Edge cloud gateway efficient traffic forwarding method, device and system

Abstract

The invention relates to an edge cloud gateway efficient traffic forwarding method, device and system. The method mainly comprises the following steps: predicting and classifying received messages, judging the security types of the messages, and temporarily storing the messages in a read area buffered by a memory; reading the message in the read area buffered by the memory for analysis processing; reading the message in the read area buffered by the memory, forwarding the message, and writing the content needing to be modified into the write area buffered by the memory according to the security type of the message; and according to the security type of the message, assembling the content of the write area buffered by the memory and the content of the read area buffered by the memory into a new complete message, and sending the new complete message. According to the invention, the data isolation of each functional unit in the edge cloud gateway can be ensured, the parallel processing efficiency can be improved, the computing power consumption of a CPU (Central Processing Unit) is reduced, and the flow forwarding performance is improved.

Description

Technical Field

[0001] The present invention relates to the field of edge cloud gateway technology, and in particular to an edge cloud gateway efficient traffic forwarding method, device and system. Background Art

[0002] The edge cloud gateway is a highly efficient network data forwarding device, which generally uses a multi-core server. Each central processing unit (CPU) core will run a process (or thread) to process network traffic in parallel. With the growth of server computing power, in addition to meeting the computing power resource requirements for conventional traffic forwarding, edge cloud gateway devices still have surplus computing power for other business deployments, such as deep packet inspection technology (DPI) and security analysis services. This puts higher requirements on the internal traffic distribution of the edge cloud gateway.

[0003] There are three main types of components deployed inside the edge cloud gateway: traffic receiving and distribution unit, traffic forwarding processing unit, and traffic analysis unit. The main functions of each unit are as follows.

[0004] Traffic receiving and distribution unit: responsible for receiving network data packets from the network card through the high-performance network driver component (Data Plane Development Kit, abbreviated as: DPDK) and storing them in the memory buffer (memory buffer, abbreviated as: mbuf), and distributing them to other components internally; at the same time, receiving the data packets processed by the traffic forwarding processing unit, and then transferring them to the physical network port to transfer out the device.

[0005] Traffic forwarding processing unit: reads data packets from the "traffic receiving and distributing unit", completes routing and network address translation (NAT) conversion processing, and then sends it to the "traffic receiving and distributing unit".

[0006] Traffic analysis unit: reads data packets from the "traffic receiving and distributing unit" and performs analysis.

[0007] Based on the above units, the edge cloud gateway's internal processing methods for traffic data are mainly divided into two schemes.

[0008] refer to Figure 1As shown in the figure, it is a schematic diagram of the processing scheme of the edge cloud gateway for traffic data. Its processing steps include: ① The "traffic receiving and distributing unit" receives the data message from the physical network port and puts it into the mbuf cache. ② The "traffic receiving and distributing unit" notifies the "traffic forwarding processing unit" to process the data message, and at the same time notifies the "traffic analysis unit" to process the message; this step is asynchronous, that is, the "traffic forwarding processing unit" and the "traffic analysis unit" process the data message in mbuf in parallel. ③ The "traffic forwarding processing unit" processes the data message and notifies the "traffic receiving and distributing unit". ④ The "traffic receiving and distributing unit" transfers the message to the physical network card and releases the mbuf.

[0009] refer to Figure 2 The figure shows a schematic diagram of the second processing scheme for traffic data by the edge cloud gateway, and its processing steps include: ① The "traffic receiving and distribution unit" receives the data message from the physical network port and puts it into the mbuf cache. ② The "traffic receiving and distribution unit" copies a portion of the data message and provides it to the "traffic analysis unit" for analysis. ③ The "traffic receiving and distribution unit" notifies the "traffic forwarding processing unit" to process the data message. ④ The "traffic forwarding processing unit" processes the data message and notifies the "traffic receiving and distribution unit". ⑤ The "traffic receiving and distribution unit" transfers the message to the physical network card and releases the mbuf.

[0010] Both of the above-mentioned two solutions of the prior art have some disadvantages.

[0011] For Solution 1, inside the edge cloud gateway, data packets are not copied when distributed to different processing units, which can achieve relatively good processing performance. However, since the data packet action rewritten by the "traffic forwarding processing unit" and the data packet analysis by the "traffic analysis unit" are processed asynchronously and in parallel, and the packet data area is not isolated, there may be a situation where the "traffic analysis unit" has not yet completed the analysis, but the data packet has been rewritten by the "traffic forwarding processing unit". In this case, the "traffic analysis unit" will analyze the data packet rewritten by the "traffic forwarding processing unit", which may cause the business analysis results of the "traffic analysis unit" to be inaccurate.

[0012] For Solution 2, inside the edge cloud gateway, data packets are copied when distributed in different processing units to ensure data isolation. However, for the "traffic receiving and distribution unit", each packet needs to be copied, which increases the CPU computing burden and affects processing performance. At the same time, because all packets have an extra copy process, the packet forwarding delay is increased, which is not conducive to the efficient forwarding of traffic.

[0013] In view of this, how to overcome the defects of the existing technology, how to solve the problem that the traffic in Solution 1 is not isolated, resulting in inaccurate results of the business analysis of the "traffic analysis unit"; and how to solve the problem of message copying in Solution 2, which increases the CPU computing power burden, affects processing performance, and causes increased latency in message forwarding, have become important technical problems that the industry needs to solve urgently. Summary of the invention

[0014] In view of the defects or improvement needs in the prior art: how to solve the problem that the traffic in solution one is not isolated, resulting in inaccurate results of the business analysis of the "traffic analysis unit"; how to solve the problem that the message copy in solution two increases the CPU computing power burden, affects the processing performance, and causes the message forwarding to increase the delay. The present invention provides an edge cloud gateway efficient traffic forwarding method, device and system, which predicts and classifies the message inside the edge cloud gateway, determines the security type of the message according to the predicted classification, and selects different forwarding processing methods according to different security types, which can not only ensure the data isolation of each functional unit inside the edge cloud gateway, but also improve the parallel processing efficiency, reduce the CPU computing power consumption, and improve the traffic forwarding performance.

[0015] The present invention adopts the following technical solution:

[0016] In a first aspect, the present invention provides an edge cloud gateway efficient traffic forwarding method, comprising:

[0017] Predict and classify the received messages, determine the security type of the messages, and temporarily store the messages in the read area of ​​the memory buffer;

[0018] Read the message in the read area of ​​the memory buffer for analysis and processing;

[0019] Read the message in the read area of ​​the memory buffer for forwarding processing, and write the content that needs to be modified to the write area of ​​the memory buffer according to the security type of the message;

[0020] According to the security type of the message, the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer are assembled into a new complete message and sent.

[0021] In some embodiments, the security type of the message includes: a full-area security type message, a partial-area unsafe type message, and a full-area unsafe type message.

[0022] In some embodiments, predicting and classifying the received message to determine the security type of the message specifically includes:

[0023] Establish the analysis model of time series: yt = T × S × C × I; where T, S, C and I represent the values ​​of long-term trend, periodic change, cyclic change and random change respectively;

[0024] According to the pre-learning of the analysis model, the model feature value of the safe type message in the whole area is yt1, the model feature value of the unsafe type message in some areas is yt2, and the model feature value of the unsafe type message in the whole area is yt3;

[0025] Get the model characteristic value yt0 of the current message. If |yt0-yt1|<=0.001, the current message is judged to be a fully safe type message; if |yt0-yt2|<=0.001, the current message is judged to be a partially unsafe type message; if |yt0-yt3|<=0.001, the current message is judged to be a fully unsafe type message.

[0026] In some embodiments, writing the content to be modified to the write area of ​​the memory buffer according to the security type of the message specifically includes:

[0027] If the message is a global security message, there is no need to copy or modify it;

[0028] If the message is a partially unsafe type message, the unsafe area portion of the message is copied and modified, and then written to the write area of ​​the memory buffer;

[0029] If the message is a full-area unsafe type message, the entire message is copied and modified, and then written to the write area of ​​the memory buffer.

[0030] In some embodiments, assembling the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer into a new complete message according to the security type of the message, and sending the new complete message specifically includes:

[0031] If the message is a full-area security type message, the original packet is directly sent with the content of the read area;

[0032] If the message is a partially unsafe type message, the content of the message safety area in the read area is combined with the content of the write area and sent;

[0033] If the message is a full-area unsafe type message, it is directly sent with the content of the write area.

[0034] In some embodiments, the analyzing and processing of the message in the read area of ​​the memory buffer and the forwarding and processing of the message in the read area of ​​the memory buffer are asynchronous parallel processing.

[0035] In some embodiments, the receiving and sending of the message are both implemented through a physical port.

[0036] In a second aspect, the present invention further provides an edge cloud gateway efficient traffic forwarding device, the device comprising:

[0037] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor to execute the edge cloud gateway efficient traffic forwarding method described in the first aspect.

[0038] In a third aspect, the present invention further provides an edge cloud gateway efficient traffic forwarding system, which applies the edge cloud gateway efficient traffic forwarding method as described in the first aspect, and the system includes a traffic receiving and distributing unit, a traffic analysis unit, and a traffic forwarding processing unit, wherein:

[0039] The traffic receiving and distributing unit is used to predict and classify the received messages, determine the security type of the messages, and temporarily store the messages in the read area of ​​the memory buffer;

[0040] The traffic analysis unit is used to read the message in the read area of ​​the memory buffer for analysis and processing;

[0041] The traffic forwarding processing unit is used to read the message in the read area of ​​the memory buffer for forwarding processing, and write the content to be modified to the write area of ​​the memory buffer according to the security type of the message;

[0042] The traffic receiving and distributing unit is used to assemble the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer into a new complete message according to the security type of the message, and send the new complete message.

[0043] In a fourth aspect, the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, which are executed by one or more processors to complete the edge cloud gateway efficient traffic forwarding method described in the first aspect.

[0044] Compared with the prior art, the present invention provides an edge cloud gateway efficient traffic forwarding method, device and system, which have the beneficial effects of predicting and classifying messages inside the edge cloud gateway, judging the security type of the message according to the predicted classification, and selecting different forwarding processing methods according to different security types, which can not only ensure the data isolation of various functional units inside the edge cloud gateway, but also improve the parallel processing efficiency, reduce CPU computing power consumption, and improve traffic forwarding performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 A schematic diagram of a solution for processing traffic data by an edge cloud gateway provided by the background technology of the present invention;

[0047] Figure 2 A schematic diagram of a second processing scheme for flow data by an edge cloud gateway provided by the background technology of the present invention;

[0048] Figure 3 A flow chart of an edge cloud gateway efficient traffic forwarding method provided in Example 1 of the present invention;

[0049] Figure 4 A specific flow chart of prediction classification provided by Example 1 of the present invention;

[0050] Figure 5 A schematic diagram of a unit module of an edge cloud gateway efficient traffic forwarding system provided in Example 2 of the present invention;

[0051] Figure 6 A schematic diagram of the structure of an edge cloud gateway efficient traffic forwarding device provided in Example 3 of the present invention. DETAILED DESCRIPTION

[0052] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but do not limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, without departing from the concept of the present invention, several variations and improvements can also be made. These all belong to the protection scope of the present invention. It should be noted that, if there is no conflict, the various features in the embodiments of the present invention can be combined with each other, all within the protection scope of the present invention. In addition, although the functional module division may be performed in the device schematic diagram, and the logical order may be shown in the flow chart, in some cases, the steps shown or described may be performed in a sequence different from the module division in the device, or in the flow chart.

[0053] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in this specification and in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. In addition, the technical features involved in each embodiment of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0054] Unless the context requires otherwise, throughout the specification and claims, the term "including" is to be interpreted as open inclusion, that is, "including, but not limited to". In the description of the specification, the terms "one embodiment", "some embodiments", "exemplary embodiments", "examples", "specific examples" or "some examples" and the like are intended to indicate that specific features, structures, materials or characteristics associated with the embodiment or example are included in at least one embodiment or example of the present disclosure. The schematic representation of the above terms does not necessarily refer to the same embodiment or example. In addition, the specific features, structures, materials or characteristics may be included in any one or more embodiments or examples in any appropriate manner, that is, although they may be carried in the embodiments or examples of the above terms due to reasons such as the order and position of appearance, it is not limited to that they can be carried in combination by one embodiment or example.

[0055] The abbreviations and key terms in the present invention are defined as follows:

[0056] ECGW: Edge Cloud GateWay, edge cloud gateway, is a gateway that moves the three-layer functions of home gateway devices to edge cloud deployment. The hardware uses a general server to deploy gateway function modules through virtualization and containerization to achieve cloud-based gateways. The cloud gateway mainly identifies user traffic and then dials up to the Internet or directs traffic. The system can provide value-added services such as cloud security, cloud entertainment, cloud games, cloud storage, and cloud monitoring through directed traffic diversion;

[0057] DPDK: Data Plane Development Kit, a high-performance network driver component;

[0058] mbuf: memory buffer, in the DPDK environment, stores user data transferred between processes and network interfaces;

[0059] CPU: central processing unit, central processing unit;

[0060] DPI: Deep Packet Inspection is a flow-based bandwidth monitoring method that allows administrators to understand the network traffic of applications, interfaces and devices in real time, while detecting and preventing various security threats;

[0061] Eth: Ethernet is a computer local area network technology, a local area network communication method, and also a protocol that defines a series of software and hardware standards to connect different computer devices together;

[0062] IP: Internet Protocol. It provides a connectionless, unreliable, best-effort data packet transmission service for Internet hosts.

[0063] NAT: Network Address Translation, refers to network address translation.

[0064] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0065] Embodiment 1:

[0066] like Figure 3 As shown, an embodiment of the present invention provides an edge cloud gateway efficient traffic forwarding method, which includes the following steps.

[0067] Step 100: Predict and classify the received message, determine the security type of the message, and temporarily store the message in the read area of ​​the memory buffer. In this step, the security type of the message includes three types: full-area security type message, partial-area unsafe type message, and full-area unsafe type message. For messages of different security types, they are marked separately and temporarily stored in the read area of ​​the memory buffer mbuf for subsequent analysis and forwarding processing.

[0068] Step 200: Read the message in the read area of ​​the memory buffer for analysis and processing. In this step, the analysis and processing is performed on the message in the read area of ​​the mbuf previously stored. If the message in the read area of ​​the mbuf is not changed, the message data area is isolated, and no analysis error will occur.

[0069] Step 300: Read the message in the read area of ​​the memory buffer for forwarding processing, and write the content that needs to be modified to the write area of ​​the memory buffer according to the security type of the message. In this step, the content that needs to be modified to the write area of ​​the memory buffer according to the security type of the message specifically includes: if the message is a full-area security type message, no copying and modification are required; if the message is a partial-area unsafe type message, then copy the unsafe area part of the message and modify it, and then write it to the write area of ​​the memory buffer; if the message is a full-area unsafe type message, then copy the entire message and modify it, and then write it to the write area of ​​the memory buffer. The scenario in which this embodiment is applied is that there are multiple tasks to process the message data area, some of which only read, and some need to modify the data area. Therefore, for the unsafe area, the modified task must copy it away and then modify it.

[0070] In the above steps, the analysis and processing of the message in the read area of ​​the memory buffer and the forwarding processing of the message in the read area of ​​the memory buffer are asynchronous parallel processing. And the analysis and processing and the forwarding processing are all messages in the read area of ​​the mbuf that previously existed, so that there will be no analysis errors for the analysis and processing. For the forwarding processing, it is only necessary to write the content that needs to be modified to the write area of ​​mbuf, and it is not necessary to completely copy all the message contents, which can reduce the CPU computing power burden and reduce the message forwarding delay.

[0071] Step 400: According to the security type of the message, the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer are assembled into a new complete message and sent. In this step, according to the security type of the message, the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer are assembled into a new complete message and sent specifically including: if the message is a full-area security type message, the original packet is directly sent with the contents of the read area; if the message is a partial-area unsafe type message, the contents of the message security area portion in the read area are combined with the contents of the write area and sent; if the message is a full-area unsafe type message, the contents of the write area are directly sent. In some embodiments, the reception and transmission of the message are both implemented through physical ports.

[0072] Through the above steps, the message content in the read area of ​​mbuf is read for analysis during business analysis, and the message content in the read area of ​​mbuf will not be changed, which can ensure the data isolation of each functional unit inside the edge cloud gateway and solve the problem of inaccurate business analysis results. Furthermore, when performing analysis and forwarding processing at the same time, it is not necessary to copy all messages once. Only the message content that needs to be modified needs to be copied and written to the write area of ​​mbuf, and subsequent message sending can be performed, which can improve parallel processing efficiency, reduce CPU computing power consumption, and improve traffic forwarding performance.

[0073] refer to Figure 4 As shown, in some embodiments, predicting and classifying the received messages and determining the security type of the messages specifically includes the following steps.

[0074] Step 101: Establish an analysis model of time series: yt=T×S×C×I; wherein T, S, C and I represent the values ​​of long-term trend, periodic change, cyclic change and random change respectively.

[0075] Step 102: According to the pre-learning of the analysis model, the model feature value of the safe type message in the whole area is yt1, the model feature value of the unsafe type message in some areas is yt2, and the model feature value of the unsafe type message in the whole area is yt3. The model learning here is to learn with actual data input. For example, if you want to learn the characteristics of Wuchang District, then first connect the Internet traffic in Wuchang District to the model for calculation, and finally learn the experience value characteristics of Wuchang District. Other areas are similar. So here yt1 / yt2 / yt3 are the feature values ​​learned through AI learning.

[0076] Step 103: Get the model feature value yt0 of the current message. If |yt0-yt1|<=0.001, the current message is judged to be a safe message for the whole area; if |yt0-yt2|<=0.001, the current message is judged to be an unsafe message for some areas; if |yt0-yt3|<=0.001, the current message is judged to be an unsafe message for the whole area. yt1, yt2, and yt3 are the feature values ​​learned in the early stage. For example, the Internet traffic in Wuchang District is obtained after a period of model learning. The yt0 here is calculated in real time. For example, the value of the current access traffic at 10:00 is yt0 according to the model algorithm. Then, it is compared with the feature values ​​in turn (compared with yt1\yt2\yt3). As long as the error is less than 0.001, it is considered to belong to a certain type of feature.

[0077] To summarize, this embodiment proposes to provide an efficient traffic forwarding method for an edge cloud gateway, which includes the following advantages: predicting and classifying messages inside the edge cloud gateway, determining the security type of the message based on the predicted classification, and selecting different forwarding processing methods based on different security types. This can not only ensure data isolation of various functional units inside the edge cloud gateway, but also improve parallel processing efficiency, reduce CPU computing power consumption, and improve traffic forwarding performance.

[0078] Specifically, the message content in the read area of ​​mbuf is read for analysis during business analysis, and the message content in the read area of ​​mbuf will not be changed, which can ensure the data isolation of each functional unit inside the edge cloud gateway and solve the problem of inaccurate business analysis results. Furthermore, when performing analysis and forwarding processing at the same time, it is not necessary to copy all messages once. Only the message content that needs to be modified needs to be copied and written to the write area of ​​mbuf, and subsequent message sending can be performed, which can improve parallel processing efficiency, reduce CPU computing power consumption, and improve traffic forwarding performance.

[0079] Embodiment 2:

[0080] Based on the edge cloud gateway efficient traffic forwarding method provided in the above-mentioned embodiment 1, embodiment 2 of the present invention provides an edge cloud gateway efficient traffic forwarding system to explain the solution of the present invention in more detail.

[0081] refer to Figure 5 As shown, the efficient traffic forwarding system of the edge cloud gateway of this embodiment includes a traffic receiving and distributing unit, a traffic analyzing unit and a traffic forwarding processing unit. Among them: the traffic receiving and distributing unit is used to predict and classify the received messages, determine the security type of the messages, and temporarily store the messages in the read area of ​​the memory buffer. The traffic analysis unit is used to read the messages in the read area of ​​the memory buffer for analysis and processing. There can be multiple traffic analysis units, corresponding to multiple computing power consuming services. The traffic forwarding processing unit is used to read the messages in the read area of ​​the memory buffer for forwarding processing, and write the content that needs to be modified to the write area of ​​the memory buffer according to the security type of the message. The traffic forwarding processing unit mainly implements routing and NAT conversion. The traffic receiving and distributing unit is also used to assemble the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer into a new complete message according to the security type of the message, and send it.

[0082] The above system needs to predict and classify the messages inside the edge cloud gateway. The implementation process is as follows:

[0083] ① The traffic receiving and distributing unit receives data packets and forms a packet set.

[0084] ② The traffic receiving and distributing unit performs prediction and classification, and eventually forms three types of messages: safe messages for the entire area; unsafe messages for some areas; and unsafe messages for the entire area.

[0085] The prediction classification model is as follows: The traffic series forms a set of variables X(t). At times t1 < t2 < … < tn, an ordered set discretized with time t as the independent variable is obtained: X(t1), X(t2), …, X(tn). The independent variable t is the meaning of the packet with different attributes, such as the destination IP port, protocol, packet length, etc. The fluctuations of the time series are the result of the combined action of many factors. The effects of various factors have four categories: long-term trend, periodic variation, cyclic variation, and random variation. If T, S, C, and I respectively represent the values of the long-term trend, periodic variation, cyclic variation, and random variation, then the analysis model for the time series yt is: yt = T × S × C × I; Through pre-learning according to the model, the feature model of the fully secure type packets in the whole region is yt1, the feature model of the partially insecure type packets in the partial region is yt2, and the feature model of the fully insecure type packets in the whole region is yt3. It should be noted that the prediction classification model is a model algorithm for statistical classification. X is a set of variables that changes according to time, so it is X(t). One point is collected per second, and a sample for a period of time, such as 7 days, is collected, that is, X(t1)...X(604800). T is the trend value obtained according to the long-term trend of X(t); S is the value calculated according to the periodic variation law of X(t); C is the value calculated according to the cyclic law of X(t); I is the value calculated according to the random variation of X(t). The formula of the model is: yt = T x S x C x I.

[0086] For the current packet, yt0 is obtained according to the model. If |yt0 - yt1| <= 0.001, it is a fully secure type packet in the whole region; if |yt0 - yt2| <= 0.001, it is a partially insecure type packet in the partial region; if |yt0 - yt3| <= 0.001, it is a fully insecure type packet in the whole region.

[0087] ③ The traffic analysis unit and the traffic forwarding processing unit perform internal processing in an asynchronous parallel manner according to the packet type analysis result.

[0088] ④ The traffic forwarding processing unit writes the part of the content that needs to be modified in the packet to the write area of the mbuf; In this case, data isolation is ensured, thus ensuring that the data processed by the traffic analysis unit is normal and not contaminated. For example, the packet content in the read area of the mbuf includes three parts: the eth header, the IP header, and the payload; If the whole region is secure, there is no need to copy and modify; If the eth header part and the IP header part are insecure, then copy the eth header and the IP header and write them to the write area of the mbuf after modification; If the whole region is insecure, copy the entire packet of the eth header, the IP header, and the payload and write it to the write area of the mbuf after modification.

[0089] ⑤ The traffic receiving and distribution unit uses the technology of assembling and sending a message in two pieces inside DPDK, and finally assembles a complete message to send. Network traffic is sent from the physical port (such as the network card port). DPDK self-assembly does not occupy computing resources and does not delay. For example, when the entire area is safe and there is no copy modification, the original packet of the message in the read area is sent directly; when the eth header and IP header are not safe, the eth header, IP header and payload of the write area are assembled and sent; when the entire area is not safe, the eth header, IP header and payload of the write area are sent.

[0090] In summary, the solution of the embodiment of the present invention solves the problem of the original technical solution 1 that the data is not isolated under the premise of ensuring the processing and forwarding performance, resulting in inaccurate data processing by the traffic analysis unit; the technical solution of the embodiment of the present invention solves the problem of the original technical solution 2 that ensures data accuracy but reduces the traffic forwarding performance. In other words, the technical solution of the embodiment of the present invention can not only ensure the data isolation of each functional unit inside the edge cloud gateway, but also improve the parallel processing efficiency, reduce the CPU computing power consumption, and improve the traffic forwarding performance.

[0091] Embodiment 3:

[0092] Based on the edge cloud gateway efficient traffic forwarding method provided in the above embodiment 1, the present invention also provides an edge cloud gateway efficient traffic forwarding device that can be used to implement the above method and system, such as Figure 6 , which is a schematic diagram of the device architecture of an embodiment of the present invention. The edge cloud gateway efficient traffic forwarding device of this embodiment includes one or more processors 21 and a memory 22. Among them, Figure 6 A processor 21 is taken as an example.

[0093] The processor 21 and the memory 22 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0094] The memory 22, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as the edge cloud gateway efficient traffic forwarding method in Example 1. The processor 21 executes various functional applications and data processing of the edge cloud gateway efficient traffic forwarding device by running the non-volatile software programs, instructions and modules stored in the memory 22, that is, the edge cloud gateway efficient traffic forwarding method in Example 1 is implemented.

[0095] The memory 22 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 22 may optionally include a memory remotely arranged relative to the processor 21, and these remote memories may be connected to the processor 21 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0096] The program instructions / modules are stored in the memory 22. When executed by one or more processors 21, the edge cloud gateway efficient traffic forwarding method in the above embodiment 1 is executed, for example, the above described Figure 3-Figure 4 The steps shown.

[0097] The above product can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not described in detail in this embodiment, please refer to the method provided by the embodiment of the present invention.

[0098] It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0099] Through the description of the above implementation methods, ordinary technicians in this field can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, it can also be implemented by hardware. Ordinary technicians in this field can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may also be combined, the steps may be implemented in any order, and there are many other changes in different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An efficient traffic forwarding method for edge cloud gateway, characterized in that: include: Predict and classify the received messages, determine the security type of the messages, and temporarily store the messages in the read area of ​​the memory buffer; Read the message in the read area of ​​the memory buffer for analysis and processing; Read the message in the read area of ​​the memory buffer for forwarding processing, and write the content that needs to be modified to the write area of ​​the memory buffer according to the security type of the message; According to the security type of the message, the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer are assembled into a new complete message and sent.

2. The edge cloud gateway efficient traffic forwarding method according to claim 1 is characterized in that: The security types of the message include: a full-area security type message, a partial-area unsafe type message, and a full-area unsafe type message.

3. The edge cloud gateway efficient traffic forwarding method according to claim 2 is characterized in that: The predicting and classifying of the received message to determine the security type of the message specifically includes: Establish the analysis model of time series: yt = T × S × C × I; where T, S, C and I represent the values ​​of long-term trend, periodic change, cyclic change and random change respectively; According to the pre-learning of the analysis model, the model feature value of the safe type message in the whole area is yt1, the model feature value of the unsafe type message in some areas is yt2, and the model feature value of the unsafe type message in the whole area is yt3; Get the model characteristic value yt0 of the current message. If |yt0-yt1|<=0.001, the current message is judged to be a fully safe type message; if |yt0-yt2|<=0.001, the current message is judged to be a partially unsafe type message; if |yt0-yt3|<=0.001, the current message is judged to be a fully unsafe type message.

4. The edge cloud gateway efficient traffic forwarding method according to claim 2 is characterized in that: The step of writing the content to be modified to the write area of ​​the memory buffer according to the security type of the message specifically includes: If the message is a global security message, there is no need to copy or modify it; If the message is a partially unsafe type message, the unsafe area portion of the message is copied and modified, and then written to the write area of ​​the memory buffer; If the message is a full-area unsafe type message, the entire message is copied and modified, and then written to the write area of ​​the memory buffer.

5. The edge cloud gateway efficient traffic forwarding method according to claim 4 is characterized in that: The step of assembling the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer into a new complete message according to the security type of the message, and sending the new complete message specifically includes: If the message is a full-area security type message, the original packet is directly sent with the content of the read area; If the message is a partially unsafe type message, the content of the message safety area in the read area is combined with the content of the write area and sent; If the message is a full-area unsafe type message, it is directly sent with the content of the write area.

6. The edge cloud gateway efficient traffic forwarding method according to any one of claims 1-5, characterized in that: The analyzing and processing of the message in the read area of ​​the memory buffer and the forwarding and processing of the message in the read area of ​​the memory buffer are asynchronous parallel processing.

7. The edge cloud gateway efficient traffic forwarding method according to any one of claims 1-5, characterized in that: The reception and transmission of the message are both realized through the physical port.

8. An edge cloud gateway efficient traffic forwarding device, characterized in that: The device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor to execute the edge cloud gateway efficient traffic forwarding method described in any one of claims 1-7.

9. An edge cloud gateway efficient traffic forwarding system, using the edge cloud gateway efficient traffic forwarding method as described in any one of claims 1-7, characterized in that: The system includes a traffic receiving and distributing unit, a traffic analyzing unit, and a traffic forwarding processing unit, wherein: The traffic receiving and distributing unit is used to predict and classify the received messages, determine the security type of the messages, and temporarily store the messages in the read area of ​​the memory buffer; The traffic analysis unit is used to read the message in the read area of ​​the memory buffer for analysis and processing; The traffic forwarding processing unit is used to read the message in the read area of ​​the memory buffer for forwarding processing, and write the content to be modified to the write area of ​​the memory buffer according to the security type of the message; The traffic receiving and distributing unit is used to assemble the contents of the write area of ​​the memory buffer and the read area of ​​the memory buffer into a new complete message according to the security type of the message, and send the new complete message.

10. A non-volatile computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, which are executed by one or more processors to complete the edge cloud gateway efficient traffic forwarding method as described in any one of claims 1-7.

Images