Rule management system and method for DPI (Deep Packet Inspection) shunting equipment

Abstract

The invention specifically relates to a DPI shunting equipment rule management system and method, and the system comprises a service configuration table, each service configuration item has a unique service ID; a rule configuration table, wherein each rule configuration item has a unique rule ID; the rule hash table is used for quickly retrieving a rule ID (Identity) through hash mapping of rule matching contents; when the strategy control server calls an RPC interface through a remote procedure to issue service configuration to the DPI shunting equipment, the DPI shunting equipment splits the service configuration into one or more rule configurations according to a splitting algorithm; and the Redis database is used for persistently storing the contents of the service configuration table, the rule configuration table and the rule hash table. The method has the advantages that the table items of each management module are designed to be loosely coupled, so that the management modules are allowed to be independently developed and debugged; the double-ID management mode has good expandability and can be compatible with a traditional single-ID rule management system.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a DPI diversion device rule management system and method. Background Art

[0002] In telecom value-added services, deep packet inspection (DPI) devices are responsible for identifying and forwarding data traffic according to the service type. This is usually achieved by setting multiple rules on the device, because a single service may require multiple rules to describe, and the rules of different services may overlap. In this case, the priority of the rules becomes particularly important.

[0003] In the application of deep packet inspection (DPI) services, the policy control server sends the service configuration to the DPI diversion device through the remote procedure call (RPC) interface. Once the DPI diversion device receives these configurations, it must decompose the service configuration into one or more rule configurations and send them to the processing chip. Since all configurations need to be able to be queried and modified, a management system is required to manage service configurations and rule configurations.

[0004] Compared with conventional rule management systems, the rule management system of DPI diversion devices faces two challenges: 1. In a conventional system, there is only rule configuration but no service configuration, so only one index item with rule ID as index needs to be maintained. However, in the system of DPI traffic diversion equipment, there are both service configuration and rule configuration, so two index items are required: one with service ID as index and the other with rule ID as index.

[0005] 2. DPI traffic diversion devices will encounter two scenarios: Scenario 1 is to decompose a service configuration into multiple rule configurations; Scenario 2 is that some rule configurations decomposed from multiple service configurations have the same matching content. In Scenario 1, a service ID needs to be associated with multiple rule IDs; in Scenario 2, a rule ID may need to be associated with multiple service IDs. At this time, it is necessary to consider the priority of the service configuration and process and forward traffic according to the forwarding behavior of the service configuration with the highest priority. In the application scenario of business rules, the relationship between service configuration and rule configuration is crucial. See Figure 1 .

[0006] In order to cope with the complex business and rule configurations in practical applications, there is an urgent need to design a dual-ID rule management system and method for DPI diversion equipment. The management system needs to be able to realize the correlation between business and rules, support flexible addition, deletion and query of business configuration and rule configuration with a small memory footprint, and also support configuration backup and recovery functions. Summary of the invention

[0007] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a DPI diversion device rule management system and method, so that the business configuration table and the rule configuration table are managed separately, and table operation management is performed independently; a flexible table item allocation strategy is adopted, and table item records are associated through a linked list to save memory space; and the redis database is reasonably used to solve the configuration storage problem without affecting the effectiveness rate of the business.

[0008] In order to achieve the above purpose, a DPI diversion device rule management system is designed, including: a service configuration table, which is used to store the service priority, forwarding behavior and the rules into which the service is split, wherein each service configuration item has a unique service ID; a rule configuration table, which is used to store the specific matching content of the rule, the corresponding service split out of the rule and the service ID with the highest priority, wherein each rule configuration item has a unique rule ID; a rule hash table, which quickly retrieves the rule ID by hash mapping the rule matching content, wherein the key of the rule hash table is the rule matching content, the value is the rule ID, and rule_entry is reused in the rule configuration table and the rule hash table , rule_entry only allocates space once, and the two tables access the same address when obtaining rule_entry; policy control server, when the policy control server sends the service configuration to the DPI diversion device through the remote procedure call RPC interface, the DPI diversion device splits the service configuration into one or more rule configurations according to the splitting algorithm; during the splitting process, the DPI diversion device queries whether the rule already exists through the rule hash table: if the rule already exists, the corresponding rule ID is reused; if the rule does not exist, a new rule ID is assigned, and the key-value mapping of the rule is added to the rule hash table; fill the service-related configuration into the service configuration table according to the service ID, Fill the split rule configuration into the rule configuration table according to the rule ID, and refresh the service ID list and valid service ID in the rule configuration table as needed; when the policy control server sends a delete service configuration operation through the RPC interface, the DPI traffic diversion device retrieves the service configuration table according to the issued service ID, obtains the corresponding rule ID list, and traverses the rule ID list one by one: retrieves the rule configuration table according to the rule ID, removes the service ID that needs to be deleted from the service ID list, and recalculates the valid service ID; if the service ID list is empty after removal, clear the storage space corresponding to the rule ID in the rule configuration table, and deletes the rule_ entry as the key node; finally, clear the storage space corresponding to the business ID in the business configuration table; when the policy control server sends a query request through the RPC interface, the DPI diversion device retrieves the business configuration table according to the business ID, obtains the rule ID list, and retrieves the rule configuration table according to the rule ID to obtain the entries of each rule, thereby restoring the business configuration according to the rule reorganization algorithm and returning it to the policy control server; Redis database is used to persistently store the contents of the business configuration table, rule configuration table and rule hash table to ensure that the configuration in the memory can be restored after the device is powered off and restarted, and the write operation of the Redis database is asynchronously sent to reduce communication delays.

[0009] The present invention also provides a DPI diversion device rule management method using the management system, comprising: a service delivery method: S1. After the service configuration is delivered from the policy control server to the DPI diversion device, the management system first performs a parameter validity check; S2. After the check is passed, a storage space is allocated to the corresponding position in the service configuration table, and the priority and action information in the service configuration are directly filled into the table, and then the service matching content is split into multiple internal rules according to the service splitting algorithm; S3. After taking out the rule matching content rule_entry, the rule hash table is checked with the rule_entry group key to see whether other services have split this internal rule before. If the hash table returns, it means that it has been added before, then the management system selects a rule with the highest priority and writes it into the hardware; S4. If the rule has not been added, the management system will first take an idle rule_id from the rule_id resource pool and assign it to this rule. Then, using this rule_id as the index, it will allocate storage space at the corresponding position in the rule configuration table, directly append the business id to the business_id_list list, assign the business id to effect_business_id, and then apply for a piece of storage space for rule_entry, fill the memory address into the rule_entry field of the rule configuration table, and then insert it into the rule hash table with the memory of this piece of rule_entry as the key and rule_id as the value. Here, rule_entry only uses a piece of storage space. Then, the business id added this time, the priority and action information in the business configuration table are taken out and sent to the hardware together with the rule_entry of this rule. S5.If the hash table is checked and it is found that this rule has been added before, the previously added rule_id is directly taken out from the hit result of the hash table, and then the corresponding storage space is found in the rule configuration table with this rule_id as the index, and the business id added this time is appended to the business_id_list list. At this time, there are at least two business ids in the business_id_list list. The management system selects the business id with the highest priority and fills it into effect_business_id. After judging the priority, if the effect_business_id of the highest priority business that is split out of this rule has changed, then it is necessary to reuse the logic of sending the rules to the hardware mentioned above, and refresh the priority and action information corresponding to the effect_business_id to the hardware to ensure that the traffic is forwarded according to the forwarding behavior of the highest priority business after hitting; if the effect_business_id has not changed, there is no need to refresh the hardware configuration, and the traffic that hits this rule is still forwarded according to the previous forwarding behavior; S6. The relevant operations of this split rule in the rule configuration table have been completed. Then, the rule_id of this rule needs to be appended to the rule_id_list of the business configuration table, so that the management system can retrieve the split rule by business id, and then determine whether the split rule currently being processed is the last one among all split rules. If it is not the last one, take the matching content of the next rule and repeat the above steps until all split rules are traversed. .

[0010] Preferably, the method provided by the present invention also includes other technical features, including: business deletion method: S1. Check the rule configuration table according to rule_id, take out the business_id_list list therefrom, and determine whether there is only one id in the list, which is the business id that needs to be deleted currently; S2. If there is only one id in the business_id_list list, then this rule can be deleted directly. First, clear the management memory, delete the node with rule_entry of this rule as the key in the rule hash table, release the memory space applied for the rule_entry of this rule, release the storage space of the rule in the rule configuration table, and then delete the rule in the hardware; S3. If there are multiple ids in the business_id_list list, it means that this rule has been split out by multiple business configurations. First, remove the business id that needs to be deleted this time from the business_id_list list, and then calculate the business id with the highest priority among these business ids according to the priority calculation algorithm according to the new business_id_list list and fill it into the effec In t_business_id, if effect_business_id changes, the priority and action information of the new highest priority business id are refreshed to the hardware. If effect_business_id does not change, there is no need to update the hardware configuration. This logic is the same logic that is reused when effect_business_id changes when the previous business is delivered. S4. After processing this rule, remove the rule_id of this rule from the rule_id_list in the business configuration table, and then determine whether there are any remaining rule_ids in the rule_id_list. If there are, take out the next rule_id and repeat the above steps until the rule_id_list is empty.

[0011] Preferably, the method provided by the present invention also includes other technical features, including: a business query method, which first performs a parameter validity check. After the check, the rule_id_list list in the business configuration table is taken out according to the business id, all rule_ids in the rule_id_list list are taken out, the rule configuration table is queried, the rule_entry of all rules is obtained, and then the algorithm is reorganized according to the rules to restore the business configuration, and finally the business configuration is returned to the policy control server, and the process ends.

[0012] Compared with the prior art, the present invention has the following advantages: 1. The table entries of each management module are designed to be loosely coupled, allowing them to be developed and debugged independently.

[0013] 2. The dual ID management mode has good scalability and is compatible with the traditional single ID rule management system.

[0014] 3. Applicable to a variety of business scenarios from simple to complex, so that rule management can maintain flexibility and high efficiency in different business environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 , is a schematic diagram of a business configuration scenario of the prior art; Figure 2 , is the business delivery processing flow chart; Figure 3 , is a business deletion process flow chart; Figure 4 , is a business query processing flow chart. DETAILED DESCRIPTION

[0016] In order to make the purpose, principle and structure of the present invention more clear, it is further described below in conjunction with the drawings and specific embodiments.

[0017] Embodiment 1: The present invention provides a DPI diversion device rule management system, including: a business configuration table for maintaining business configuration and a rule configuration table for rule configuration, wherein the description of each variable in the business configuration table and the rule configuration table is shown in the following table.

[0018] Table 1 is a description of the variables in the business configuration table. Business configuration table contents meaning business_id The unique ID used to index the service in the service configuration table, also referred to as the service ID in the present invention rule_id_list Used to store the rule_id of the business split into multiple rules, designed as a list priority Used to indicate priority. When a flow hits multiple services at the same time, it is forwarded according to the service forwarding behavior with the highest priority. The smaller the priority, the higher the priority. action Used to store the forwarding behavior of the traffic hitting this service

[0019] Table 2 is a description of the variables in the rule configuration table. Contents of the rule configuration table meaning rule_id The unique id used to index the rule in the rule configuration table, which we also call the rule id in this invention business_id_list Used to store the business_id of all businesses that split out this rule, designed as a list effect_business_id The business_id of the business with the highest priority and actually in effect in the business_id_list rule_entry Used to store matching content of rules

[0020] Table 3 is a description of the variables in the rule hash table. Rules hash table content Specific content meaning Key rule_entry Part involved in hash calculation, matching content of rules Value rule_id Rule ID

[0021] The priority of the service, forwarding behavior, and the rules into which the service is split are saved in the service configuration table (see Table 1); the specific matching content of the rule, which services split the rule, and the service ID with the highest priority among these services are saved in the rule configuration table (see Table 2).

[0022] In addition, in order to quickly retrieve the rule ID through the rule matching content, the present invention introduces a third table - rule hash table (see Table 3), where the key is the rule matching content, the value is the rule ID, and the rule_entry is reused in the rule configuration table and the rule hash table. To save storage space, the rule_entry is only allocated once, and the two tables access the same address when obtaining the rule_entry. It also includes a policy control server. When the policy control server sends the business configuration to the DPI diversion device through the RPC interface, the business configuration is split into one or more rule configurations according to the splitting algorithm, and the rule hash table is used to query whether these rules have been added. If they have been added, the previous rule_id is reused directly. If they have not been added, a new rule_id is assigned, and the key-value mapping of the rule is added to the rule hash table; then the business-related configuration is filled into the business configuration table according to the business id, and the split rule configuration is filled into the rule configuration table according to the rule_id. If a rule has been split out by other businesses before, then the business_id_list and effect_business_id in the rule configuration table must be refreshed at this time.

[0023] When the policy control server issues a delete business configuration operation through the RPC interface, in this embodiment, the business configuration table is retrieved according to the business id sent, rule_id_list is obtained, and then the rule ids in rule_id_list are traversed one by one, and the rule configuration table is retrieved according to the rule id, and the business id that needs to be deleted is removed from the business_id_list, and then effect_business_id is recalculated. If the business_id_list is empty after the business id that needs to be deleted is removed, then the storage space corresponding to the rule_id in the rule configuration table is directly cleared, and the node with the rule_entry of the rule as the key is deleted in the rule hash table. After processing the rule-related table items, the storage space corresponding to the business id in the business configuration table is finally cleared.

[0024] When the policy control server sends a query request through the RPC interface, this embodiment summarizes and retrieves the business configuration table according to the business id sent, obtains rule_id_list, and then traverses the rule ids in rule_id_list one by one, retrieves the rule configuration table according to the rule id, obtains the rule_entry of each rule, and then restores the business configuration according to the rule reorganization algorithm and returns it to the policy control server.

[0025] The management of the business configuration table, rule configuration table and rule hash table are all memory operations, which can ensure the rate at which the business takes effect. However, in order to ensure that the configuration can be restored after the device is powered off and restarted, the present invention introduces the redis database, and saves the business configuration table, rule configuration table and rule hash table to the hard disk through the redis save mechanism. When the device is powered off and restarted, the software can restore the memory of the business configuration table, rule configuration table and rule hash table through redis. To ensure that the redis operation does not affect the rate at which the business takes effect. The present invention adopts the following two strategies: 1. Only at the end of each business addition and deletion operation, only the modified points in the table items are saved to redis, and the append operation of redis is used to perform only one inter-process communication; 2. The redis write operation adopts an asynchronous sending method, which can greatly reduce the communication delay caused by inter-process communication.

[0026] Embodiment 2: This embodiment provides a DPI offloading device rule management method using the management system described in Embodiment 1, which is as follows: 1. Business issuance: The service configuration issued by the policy control server includes three elements: service matching content, priority information, and forwarding behavior action information. The service matching content needs to be converted again on the DPI diversion device into multiple internal rules to match different message features. For the specific process of DPI diversion device management system processing service issuance, see Figure 2 .

[0027] After the service configuration is sent from the policy control server to the DPI diversion device, the management system must first perform a parameter validity check, including the validity of the service id, the validity of the service matching field, the validity of the priority and action parameters, etc. If the parameter validity check fails, the corresponding error code is directly returned to the policy control server. Subsequently, using the service id as the index, storage space is allocated to the corresponding position in the service configuration table, and the priority and action information in the service configuration is directly filled into the table. Then, according to the service splitting algorithm, the service matching content is split into multiple internal rules, and then the split rule contents are taken in turn, and the following operations are performed: After extracting the rule matching content (rule_entry), use the rule_entry group key to check the rule hash table to see if other businesses have split out this internal rule before. If the hash table returns, it means that it has been added before. Then, there is a priority issue involved here, because the hardware device only allows one rule to be added for the same rule_entry. If you want to add multiple rules, the management system needs to help select the rule with the highest priority and write it into the hardware.

[0028] Here, we first discuss the scenario where the hash table is checked and it is found that this rule has not been added before. If the rule has not been added, the management system will first take a free rule_id from the rule_id resource pool and assign it to this rule. Then, using this rule_id as the index, it will allocate storage space at the corresponding position in the rule configuration table, directly append the business id to the business_id_list list, and then assign the business id to effect_business_id. Then, a piece of storage space is applied for rule_entry, and the memory address is filled in the rule_entry field of the rule configuration table. Then, the memory of this piece of rule_entry is used as the key and rule_id is used as the value to insert it into the rule hash table. Here, rule_entry only uses a piece of storage space, saving some memory. Then, effect_business_id, which is actually the business id added this time, is taken out from the priority and action information in the business configuration table, and sent to the hardware together with the rule_entry of this rule. The reason for doing this here is to reuse this logic in other scenarios discussed later.

[0029] Then, let's discuss the scenario where the hash table is checked to find that this rule has been added before. For this scenario, the present invention directly takes out the previously added and assigned rule_id from the hit result of the hash table, and then uses this rule_id as the index to find the corresponding storage space in the rule configuration table, and appends the business id added this time to the business_id_list list. At this time, there must be at least two business ids in the business_id_list list, so there is a priority problem here. The management system needs to select the business id with the highest priority and fill it into the effect_business_id. Usually, it is determined based on the priority field of the business configuration to determine who has the highest priority. However, the policy control server sometimes requires users to determine the priority of the business based on other criteria, such as the order in which the business is added, the type of business, etc. The implementation of this priority judgment is an independent component with mode selection, which will not be discussed here. After determining the priority, if the highest priority business ID (effect_business_id) of all the services split out of this rule changes, then it is necessary to reuse the logic of sending the above-mentioned rules to the hardware, and refresh the priority and action information corresponding to the effect_business_id to the hardware to ensure that the traffic is forwarded according to the forwarding behavior of the highest priority service after it is hit; if the effect_business_id has not changed, then there is no need to refresh the hardware configuration, and the traffic that hits this rule is still forwarded according to the previous forwarding behavior.

[0030] After completing the above processing flow, the relevant operations of this split rule in the rule configuration table have been completed. Then, the rule_id of the rule needs to be appended to the rule_id_list of the business configuration table, so that the management system can retrieve the split rule by business id. Then, determine whether the split rule currently being processed is the last one among all the split rules. If it is not the last one, take the matching content of the next rule and repeat the above steps until all the split rules are traversed.

[0031] After traversing all splitting rules, you need to save the business configuration table, rule configuration table, and rule hash table. In order to avoid configuration loss after the device is powered off and restarted, after saving, the management system can read data from the hard disk to restore the memory of the business configuration table, rule configuration table, and rule hash table when it restarts.

[0032] The present invention uses the redis database and its automatic save function to save data. In order to avoid frequent redis operations affecting the service delivery rate, this embodiment adopts the following two strategies: 1. Only at the end of each service addition and deletion operation, only the modified points in the table items are saved to redis, and the append operation of redis is used to perform only one inter-process communication; 2. The redis write operation adopts an asynchronous delivery method, which can greatly reduce the communication delay caused by inter-process communication.

[0033] Finally, the processing result is returned to the policy control server and the process ends.

[0034] 2. Business Deletion After receiving the request to delete the service configuration from the policy control server, the DPI traffic distribution device manages the specific processing flow of the management system. Figure 3 .

[0035] Similar to the service delivery process, after receiving the service deletion request, the management system must first perform a parameter validity check, mainly checking the validity of the service id. If the parameter validity check fails, the corresponding error code is directly returned to the policy control server. Subsequently, the present invention uses the service id as an index to find the corresponding storage location in the service configuration table, extracts the rule_id_list list from it, and then traverses the rule_id in the list to perform the following operations: Look up the rule configuration table according to rule_id, take out the business_id_list list from it, and determine whether there is only one id in the list, which is the business id that needs to be deleted.

[0036] If the business_id_list list contains only one id, then this rule can be directly deleted. In this embodiment, the management memory must be cleared first, and the following operations need to be performed: delete the node with the rule_entry of this rule as the key in the rule hash table; release the memory space applied for the rule_entry of this rule; release the storage space of this rule in the rule configuration table. Then, in this embodiment, the rule needs to be deleted in the hardware.

[0037] If there are multiple IDs in the business_id_list, it means that this rule has been split out by multiple business configurations. In this embodiment, the business ID that needs to be deleted this time is first removed from the business_id_list, and then the new business_id_list is used according to the priority calculation algorithm mentioned above to calculate the business ID with the highest priority among these business IDs and fill it into effect_business_id. If the effect_business_id changes, then in this embodiment, the priority and action information of the new highest priority business ID needs to be refreshed to the hardware. If the effect_business_id does not change, there is no need to update the hardware configuration. This logic is the same logic that is reused when the effect_business_id changes when the previous business is issued.

[0038] After processing this rule, in this embodiment, the rule_id of this rule needs to be removed from the rule_id_list in the business configuration table, and then it is determined whether there are any remaining rule_ids in the rule_id_list. If there are, the next rule_id is taken out and the above steps are repeated until the rule_id_list is empty.

[0039] After processing all rules, the storage space allocated by the service ID in the service configuration table can be released in this embodiment, and then the modification points of the service configuration table, rule configuration table and rule hash table are saved in redis. Finally, the processing result is returned to the policy control server and the process ends.

[0040] 3. Business Inquiry After receiving the request for querying service configuration from the policy control server, the DPI traffic distribution device manages the specific processing flow of the management system. Figure 4 .

[0041] First, the parameter validity is checked. After passing the check, the rule_id_list in the business configuration table is retrieved according to the business id, all rule_ids in the rule_id_list are retrieved, the rule configuration table is queried, the rule_entry of all rules is obtained, and then the business configuration is restored according to the rule reorganization algorithm. The rule reorganization algorithm is an independent function related to the business. Finally, the business configuration is returned to the policy control server, and the process ends.

[0042] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent substitutions or changes according to the technical solutions and novel concepts of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A DPI diversion device rule management system, characterized in that: include: The service configuration table is used to store the service priority, forwarding behavior, and rules for splitting the service, where each service configuration item has a unique service ID; The rule configuration table is used to store the specific matching content of the rule, the corresponding business splits the rule and the business ID with the highest priority, where each rule configuration item has a unique rule ID; The rule hash table quickly retrieves the rule ID by hash mapping the rule matching content. The key of the rule hash table is the rule matching content, and the value is the rule ID. The rule_entry is reused in the rule configuration table and the rule hash table. The rule_entry is allocated space only once, and the two tables access the same address when obtaining the rule_entry. Policy Control Server, When the policy control server sends the service configuration to the DPI offloading device through the remote procedure call RPC interface, the DPI offloading device splits the service configuration into one or more rule configurations according to the splitting algorithm; During the splitting process, the DPI splitting device queries the rule hash table to see if the rule already exists: If the rule already exists, reuse the corresponding rule ID; If the rule does not exist, a new rule ID is assigned and the key-value mapping of the rule is added to the rule hash table; Fill the business-related configurations into the business configuration table according to the business ID, fill the split rule configurations into the rule configuration table according to the rule ID, and refresh the business ID list and valid business ID in the rule configuration table as needed; When the policy control server sends a delete service configuration operation through the RPC interface, the DPI traffic diversion device retrieves the service configuration table according to the issued service ID, obtains the corresponding rule ID list, and traverses the rule ID list one by one: Retrieve the rule configuration table according to the rule ID, remove the business ID that needs to be deleted from the business ID list, and recalculate the valid business ID; If the business ID list is empty after removal, the storage space corresponding to the rule ID in the rule configuration table is cleared, and the node with the rule_entry of the rule as the key is deleted from the rule hash table; Finally, clear the storage space corresponding to the business ID in the business configuration table; When the policy control server sends a query request through the RPC interface, the DPI traffic diversion device retrieves the service configuration table according to the service ID, obtains the rule ID list, and retrieves the rule configuration table according to the rule ID to obtain the entries of each rule, thereby restoring the service configuration according to the rule reorganization algorithm and returning it to the policy control server; The Redis database is used to persistently store the contents of the business configuration table, the rule configuration table, and the rule hash table to ensure that the configuration in the memory can be restored after the device is powered off and restarted, and the write operation of the Redis database is asynchronously sent to reduce communication delays.

2. A DPI diversion device rule management method using the management system as claimed in claim 1, characterized in that: include Business delivery method: S1. After the service configuration is sent from the policy control server to our DPI diversion device, the management system must first verify the legitimacy of the parameters; S2. After the verification is passed, storage space is allocated to the corresponding position in the business configuration table, and the priority and action information in the business configuration are directly filled into the table. Then, according to the business splitting algorithm, the business matching content is split into multiple internal rules; S3. After extracting the rule matching content rule_entry, use the rule_entry group key to check the rule hash table to see whether other businesses have previously split out this internal rule. If the hash table returns, it means that it has been added before. In this case, the management system selects a rule with the highest priority and writes it to the hardware. S4. If the rule has not been added, the management system will first take an idle rule_id from the rule_id resource pool and assign it to this rule. Then, using this rule_id as the index, it will allocate storage space at the corresponding position in the rule configuration table, directly append the business id to the business_id_list list, assign the business id to effect_business_id, and then apply for a piece of storage space for rule_entry, fill the memory address into the rule_entry field of the rule configuration table, and then insert it into the rule hash table with the memory of this piece of rule_entry as the key and rule_id as the value. Here, rule_entry only uses one piece of storage space. Then, the added business id, priority and action information in the business configuration table are taken out and sent to the hardware together with the rule_entry of this rule. S5. If the hash table is checked and it is found that this rule has been added before, the previously added rule_id is directly taken out from the hit result of the hash table, and then the corresponding storage space is found in the rule configuration table with this rule_id as the index, and the business id added this time is appended to the business_id_list list. At this time, there are at least two business ids in the business_id_list list. The management system selects the business id with the highest priority and fills it into the effect_business_id. After judging the priority, if the effect_business_id of the highest priority business that is split out of this rule has changed, then it is necessary to reuse the logic of sending the rules to the hardware mentioned above, and refresh the priority and action information corresponding to the effect_business_id to the hardware to ensure that the traffic is forwarded according to the forwarding behavior of the highest priority business after hitting; if the effect_business_id has not changed, there is no need to refresh the hardware configuration, and the traffic that hits this rule is still forwarded according to the previous forwarding behavior; S6. The relevant operations of this split rule in the rule configuration table have been completed. Then, the rule_id of this rule needs to be appended to the rule_id_list of the business configuration table, so that the management system can retrieve the split rule by business id, and then determine whether the currently processed split rule is the last one among all split rules. If it is not the last one, take the matching content of the next rule and repeat the above steps until all split rules are traversed.

3. A DPI diversion device rule management method as claimed in claim 2, characterized in that: Also includes How to delete a service: S1. Check the rule configuration table according to rule_id, take out the business_id_list list, and determine whether there is only one id in the list, which is the business id that needs to be deleted; S2. If the business_id_list list contains only one id, then this rule can be deleted directly. First, clear the management memory, delete the node with rule_entry of this rule as the key in the rule hash table, release the memory space applied for the rule_entry of this rule, release the storage space of this rule in the rule configuration table, and then delete this rule in the hardware; S3. If there are multiple IDs in the business_id_list, it means that this rule has been split out by multiple business configurations. First, remove the business ID to be deleted from the business_id_list, and then calculate the business ID with the highest priority among these business IDs according to the priority calculation algorithm based on the new business_id_list, and fill it into effect_business_id. If effect_business_id changes, the priority and action information of the new highest priority business ID is refreshed to the hardware. If effect_business_id does not change, there is no need to update the hardware configuration. This logic is the same as the logic reused when effect_business_id changes when the previous business is delivered; S4. After processing this rule, remove the rule_id of this rule from the rule_id_list in the business configuration table, and then determine whether there are any remaining rule_ids in the rule_id_list. If there are, take out the next rule_id and repeat the above steps until the rule_id_list is empty.

4. A DPI diversion device rule management method as claimed in claim 2, characterized in that: Also includes The business query method first checks the validity of the parameters. After passing the check, the rule_id_list in the business configuration table is retrieved according to the business id, all rule_ids in the rule_id_list are retrieved, the rule configuration table is queried, the rule_entry of all rules is obtained, and then the algorithm is reorganized according to the rules to restore the business configuration. Finally, the business configuration is returned to the policy control server, and the process ends.

Images