Serial plugging method and device based on deep data packet detection, and medium

Abstract

The invention discloses a serial blocking method and device based on deep data packet detection and a medium. The method is applied to a serial plugging device, the serial plugging device at least comprises an intelligent network card, a packet receiving and forwarding module and a service plugging module, and the method comprises the following steps: detecting an obtained flow packet according to a hardware rule table configured by the intelligent network card; forwarding the flow packet passing the detection to the service blocking module based on the packet receiving and forwarding module; and blocking the traffic packet according to the at least one blocking thread of the service blocking module. According to the embodiment of the invention, blocking detection is carried out on the traffic packets through the intelligent network card, the response efficiency of traffic packet processing is improved, parallel processing is carried out on the traffic packets according to the plurality of blocking threads of the service blocking module, the processing efficiency of the traffic packets can be improved, the time overhead of traffic packet blocking can be reduced, and the time consumption of traffic packet processing can be reduced. And user experience is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a serial blocking method, device and medium based on deep data packet inspection. Background Art

[0002] As a network security technology, Deep Packet Inspection (DPI) deeply analyzes data packets in network traffic to identify and process various complex network applications and threats. At present, it is combined with blocking technology to block network traffic and prevent bad traffic from entering the network. Blocking methods can include sending specific blocking packets or not forwarding specific access traffic to protect the network from malicious attacks or illegal access. With the advancement of technology, serial blocking has emerged. Serial blocking needs to achieve low-latency traffic forwarding while ensuring network security, requiring the average forwarding delay to be less than 200 microseconds. However, the traditional serial blocking traffic processing logic often involves multiple steps, including packet reception, flow table establishment, protocol failure, blocking rule matching, packet loss, blocking log output, and normal traffic forwarding. The process is long, resulting in low traffic processing efficiency. Traditional serial blocking technology can no longer meet some application scenarios with high real-time requirements. Summary of the invention

[0003] The present invention provides a serial blocking method, device and medium based on deep data packet detection, so as to perform blocking detection on traffic packets through an intelligent network card, improve the response efficiency of traffic packet processing, and perform parallel processing on each traffic packet according to multiple blocking threads of a business blocking module, thereby improving the processing efficiency of traffic packets, reducing the time overhead of traffic packet blocking, reducing the time consumption of traffic packet processing, and improving user experience.

[0004] According to one aspect of the present invention, a serial blocking method based on deep data packet inspection is provided, and the method is applied to a serial blocking device, and the serial blocking device at least includes a smart network card, a packet receiving and forwarding module, and a service blocking module. The method includes:

[0005] Detecting the acquired traffic packets according to the hardware rule table configured by the smart network card;

[0006] Forwarding the traffic packet that passes the detection to the service blocking module based on the packet receiving and forwarding module;

[0007] The traffic packet is blocked according to at least one blocking thread of the service blocking module.

[0008] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0009] at least one processor; and

[0010] a memory communicatively connected to the at least one processor; wherein,

[0011] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the serial blocking method based on deep data packet inspection described in any embodiment of the present invention.

[0012] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the serial blocking method based on deep data packet inspection described in any embodiment of the present invention when executed.

[0013] The technical solution of the embodiment of the present invention processes the traffic packet through the hardware rule table configured by the smart network card in the serial blocking device, forwards the detected traffic packet according to the packet receiving and forwarding module, and performs parallel blocking processing on different traffic packets according to multiple blocking threads of the business blocking module. The embodiment of the present invention realizes the serial blocking execution of deep data packet detection, performs blocking detection on the traffic packet through the smart network card, improves the response efficiency of traffic packet processing, and processes each traffic packet in parallel according to multiple blocking threads of the business blocking module, which can improve the processing efficiency of the traffic packet, reduce the time overhead of traffic packet blocking, reduce the time consumption of traffic packet processing, and improve user experience.

[0014] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 This is a logic example diagram of an existing serial blocking implementation process provided according to an embodiment of the present invention;

[0017] Figure 2 is a flow chart of a serial blocking method for deep data packet inspection provided according to Embodiment 1 of the present invention;

[0018] Figure 3is a flow chart of a serial blocking method for deep data packet inspection provided in accordance with Embodiment 2 of the present invention;

[0019] Figure 4 is a schematic diagram of the structure of a hardware rule table provided according to Embodiment 2 of the present invention;

[0020] Figure 5 is a flow chart of another serial blocking method of deep data packet inspection provided by Embodiment 3 of the present invention;

[0021] Figure 6 is a flow chart of another serial blocking method for deep data packet inspection provided by Embodiment 4 of the present invention;

[0022] Figure 7 This is an example diagram of a rule loading process provided according to Embodiment 4 of the present invention;

[0023] Figure 8 is a structural schematic diagram of a serial plugging device provided according to Embodiment 5 of the present invention;

[0024] Fig. 9 This is an example diagram of a serial blocking device functional interaction provided according to Embodiment 5 of the present invention;

[0025] Fig.10 This is a software and hardware environment configuration structure diagram of a serial blocking device provided according to Embodiment 5 of the present invention;

[0026] Fig.11 This is a flowchart of a serial blocking method for deep data packet inspection provided in accordance with Embodiment 5 of the present invention;

[0027] Fig.12 It is a structural schematic diagram of an electronic device for implementing the serial blocking method of deep data packet inspection according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] In the embodiment of the present invention, the serial blocking technology reduces the forwarding delay of network traffic packets by optimizing the hardware architecture and improving the data processing speed. These solutions are often difficult to reduce the delay forwarding while maintaining high performance, or need to make compromises in terms of cost or load type. See Figure 1 The existing DPI serial blocking traffic processing logic mainly includes packet forwarding, flow table establishment, protocol identification, blocking rule matching, packet loss, blocking log output, and normal traffic forwarding. Under this processing logic, how to efficiently implement the blocking function and maintain low-latency forwarding becomes a challenge.

[0031] Embodiment 1

[0032] Figure 2 This is a flowchart of a serial blocking method based on deep data packet inspection according to the first embodiment of the present invention. This embodiment is applicable to the case of blocking traffic packets. The method can be executed by a serial blocking device. The serial blocking device at least includes an intelligent network card, a packet receiving and forwarding module, and a service blocking module. The serial blocking device can be implemented in the form of hardware and / or software. Figure 2 As shown, the method includes:

[0033] Step 110: Detect the acquired traffic packet according to the hardware rule table configured by the smart network card.

[0034] Among them, the smart network card can be a smart network card interface card, which can be a programmable accelerator that can optimize the data center network and improve the security of data packet transmission. Smart network cards are usually made of network interface controllers, multi-core CPUs, and can add FPGAs and GPUs. Smart network cards can accelerate the processing speed of network traffic packets through programming. The hardware rule table can be a rule configured in the smart network card for deep detection of traffic packets. The hardware rule table includes one or more rules. Different deep detection rules can be configured for traffic packets of different communication protocols in the hardware rule table. Traffic packets can be data transmission units packaged by communication protocols. Traffic packets can exist in the form of data packets. Traffic packets can include a data block sent once. The message header of the traffic packet can include at least five-tuple information such as source network address, destination network address, source port, destination port, and protocol type.

[0035] In an embodiment of the present invention, when the smart network card obtains a traffic packet, the smart network card can detect the traffic packet through one or more rules in the hardware rule table configured by itself, and determine whether the traffic packet matches the blocking rule in the hardware rule table. If there is a matching rule, the traffic packet can be discarded; if there is no matching rule, it can be processed through subsequent steps. The embodiment of the present invention can process the received traffic packet through the smart network card, and can reduce the processing delay of the traffic packet through hardware, thereby improving the processing efficiency of the traffic packet.

[0036] Step 120: forward the detected traffic packets to the service blocking module based on the packet receiving and forwarding module.

[0037] Among them, the packet receiving and forwarding module is a software and hardware module that forwards traffic packets. The packet receiving and forwarding module can forward one or more traffic packets to the service blocking module through a queue, a tree or other temporary storage structure, and the service blocking module can be a software and hardware module that performs blocking processing on traffic packets. The service blocking module can be composed of one or more blocking threads, and different blocking threads can be processed in parallel. It can be understood that blocking can refer to a network security technology that is used to block network traffic and prevent bad traffic from entering the network. The blocking method can include sending specific blocking packets or not forwarding specific access traffic to protect the network from malicious attacks or illegal access.

[0038] In an embodiment of the present invention, after the traffic packet is processed by the intelligent network card, the traffic packet that passes the detection can be handed over by the intelligent network card to the packet receiving and forwarding module for forwarding. The packet receiving and forwarding module can temporarily store one or more traffic packets through a queue or tree or other temporary storage results, and forward the temporarily stored traffic packets to the service blocking module, so that the service blocking module performs service blocking processing on the traffic packet.

[0039] Step 130: Block the traffic packet according to at least one blocking thread of the service blocking module.

[0040] Among them, the blocking thread can be a business thread that executes blocking rule matching and blocking processing. Different blocking threads can be processed in parallel. The business blocking module can be composed of one or more blocking threads. The rules used by each blocking thread when performing blocking processing on the traffic packet can be the rules stored locally in the business blocking module, or the rules of the blocking rule server connected to the business blocking module.

[0041] In an embodiment of the present invention, the packet receiving and forwarding module can forward the traffic packet to different blocking threads of the business blocking module. In the blocking thread, the rules stored locally in the business blocking module, or the rules of the blocking rule server, can be obtained, and the traffic packet can be matched with the above rules. The matching can include matching the quintuple of the traffic packet with the parameters in the rule. If the match is successful, the blocking rule can call the corresponding processing operation in the rule to block the traffic packet. If the match is not successful, it can be determined that there is no need to block the traffic packet.

[0042] The embodiment of the present invention processes traffic packets through a hardware rule table configured by a smart network card in a serial blocking device, forwards the detected traffic packets according to the packet receiving and forwarding module, and performs parallel blocking processing on different traffic packets according to multiple blocking threads of the service blocking module. The embodiment of the present invention implements the serial blocking execution of deep data packet detection, performs blocking detection on traffic packets through a smart network card, improves the response efficiency of traffic packet processing, and performs parallel processing on each traffic packet according to multiple blocking threads of the service blocking module, which can improve the processing efficiency of traffic packets, reduce the time overhead of traffic packet blocking, reduce the time consumption of traffic packet processing, and improve user experience.

[0043] Embodiment 2

[0044] Figure 3 is a flowchart of a serial blocking method for deep data packet inspection provided according to the second embodiment of the present invention. The embodiment of the present invention is a specific embodiment based on the above embodiment, and describes the processing process of the traffic packet in the smart network card. Figure 3 The method provided in the embodiment of the present invention specifically includes the following steps:

[0045] Step 210: When the smart network card receives the traffic packet, extract the rule group of the hardware rule table configured by the smart network card.

[0046] Among them, the rule group can be a rule set composed of one or more blocking rules. Each rule set can include multiple hardware blocking rules. Different rule groups can be configured with a matching order. For example, after the first rule group matches the traffic packet, the second rule package is used to match the traffic packet.

[0047] In an embodiment of the present invention, the hardware rule table configured by the smart network card may include one or more rule groups, each rule group may include at least one hardware blocking rule, and when the smart network card receives a traffic packet, it may read one or more rule groups in the hardware rule table. It can be understood that the rule groups may be configured in the hardware rule table in sequence, and the smart network card may read multiple rule groups at a time in sequence, or read one rule group at a time in sequence and read the hardware rule table multiple times.

[0048] Step 220: Match the traffic packet with the hardware blocking rules in each rule group based on the smart network card.

[0049] Among them, the hardware blocking rules can be the blocking rules for the smart network card to match and process the traffic packets. The hardware blocking rules may include the matching rule conditions for matching the traffic packets and the operations for processing the corresponding traffic packets when the match is successful. The operations may include but are not limited to discarding the traffic packets, sending specific blocking packets to the source network address of the traffic packets, etc.

[0050] In an embodiment of the present invention, the intelligent network card can be called to parse and analyze the traffic packet, and the data packet characteristics of the traffic packet can be determined. The data packet characteristics may include protocol characteristics or five-tuple characteristics, etc. For example, the five-tuple characteristics may include the source network address, the target network address, the source port, the target port, and the protocol type, etc. The extracted data packet characteristics can be matched with the hardware blocking rules in the rule group in turn to determine whether there is a hardware blocking rule that matches the traffic packet.

[0051] Step 230: If the traffic packet successfully matches the hardware blocking rule, the traffic packet is discarded; if the traffic packet fails to match all the hardware blocking rules in each rule group, the traffic packet is forwarded to the packet receiving and forwarding module.

[0052] In an embodiment of the present invention, when a traffic packet has a matching hardware blocking rule in the smart network card, it can be determined to perform blocking processing on the traffic packet. Specifically, the traffic packet can be discarded and the access traffic of the traffic packet will not be forwarded. If the traffic packet does not have a matching hardware blocking rule in the smart network card, the traffic packet can be forwarded to the packet receiving and forwarding module, which will forward it to the service blocking module configured in the serial blocking device for blocking processing.

[0053] Step 240: forward the detected traffic packets to the service blocking module based on the packet receiving and forwarding module.

[0054] Step 250: Block the traffic packet according to at least one blocking thread of the service blocking module.

[0055] The embodiment of the present invention controls the intelligent network card to extract the rule group in the hardware rule table when receiving the traffic packet, matches the rule group with the received traffic packet, discards the traffic packet that successfully matches the hardware blocking rule in the rule group, forwards the traffic packet that does not successfully match the hardware blocking rule in the rule group to the packet receiving and forwarding module, forwards the detected traffic packet to the service blocking module according to the packet receiving and forwarding module, and performs parallel blocking processing on different traffic packets according to multiple blocking threads of the service blocking module. The embodiment of the present invention realizes the serial blocking execution of deep data packet detection, performs blocking detection on the traffic packet through the intelligent network card, improves the response efficiency of traffic packet processing, and performs parallel processing on each traffic packet according to multiple blocking threads of the service blocking module, which can improve the processing efficiency of the traffic packet, reduce the time overhead of traffic packet blocking, reduce the time consumption of traffic packet processing, and improve user experience.

[0056] Further, based on the above-mentioned embodiments of the invention, the hardware rule table includes at least a first rule group and at least one second rule group, wherein the first rule group includes blocking processing rules and hash jump rules, and the second rule group includes blocking processing rules and rule group jump rules.

[0057] In an embodiment of the present invention, the hardware rule table includes at least two types of rule groups. The second rule group may include a rule group jump rule for controlling the matching jump of the traffic packet, and may also include a blocking processing rule for blocking the traffic packet. The traffic packet may first match the blocking processing rule in the second rule group. When all matches are unsuccessful, the traffic packet may be matched with the rule group jump rule to control the traffic packet to jump to the next second rule group or the first rule group for matching. The first rule group may include a blocking processing rule and a hash jump rule. The hash jump rule may control the traffic packet to jump to different packet receiving queues in the packet receiving and forwarding module. The hash jump rule may include an access address of the packet receiving queue. The hash jump rule may randomly access any packet receiving queue in the packet receiving and forwarding module through a hash algorithm.

[0058] In an exemplary embodiment, the hardware blocking rules configured by the smart network card can be as follows: Figure 4As shown, the smart network card can include rules of multiple groups, and each group supports up to 65535 rules; the traffic packets received by the smart network card can match the rules in group0 by default. If the jump rule is not matched in group0 for jumping, then after the rule matching in group0 is completed, the rules in other groups will no longer be matched. The role of the jump rule is to hit the jump rule when all non-jump rules of this group are not hit, and then jump to the next group to continue matching. The embodiment of the present invention can control which group the traffic packet jumps to for matching according to the jump rule by extending the rules in multiple groups. If the last group is jumped, and the rules of this group are matched, and there is no rule sent, then the packet will not be sent to the application, and the message of this traffic packet will be discarded. All the last group needs to have an RSS sending rule. In the worst case, a data packet only hits the RSS hash rule in the end, then the number of groups matched is the total number of groups - 1, and too many groups will also affect the matching performance of the hardware. The smart network card supports the drop operation on matching data packets, that is, the message is discarded after the hardware receives it, and the message is not sent to the application. Then the application cannot receive the message and cannot forward it, thus realizing serial packet loss and achieving the blocking effect.

[0059] Embodiment 3

[0060] Figure 5 is a flow chart of another serial blocking method of deep data packet inspection provided according to the third embodiment of the present invention. The embodiment of the present invention is a specific embodiment based on the above embodiment, and describes the processing process of the packet receiving and forwarding module. Figure 5 The method provided in the embodiment of the present invention specifically includes the following steps:

[0061] Step 310: Detect the acquired traffic packet according to the hardware rule table configured by the smart network card.

[0062] Step 320: Receive the traffic packet sent by the smart network card.

[0063] In the implementation of the present invention, the packet receiving and forwarding module can be controlled to receive the traffic packets sent by the smart network card.

[0064] Step 330: Save the traffic packet to the packet receiving queue of the packet receiving and forwarding module, and update the reference count of the packet receiving and forwarding module according to the number of received traffic packets.

[0065] The packet receiving queue may be a data structure for temporarily storing traffic packets, and multiple packet receiving queues may realize batch receiving of traffic packets. The reference count may be the counting information of traffic packets used for blocking processing in the service blocking module, and the cache of the smart network card may be cleared when the reference count is cleared.

[0066] In an embodiment of the present invention, the packet receiving and forwarding module may include multiple packet receiving queues, which can evenly save traffic packets in different packet receiving queues so that traffic packets can be evenly forwarded, thereby improving the forwarding efficiency of traffic packets and reducing the instantaneous load of the transceiver and forwarding module. Each time the packet receiving and forwarding module receives a traffic packet, it can increment the reference count. Specifically, the packet receiving and forwarding module can count the number of traffic packets received at regular intervals and update the reference count according to the number. It can be understood that the shorter the time interval for counting the number of traffic packets, the more even the rate at which the packet receiving and forwarding module forwards traffic packets.

[0067] Step 340: call the packet receiving and forwarding module to forward the traffic packets of each packet receiving queue to the service blocking module.

[0068] In an embodiment of the present invention, the packet receiving and forwarding module can forward the traffic packets in the packet receiving queue to the business blocking module for processing in sequence. Furthermore, the packet receiving queues can respectively correspond to one or more blocking threads in the business blocking module, and the traffic packets in each packet receiving queue can be forwarded to the corresponding blocking threads in the business blocking module. It can be understood that the forwarding speed of the packet receiving queue for the traffic packets can match the processing speed of the traffic packets of the blocking thread, which can further improve the processing efficiency of the traffic packets and reduce the processing waiting delay of the traffic packets.

[0069] Step 350: Block the traffic packet according to at least one blocking thread of the service blocking module.

[0070] In the embodiment of the present invention, the received traffic packets are detected through the hardware rule table configured by the smart network card, the traffic packets sent by the smart network card are received, the traffic packets are saved in the packet receiving queue of the packet receiving and forwarding module, the reference count is updated based on the number of received traffic packets, the packet receiving and forwarding module is controlled to forward the traffic packets in each packet receiving queue to the service blocking module, and the traffic packets are blocked based on the blocking thread of the service blocking module. In the embodiment of the present invention, the packet receiving queue temporarily stores the traffic packets to ensure that the traffic packets are forwarded evenly, which can improve the forwarding efficiency of the traffic packets, reduce the instantaneous load of the transceiver forwarding module, further improve the processing efficiency of the traffic packets, and reduce the waiting delay of the processing of the traffic packets.

[0071] Furthermore, based on the above-mentioned embodiments of the invention, the present invention further includes:

[0072] When it is determined that the reference count is zero, the data packet memory resource of the smart network card is released.

[0073] In the embodiment of the present invention, when the reference count in the packet receiving and forwarding module is zero, the data packet memory resource of the smart network card can be identified, thereby ensuring the stability of the smart network card.

[0074] Embodiment 4

[0075] Figure 6 is a flowchart of another serial blocking method of deep data packet inspection provided according to the fourth embodiment of the present invention. The embodiment of the present invention describes the blocking processing process of the traffic packet by the service blocking module through the blocking thread. Figure 6 The method provided in the embodiment of the present invention specifically includes the following steps:

[0076] Step 410: Detect the acquired traffic packet according to the hardware rule table configured by the smart network card.

[0077] Step 420: forward the detected traffic packets to the service blocking module based on the packet receiving and forwarding module.

[0078] Step 430: Transmit the traffic packet forwarded by the packet receiving and forwarding module to the blocking thread.

[0079] In an embodiment of the present invention, the service blocking module can receive the traffic packet sent by the packet forwarding module, and assign the traffic packet to a blocking thread for processing. It can be understood that the service blocking module can adopt a load balancing strategy to distribute the traffic packets, ensure the consistency of the traffic packet processing volume of each blocking thread, and improve the processing performance of the service blocking module.

[0080] Step 440: parse the data packet protocol of the traffic packet based on the blocking thread.

[0081] Among them, the data packet protocol can be a communication protocol used by the traffic packet, and the data packet protocol can be implemented in the blocking thread through protocol identification technology. The protocol identification technology matches keyword features in the traffic packet to identify the protocol type used by the traffic.

[0082] In the embodiment of the present invention, the blocking thread may be controlled to perform data packet analysis on the traffic packet, and the data packet protocol corresponding to the traffic packet may be identified through keywords included in the data packet.

[0083] Step 450, match the blocking rule corresponding to the data packet protocol with the traffic packet according to the blocking thread; if the match is successful, call the blocking rule to block the traffic packet, and send the blocking rule to the hardware rule table of the smart network card; if the match fails, wait for the next traffic packet to be blocked.

[0084] In an embodiment of the present invention, after identifying the data packet protocol corresponding to the traffic packet, one or more blocking rules can be matched according to the data packet protocol. The blocking rule can be configured with a service blocking module or server. If there is a blocking rule that matches the traffic packet, that is, the data packet protocol of the traffic packet meets the conditions in the blocking rule, the blocking rule can be called to block the traffic packet. The implementation method of the blocking can include but is not limited to: sending a specific blocking packet or not forwarding the traffic packet, etc. If there is no blocking rule corresponding to the traffic packet, the blocking thread can receive the next traffic packet, and match and process the blocking rule for the traffic packet. Specifically, for the blocking rule that successfully matches the traffic packet, in order to further improve the blocking efficiency, the blocking rule can be added to the hardware rule table of the smart network card.

[0085] Furthermore, based on the above-mentioned embodiments of the invention, after calling the blocking rule to block the traffic packet, it also includes generating a blocking log of the traffic packet and saving the blocking log.

[0086] In an embodiment of the present invention, a traffic packet is processed through a hardware rule table configured by a smart network card, a packet receiving and forwarding module is called to send the detected traffic packet to a service blocking module, a data packet protocol of the traffic packet is identified according to a blocking thread of the service blocking module, and the traffic packet is matched and processed according to the blocking rule of the data packet protocol. For the traffic packet that has been matched successfully, a blocking rule is called to block the traffic packet, and the blocking rule is sent to the hardware rule table of the smart network card. If there is no matching blocking rule for the traffic packet, the traffic packet continues to be waited for processing. The blocking rules are classified by the data packet protocol, which can reduce the workload of matching the data packet with the blocking rule, and further improve the blocking efficiency of the traffic packet.

[0087] Further, based on the above-mentioned embodiment of the invention, matching the blocking rule corresponding to the data packet protocol with the traffic packet according to the blocking thread includes:

[0088] The blocking thread is called to obtain the main rule matching handle of the business blocking module; based on the blocking thread, the blocking rule is called according to the main rule matching handle to match the traffic packet.

[0089] The main rule matching handle may be used for information on calling the blocking rule, and the main rule matching handle may be configured in the blocking thread.

[0090] Specifically, the blocking thread can be controlled to call the main rule matching handle, thereby loading the blocking rule corresponding to the main rule matching handle, and the blocking rule can be used to match the traffic packet to determine whether the keyword features of the traffic packet meet the matching conditions in the blocking rule.

[0091] Based on the above-mentioned embodiment of the invention, the serial blocking device further includes a rule management module, and the method further includes:

[0092] According to the rule management module, the first blocking rule issued by the preset rule server is received and saved; the rule management module is called to issue the first blocking rule to the business blocking module; based on the business blocking module, a rule matching handle is created according to the first blocking rule, and the first blocking rule is loaded; it is determined that the loading of the first blocking rule is completed, and the business blocking module is controlled to switch the main rule matching handle to the rule matching handle.

[0093] The first blocking rule may be a blocking rule to be added to the rule management module, the rule management module may be a software or hardware module in the serial blocking device that manages the blocking rules in a unified manner, and the rule management module may update, delete, or modify the blocking rules. The preset rule server may be a server that stores the blocking rules, and the preset rule server may include a third-party rule server.

[0094] In an embodiment of the present invention, the preset rule server can send the first blocking rule that needs to be added to the rule management module, the rule management module can send the first blocking rule to the business blocking module, and create a rule matching handle for calling the first blocking rule in the business blocking module. The business blocking module can call the rule matching handle to load the first blocking rule, and after determining that the first blocking rule has been loaded by the business blocking module, the rule matching handle of the business blocking rule can be switched to the rule matching handle, so that the business blocking module can add the first blocking rule according to the rule matching handle.

[0095] In an exemplary embodiment, see Figure 7 , the rule loading process may include:

[0096] 1. The policy server sends blocking rules to the DPI serial blocking device. The rule types are not limited to: blocking strategies such as quintuple, Host, Url and random keywords;

[0097] 2. The rule management module of the DPI blocking device saves the strategy and generates a rule file;

[0098] 3. The rule management module notifies the blocking module to reload the blocking rules;

[0099] 4. The blocking module creates a new rule matching handle and loads all new rules;

[0100] 5. After the blocking module loads the rules, switch the master and slave rule matching handles.

[0101] Embodiment 5

[0102] Figure 8 is a schematic diagram of the structure of a serial plugging device provided according to Embodiment 5 of the present invention, see Figure 8 The serial blocking device may include an intelligent network card, a rule management module, a packet receiving / forwarding module, a service thread, and a log thread. The serial blocking device may also be connected to an external policy server and a log server, and may obtain blocking rules from an external policy server and report the log of the blocking process to the log server. Fig. 9 , the packets received by the packet receiving module are forwarded immediately to achieve low-latency serial forwarding. Otherwise, after a series of business processing such as protocol identification, blocking engine matching, blocking logs, etc., the delay cannot meet the average forwarding requirement of 200 microseconds. Smart NICs include but are not limited to: Intel E810, Broadcom BCM5741X / BCM575XX, Marvell OCTEON CN9K / CN10K, Solarflare SFN7xxxSFN8xxx, Alveo SN1000 and Mellanox cx5 / cx6 and other types of smart NICs. Smart NICs implement DROP operations based on five-tuple rules. Once the five-tuple rules are matched, the data packet can be discarded, which greatly saves the pressure of processing data packets on the upper-layer application and improves performance. The blocking rule matching engine can realize regular expression matching of random keywords, HOST, URL, etc. in the packet payload, greatly improving the blocking identification capability, while the traditional ACL only supports five-tuple matching.

[0103] In an embodiment of the present invention, the serial blocking device may implement the blocking process of the traffic packet through the DPI serial blocking program and the smart network card. The interaction process between the DPI serial blocking program and the smart network card may include the following steps:

[0104] 1. The DPI serial blocking program sends the jump rules and hash rules of the network card to all physical network ports by default when it is started;

[0105] 2. The DPI serial blocking program starts loading the blocking rules issued by the policy server;

[0106] 3. The engine of the DPI serial blocking program performs blocking rule matching. The engine can not only match blocking rules of five-tuples, but also match blocking rules in the form of regular expressions of HOST, URL and random keywords;

[0107] 4. If the network card does not match any blocking rules, the data packet is directly sent to the program, and the program can receive the packet normally;

[0108] 5. The DPI serial blocking program first implements message forwarding, and forwarding messages immediately ensures low latency of serial forwarding;

[0109] 6. The DPI serial blocking program rule engine detects blocking hits;

[0110] 7. The DPI serial blocking program sends a five-tuple blocking rule to the network card, matching the traffic from server to client. If it is TCP, the PUASH ACK flag matching option can also be added;

[0111] 8. When the subsequent network card receives the five-tuple traffic, the message is discarded directly on the network card side, and the message will not be sent to the application, thus achieving the blocking function.

[0112] In the embodiments of the present invention, see Fig.10 The hardware platform of the present invention can cover: X86-32, X86-64, ARMv7, ARMv8, LoongArch64, Power8 and other hardware platforms. The operating system of the present invention can support: Linux (CentOS, Federa, Ubuntu, Debian, OpenEuler and other mainstream distributions), OpenBSD, etc. See Fig.11 The business processing flow in the serial blocking device may include the following process:

[0113] 1. Network card hardware receives packets;

[0114] 2. Check the hardware rule table of the network card hardware;

[0115] 3. Determine whether to discard the data packets received by the network card hardware;

[0116] 4. If the packet needs to be discarded, discard it directly;

[0117] 5. If it does not need to be discarded, the data packet is sent to the application;

[0118] 6. Application receives the package;

[0119] 7. The reference count is increased by 1;

[0120] 8. Forward the data packet to the business thread;

[0121] 9. Asynchronously go to the business thread for business processing;

[0122] 10. Call the service thread to decode the data packet;

[0123] 11. Call the service thread to perform protocol identification on the data packet;

[0124] 12. Match the blocking rules of data packets based on business threads;

[0125] 13. If the rule is matched, the five-tuple hardware rule is sent to the network card;

[0126] 14. If the rule is matched, the output blocking log is output;

[0127] 15. If no match is found, continue to process subsequent messages.

[0128] In an embodiment of the present invention, the software forwards the packet immediately after receiving it. Under normal business conditions, the forwarding delay can be controlled to about 10 microseconds, while the delay of the non-traditional processing method is uncontrollable. This processing method utilizes the highly optimized and fast response characteristics of the software, and can realize the instant processing and forwarding of network data packets, thereby ensuring the real-time and response speed of the business. Compared with the traditional processing method, this method can control the forwarding delay more accurately, and is suitable for application scenarios with high real-time requirements. In addition, if the blocking rule matching is also handed over to the network card hardware, the blocking-related logs cannot be output, so the blocking function cannot be completely handled by the network card hardware. The output log of the blocking rule matching is crucial for network security monitoring and troubleshooting. If it is handled by the network card hardware, the blocking-related log information cannot be obtained, which may affect the efficiency and accuracy of network security management and problem location.

[0129] Secondly, the network card hardware can only match rules based on fixed information in the data packet, such as the five-tuple, and cannot match and extract information such as HOST, URL, and keywords. However, if it is handled by software, the rule matching ability of the matching engine will be greatly improved, and the business capabilities will be greatly improved and expanded. The network card hardware limits the ability and flexibility of rule matching and cannot handle complex matching requirements, such as matching and extracting information such as HOST, URL, and keywords. However, if it is handled by software, more flexible and efficient rule matching can be achieved, thereby improving the processing ability and scalability of the business.

[0130] Finally, if the packet discarding operation is handed over to the hardware, the application does not need to handle the packet discarding operation, and the packet is discarded before the software receives it, which reduces the processing of many messages. The saved CPU can handle more other services. The performance of software processing is improved. Handing over the packet discarding operation to the hardware can reduce the processing burden of the software and improve the overall performance of the system. The hardware discards invalid packets before receiving the packets, which can reduce the processing pressure of the software and enable the CPU to handle more other important business tasks, thereby improving the throughput and performance of the system.

[0131] Embodiment 5

[0132] Fig.12It is a structural schematic diagram of an electronic device for implementing the serial blocking method of deep data packet inspection of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0133] like Fig.12 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0134] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0135] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as the serial blocking method of deep packet inspection.

[0136] In some embodiments, the serial blocking method of deep packet inspection can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the serial blocking method of deep packet inspection described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the serial blocking method of deep packet inspection in any other suitable manner (e.g., by means of firmware).

[0137] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0138] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0139] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0140] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0141] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0142] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0143] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0144] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A serial blocking method based on deep packet inspection, It is characterized in that The method is applied to a serial blocking device, which includes at least a smart network card, a packet receiving and forwarding module, and a service blocking module. The method includes: Detecting the acquired traffic packets according to the hardware rule table configured by the smart network card; Forwarding the traffic packet that passes the detection to the service blocking module based on the packet receiving and forwarding module; The traffic packet is blocked according to at least one blocking thread of the service blocking module.

2. The method according to claim 1, characterized in that ， The detecting the acquired traffic packet according to the hardware rule table configured by the smart network card includes: When the smart network card receives the traffic packet, extracting a rule group of the hardware rule table configured by the smart network card; Matching the traffic packet with the hardware blocking rules in each of the rule groups based on the smart network card; If the traffic packet successfully matches the hardware blocking rule, the traffic packet is discarded; if the traffic packet fails to match all the hardware blocking rules in each rule group, the traffic packet is forwarded to the packet receiving and forwarding module.

3. The method according to claim 2, It is characterized in that The hardware rule table includes at least a first rule group and at least one second rule group, wherein the first rule group includes blocking processing rules and hash jump rules, and the second rule group includes blocking processing rules and rule group jump rules.

4. The method according to claim 1, It is characterized in that The forwarding of the traffic packet detected by the packet receiving and forwarding module to the service blocking module includes: Receiving the traffic packet sent by the smart network card; The traffic packet is saved in the packet receiving queue of the packet receiving and forwarding module, and a reference count of the packet receiving and forwarding module is updated according to the number of the traffic packets received; The packet receiving and forwarding module is called to forward the traffic packets of each packet receiving queue to the service blocking module.

5. The method according to claim 4, It is characterized in that Also includes: When it is determined that the reference count is zero, the data packet memory resource of the smart network card is released.

6. The method according to claim 1, It is characterized in that The blocking process of the traffic packet according to at least one blocking thread of the service blocking module includes: Transmitting the traffic packet forwarded by the packet receiving and forwarding module to the blocking thread; Parsing a data packet protocol of the traffic packet based on the blocking thread; Matching the blocking rule corresponding to the data packet protocol with the traffic packet according to the blocking thread; If the match is successful, the blocking rule is called to block the traffic packet, and the blocking rule is sent to the hardware rule table of the smart network card; If the match fails, wait for the next traffic packet to be blocked.

7. The method according to claim 6, It is characterized in that The matching of the blocking rule corresponding to the data packet protocol with the traffic packet according to the blocking thread includes: Calling the blocking thread to obtain the main rule matching handle of the business blocking module; Based on the blocking thread, the blocking rule is called according to the main rule matching handle to match the traffic packet.

8. The method according to claim 1, It is characterized in that The serial blocking device further includes a rule management module, and the method further includes: Receive and save the first blocking rule issued by the preset rule server according to the rule management module; Calling the rule management module to send the first blocking rule to the service blocking module; Creating a rule matching handle based on the service blocking module according to the first blocking rule, and loading the first blocking rule; Determine that the first blocking rule is loaded completely, and control the service blocking module to switch the main rule matching handle to the rule matching handle.

9. An electronic device, It is characterized in that The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the serial blocking method based on deep packet inspection as described in any one of claims 1-8.

10. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the serial blocking method based on deep data packet inspection according to any one of claims 1 to 8 when executed.

Images