Message processing method and device, DPU and SDN controller

Abstract

The application provides a message processing method and device, a DPU and an SDN controller, and relates to the technical field of network security. The method comprises the following steps: unloading configuration information sent by a software-defined wide area network (SDN) controller, wherein the configuration information comprises security policy (SP) information and security alliance (SA) information; adding entries in a pre-defined SP table based on the SP information to obtain a target SP table; adding entries in a pre-defined SA table based on the SA information to obtain a target SA table; wherein the target SP table is used to determine whether to encrypt a message sent by at least one POP, and the target SA table is used to determine encryption information of the message sent by the at least one POP and decryption information of the message sent to the at least one POP. By inserting a hardware DPU into a target host and using the DPU to encrypt and decrypt the message, the application can save the computing resources of the target host deployed by the POP and reduce the power consumption of the target host.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a message processing method, apparatus, DPU and SDN controller. Background Technology

[0002] Software-defined wide area network (SDWAN) networking includes point-of-presence (POP) networking, where customer-premise equipment (CPE) accesses the central network. A POP deployed in the edge cloud connects multiple CPEs, which can access the central network through the edge cloud POP and other POPs. In related technologies, the physical servers in the edge cloud often cannot provide sufficient computing resources to the edge cloud POPs, resulting in relatively limited computing resources for POPs deployed in the edge cloud. Summary of the Invention

[0003] This application provides a message processing method, apparatus, DPU, and SDN controller to address the technical problem of limited computing resources for POPs deployed in edge clouds.

[0004] To solve the above-mentioned technical problems, this application is implemented as follows:

[0005] In a first aspect, embodiments of this application provide a message processing method applied to a data processing unit (DPU), wherein the DPU is located on a target host, and the target host has at least one access point (POP) deployed thereon. The method includes:

[0006] Unload the configuration information sent by the Software Defined Wide Area Network (SDN) controller, which includes Security Policy (SP) information and Security Association (SA) information;

[0007] Based on the SP information, entries are added to the predefined SP table entries to obtain the target SP table;

[0008] Based on the SA information, entries are added to the predefined SA table entries to obtain the target SA table;

[0009] The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0010] Secondly, embodiments of this application provide a message processing method applied to a software-defined wide area network (SDN) controller, the method comprising:

[0011] Send configuration information to the data processor (DPU), the configuration information including security policy (SP) information and security association (SA) information, the DPU being set on the target host, the target host having at least one access point (POP) deployed;

[0012] The SP information is used to add entries to predefined SP table entries to obtain a target SP table, and the SA information is used to add entries to predefined SA table entries to obtain a target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0013] Thirdly, embodiments of this application provide a message processing apparatus applied to a data processor (DPU), wherein the DPU is located on a target host, and the target host has at least one access point (POP) deployed thereon. The apparatus includes:

[0014] The unloading module is used to unload the configuration information sent by the software-defined wide area network (SDN) controller, including security policy (SP) information and security association (SA) information.

[0015] The first adding module is used to add entries to the predefined SP table entries based on the SP information to obtain the target SP table.

[0016] The second adding module is used to add entries to the predefined SA table entries based on the SA information to obtain the target SA table.

[0017] The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0018] Fourthly, embodiments of this application provide a message processing apparatus applied to a software-defined wide area network (SDN) controller, the apparatus comprising:

[0019] The sending module is used to send configuration information to the data processor (DPU). The configuration information includes security policy (SP) information and security association (SA) information. The DPU is set on the target host, and the target host has at least one access point (POP) deployed on it.

[0020] The SP information is used to add entries to predefined SP table entries to obtain a target SP table, and the SA information is used to add entries to predefined SA table entries to obtain a target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0021] Fifthly, embodiments of this application provide a data processor (DPU), wherein the DPU is located on a target host, the target host having at least one access point (POP) deployed, and the DPU includes a transceiver and a processor.

[0022] The processor is used to unload the configuration information sent by the software-defined wide area network (SDN) controller, the configuration information including security policy (SP) information and security association (SA) information;

[0023] The processor is further configured to add entries to predefined SP table entries based on the SP information to obtain a target SP table;

[0024] The processor is further configured to add entries to predefined SA entries based on the SA information to obtain a target SA table;

[0025] The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0026] Sixthly, embodiments of this application provide a software-defined wide area network (SDN) controller, the SDN controller including a transceiver and a processor.

[0027] The transceiver is used to send configuration information to the data processor (DPU). The configuration information includes security policy (SP) information and security association (SA) information. The DPU is set on the target host, and the target host has at least one access point (POP) deployed.

[0028] The SP information is used to add entries to predefined SP table entries to obtain a target SP table, and the SA information is used to add entries to predefined SA table entries to obtain a target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0029] In a seventh aspect, embodiments of this application provide a data processor (DPU), including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the message processing method as described in the first aspect.

[0030] Eighthly, embodiments of this application provide a software-defined wide area network (SDN) controller, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the packet processing method as described in the second aspect.

[0031] In a ninth aspect, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the message processing method as described in the first aspect; or, when executed by a processor, the computer program implements the steps of the message processing method as described in the second aspect.

[0032] In a tenth aspect, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the message processing method as described in the first aspect; or, when executed by a processor, the computer instructions implement the steps of the message processing method as described in the second aspect.

[0033] In this embodiment, a DPU is configured on the target host. The SDN sends configuration information, including SP (Service Provider) and SA (Service Provider) information, to the DPU. The DPU can add entries to predefined SP table entries based on the SP information to obtain the target SP table; and it can add entries to predefined SA table entries based on the SA information to obtain the target SA table. After obtaining the target SP table and target SA table, the DPU can encrypt and decrypt packets according to the target SP table and target SA table. Based on this, by inserting a hardware DPU into the target host and using the DPU to encrypt and decrypt packets, this embodiment can save computing resources on the target host deployed in POP and reduce the power consumption of the target host. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a schematic diagram of an SDWAN network provided in an embodiment of this application;

[0036] Figure 2 This is one of the flowcharts of a message processing method provided in the embodiments of this application;

[0037] Figure 3 This is one of the vPOP security DPU architecture diagrams provided in the embodiments of this application;

[0038] Figure 4 This is a second vPOP secure DPU architecture diagram provided in the embodiments of this application;

[0039] Figure 5 This is a second flowchart of a message processing method provided in an embodiment of this application;

[0040] Figure 6 This is one of the structural schematic diagrams of a message processing device provided in the embodiments of this application;

[0041] Figure 7 This is a second schematic diagram of the structure of a message processing device provided in the embodiments of this application;

[0042] Figure 8 This is a schematic diagram of the structure of a DPU provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0044] To better understand the technical solutions of the embodiments of this application, the relevant content is described below.

[0045] (1) POP networking

[0046] With the digital transformation of enterprises, more and more companies are using SD-WAN (SDN) as an important means of cloud access and enterprise networking to connect customer networks and data center networks. SD-WAN networking is divided into two methods: Internet Protocol Security (IPSec) direct connection and Point of Presence (POP) networking. Due to its advantages in supporting multi-tenancy and large-scale networking, POP networking has become the mainstream. A POP typically consists of multiple physical servers, which provide the relevant computing resources to the POP.

[0047] See Figure 1 In related technologies, to provide localized cloud services to users, POP (edge ​​POP) nodes are deployed to the metropolitan area network via the network. An edge cloud POP may connect to thousands of CPE devices. Assuming a bandwidth of 100Mbps per CPE, each edge cloud virtualized POP (vPOP) needs a performance of over 100Gbps to meet the bandwidth requirements.

[0048] However, edge cloud virtualization Point of Presence (POP) is inherently limited by virtualization overhead and the performance constraints of using software for Internet Protocol Security (IPsec) encryption and decryption. Specifically, related technologies typically employ software for IPsec encryption and decryption, and even a large packet of 1024 bytes can only provide a throughput of around 1Gbps. Therefore, a cluster of over 100 virtual machines is usually required to meet the performance demands of POP. This approach consumes a significant number of Central Processing Unit (CPU) cores, and the large size of the virtual machine cluster increases the technical complexity of management and data plane control. Furthermore, edge servers are generally low-cost physical servers, often unable to provide sufficient CPU resources to POP. Clearly, related technologies suffer from the technical challenge of limited computing resources for POP.

[0049] (2) IPsec

[0050] IPsec refers to the encryption and authentication of Internet Protocol (IP) data packets to protect the security of IP protocol network transmissions. In related technologies, the aforementioned Point of Presence (POP) typically uses software for IPsec encryption / decryption, and for encapsulation and decapsulation in IPsec tunnel mode. However, software-based IPsec encryption / decryption and encapsulation / decapsulation consumes significant CPU resources, and the physical servers used to build edge POPs often struggle to provide sufficient CPU resources to the POPs.

[0051] In this application embodiment, a message processing method, apparatus, DPU, and SDN controller are proposed to solve the technical problem of limited computing resources for POPs deployed in edge clouds.

[0052] See Figure 2 , Figure 2 This is one of the flowcharts of a message processing method provided in an embodiment of this application. The method is applied to a data processor (DPU), the DPU is set on a target host, and the target host has at least one access point (POP) deployed. The method includes:

[0053] Step 101: Unload the configuration information sent by the Software Defined Wide Area Network (SDN) controller, including Security Policy (SP) information and Security Association (SA) information;

[0054] Step 102: Add entries to the predefined SP table entries based on the SP information to obtain the target SP table;

[0055] Step 103: Add entries to the predefined SA table entries based on the SA information to obtain the target SA table;

[0056] The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0057] It is worth noting that the number of target hosts can be one or more. In the case of multiple target hosts, all target hosts provide computing resources to the POP. The target host inserts a DPU, and the virtual machines deployed on the target host can share the DPU's resources.

[0058] In step 101, the SDN controller sends configuration information to the DPU, which includes SP information and SA information. The SA information contains the IPsec encryption algorithm, the IPsec authentication algorithm, and their related key information; the SP information contains information for specifying the stream of interest (i.e., the data stream that needs encryption), and information for specifying which SA or SAs to use for the packet. In this embodiment, the SA and SP information are directly distributed by the SDN, simplifying the key exchange process, and all network elements in the SDN scenario are white-boxed and autonomously controllable.

[0059] It is worth noting that in this embodiment, the tunnel mode of IPSec can be used for encrypted transmission. Specifically, tunnel mode refers to encrypting the IP payload and encapsulating the entire IP data packet using an Authentication Header (AH) header, an Encapsulating Security Payload (ESP) header, or other IP headers. In tunnel mode, the IP address of the outer (or outer layer) IP header is the tunnel endpoint, and the IP addresses in the encapsulated IP header are the final source and destination IP addresses. Using tunnel mode, a new tunnel header is added to the data packet, with the original header placed after the new header, which helps improve the security of message transmission. Taking the ESP tunnel mode as an example, in this embodiment, after encrypting the message by matching the target SP table and the target SA table, the preset ESP table in the DPU can be matched to add an ESP header (i.e., a new message header).

[0060] It should be noted that the vPOP of the access security DPU card is divided into a control plane and a data plane. The SDN controller is responsible for issuing IPsec SA information and IPsec SP information from the control plane. The data plane is used for packet transmission and reception.

[0061] like Figure 3 As shown, the configuration stream (i.e., configuration information) sent by the SDN controller passes through the controller to the host-side virtual machine (VM), the vHost backend, and then to the DPU. In some embodiments, the configuration stream can be first parsed by a userspace agent based on an RISC microprocessor (Advanced RISC Machines, ARM) architecture, and then the stream can be offloaded to the hardware by calling the vhost encryption / decryption device offload interface (Cryptodev-vhost offload).

[0062] In steps 102 and 103, the predefined SP entries and predefined SA entries refer to entries that are pre-defined in the DPU by the compiler. These entries are used to define the specific style of the flow table. Based on the configuration information, specific entries of the flow table can be added to the predefined entries.

[0063] In the vPOP architecture of the DPU card in this application embodiment, the hardware implementation of the DPU typically includes Field Programmable Gate Array (FPGA), Network Processor (NP), and Application Specific Integrated Circuit (ASIC). Each of these hardware implementations has a custom network card forwarding framework and custom hardware forwarding table entries.

[0064] FPGAs offer good programmability, but due to manufacturing limitations, they consume more power and have lower performance, making it increasingly difficult to meet the high bandwidth and low power consumption requirements of data centers. NPs or ASICs combine programmability and high performance, enabling low-power system-on-chip (SoC) solutions. Therefore, in some embodiments, NPs or ASICs can be selected as the hardware implementation of the DPU.

[0065] In this embodiment, by inserting a hardware DPU into the target host, the DPU's physical network card provides a hardware-based security acceleration engine. Utilizing the DPU hardware for packet encryption, decryption, and encapsulation / decryption saves computing resources and reduces power consumption on the target host deployed in the POP deployment. In this embodiment, using a DPU card for IPSec encryption / decryption and encapsulation / decryption, a small edge cloud POP cluster can be built with two physical servers and more than ten VMs.

[0066] In this embodiment, SA and SP information are directly distributed via SDN. A target SP table is generated based on the SP information and predefined SP entries, and a target SA table is generated based on the SA information and predefined SA entries, simplifying the IPsec key negotiation process. The DPU can determine the flow of interest based on the target SP table and the encryption / decryption information of the packet based on the target SA table. Thus, the initial packet does not need to be sent to the software protocol stack, enabling a completely hardware-level IPsec hardware-to-tablet conversion, which is superior to the FPGA IPsec hardware acceleration and the hardware offloading acceleration scheme of the DPDK inline cryptodev in related technologies.

[0067] Optionally, the configuration information further includes routing information. After unloading the configuration information sent by the software definition WAN SDN controller, the method further includes:

[0068] Based on the routing information, entries are added to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for packets sent by the at least one POP, and / or, the at least one routing table is used to determine the routing rules for packets sent to the at least one POP.

[0069] In this implementation, the configuration information may further include routing information. The DPU can add entries to at least one predefined routing table entry based on the routing information to obtain at least one corresponding routing table. This at least one routing table may be an underlay-level routing table used to guide Layer 3 (IP layer) forwarding for outbound and inbound flows.

[0070] To make this clearer, the following example uses at least one of the above routing tables, which includes a next-hop node (NEXT_HOP) table, to illustrate how to determine routing rules based on the NEXT_HOP table.

[0071] In the above embodiments, for outgoing packets, after encrypting the packets by matching the target SP table and the target SA table, the ESP table can be matched and an ESP header can be added.

[0072] After adding the ESP header, the NEXT_HOP table can be matched, that is, the ID of the next hop can be found by the destination IP of the outgoing packet, and then the outgoing interface of the outgoing packet can be determined by the ID of the next hop.

[0073] In this embodiment of the application, the SDN controller issues routing information, and the DPU can determine at least one routing table based on the issued routing information and predefined entries, which is used to guide the routing rules for outbound and inbound packets.

[0074] Optionally, the uninstallation of the software defines the configuration information sent by the WAN SDN controller, including:

[0075] The SDN controller unloads configuration information sent by the target driver and the backend of the target host through the unloading interface. The target driver is the PollMode Driver (PMD) in the Data Platform Development Kit (DPDK) architecture and is deployed in the user space of the virtual machine on the target host.

[0076] See Figure 3In this embodiment, a semi-virtualized I / O user-space (Virtio user) encryption / decryption (Virtio-Crypto) PMD is added to the DPDK encryption / decryption device architecture (Cryptodev Framework). This PMD runs in a virtual machine environment and shares the same control plane API and data plane API with other DPDK Crypto PMDs. The control plane and data plane refer to the Virtio control plane and data plane. Deploying the user-space Virito-Crypto DPDK PMD in this embodiment, compared to deploying it in kernel space, supports zero-copy packets, burst batch processing of packets, and allows multiple user virtual machines to share a single backend encryption / decryption device (Cryptodev backend).

[0077] In this embodiment, the Cryptodev backend uses Vhost-User-crypto, a type of DPDK Vhost, which abstracts the API, shielding the details of Vhost and Cryptodev. After the secure DPU card is connected, the configuration information issued by SDN is sent to the Cryptodev backend via Virtio-Crypto-PMD running on a virtual machine. The Cryptodev backend then sends the configuration information to the DPU via Cryptodev-vhost, which is a specific implementation of the backend sending the configuration stream to the DPU. This embodiment uses the standardized vPOP of virtio-crypto to fully utilize the DPU's hardware (HW) for secure encryption / decryption and encapsulation.

[0078] See Figure 3 In related technologies, the Cryptodev buildtin deployed via vHost calls the SW crypto library for software encryption and decryption. In this embodiment, software encryption and decryption are unnecessary; the DPU handles encryption and decryption, as well as encapsulation and decryption when necessary, thus saving host computing resources. The DPU can be offloaded using an inline crypto engine. Before offloading, the userspace agent can parse the configuration information.

[0079] In this embodiment of the application, deploying the Virito-Crypto DPDK PMD in user space on a virtual machine, compared to deploying it in kernel space, can support zero-copy packets and burst batch processing of packets, and multiple user virtual machines can share a single Cryptodev backend.

[0080] Optionally, at least one of the predefined SP entries, the predefined SA entries, and at least one predefined routing table entry is predefined by a Programming Protocol-Independent Packet Processor (P4).

[0081] P4 is a high-level programmable protocol-independent processing language. Leveraging the inherent protocol independence of P4, the aforementioned entries can be pre-defined using P4, enabling subsequent modifications to standard protocols and innovations in network security. Furthermore, in this embodiment, the interface for customizing P4 entries can be exposed to users.

[0082] It is worth noting that, referring to the above embodiments, the hardware implementation of the DPU includes FPGA, NP, and ASIC methods. In this embodiment, a P4-defined NP or a P4-defined ASIC can be used, which combines programmability and high performance, and can achieve low power consumption of the SoC chip.

[0083] See Figure 4 Taking the domain-specific architecture (DSA) model defined by P4 as an example, this application provides an exemplary illustration of the use of P4 predefined features in its embodiments.

[0084] The predefined static entries in the P4 table can be compiled and generated by the P4 compiler. The P4 Entry in the table is generated from the configuration information mentioned above. In this implementation, the IPsec-related entries (the table entries specify the form of the table and have no specific entries) drive the generation of P4 Entry (the P4 Entry contains specific entries added from the configuration information based on the table entries). The P4 Entry includes the aforementioned target SA table, target SP table, and at least one routing table. After the P4 Entry is generated, subsequent data flow forwarding follows the DSA forwarding model, querying the P4 Entry for forwarding.

[0085] Figure 4 In the DSA forwarding model, parser.P4 refers to parsing data packets; classify.P4 refers to querying the classify matching table (including the target SA table and target SP table mentioned above), and querying the classify matching table is used to match the corresponding SP and SA; Ipsec.p4 is used to perform corresponding actions based on the matching results, such as encryption or decryption; eth.p4 is used to handle Layer 2 (L2) and Layer 3 (L3) services for ordinary network forwarding; and deparser.P4 is used to serialize packets.

[0086] In this embodiment, basic configuration and IPsec SA, SP and other configuration information are issued from the control plane. Custom flow tables are generated by driving the generation of predefined entries in P4 and configuration information. P4 is a high-level programmable protocol-independent processing language. Based on the natural advantage of P4 language protocol independence, the above-mentioned entries are predefined in P4, and standard protocols can be modified in the future to carry out network security innovation.

[0087] The DPU offload interface offloads configuration information to the hardware. After generating a custom flow table using P4 predefined entries and configuration information, VM-to-VM traffic undergoes hardware fast forwarding. During fast forwarding, outbound traffic is encrypted and ESP packets are encapsulated, while inbound traffic is decapsulated and decrypted. The hardware engine guides forwarding by looking up custom hardware matching tables stored in the Ternary Content Addressable Memory (TCAM) and Double Data Rate Synchronous Dynamic Random-Access Memory (DDR). TCAM and DDR can store different matching tables: TCAM maintains fuzzy matching flow tables for fast matching, while DDR handles precise matching flow tables. Flow tables requiring fast matching can be stored in TCAM, and those requiring precise matching can be stored in DDR. For example, a 32-bit routing table can be stored in DDR.

[0088] Optionally, the message outbound process in this application embodiment includes:

[0089] Receive a first message, wherein the first message is a message sent by a first POP, and the first POP is any one of the at least one POPs;

[0090] Based on the 5-tuple of the first message and the target SP table, determine the SP corresponding to the first message;

[0091] When the SP corresponding to the first message indicates that the first message is encrypted, the SA corresponding to the first message is determined based on the SP corresponding to the first message and the target SA table;

[0092] The first message is encrypted based on the SA corresponding to the first message.

[0093] In this embodiment of the application, by inserting a DPU to encrypt outbound messages, the CPU resources of the physical server can be saved and the power consumption of the physical server can be reduced.

[0094] In some embodiments, before matching the target SP table and the target SA table, it can be determined whether the first packet has been encapsulated. If it has been encapsulated, the first packet can be forwarded directly.

[0095] In some embodiments, the DPU can also perform Layer 2 switching of outgoing packets and client rate limiting, which are described in detail below.

[0096] a. Determine whether the outgoing message has been encapsulated by the information carried in the metadata of the outgoing message;

[0097] b. If no encapsulation has been added, execute c; otherwise, jump to h.

[0098] c. Query the CLASSIFY matching table (including the target SP table and target SA table mentioned above), match the SP of the outbound message with the 5-tuple of the outbound message, and if the SP indicates that the outbound message should be encrypted, match the SA corresponding to the outbound message. If the match is successful, send it to the DPU's built-in security coprocessor for encryption; otherwise, jump to h. The security coprocessor is a separate encryption and decryption hardware processor. When encryption and decryption are required, the DPU calls the security coprocessor to perform encryption and decryption calculations.

[0099] d. For IPsec tunnel mode transmission, match the ESP table, add an ESP header for packet encapsulation, otherwise jump to h;

[0100] e. Match the NEXT_HOP table to determine the ID of the outgoing packet NEXT_HOP, and determine the outgoing interface of the outgoing packet based on the NEXT_HOP ID; add the source IP address and destination IP address, and add the outer source port Media Access Control (MAC) address and destination MAC address;

[0101] f. Look up the Layer 2 encapsulation table based on the Layer 2 information in the header of the outgoing message, and perform Layer 2 switching;

[0102] g. Match the METER table to apply client-side rate limiting. METER is a traffic limiting algorithm used to limit the bandwidth capacity purchased by the customer.

[0103] h. Outgoing direction processing is complete.

[0104] Through the aforementioned outbound process, the DPU can perform IPsec encryption and encapsulation on outbound packets, as well as implement Layer 2 switching and client rate limiting.

[0105] Optionally, the message inbound process in this application embodiment includes:

[0106] Receive a second message, which is a message sent to a second POP, and the second POP is any one of the at least one POPs;

[0107] If it is determined that the second message will be decrypted, the SA corresponding to the second message is determined based on the source Internet Protocol IP address of the outer layer of the second message, the destination IP address of the outer layer of the second message, the Security Parameter Index (SPI) in the second message, and the target SA table;

[0108] The second message is decrypted based on the SA corresponding to the second message.

[0109] In this embodiment of the application, by inserting a DPU to decrypt inbound packets, the CPU resources of the physical server can be saved and the power consumption of the physical server can be reduced.

[0110] In some embodiments, if the second message is a message encapsulated with an ESP header, the DPU also needs to perform ESP decapsulation processing.

[0111] In some embodiments, the DPU can also perform Layer 2 and Layer 3 forwarding of inbound packets, which will be described in detail below.

[0112] a. Match the message type (PKT-TYPE) table to determine the specific type of the incoming message, and record the matching result in the metadata configuration (ingress_metadata) for subsequent processing; where PKT-TYPE is a table pre-stored in the DPU;

[0113] b. Layer 2 matching: Match the destination MAC address (Dest_mac) and Virtual LAN ID (VLAN_ID) of the incoming packet against the MAC table. If a match is found, check if the packet's IPv4 or IPv6 domain is valid. If valid, proceed to step c; otherwise, the process ends.

[0114] c. Layer 3 matching: Matching the destination IP address (Dest_ip) and Virtual Routing Forwarding (VRF) information of the incoming packets against the IP table; it can also check whether the destination address and VLAN_ID match precisely based on the ingress port of the incoming packets. If the IP table matches successfully, proceed to step d; otherwise, the process ends.

[0115] d. Look up the IPsec SA by using the source IP address, destination IP address, and Security Parameter Index (SPI) of the incoming packet.

[0116] Match the source MAC (SMAC) table and perform source MAC learning.

[0117] If the packet is a Layer 3 packet, it is matched against the host routing table. If a match is found and decapsulation is required, IPsec decryption and ESP decapsulation are performed. If no match is found, it is matched against the Longest Prefix Matchtable (LPM) table. If a match is found and decapsulation is required, IPsec decryption and ESP decapsulation are performed.

[0118] e. Perform Layer 3 forwarding and determine whether the decrypted and decapsulated packet matches the Layer 3 routing table. If yes, proceed to Layer 2 forwarding; otherwise, execution ends. The Layer 3 routing table can be the routing table obtained by adding routing information to predefined routing table entries in the above embodiments.

[0119] f. Match the Layer 2 Encapsulation (L2_ENCAP) table to exchange Layer 2 packet headers, query the Destination MAC (DMAC) table, and perform Layer 2 forwarding.

[0120] Through the aforementioned inbound process, the DPU can completely offload the Layer 2 and Layer 3 forwarding of inbound packets and the IPsec forwarding, thereby saving CPU resources on the edge server and reducing server power consumption.

[0121] See Figure 5 , Figure 5 This is a second flowchart of a message processing method provided in an embodiment of this application, used in an SDN controller, such as... Figure 5 As shown, the method includes the following steps:

[0122] Step 201: Send configuration information to the data processor (DPU). The configuration information includes security policy (SP) information and security association (SA) information. The DPU is set on the target host, and the target host has at least one access point (POP) deployed.

[0123] The SP information is used to add entries to predefined SP table entries to obtain a target SP table, and the SA information is used to add entries to predefined SA table entries to obtain a target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0124] Optionally, the configuration information further includes routing information, which is used to add entries to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for packets sent by the at least one POP, and / or the at least one routing table is used to determine the routing rules for packets sent to the at least one POP.

[0125] Optionally, sending configuration information to the data processor (DPU) includes:

[0126] Configuration information is sent to the DPU through the target driver and the backend of the target host. The target driver is the polling mode driver PMD in the Data Platform Development Kit (DPDK) architecture, and the target driver is deployed in the user space of the virtual machine on the target host.

[0127] It should be noted that this embodiment is as a comparison with... Figure 2 The implementation method of the SDN controller corresponding to the illustrated embodiment can be found in the following examples. Figure 2 The related descriptions of the embodiments shown will not be repeated in this embodiment to avoid repetition, and can achieve the same beneficial effects.

[0128] See Figure 6 , Figure 6 This is one of the structural schematic diagrams of a message processing device provided in the embodiments of this application, such as... Figure 6 As shown, the device 300 includes:

[0129] The unloading module 301 is used to unload the configuration information sent by the software-defined wide area network (SDN) controller, the configuration information including security policy (SP) information and security association (SA) information;

[0130] The first adding module 302 is used to add entries to the predefined SP table entries based on the SP information to obtain the target SP table;

[0131] The second adding module 303 is used to add entries to the predefined SA table entries based on the SA information to obtain the target SA table.

[0132] The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0133] Optionally, the configuration information further includes routing information, and the device further includes:

[0134] The third adding module is used to add entries to at least one predefined routing table entry based on the routing information to obtain at least one routing table. The at least one routing table is used to determine the routing rules for the packets sent by the at least one POP, and / or the at least one routing table is used to determine the routing rules for the packets sent to the at least one POP.

[0135] Optionally, the unloading module is specifically used for:

[0136] The SDN controller unloads configuration information sent by the target driver and the backend of the target host through the unloading interface. The target driver is the polling mode driver PMD in the Data Platform Development Kit (DPDK) architecture, and the target driver is deployed in the user space of the virtual machine on the target host.

[0137] Optionally, at least one of the predefined SP entries, the predefined SA entries, and at least one predefined routing table entry is predefined by a protocol-independent packet processor P4.

[0138] Optionally, the device further includes:

[0139] The first receiving module is configured to receive a first message, wherein the first message is a message sent by a first POP, and the first POP is any one of the at least one POPs.

[0140] The first determining module is used to determine the SP corresponding to the first message based on the five-tuple of the first message and the target SP table;

[0141] The second determining module is used to determine the SA corresponding to the first message based on the SP corresponding to the first message and the target SA table when the SP corresponding to the first message indicates that the first message is encrypted.

[0142] The encryption module is used to encrypt the first message based on the SA corresponding to the first message.

[0143] Optionally, the device further includes:

[0144] The second receiving module is used to receive a second message, which is a message sent to a second POP, and the second POP is any one of the at least one POPs;

[0145] The third determining module is used to determine the SA corresponding to the second message based on the source Internet Protocol IP address of the outer layer of the second message, the destination IP address of the outer layer of the second message, the Security Parameter Index (SPI) in the second message, and the target SA table when it is determined that the second message will be decrypted.

[0146] The decryption module is used to decrypt the second message based on the SA corresponding to the second message.

[0147] Device 300 can achieve Figure 2 The various processes implemented by the DPU in the illustrated method embodiment can achieve the same beneficial effects, and will not be described again here to avoid repetition.

[0148] See Figure 7 , Figure 7 This is a second schematic diagram of the structure of a message processing device provided in the embodiments of this application, as shown below. Figure 7 As shown, the device 400 includes:

[0149] The sending module 401 is used to send configuration information to the data processor DPU. The configuration information includes security policy (SP) information and security association (SA) information. The DPU is set on the target host, and the target host has at least one access point (POP) deployed.

[0150] The SP information is used to add entries to predefined SP table entries to obtain a target SP table, and the SA information is used to add entries to predefined SA table entries to obtain a target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0151] Optionally, the configuration information further includes routing information, which is used to add entries to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for packets sent by the at least one POP, and / or the at least one routing table is used to determine the routing rules for packets sent to the at least one POP.

[0152] Optionally, sending configuration information to the data processor (DPU) includes:

[0153] Configuration information is sent to the DPU through the target driver and the backend of the target host. The target driver is the polling mode driver PMD in the Data Platform Development Kit (DPDK) architecture, and the target driver is deployed in the user space of the virtual machine on the target host.

[0154] Device 400 can achieve Figure 5 The various processes implemented by the SDN controller in the illustrated method embodiment can achieve the same beneficial effects, and will not be described again here to avoid repetition.

[0155] This application also provides a DPU, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described message processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0156] For details, see Figure 8 As shown in the figure, this application embodiment also provides a DPU, including a bus 501, a transceiver 502, an antenna 503, a bus interface 504, a processor 505, and a memory 506.

[0157] The processor 505 is used to unload the configuration information sent by the software-defined wide area network (SDN) controller, the configuration information including security policy (SP) information and security association (SA) information;

[0158] The processor 505 is further configured to add entries to predefined SP table entries based on the SP information to obtain a target SP table;

[0159] The processor 505 is further configured to add entries to predefined SA entries based on the SA information to obtain a target SA table;

[0160] The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP.

[0161] Optionally, the configuration information further includes routing information. After the configuration information sent by the software definition WAN SDN controller is unloaded, the processor 505 is further configured to:

[0162] Based on the routing information, entries are added to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for packets sent by the at least one POP, and / or, the at least one routing table is used to determine the routing rules for packets sent to the at least one POP.

[0163] Optionally, the processor 505 is specifically used for:

[0164] The SDN controller unloads configuration information sent by the target driver and the backend of the target host through the unloading interface. The target driver is the polling mode driver PMD in the Data Platform Development Kit (DPDK) architecture, and the target driver is deployed in the user space of the virtual machine on the target host.

[0165] Optionally, at least one of the predefined SP entries, the predefined SA entries, and at least one predefined routing table entry is predefined by a protocol-independent packet processor P4.

[0166] Optionally, the transceiver 502 is configured to receive a first message, wherein the first message is a message sent by a first POP, and the first POP is any one of the at least one POPs;

[0167] The processor 505 is further configured to determine the SP corresponding to the first message based on the five-tuple of the first message and the target SP table;

[0168] The processor 505 is further configured to determine the SA corresponding to the first message based on the SP corresponding to the first message and the target SA table when the first message is encrypted according to the SP instruction corresponding to the first message.

[0169] The processor 505 is further configured to encrypt the first message based on the SA corresponding to the first message.

[0170] Optionally, the transceiver 502 is configured to receive a second message, the second message being a message sent to a second POP, the second POP being any one of the at least one POPs;

[0171] The processor 505 is further configured to, when it is determined that the second message will be decrypted, determine the SA corresponding to the second message based on the source Internet Protocol IP address of the outer layer of the second message, the destination IP address of the outer layer of the second message, the Security Parameter Index (SPI) in the second message, and the target SA table;

[0172] The processor 505 is further configured to decrypt the second message based on the SA corresponding to the second message.

[0173] exist Figure 8In this document, a bus architecture (represented by bus 501) is used. Bus 501 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 505 and memory represented by memory 506. Bus 501 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 504 provides an interface between bus 501 and transceiver 502. Transceiver 502 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 505 is transmitted over a wireless medium via antenna 503, which further receives data and transmits it to processor 505.

[0174] Processor 505 manages bus 501 and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 506 can be used to store data used by processor 505 during operation.

[0175] Alternatively, the processor 505 may be an ASIC, FPGA, or CPLD.

[0176] This application also provides an SDN controller, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described packet processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0177] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described message processing method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0178] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 2 or Figure 5 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0179] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0180] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0181] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A message processing method, characterized in that, The method, applied to a data processor (DPU) located on a target host, wherein the target host has at least one access point (POP), includes: Unload the configuration information sent by the Software Defined Wide Area Network (SDN) controller, including Security Policy (SP) information and Security Association (SA) information; Based on the SP information, entries are added to the predefined SP table entries to obtain the target SP table; Based on the SA information, entries are added to the predefined SA table entries to obtain the target SA table; The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP. The configuration information also includes routing information. After uninstalling the configuration information sent by the software-defined WAN SDN controller, the method further includes: Based on the routing information, entries are added to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for packets sent by the at least one POP, and / or, the at least one routing table is used to determine the routing rules for packets sent to the at least one POP.

2. The method according to claim 1, characterized in that, The uninstallation software defines the configuration information sent by the WAN SDN controller, including: The SDN controller unloads configuration information sent by the target driver and the backend of the target host through the unloading interface. The target driver is the polling mode driver PMD in the Data Platform Development Kit (DPDK) architecture, and the target driver is deployed in the user space of the virtual machine on the target host.

3. The method according to claim 1, characterized in that, At least one of the predefined SP entries, the predefined SA entries, and at least one predefined routing table entry is predefined by a protocol-independent packet processor P4.

4. The method according to claim 1, characterized in that, The method further includes: Receive a first message, wherein the first message is a message sent by a first POP, and the first POP is any one of the at least one POPs; Based on the 5-tuple of the first message and the target SP table, determine the SP corresponding to the first message; When the SP corresponding to the first message indicates that the first message is encrypted, the SA corresponding to the first message is determined based on the SP corresponding to the first message and the target SA table; The first message is encrypted based on the SA corresponding to the first message.

5. The method according to claim 1, characterized in that, The method further includes: Receive a second message, which is a message sent to a second POP, and the second POP is any one of the at least one POPs; If it is determined that the second message will be decrypted, the SA corresponding to the second message is determined based on the source Internet Protocol IP address of the outer layer of the second message, the destination IP address of the outer layer of the second message, the Security Parameter Index (SPI) in the second message, and the target SA table; The second message is decrypted based on the SA corresponding to the second message.

6. A message processing method, characterized in that, The method, applied to a software-defined wide area network (SDN) controller, includes: Send configuration information to the data processor (DPU), the configuration information including security policy (SP) information and security association (SA) information, the DPU being set on the target host, the target host having at least one access point (POP) deployed; The SP information is used to add entries to predefined SP table entries to obtain a target SP table, and the SA information is used to add entries to predefined SA table entries to obtain a target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP. The configuration information also includes routing information, which is used to add entries to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for the packets sent by the at least one POP, and / or the at least one routing table is used to determine the routing rules for the packets sent to the at least one POP.

7. The method according to claim 6, characterized in that, Sending configuration information to the data processor (DPU) includes: Configuration information is sent to the DPU through the target driver and the backend of the target host. The target driver is the polling mode driver PMD in the Data Platform Development Kit (DPDK) architecture, and the target driver is deployed in the user space of the virtual machine on the target host.

8. A message processing apparatus, characterized in that, An apparatus for use with a data processor (DPU), wherein the DPU is located on a target host and the target host has at least one access point (POP) deployed thereon, the apparatus comprising: The unloading module is used to unload the configuration information sent by the software-defined wide area network (SDN) controller, including security policy (SP) information and security association (SA) information. The first adding module is used to add entries to the predefined SP table entries based on the SP information to obtain the target SP table. The second adding module is used to add entries to the predefined SA table entries based on the SA information to obtain the target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP. The configuration information also includes routing information, and the device further includes: The third adding module is used to add entries to at least one predefined routing table entry based on the routing information to obtain at least one routing table. The at least one routing table is used to determine the routing rules for the packets sent by the at least one POP, and / or the at least one routing table is used to determine the routing rules for the packets sent to the at least one POP.

9. A message processing apparatus, characterized in that, The device, applied to a software-defined wide area network (SDN) controller, includes: The sending module is used to send configuration information to the data processor (DPU). The configuration information includes security policy (SP) information and security association (SA) information. The DPU is set on the target host, and the target host has at least one access point (POP) deployed on it. The SP information is used to add entries to predefined SP table entries to obtain a target SP table, and the SA information is used to add entries to predefined SA table entries to obtain a target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP. The configuration information also includes routing information, which is used to add entries to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for the packets sent by the at least one POP, and / or the at least one routing table is used to determine the routing rules for the packets sent to the at least one POP.

10. A data processor (DPU), characterized in that, The DPU is located on the target host, which has at least one access point (POP). The DPU includes a transceiver and a processor. The processor is used to unload the configuration information sent by the software-defined wide area network (SDN) controller, the configuration information including security policy (SP) information and security association (SA) information; The processor is further configured to add entries to predefined SP table entries based on the SP information to obtain a target SP table; The processor is further configured to add entries to predefined SA entries based on the SA information to obtain a target SA table; The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP. The configuration information also includes routing information, and the processor is further configured to: Based on the routing information, entries are added to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for packets sent by the at least one POP, and / or, the at least one routing table is used to determine the routing rules for packets sent to the at least one POP.

11. A software-defined wide area network (SDN) controller, characterized in that, The SDN controller includes a transceiver and a processor. The transceiver is used to send configuration information to the data processor (DPU). The configuration information includes security policy (SP) information and security association (SA) information. The DPU is set on the target host, and the target host has at least one access point (POP) deployed. The SP information is used to add entries to predefined SP table entries to obtain a target SP table, and the SA information is used to add entries to predefined SA table entries to obtain a target SA table. The target SP table is used to determine whether to encrypt the messages sent by the at least one POP, and the target SA table is used to determine the encryption information of the messages sent by the at least one POP and the decryption information of the messages sent to the at least one POP. The configuration information also includes routing information, which is used to add entries to at least one predefined routing table entry to obtain at least one routing table. The at least one routing table is used to determine the routing rules for the packets sent by the at least one POP, and / or the at least one routing table is used to determine the routing rules for the packets sent to the at least one POP.

12. A data processor (DPU), characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the message processing method as described in any one of claims 1 to 5.

13. A software-defined wide area network (SDN) controller, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the message processing method as described in any one of claims 6 to 7.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the message processing method as described in any one of claims 1 to 5; or, when executed by a processor, the computer program implements the steps of the message processing method as described in any one of claims 6 to 7.

15. A computer program product, characterized in that, The method includes computer instructions that, when executed by a processor, implement the steps of the message processing method as described in any one of claims 1 to 5; or, when executed by a processor, the computer instructions implement the steps of the message processing method as described in any one of claims 6 to 7.

Images