Message processing method and device, electronic equipment and readable medium

Abstract

The invention provides a message processing method, and the method comprises the steps: receiving a message, and carrying out the mirroring of a target message to a mirroring server under the condition that the message is determined to be the target message based on a pre-configured access control list, and the target message is a message which is not matched in the access control list. According to the embodiment of the invention, the message is filtered by using the access control list, the possible abnormal message is quickly separated, and the possible abnormal message is mirrored to the mirroring server, so that the processing amount of message analysis of the mirroring server can be reduced, and the network diagnosis capability is improved. The invention further provides a message processing device, electronic equipment and a readable medium.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a message processing method, device, electronic device and readable medium. Background Art

[0002] When the network is actually in use, there are illegal messages and some other unknown network packets. These packets will occupy a certain amount of network bandwidth. Some packets will be processed by the device. When there are too many packets, it may even affect the normal network protocol negotiation.

[0003] Illegal messages and network packets cannot be filtered out by firewalls. The existence of these illegal messages and network packets will affect network diagnosis and problem analysis. If all messages in the network are directly captured for analysis to detect the packets, the analysis workload is large, time-consuming and labor-intensive, and affects the network diagnosis capability. Therefore, it is necessary to provide a method that can quickly separate the packets in the network. Summary of the invention

[0004] The present disclosure provides a message processing method, device, electronic device and readable medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a message processing method, the method comprising:

[0006] Receive messages;

[0007] In the case where the message is determined to be a target message based on a pre-configured access control list, the target message is mirrored to a mirror server, wherein the target message is a message that is not matched in the access control list.

[0008] On the other hand, the embodiment of the present disclosure also provides a message processing device, including a chip layer, wherein the chip layer is used to receive a message and, when determining that the message is a target message based on a pre-configured access control list, mirror the target message to a mirror server, wherein the target message is a message that is not matched in the access control list.

[0009] On the other hand, an embodiment of the present disclosure also provides an electronic device, comprising: at least one processor; a memory, on which at least one program is stored, and when the at least one program is executed by the at least one processor, the at least one processor implements the message processing method as described above; at least one I / O interface, connected between the processor and the memory, and configured to implement information interaction between the processor and the memory.

[0010] On the other hand, an embodiment of the present disclosure further provides a computer-readable medium having a computer program stored thereon, wherein the program, when executed, implements the message processing method as described above.

[0011] The message processing method provided by the embodiment of the present disclosure includes: receiving a message, and in the case where the message is determined to be a target message based on a pre-configured access control list, mirroring the target message to a mirror server, wherein the target message is a message that is not matched in the access control list. The embodiment of the present disclosure uses the access control list to filter the message, quickly separates possible abnormal messages, and mirrors the possible abnormal messages to the mirror server, which can reduce the processing volume of the mirror server for message analysis and improve the network diagnosis capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A schematic diagram of a network architecture of an embodiment of the present disclosure;

[0013] Figure 2 Schematic diagram of the traffic mirroring process provided by the embodiment of the present disclosure Figure 1 ;

[0014] Figure 3 Schematic diagram of the traffic mirroring process provided by the embodiment of the present disclosure Figure 2 ;

[0015] Figure 4 A schematic diagram of a process for configuring an access control list provided in an embodiment of the present disclosure;

[0016] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] Example embodiments will be described more fully below with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete and to enable those skilled in the art to fully understand the scope of the present disclosure.

[0018] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0019] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "comprising" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded.

[0020] The embodiments described herein may be described with reference to plan views and / or cross-sectional views by means of idealized schematic diagrams of the present disclosure. Therefore, the example illustrations may be modified according to manufacturing techniques and / or tolerances. Therefore, the embodiments are not limited to the embodiments shown in the accompanying drawings, but include modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the accompanying drawings have schematic properties, and the shapes of the regions shown in the figures illustrate the specific shapes of the regions of the elements, but are not intended to be limiting.

[0021] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0022] Illegal messages and network packets occupy network bandwidth. When there are too many network packets, they affect normal network protocol negotiation. If all messages in the network are directly captured for analysis, the analysis workload will be relatively large. Therefore, it is hoped that illegal messages or network packets can be captured to the mirror server for analysis without affecting the normal forwarding of business flows, and then these illegal messages or packets can be filtered by setting rules on the firewall to purify the network environment. In actual use, how to separate the normal business flow and only capture illegal messages or network packets is a technical difficulty.

[0023] Access Control List (ACL) is an access control technology based on packet filtering. It can filter data packets on the interface according to the set conditions, allowing them to pass or discarding them. Access control lists are widely used in routers and layer 3 switches. With the help of access control lists, users' access to the network can be effectively controlled.

[0024] Traffic mirroring is a mirroring technology that configures a mirroring binding access control list and mirrors the traffic matching the access control list to a mirror server through the mirroring function.

[0025] In view of the problems that the analysis and investigation of illegal messages and network miscellaneous packets in the network is labor-intensive and time-consuming, and the network diagnostic capability is low, the disclosed embodiment proposes a traffic mirroring solution based on access control list technology. In the scenario where illegal messages and network miscellaneous packets exist, the illegal messages and messages including network miscellaneous packets can be quickly separated through traffic mirroring, and the illegal messages and messages including network miscellaneous packets can be mirrored to eliminate network problems caused by illegal messages and network miscellaneous packets and improve network diagnostic capabilities.

[0026] Figure 1 FIG. 1 is a schematic diagram of the network architecture of an embodiment of the present disclosure. Figure 1 As shown, the network architecture includes a message processing device 1, a server, a terminal 1, a firewall, a message processing device 2, a terminal 2 and a mirror server. The message processing device 1 is connected to the server, the terminal 1 and the firewall. The server can be a video server, a network server and other devices. The terminal 1 can be a PC (personal computer) and other devices. The firewall is connected to the message processing device 2 through the network for network access security control. The message processing device 2 is connected to the mirror server and the terminal 2. The terminal 1 can be a PC and other devices.

[0027] The present disclosure provides a message processing method, which is applied to a message processing device, and an access control list is configured on the message processing device. The message processing device may be Figure 1 The message processing device 1 and / or the message processing device 2 in the embodiment may specifically be a switch or a router. In the embodiment of the present disclosure, the message processing device is taken as the message processing device 1 as an example for description.

[0028] Figure 2 Schematic diagram of the traffic mirroring process provided by the embodiment of the present disclosure Figure 1 .like Figure 2 As shown, the message processing method includes the following steps:

[0029] Step S11, receiving a message.

[0030] The message may be a message sent from the server to terminal 1 or terminal 2, or a message sent from terminal 1 or terminal 2 to the server, or a message sent from terminal 1 or terminal 2 to the opposite terminal (ie, terminal 2 or terminal 1).

[0031] Step S12: when it is determined that the message is a target message based on the pre-configured access control list, the target message is mirrored to a mirror server, wherein the target message is a message that is not matched in the access control list.

[0032] In some embodiments, the target message may be an illegal message or a message including a network miscellaneous packet.

[0033] After receiving the message, the message processing device matches the access control list configured locally. If the message is not matched in the access control list, it means that the message may be an abnormal message, and the message is mirrored, that is, the message is copied and sent to the mirror server so that the mirror server can further analyze the message. In other words, the access control list is used to filter the received messages, so as to quickly separate possible abnormal messages for mirror analysis.

[0034] The message processing method provided by the embodiment of the present disclosure includes: receiving a message, and in the case of determining that the message is a target message based on a pre-configured access control list, mirroring the target message to a mirror server, wherein the target message is a message that is not matched in the access control list. The embodiment of the present disclosure uses an access control list to filter messages, quickly separate possible abnormal messages, and mirror the possible abnormal messages to the mirror server, which can reduce the processing volume of the mirror server for message analysis, improve the network diagnosis capability, and enable the mirror server to analyze illegal messages from the target message more quickly, and feedback the characteristic information of the illegal message to the firewall. It can be seen that the processing speed of the mirror server is positively correlated with the protection rate of the firewall, the network diagnosis capability is improved, and the network security problems are avoided more quickly.

[0035] In some embodiments, Figure 3 As shown, after receiving the message (i.e., step S11), the message processing method may further include the following steps:

[0036] Step S12', forwarding the message to the target device.

[0037] When it is determined that the received message is the target message, the target message is also forwarded normally. In this way, when the target message is a normal message, the normal operation of the business can be guaranteed, that is, the discarding of illegal messages is placed in the firewall part.

[0038] The target device is related to the service and may be any one of the server, terminal 1, message processing device 2, and terminal 2. The target device may be determined according to the routing table.

[0039] It should be noted that after receiving the message (i.e., step S11), the message processing method may further include the following steps: when the message is determined to be a normal message based on the access control list, the message is forwarded to the target device, and the message is no longer mirrored to the mirror server; wherein the normal message is the message matched in the access control list. That is, after receiving the message, the message processing device matches the access control list configured locally, and if the message is matched in the access control list, it is determined that the message is a normal message, and the normal message is directly forwarded, and the normal message is no longer mirrored.

[0040] If the normal business flow is set to be discarded using the access control list, and the allowed messages are mirrored to the mirror server by configuring the traffic mirroring based on the access control list, although the illegal messages and network miscellaneous packets can be determined by mirror analysis, the normal business flow is set to be discarded in order to analyze and determine the illegal messages and network miscellaneous packets, which will affect the forwarding behavior of normal business. However, the embodiment of the present disclosure does not perform mirroring processing on normal messages, but directly forwards them, which can ensure the normal operation of the business.

[0041] In some embodiments, the step of mirroring the target message to the mirror server (step S21) includes the following steps: when the target message is not directly connected to the mirror server, the target message is remotely mirrored to the mirror server. Figure 1 As shown, the message processing device 1 is connected to the mirror server through a firewall and a message processing device 2. Therefore, when the message processing device 1 finds a target message, it copies the target abnormal message and transmits it to the mirror server through the firewall, the message processing device 2 and other devices to realize remote mirroring.

[0042] In some embodiments, the step of mirroring the target message to the mirror server (step S21) includes the following steps: when the mirror server is directly connected, the target message is mirrored to the mirror server via a local computer. Figure 1 As shown, the message processing device 2 is directly connected to the mirror server. Therefore, when the message processing device 2 finds the target message, it copies the target message and directly sends it to the mirror server to realize local mirroring.

[0043] In some embodiments, before receiving the message (ie, step S11), the message processing method further includes the step of configuring an access control list, such as Figure 4 As shown, the step of configuring the access control list includes the following steps:

[0044] Step S21, obtaining an access control list and mirroring parameters through the software layer, and sending the access control list and mirroring parameters to the driver layer.

[0045] Step S22, writing the access control list and the mirroring parameters into the chip layer through the driver layer, so that the chip layer will mirror the target message to the mirroring server when determining that the received message is the target message based on the access control list.

[0046] After the software layer of the message processing device obtains the access control list and the mirroring parameters, it sends the access control list and the mirroring parameters to the driver layer. The driver layer parses the access control list and the mirroring parameters, saves the data, and writes the access control list and the mirroring parameters to the chip layer. When the access control list is set to discard the mirroring, when the mirroring function is bound to the access control list, only the mirroring message is discarded, which does not affect the forwarding of the normal business flow. Among them, the mirroring parameters include parameters such as ports.

[0047] The disclosed embodiment also provides a message processing device, which includes a chip layer, the chip layer is used to receive a message, and when determining that the message is a target message based on a pre-configured access control list, mirror the target message to a mirror server, wherein the target message is a message that is not matched in the access control list, that is, when mirroring, the message that matches the access control list is discarded, but the business is forwarded normally, and only illegal messages are mirrored.

[0048] In some embodiments, the message processing device may further include a software layer and a driver layer, the software layer is used to obtain the access control list and the mirroring parameters, and send the access control list and the mirroring parameters to the driver layer;

[0049] The driver layer is used to write the access control list and the mirror parameters into the chip layer.

[0050] The present disclosure also provides an electronic device, such as Figure 5 As shown, including:

[0051] at least one processor 501;

[0052] A memory 502 storing at least one program, and when the at least one program is executed by the at least one processor, the at least one processor implements the message processing method provided in the aforementioned embodiments;

[0053] At least one I / O interface 503 is connected between the processor and the memory and is configured to implement information exchange between the processor and the memory.

[0054] Among them, the processor 501 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 502 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 503 is connected between the processor 601 and the memory 502, and can realize information interaction between the processor 501 and the memory 502, including but not limited to a data bus (Bus), etc.

[0055] In some embodiments, the processor 501 , the memory 502 , and the I / O interface 503 are connected to each other through a bus, and further connected to other components of the computing device.

[0056] The embodiments of the present disclosure further provide a computer-readable medium on which a computer program is stored, wherein when the computer program is executed, the message processing method provided in the aforementioned embodiments is implemented.

[0057] It will be appreciated by those skilled in the art that all or some of the steps in the method disclosed above, the functional modules / units in the device may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0058] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly stated, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, it will be understood by those skilled in the art that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A message processing method, comprising: Receive messages; In the case where the message is determined to be a target message based on a pre-configured access control list, the target message is mirrored to a mirror server, wherein the target message is a message that is not matched in the access control list.

2. The method according to claim 1, characterized in that After receiving the message, the method further includes: forwarding the message to a target device.

3. The method according to claim 1, characterized in that The mirroring of the target message to the mirror server includes: In the case of not being directly connected to the mirror server, the target message is remotely mirrored to the mirror server via a network.

4. The method according to claim 1, characterized in that The mirroring of the target message to the mirror server includes: In case of direct connection with the mirror server, the target message is mirrored locally to the mirror server.

5. The method according to claim 1, characterized in that The target message is an illegal message or a message including a miscellaneous network packet.

6. The method according to any one of claims 1 to 5, characterized in that: Before receiving the message, the method further includes: Acquire the access control list and the mirroring parameters through the software layer, and send the access control list and the mirroring parameters to the driver layer; The access control list and the mirroring parameters are written into the chip layer through the driver layer, so that the chip layer mirrors the target message to the mirroring server when it is determined based on the access control list that the received message is the target message.

7. A message processing device, characterized in that: The chip layer includes a chip layer for receiving a message, and when the message is determined to be a target message based on a pre-configured access control list, mirroring the target message to a mirror server, wherein the target message is a message that is not matched in the access control list.

8. The message processing device according to claim 7, characterized in that: It also includes a software layer and a driver layer, wherein the software layer is used to obtain an access control list and image parameters, and send the access control list and image parameters to the driver layer; The driver layer is used to write the access control list and the mirroring parameters into the chip layer.

9. An electronic device, characterized in that: include: at least one processor; a memory having at least one program stored thereon, wherein when the at least one program is executed by the at least one processor, the at least one processor implements the message processing method according to any one of claims 1 to 6; At least one I / O interface is connected between the processor and the memory and is configured to implement information interaction between the processor and the memory.

10. A computer readable medium having a computer program stored thereon, wherein: When the program is executed, the message processing method according to any one of claims 1 to 6 is implemented.

Images