive a message, the message containing first information, the first information indicating whether the message has been cleaned;
[0252] Determine the second information, which includes the routing information of the message, and the routing information may or may not include the third information, wherein the third information indicates that the corresponding route includes a traction route;
[0253] Using the first information and / or the second information, the message is sent to the second device for cleaning or the message is forwarded;
[0254] The second device 1202 is used for:
[0255] Receive the first message;
[0256] The first message is cleaned to obtain a second message, which contains first information indicating that the message has been cleaned.
[0257] The second message is sent to the first device.
[0258] It should be noted that the specific processing procedures of the first device 1201 and the second device 1202 have been described in detail above and will not be repeated here.
[0259] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a first memory 1003 storing a computer program, which can be executed by a first processor 1002 of a first device 1000 to complete the steps described in the aforementioned first device-side method. Another example is a second memory 1103 storing a computer program, which can be executed by a second processor 1102 of a second device 1100 to complete the steps described in the aforementioned second device-side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.
[0260] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.
[0261] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.
[0262] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.
Claims
1. A message processing method, characterized in that, Applied to the first device, including: Receive a message, the message containing first information, the first information indicating whether the message has been cleaned; The incoming interface is used to determine whether the sending device of the message is a source routing device. The incoming interface is the interface between the first device and other routing devices. Wherein, if the sending device of the message is the source routing device, the first device processes the message so that the processed message does not contain the first identifier; if the sending device of the message is not the source routing device, the first identifier of the message is not processed. The routing information of the packet is retrieved from the routing table, which contains at least one entry for routing information; For each of the at least one routing information, if the route corresponding to the routing information includes a traction route, the routing information contains third information; if the route corresponding to the routing information includes a forwarding route, the routing information does not contain the third information, wherein, if the routing information contains a second identifier, it is determined that the corresponding route includes the traction route; The first identifier is obtained from the reserved bits in the Message Service Type (TOS) field; Wherein, if the first identifier is obtained, the first information indicates that the packet has been cleaned; or, if the first identifier is not obtained, the first information indicates that the packet has not been cleaned. Using the first information and / or the routing information, the packet is sent to the second device for cleaning or the packet is forwarded; wherein, if the routing information contains the third information and the first information indicates that the packet has not been cleaned, the packet is sent to the second device for cleaning; if the routing information contains the third information and the first information indicates that the packet has been cleaned, the packet is forwarded.
2. The method according to claim 1, characterized in that, If the routing information does not contain the third information, the message will be forwarded.
3. A message processing apparatus, characterized in that, include: A first receiving unit is configured to receive a message, the message containing first information, the first information indicating whether the message has been cleaned; A determining unit is configured to look up the routing information of the packet from a routing table, the routing table containing at least one routing information; for each routing information in the at least one routing information, if the routing information corresponds to a traction route, the routing information contains third information; if the routing information corresponds to a forwarding route, the routing information does not contain the third information, wherein, if the routing information contains a second identifier, it is determined that the corresponding route contains the traction route; A first sending unit is configured to use the first information and / or the routing information to send the packet to a second device for cleaning or to forward the packet; wherein, if the routing information contains the third information and the first information indicates that the packet has not been cleaned, the packet is sent to the second device for cleaning; if the routing information contains the third information and the first information indicates that the packet has been cleaned, the packet is forwarded. The device is further configured to determine whether the sending device of the message is a source routing device through an ingress interface, wherein the ingress interface is an interface between the first device and other routing devices; wherein, if the sending device of the message is the source routing device, the first device processes the message so that the processed message does not contain the first identifier; if the sending device of the message is not the source routing device, the first identifier of the message is not processed. The device is further configured to obtain the first identifier from a reserved bit in the Message Service Type (TOS) field; wherein, if the first identifier is obtained, the first information indicates that the message has been cleaned; or, if the first identifier is not obtained, the first information indicates that the message has not been cleaned.
4. A first device, characterized in that, Includes a first communication interface and a first processor; wherein, The first communication interface is configured to receive a message containing first information indicating whether the message has been cleaned; and to send the message to a second device for cleaning or forward the message using the first information and / or the routing information; wherein, if the routing information contains the third information and the first information indicates that the message has not been cleaned, the message is sent to the second device for cleaning; if the routing information contains the third information and the first information indicates that the message has been cleaned, the message is forwarded. The first processor is configured to look up the routing information of the packet from a routing table, the routing table containing at least one routing information; for each routing information in the at least one routing information, if the routing information corresponds to a traction route, the routing information contains third information; if the routing information corresponds to a forwarding route, the routing information does not contain the third information, wherein, if the routing information contains a second identifier, it is determined that the corresponding route contains the traction route; The first device is further configured to determine whether the sending device of the packet is a source routing device through an ingress interface, wherein the ingress interface is an interface between the first device and other routing devices; wherein, if the sending device of the packet is the source routing device, the first device processes the packet so that the processed packet does not contain the first identifier; if the sending device of the packet is not the source routing device, the first identifier of the packet is not processed. The first device is further configured to obtain the first identifier from a reserved bit in the Message Service Type (TOS) field; wherein, if the first identifier is obtained, the first information indicates that the message has been cleaned; or, if the first identifier is not obtained, the first information indicates that the message has not been cleaned.
5. A first device, characterized in that, include: A first processor and a first memory for storing computer programs capable of running on the processor. Wherein, when the first processor is used to run the computer program, it performs the steps of the method described in claim 1 or 2.
6. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method of claim 1 or 2.
Citation Information
Patent Citations
Message forwarding method and device
CN106059939A
Flow cleaning method and device, electronic equipment and storage medium
CN112532621A