Message auditing method, device and equipment and readable storage medium
By draining the target message to the audit end not located on the transmission path for auditing on the message transmission path, the resource waste and maintenance costs caused by indiscriminate audits in the prior art are solved, and the selective Traffic audit and efficient audit strategy management.
Patent Information
- Application Number
- CN202411366095.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-27
- Publication Date
- 2025-01-07
AI Technical Summary
In the prior art, audit function equipment needs to conduct indiscriminate audits of all traffic flowing through itself, resulting in waste of resources and loss of transmission performance. When the traffic processing strategy changes, audit function equipment needs to be updated, which increases maintenance costs.
By draining the target message to the audit end not located on the transmission path for auditing on the message transmission path, selective traffic audit is realized, reducing the amount of audit data and maintenance costs.
Selective traffic audit is realized, which reduces the amount of audit data and maintenance costs, improves audit efficiency, and the audit strategy is not related to the traffic processing strategy, avoiding business intrusion and network topology changes.
Smart Images
Figure CN119276799A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a message auditing method, apparatus, device and readable storage medium. Background Art
[0002] At present, audit function devices are generally connected in series on the network transmission path, so that the audit function devices can audit the traffic flowing through themselves and intercept or release it. In this way, the audit function device needs to audit all traffic flowing through itself indiscriminately. This full-flow audit method will cause resource waste and transmission performance loss. If the traffic processing strategy changes, the audit function device needs to be updated accordingly. This solution of changing the audit strategy as the traffic processing strategy changes will undoubtedly increase maintenance costs.
[0003] Therefore, how to reduce the coupling between the audited traffic and the audit policy and the traffic audit maintenance cost is a problem that technical personnel in this field need to solve. Summary of the invention
[0004] In view of this, the purpose of this application is to provide a message audit method, device, equipment and readable storage medium to reduce the coupling between the audited traffic and the audit policy and the maintenance cost of traffic audit. The specific scheme is as follows:
[0005] In a first aspect, the present application provides a message audit method, which is applied to a target device on a message transmission path, comprising:
[0006] Receive target message;
[0007] If the target message meets the preset diversion requirements, the target message is determined as a message to be audited, and the target message is encapsulated;
[0008] The encapsulated target message is directed to an audit terminal that is not located on the message transmission path through a diversion channel, so that the audit terminal can audit the encapsulated target message.
[0009] Optionally, the diversion requirement is: the source IP address, destination IP address, protocol information, source port and / or destination port of the target message are recorded in a preset diversion rule; or the session of the target message has a diversion mark.
[0010] Optionally, if the source IP address, destination IP address, protocol information, source port or destination port of the target message is not recorded in the preset diversion rule, or the session of the target message has no diversion mark, it is determined that the target message does not meet the diversion requirements.
[0011] Optionally, it also includes:
[0012] If the target message does not meet the diversion requirement, the target message is determined as a message that does not need to be audited, and the target message continues to be transmitted on the message transmission path.
[0013] Optionally, the encapsulating the target message includes:
[0014] The nsh header and the eth header are encapsulated in the outer layer of the target message.
[0015] Optionally, directing the encapsulated target message to an audit terminal that is not located on the message transmission path through a diversion channel includes:
[0016] At least one diversion channel with a transmission performance higher than a preset transmission requirement is selected from a plurality of preset diversion channels, and the encapsulated target message is diverted to the audit end.
[0017] Optionally, after receiving the target message, the method further includes:
[0018] Detect whether the session of the target message has a diversion mark;
[0019] If the session of the target message has a diversion mark, the target message is determined as a message to be audited and the target message is encapsulated; the encapsulated target message is diverted to an audit terminal that is not located on the message transmission path through a diversion channel so that the audit terminal audits the encapsulated target message;
[0020] If the session of the target message has no diversion mark, then detect whether the source IP address, destination IP address, protocol information, source port and / or destination port of the target message are recorded in the preset diversion rule.
[0021] Optionally, the target device is a network card device of a virtual machine, and accordingly, the message transmission path is used to connect network card devices of different virtual machines in the same local area network.
[0022] Optionally, the target device is a network forwarding device connected to a local area network, and accordingly, the message transmission path is used to connect the local area network and an external network;
[0023] If the target message is a message sent from the local area network to the external network, after the audit end audits the encapsulated target message, the audit end further includes: verifying the target message returned by the audit end through the diversion channel, performing address conversion on the target message, and sending the target message after address conversion to the external network;
[0024] If the target message is a message sent from the external network to the local area network, before determining the target message as a message to be audited, it also includes: performing address conversion on the target message; accordingly, after the audit end audits the encapsulated target message, it also includes: verifying the target message returned by the audit end through the drainage channel, and sending the verified target message to the local area network.
[0025] Optionally, the audit end is deployed with an audit policy, and the audit policy is unrelated to the traffic diversion requirement.
[0026] In a second aspect, the present application provides a message auditing device, which is applied to a target device on a message transmission path, including:
[0027] A receiving module, used for receiving a target message;
[0028] A detection module, configured to determine the target message as a message to be audited and encapsulate the target message if the target message meets the preset diversion requirements;
[0029] The diversion module is used to divert the encapsulated target message to the audit end which is not located on the message transmission path through the diversion channel, so that the audit end can audit the encapsulated target message.
[0030] In a third aspect, the present application provides an electronic device, including:
[0031] Memory for storing computer programs;
[0032] A processor is used to execute the computer program to implement the aforementioned disclosed message auditing method.
[0033] In a fourth aspect, the present application provides a readable storage medium for storing a computer program, wherein the computer program implements the aforementioned disclosed message auditing method when executed by a processor.
[0034] It can be seen from the above scheme that the present application provides a message auditing method, which is applied to a target device on a message transmission path, including: receiving a target message; if the target message meets the preset diversion requirements, determining the target message as a message to be audited, and encapsulating the target message; diverting the encapsulated target message to an audit end that is not located on the message transmission path through a diversion channel, so that the audit end can audit the encapsulated target message.
[0035] It can be seen that the present application enables the target device on the message transmission path to divert the traffic flowing through itself to the audit terminal which is not on the message transmission path, and the target device selectively diverts the traffic in order according to the diversion requirements, thereby realizing selective traffic auditing and avoiding full traffic auditing, thereby reducing the amount of audit data and improving auditing efficiency. Moreover, since the audit terminal is not on the message transmission path, only the messages sent by the diversion channel are audited, thereby reducing the coupling between the audited traffic and the audit strategy (deployed in the audit terminal), and changes in the traffic processing strategy will not affect the audit strategy of the audit terminal, there is no business intrusion, and there is no need to change the network topology of the transmission path, which can reduce the maintenance cost of traffic auditing.
[0036] Correspondingly, a message auditing device, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0038] Figure 1 A flow chart of a message audit method disclosed in this application;
[0039] Figure 2 A schematic diagram of message diversion disclosed in this application;
[0040] Figure 3 This is another message diversion schematic diagram disclosed in this application;
[0041] Figure 4 A schematic diagram of message encapsulation disclosed in this application;
[0042] Figure 5 A schematic diagram of a message auditing device disclosed in this application;
[0043] Figure 6 A schematic diagram of an electronic device disclosed in this application;
[0044] Figure 7 This is a schematic diagram of another electronic device disclosed in this application. DETAILED DESCRIPTION
[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0046] At present, audit function devices are generally connected in series on the network transmission path, so that the audit function device can audit the traffic flowing through itself and intercept or release it. In this way, the audit function device needs to audit all traffic flowing through itself indiscriminately. This full-flow audit method will cause resource waste and transmission performance loss. If the traffic processing strategy changes, the audit function device needs to be updated accordingly. This solution of changing the audit strategy as the traffic processing strategy changes will undoubtedly increase maintenance costs. To this end, the present application provides a message audit solution that can reduce the coupling between the audited traffic and the audit strategy and the traffic audit maintenance cost.
[0047] See also Figure 1 As shown, the embodiment of the present application discloses a message audit method, which is applied to a target device on a message transmission path, including:
[0048] S101. Receive a target message.
[0049] In this embodiment, the target device on the message transmission path may be a network card, a router, a switch, a gateway, etc. The target message may be a message sent from the intranet to the extranet, or may be a message sent from the extranet to the intranet.
[0050] S102: If the target message meets the preset diversion requirements, the target message is determined as a message to be audited, and the target message is encapsulated.
[0051] It should be noted that the first message in the same session is detected using the diversion rules. If it is determined to be a message that needs to be audited, a diversion mark is added to the session. Then, the subsequent messages in this session do not need to be detected using the diversion rules, but directly determine whether the corresponding session has a diversion mark. If the detection determines that it is a message that does not need to be audited, the diversion mark is not added to the session or the non-drainage mark is added to the session. Then, the subsequent messages in this session do not need to be detected using the diversion rules, but directly determine the corresponding session and release the message. In one example, the diversion requirement is: the source IP address, destination IP address, protocol information, source port and / or destination port of the target message are recorded in the preset diversion rules; or the session of the target message has a diversion mark. Correspondingly, if the source IP address, destination IP address, protocol information, source port or destination port of the target message are not recorded in the preset diversion rules, or the session of the target message does not have a diversion mark, it is determined that the target message does not meet the diversion requirements.
[0052] If the target device determines that the target message does not meet the diversion requirements, it determines the target message as a message that does not need to be audited, and continues to transmit the target message on the message transmission path. That is, in this case, the target message is not diverted to the audit end, but is transmitted to the predetermined destination end.
[0053] It should be noted that the target message may be encapsulated using any protocol or rule, such as using the nsh protocol. Therefore, in one example, encapsulating the target message includes encapsulating an nsh header (Ethernet header) and an eth header (network service header) in the outer layer of the target message.
[0054] S103: divert the encapsulated target message to an audit terminal that is not located on the message transmission path through a diversion channel, so that the audit terminal can audit the encapsulated target message.
[0055] More than one diversion channel can be deployed, so in one example, the encapsulated target message is diverted to the audit end that is not on the message transmission path through the diversion channel, including: selecting at least one diversion channel with a transmission performance higher than the preset transmission requirement from the preset multiple diversion channels, and diverting the encapsulated target message to the audit end. In addition, the performance data such as the transmission delay of the diversion channel can be detected, so as to compare the transmission performance of each diversion channel with the preset transmission requirement, so as to select a diversion channel with better transmission performance to divert the target message. Among them, the transmission performance of the diversion channel can be represented by performance data such as transmission delay and transmission rate.
[0056] In one example, after receiving the target message, the target device also detects whether the session of the target message has a diversion mark; if the session of the target message has a diversion mark, the target message is determined as a message to be audited and the target message is encapsulated; the encapsulated target message is diverted to an audit end that is not located on the message transmission path through a diversion channel so that the audit end can audit the encapsulated target message; if the session of the target message has no diversion mark, the source IP address, destination IP address, protocol information, source port and / or destination port of the target message are detected whether they are recorded in the preset diversion rules.
[0057] As mentioned above, the target device on the message transmission path can be a network card, router, switch, gateway, etc. The target device is the network card device of the virtual machine. Accordingly, the message transmission path is used to connect the network card devices of different virtual machines in the same local area network. The target device is a network forwarding device connected to the local area network. Accordingly, the message transmission path is used to connect the local area network and the external network; accordingly, if the target message is a message sent from the local area network to the external network, then after the audit end audits the encapsulated target message, it also includes: verifying the target message returned by the audit end through the drainage channel, performing address conversion on the target message, and sending the target message after address conversion to the external network. For details, please refer to Figure 2 .exist Figure 2 In the process, after the network card device of the virtual machine receives the packet, it first determines whether the source IP address, destination IP address, protocol information, source port and / or destination port of the current packet are recorded in the preset diversion rules; or determines whether the session of the current packet has a diversion mark, so as to determine whether to divert it. If diversion is determined, the status of each diversion channel is checked to select the diversion channel. After the message is encapsulated, the encapsulated message is diverted to the audit end through the selected diversion channel; after the audit end returns the packet, the returned data is verified. If the verification passes, the address conversion is performed, and the data packet continues to be sent.
[0058] Accordingly, if the target message is a message sent from the external network to the local area network, before determining the target message as the message to be audited, it also includes: performing address translation on the target message; accordingly, after the audit end audits the encapsulated target message, it also includes: verifying the target message returned by the audit end through the diversion channel, and sending the verified target message to the local area network. For details, please refer to Figure 3 .exist Figure 3In the process, after the network card device of the virtual machine receives the packet, it first determines whether the source IP address, destination IP address, protocol information, source port and / or destination port of the current packet are recorded in the preset diversion rules; or determines whether the session of the current packet has a diversion mark, so as to determine whether to divert it. If diversion is determined, the address of the data packet is converted, and the status of each diversion channel is checked to select the diversion channel. After the message is encapsulated, the encapsulated message is diverted to the audit end through the selected diversion channel; after the audit end returns the packet, the information of the returned data is verified. If the verification passes, the data packet continues to be sent.
[0059] In one example, an audit policy is deployed on the audit end, and the audit policy is not related to the traffic diversion requirements.
[0060] It can be seen that this embodiment enables the target device on the message transmission path to divert the traffic flowing through itself to the audit end which is not on the message transmission path, and the target device selectively diverts the traffic in order according to the diversion requirements, thereby realizing selective traffic auditing and avoiding full traffic auditing, thereby reducing the amount of audit data and improving audit efficiency. Moreover, since the audit end is not on the message transmission path, only the messages sent by the diversion channel are audited, thereby reducing the coupling between the audited traffic and the audit strategy (deployed in the audit end), the audit strategy and the diversion requirements are unrelated, and changes in the traffic processing strategy will not affect the audit strategy of the audit end, there is no business intrusion, and there is no need to change the network topology of the transmission path, which can reduce the maintenance cost of traffic auditing.
[0061] As mentioned above, this application provides two traffic diversion points: the network card of the virtual machine in the LAN and the router outside the LAN. The appropriate diversion point can be selected according to different application scenarios. When accessing the intranet virtual machine from the external network, the diversion rules (such as iptables rules) can be configured on the router to introduce the traffic that needs to be audited into the fwaas container (i.e., the audit end) for traffic audit. After the audit is completed, the fwaas container sends the traffic back to the router so that the router can complete the subsequent forwarding path. For the traffic between different virtual machines in the same intranet, the diversion rules are configured at the network card of each virtual machine, and the traffic that needs to be audited is introduced into the fwaas container for traffic audit. After the audit is completed, it is sent back and the subsequent forwarding operation is completed. Regardless of the audit method, the diversion rules can be configured in the same way to introduce the traffic that needs to be audited into the fwaas container for auditing, and the traffic that does not need to be audited can directly complete the original forwarding path. When the traffic is adjusted due to the virtual machine business, only the diversion rules need to be adjusted accordingly, without changing the fwaas container and the audit policy therein. In this example, each virtual machine, router, and fwaas container are virtual devices and are deployed on the same physical host. Among them, the fwaas (fire wall as a Service) container is a container that implements a firewall service. Fwaas is a security service provided by Openstack, which supports virtual firewalls, dynamic allocation of security resources, and elastic expansion of security devices, and manages virtual firewall resources in a unified manner through the Openstack console.
[0062] The specific implementation of using the diversion rules to select the traffic that needs to be audited is: match the message with the diversion rules, and the matching dimensions include source IP address, destination IP address, protocol, source port, destination port and other information. The message that matches the diversion rules is the traffic that needs to be audited. The outer layer of the original message is encapsulated with the nsh header and eth header and sent to the diversion channel. The message encapsulation is as follows: Figure 4 As shown. Figure 4 As shown in the figure, the nsh header includes the necessary forwarding information when the message is returned, such as: the message forwarding inbound and outbound interfaces (router interfaces), forwarding device (router) ID, session ID and other necessary fields. This information is not necessary for the flow audit of the fwaas container, but it can quickly guide the forwarding when the message returns to the forwarding plane, avoiding the performance loss caused by re-searching the session or route.
[0063] The diversion channel is built based on the virtualization technology virtio, with the forwarding plane as the backend and the Fwaas container as the virtio frontend. The diversion channel can be dynamically scaled according to business needs. The traffic matching the diversion rules can select a channel according to certain rules (random selection, etc.) to send the message to the fwaas container. At the same time, the diversion channel also provides a detection mechanism. When the delay of the diversion channel is high or the channel is blocked, it is not selected for traffic diversion, but a diversion channel with a smaller delay is selected for traffic diversion. The bypass messages that are not diverted follow the normal forwarding path to maximize the guarantee that the virtual machine business is not affected.
[0064] In addition, traffic diversion adopts a fast and slow path mechanism. The matching of diversion rules is only performed on the slow path. The traffic matching the diversion rules will be marked with a diversion mark or a bypass mark in the session according to the rule action. After the slow path session is established, diversion or bypass is performed directly according to the diversion mark or bypass mark of the session. This is called the fast path mechanism. To implement the above fast and slow path mechanism, a session can be determined based on the five-tuple. For the traffic of the same five-tuple, only the first packet triggers the matching of the diversion rule. The subsequent traffic of this five-tuple is diverted or bypassed based on the diversion mark or bypass mark of the established session.
[0065] It can be seen that this application can achieve (1) on-demand diversion: only the traffic that needs to be audited will be introduced into the fwaas container for auditing, and the traffic that does not need to be audited will not change the original forwarding process; (2) dynamic diversion: the adjustment of audit traffic can be carried out dynamically, and only the corresponding diversion rules need to be adjusted, which can achieve virtual machine customer business unawareness, traffic forwarding that does not need to be audited has no performance loss and no business intrusion, and the diversion action is not perceived by the virtual machine; (3) non-business intrusion: traffic audit is placed in a separate fwaas container, is not embedded in the forwarding path, is non-business intrusive, reduces forwarding plane performance loss, and can complete the audit without complex topology changes when the business changes.
[0066] A message auditing device provided in an embodiment of the present application is introduced below. The message auditing device described below and the message auditing method described above can be referenced to each other.
[0067] See also Figure 5 As shown, the embodiment of the present application discloses a message auditing device, which is applied to a target device on a message transmission path, including:
[0068] A receiving module, used for receiving a target message;
[0069] The detection module is used to determine the target message as a message to be audited and encapsulate the target message if the target message meets the preset diversion requirements;
[0070] The diversion module is used to divert the encapsulated target message to the audit end which is not located on the message transmission path through the diversion channel, so that the audit end can audit the encapsulated target message.
[0071] In one example, the diversion requirements are: the source IP address, destination IP address, protocol information, source port and / or destination port of the target message are recorded in the preset diversion rules; or the session of the target message has a diversion mark.
[0072] In one example, the detection module is specifically used to: if the source IP address, destination IP address, protocol information, source port or destination port of the target message is not recorded in the preset diversion rules, or the session of the target message has no diversion mark, it is determined that the target message does not meet the diversion requirements.
[0073] In one example, it also includes:
[0074] The release module is used to determine the target message as a message that does not need to be audited if the target message does not meet the diversion requirements, and continue to transmit the target message on the message transmission path.
[0075] In an example, the detection module is specifically used to: encapsulate an nsh header and an eth header in an outer layer of the target message.
[0076] In one example, the diversion module is specifically used to: select at least one diversion channel with a transmission performance higher than a preset transmission requirement from a plurality of preset diversion channels, and divert the encapsulated target message to the audit end.
[0077] In one example, the detection module is specifically used to: detect whether the session of the target message has a diversion mark; if the session of the target message has a diversion mark, determine the target message as a message to be audited, and encapsulate the target message; divert the encapsulated target message to the audit end that is not located on the message transmission path through the diversion channel so that the audit end can audit the encapsulated target message; if the session of the target message does not have a diversion mark, detect whether the source IP address, destination IP address, protocol information, source port and / or destination port of the target message are recorded in the preset diversion rules.
[0078] In one example, the target device is a network card device of a virtual machine, and accordingly, the message transmission path is used to connect network card devices of different virtual machines in the same local area network.
[0079] In one example, the target device is a network forwarding device connected to a local area network, and accordingly, the message transmission path is used to connect the local area network and the external network; if the target message is a message sent from the local area network to the external network, then after the audit end audits the encapsulated target message, it also includes: verifying the target message returned by the audit end through the drainage channel, and performing address conversion on the target message, and sending the target message after address conversion to the external network; if the target message is a message sent from the external network to the local area network, then before determining the target message as a message to be audited, it also includes: performing address conversion on the target message; accordingly, after the audit end audits the encapsulated target message, it also includes: verifying the target message returned by the audit end through the drainage channel, and sending the verified target message to the local area network.
[0080] In one example, an audit policy is deployed on the audit end, and the audit policy is not related to the traffic diversion requirements.
[0081] Among them, for more specific working processes of each module and unit in this embodiment, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.
[0082] It can be seen that this embodiment provides a message auditing device, which can reduce the coupling between the audited traffic and the audit policy and the traffic audit maintenance cost.
[0083] An electronic device provided in an embodiment of the present application is introduced below. The electronic device described below and the message audit method and device described above can refer to each other.
[0084] See also Figure 6 As shown, the embodiment of the present application discloses an electronic device, including:
[0085] Memory 601, used for storing computer programs;
[0086] The processor 602 is used to execute the computer program to implement the method disclosed in any of the above embodiments.
[0087] Please refer to Figure 7 , Figure 7Another electronic device schematic diagram provided for this embodiment, the electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 322 (for example, one or more processors) and memory 332, one or more storage media 330 (for example, one or more mass storage devices) storing application programs 342 or data 344. Among them, the memory 332 and the storage medium 330 can be short-term storage or permanent storage. The program stored in the storage medium 330 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the central processor 322 can be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the electronic device 301.
[0088] The electronic device 301 may further include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341. For example, Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.
[0089] exist Figure 7 In the example, the application 342 may be a program for executing the message auditing method, and the data 344 may be data required or generated for executing the message auditing method.
[0090] The steps in the message audit method described above can be implemented by the structure of an electronic device.
[0091] A readable storage medium provided in an embodiment of the present application is introduced below. The readable storage medium described below and the message audit method, apparatus and device described above can be referenced to each other.
[0092] A readable storage medium is used to store a computer program, wherein the computer program, when executed by a processor, implements the message audit method disclosed in the above embodiment. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiment, and will not be repeated here.
[0093] The "first", "second", "third", "fourth", etc. (if any) referred to in this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods or devices.
[0094] It should be noted that the descriptions involving "first", "second", etc. in this application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.
[0095] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.
[0096] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of readable storage medium known in the art.
[0097] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.
Claims
1. A message audit method, characterized in that: The target devices used in the message transmission path include: Receive target message; If the target message meets the preset diversion requirements, the target message is determined as a message to be audited, and the target message is encapsulated; The encapsulated target message is directed to an audit terminal that is not located on the message transmission path through a diversion channel, so that the audit terminal can audit the encapsulated target message.
2. The message audit method according to claim 1, characterized in that: The traffic diversion requirement is that the source IP address, destination IP address, protocol information, source port and / or destination port of the target message are recorded in the preset traffic diversion rules; Or the session of the target message has a diversion mark.
3. The message audit method according to claim 2, characterized in that: If the source IP address, destination IP address, protocol information, source port or destination port of the target message is not recorded in the preset diversion rule, or the session of the target message has no diversion mark, it is determined that the target message does not meet the diversion requirement.
4. The message audit method according to claim 1, characterized in that: Also includes: If the target message does not meet the diversion requirement, the target message is determined as a message that does not need to be audited, and the target message continues to be transmitted on the message transmission path.
5. The message audit method according to claim 1, characterized in that: The encapsulating the target message comprises: The nsh header and the eth header are encapsulated in the outer layer of the target message.
6. The message audit method according to claim 1, characterized in that: The step of directing the encapsulated target message to an audit terminal that is not located on the message transmission path through a diversion channel includes: At least one diversion channel with a transmission performance higher than a preset transmission requirement is selected from a plurality of preset diversion channels, and the encapsulated target message is diverted to the audit end.
7. The message audit method according to claim 1, characterized in that: After receiving the target message, the method further includes: Detect whether the session of the target message has a diversion mark; If the session of the target message has a diversion mark, the target message is determined as a message to be audited and the target message is encapsulated; the encapsulated target message is diverted to an audit terminal that is not located on the message transmission path through a diversion channel so that the audit terminal audits the encapsulated target message; If the session of the target message has no diversion mark, then detect whether the source IP address, destination IP address, protocol information, source port and / or destination port of the target message are recorded in the preset diversion rule.
8. The message audit method according to claim 1, characterized in that: The target device is a network card device of a virtual machine. Accordingly, the message transmission path is used to connect network card devices of different virtual machines in the same local area network.
9. The message audit method according to claim 1, characterized in that: The target device is a network forwarding device connected to a local area network, and accordingly, the message transmission path is used to connect the local area network and an external network; If the target message is a message sent from the local area network to the external network, after the audit end audits the encapsulated target message, the audit end further includes: verifying the target message returned by the audit end through the diversion channel, performing address conversion on the target message, and sending the target message after address conversion to the external network; If the target message is a message sent from the external network to the local area network, before determining the target message as a message to be audited, it also includes: performing address conversion on the target message; accordingly, after the audit end audits the encapsulated target message, it also includes: verifying the target message returned by the audit end through the drainage channel, and sending the verified target message to the local area network.
10. The message audit method according to any one of claims 1 to 9, characterized in that: The audit end is deployed with an audit policy, and the audit policy is not related to the diversion requirement.
11. A message auditing device, characterized in that: The target devices used in the message transmission path include: A receiving module, used for receiving a target message; A detection module, configured to determine the target message as a message to be audited and encapsulate the target message if the target message meets the preset diversion requirements; The diversion module is used to divert the encapsulated target message to the audit end which is not located on the message transmission path through the diversion channel, so that the audit end can audit the encapsulated target message.
12. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the message audit method as described in any one of claims 1 to 10.
13. A readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the message audit method according to any one of claims 1 to 10 is implemented.