Access control list information processing method, router, device, network equipment, readable storage medium and program product

Abstract

The application relates to an access control list information processing method, a router, an apparatus, a network device, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving a message; searching for a matching entry of the message in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second access control list contains second entries filtered from an original entry set; if the matching entry is not found in the second access control list, searching for the matching entry in a first access control list; the first access control list is stored in an internal memory; the first access control list contains at least first entries; the first entries are entries in the original entry set except the second entries. The method can improve the searching efficiency of the access control list entries.

Description

TECHNICAL FIELD

[0001] The present application relates to the network technical field, and in particular to an access control list information processing method, a router, an apparatus, a network device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] An access control list (ACL) is an access control technology based on packet filtering, which can realize filtering of data packets in a device interface by establishing matching rules. With the increasing diversification of network security needs, network devices such as routers need to have large-scale access control list capacity to meet business needs. However, the access control list in the network device is usually stored in the internal storage space of the device, so that efficient searching of the entries of the access control list is difficult to achieve. SUMMARY

[0003] Therefore, it is necessary to provide an access control list information processing method, a router, an apparatus, a network device, a computer readable storage medium and a computer program product to solve the above technical problems.

[0004] In a first aspect, the present application provides an access control list information processing method, comprising:

[0005] receiving a packet;

[0006] finding a matching entry of the packet in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second access control list contains second entries selected from an original entry set;

[0007] if the matching entry is not found in the second access control list, finding the matching entry in a first access control list; the first access control list is stored in an internal memory; the first access control list contains at least first entries; the first entries are entries in the original entry set except the second entries.

[0008] In one of the embodiments, the second entries are selected from the original entry set by the following steps: obtaining traffic statistical information of each entry in the original entry set; and selecting the second entries in the original entry set according to the traffic statistical information of each entry.

[0009] In one of the embodiments, the filtering the second table entry from the original table entry set according to the traffic statistical information of each table entry comprises: obtaining a traffic cumulative change value of each table entry according to the traffic statistical information of each table entry; and filtering the second table entry from the original table entry set according to the size of the traffic cumulative change value of each table entry.

[0010] In one of the embodiments, the traffic statistical information comprises a traffic statistical value of a table entry at each statistical time point; and the obtaining a traffic cumulative change value of each table entry according to the traffic statistical information of each table entry comprises: obtaining a traffic change value of each statistical time interval according to the traffic statistical value of the table entry at each statistical time point; each adjacent two statistical time points form the statistical time interval; and obtaining the traffic cumulative change value of the table entry according to the traffic change value of each statistical time interval.

[0011] In one of the embodiments, the obtaining the traffic cumulative change value of the table entry according to the traffic change value of each statistical time interval comprises: obtaining a time decay coefficient of each statistical time interval relative to a current time point; and obtaining the traffic cumulative change value of the table entry according to the time decay coefficient corresponding to each statistical time interval and the traffic change value of each statistical time interval.

[0012] In one of the embodiments, the obtaining the time decay coefficient of each statistical time interval relative to a current time point comprises: obtaining the time decay coefficient according to the interval length between a later statistical time point in the adjacent two statistical time points forming the statistical time interval and the current time point; and / or the obtaining the traffic cumulative change value of the table entry according to the time decay coefficient corresponding to each statistical time interval and the traffic change value of each statistical time interval comprises: performing weighted summation on the traffic change value of each statistical time interval according to the time decay coefficient corresponding to each statistical time interval to obtain the traffic cumulative change value of the table entry.

[0013] In one of the embodiments, after the filtering the second table entry from the original table entry set according to the traffic statistical information of each table entry, the method further comprises: taking the filtered second table entry as a new second table entry; and exchanging part or all of the table entries in the second access control list and the first access control list according to the new second table entry, so that the second access control list is composed of the new second table entry, and the first access control list at least contains the new first table entry; the new first table entry is a table entry in the original table entry set except the new second table entry.

[0014] In a second aspect, the present application provides a router, comprising:

[0015] a network processing chip and an internal memory;

[0016] the network processing chip is configured to receive a packet;

[0017] the network processing chip is further configured to search for a matching entry of the packet in a second access control list; the second access control list is stored in a cache space of the network processing chip; the second access control list contains second entries filtered from an original entry set;

[0018] the network processing chip is further configured to search for the matching entry in a first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list contains at least first entries; the first entries are entries in the original entry set except the second entries.

[0019] In a third aspect, the present application provides an access control list information processing apparatus, comprising:

[0020] a packet receiving module configured to receive a packet;

[0021] a first searching module configured to search for a matching entry of the packet in a second access control list; the second access control list is stored in a cache space of the network processing chip; the second access control list contains second entries filtered from an original entry set;

[0022] a second searching module configured to search for the matching entry in a first access control list if the matching entry is not found in the second access control list; the first access control list is stored in an internal memory; the first access control list contains at least first entries; the first entries are entries in the original entry set except the second entries.

[0023] In a fourth aspect, the present application provides a network device, comprising a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0024] receiving a packet;

[0025] searching for a matching entry of the packet in a second access control list; the second access control list is stored in a cache space of the network processing chip; the second access control list contains second entries filtered from an original entry set;

[0026] If the matching entry is not found in the second access control list, the matching entry is searched in a first access control list; the first access control list is stored in an internal memory; the first access control list contains at least first entries; the first entries are entries in the original entry set except the second entries.

[0027] In a fifth aspect, the present application provides a computer readable storage medium, having stored thereon a computer program, which, when executed by a processor, implements the following steps:

[0028] receiving a packet;

[0029] searching for a matching entry of the packet in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second access control list contains second entries filtered from an original entry set;

[0030] If the matching entry is not found in the second access control list, the matching entry is searched in a first access control list; the first access control list is stored in an internal memory; the first access control list contains at least first entries; the first entries are entries in the original entry set except the second entries.

[0031] In a sixth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps:

[0032] receiving a packet;

[0033] searching for a matching entry of the packet in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second access control list contains second entries filtered from an original entry set;

[0034] If the matching entry is not found in the second access control list, the matching entry is searched in a first access control list; the first access control list is stored in an internal memory; the first access control list contains at least first entries; the first entries are entries in the original entry set except the second entries.

[0035] The access control list information processing method, the router, the device, the network equipment, the computer readable storage medium and the computer program product can receive a message, and then search for a matching entry of the message in a second access control list. The second access control list is stored in a cache space of a network processing chip, and the second access control list contains second entries filtered from an original entry set. If the matching entry is not found in the second access control list, the matching entry is searched for in a first access control list. The first access control list is stored in an internal memory, and the first access control list contains at least first entries that are entries in the original entry set except the second entries. According to the scheme, the second entries are filtered from the original entry set of the access control list, and are stored in the second access control list in the cache space of the network processing chip. The first entries that are the remaining entries in the original entry set are stored in the first access control list in the internal memory. Therefore, after receiving the message, the network processing chip in the network equipment can preferentially search for the matching entry in the cache space, and search for the matching entry in the internal memory when the matching entry cannot be found. The process can take full advantage of the fast access speed of the cache space in the network processing chip, can realize fast searching of the entries of the control list, and can effectively reduce the situation that the bandwidth between the network processing chip and the internal memory is continuously occupied by the matching entry searching task, effectively reduce the service processing delay, and improve the overall processing efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other related drawings can be obtained without creative labor on the basis of these drawings.

[0037] Figure 1 A storage schematic diagram of an access control list in the prior art;

[0038] Figure 2 A flowchart of an access control list information processing method in an embodiment;

[0039] Figure 3 A storage schematic diagram of a second access control list and a first access control list in an embodiment;

[0040] Figure 4 A structure schematic diagram of an access control list storage and query device in an embodiment;

[0041] Figure 5 A storage schematic diagram of an original entry set in an embodiment;

[0042] Figure 6 Storage schematic diagram of the second access control list and the first access control list in another embodiment;

[0043] Figure 7 Storage schematic diagram of the second access control list and the first access control list in another embodiment;

[0044] Figure 8 Flowchart of the access control list information processing method in another embodiment;

[0045] Figure 9 Structure schematic diagram of a router in an embodiment;

[0046] Figure 10 Structure block diagram of the access control list information processing device in an embodiment;

[0047] Figure 11 Internal structure diagram of a network device in an embodiment. DETAILED DESCRIPTION

[0048] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not used to limit the present application.

[0049] The method of the embodiments of the present application can be applied to a network device such as a router. In a network, an access control list (ACL) is a commonly used network security mechanism. By using an access control list, the access right of network traffic can be controlled, fine control and management of traffic can be achieved, and the security and stability of the network can be ensured.

[0050] In the prior art, for example, in the method of the access control list information processing method in the prior art, the access control list information processing method in the prior art is as follows: Figure 1As shown, access control lists (ACLs) are typically stored in the network device's internal memory, such as ternary content addressable memory (TCAM), and the network processor (NP) chip of the network device is connected to this internal memory. When the network device receives a packet that needs to be processed, the NP chip can perform packet processing and look up the ACL in the internal memory based on the ACL key value to obtain the entry that matches the packet. During this process, there is a certain physical distance between the NP chip and the internal memory, which can easily lead to latency in accessing the ACL. Furthermore, during the ACL lookup process, the NP chip needs to frequently read the ACL entries from the internal memory, causing the bandwidth between the NP chip and the internal memory to be continuously occupied by the ACL lookup task. In multi-tasking, high-concurrency scenarios, there is a risk of service disruption due to congestion.

[0051] Based on this, in an exemplary embodiment, such as Figure 2 As shown, an access control list information processing method is provided, which can be applied to network devices. In this embodiment, the method includes the following steps:

[0052] Step S201: Receive message.

[0053] Step S202: Search for a matching entry for the message in the second access control list.

[0054] Step S203: If no matching entry is found in the second access control list, then search for a matching entry in the first access control list.

[0055] Among them, such as Figure 3 As shown, the network device in this embodiment may include a network processing chip and internal memory. The network processing chip can be connected to the internal memory and has a cache space. The cache space of the network processing chip stores a second access control list, which may contain one or more second entries, each corresponding to an access control rule. The second entries in the second access control list may be a subset of entries selected from an original entry set. Optionally, the original entry set may be a collection of all access control list entries of the network device. The internal memory stores a first access control list, which may contain at least a first entry. The first entry may be any entry from the original entry set other than the second entry. Optionally, the number of entries in the first access control list may be greater than the number in the second access control list. Optionally, in some embodiments, the first access control list may also contain second entries.

[0056] In step S201, the network device can receive a packet transmitted through the network. For example, after receiving the packet, the network processing chip in the network device can perform packet processing on the packet, extract information such as a destination address from the packet, and obtain an access control list matching key value (ACL key value) corresponding to the packet according to the information. The ACL key value can be used to search for a table entry of an access control list matching the packet.

[0057] Then, in step S202, the network device can search for a matching table entry matching the aforementioned received packet in the second access control list in the cache space. For example, the network processing chip of the network device can search for a second table entry matching the access control list matching key value in the second access control list according to the access control list matching key value corresponding to the packet. If the second table entry exists, the second table entry can be used as the matching table entry of the packet. Otherwise, the network device can proceed to step S203.

[0058] When the matching table entry of the packet cannot be found in the second access control list, the network device can search for the matching table entry of the packet in the first access control list in the internal memory by performing step S203.

[0059] In the above access control list information processing method, the second table entries are selected from the original table entry set of the access control list and stored in the second access control list in the cache space of the network processing chip, and the first table entries remaining in the original table entry set are stored in the first access control list in the internal memory. Therefore, after receiving the packet, the network processing chip in the network device can preferentially search for the matching table entry from the cache space, and search for the matching table entry from the internal memory when the matching table entry cannot be found. This process can take full advantage of the fast access speed of the cache space in the network processing chip, realize fast searching of the table entries of the control list, effectively reduce the situation that the bandwidth between the network processing chip and the internal memory is continuously occupied by the matching table entry searching task, effectively reduce the service processing delay, and improve the overall processing efficiency.

[0060] In an example embodiment, the second table entries can be selected from the original table entry set by the following steps: obtaining traffic statistical information of each table entry in the original table entry set; and selecting the second table entries in the original table entry set according to the traffic statistical information of each table entry.

[0061] Specifically, when the second table entries are selected from the original table entry set, the traffic statistical information of each table entry in the original table entry set can be obtained first, and then the second table entries are selected according to the traffic statistical information of each table entry. For example, the traffic statistical information of each table entry can include information obtained by counting the hit traffic of the table entry in a period of time, for example, can include hit traffic data of the table entry in multiple time points and the like.

[0062] Optionally, according to the traffic statistical information of each table entry, the table entries in the original table entry set can be compared with each other, for example, several table entries with the largest cumulative hit traffic, or the highest hit frequency in recent period, or the largest upward trend of hit traffic are selected as the second table entries, and the remaining table entries are selected as the first table entries. For example, the number of the second table entries can be determined according to the capacity of the cache space that can be allocated to the second access control list.

[0063] In this embodiment, by selecting the second table entries according to the traffic statistical information of each table entry in the original table entry set, the table entries can be selected according to the hit condition of each table entry, so that the table entries that are more likely to be hit can be selected as the second table entries, and the lookup efficiency of the matching table entries can be further improved.

[0064] In an exemplary embodiment, according to the traffic statistical information of each table entry, the second table entries in the original table entry set can be selected by: obtaining a traffic cumulative change value of each table entry according to the traffic statistical information of each table entry; and selecting the second table entries from the original table entry set according to the size of the traffic cumulative change value of each table entry.

[0065] In this embodiment, the traffic statistical information of each table entry in the original table entry set can include the hit traffic of the corresponding table entry at multiple discrete time points in the statistical period. According to the increase and decrease of the hit traffic of each table entry with time, the traffic cumulative change value of each table entry in the statistical period can be obtained. For example, the larger the traffic cumulative change value, the more the hit traffic of the table entry increases with time, and the smaller the traffic cumulative change value, the less the hit traffic of the table entry increases with time.

[0066] Optionally, in this embodiment, the table entries in the original table entry set can be sorted in descending order of the traffic cumulative change value, and then the corresponding number of table entries in the front can be selected as the second table entries according to the preset number of the second table entries.

[0067] In the embodiment, the flow accumulation change value of each table entry is obtained by processing the flow statistical information of each table entry, so that the flow accumulation change value can reflect the change of the hit flow of each table entry with time. The second table entry is selected according to the size of the flow accumulation change value, so that the table entry with the hit frequency increasing with time can be selected as the second table entry, and the hit probability of the second table entry can be further improved, and the search efficiency of the matching table entry can be improved.

[0068] In an exemplary embodiment, the flow statistical information can include flow statistical values of each table entry at each statistical time point. Obtaining the flow accumulation change value of each table entry according to the flow statistical information of each table entry can include: obtaining the flow change value of each statistical time interval according to the flow statistical values of each table entry at each statistical time point; each adjacent two statistical time points form a statistical time interval; obtaining the flow accumulation change value of each table entry according to the flow change value of each statistical time interval.

[0069] The flow statistical information of each table entry in the original table entry set can include the flow statistical value of the corresponding table entry at each statistical time point. Each statistical time point can be a discrete time point in the statistical period, and the corresponding flow statistical value can be the hit flow data counted at the time point. For each statistical time point in the statistical period, a time interval between each two adjacent statistical time points can be regarded as a statistical time interval, and then the flow change value of each statistical time interval can be calculated, which can indicate the increment of the hit flow of the corresponding table entry in the statistical time interval.

[0070] For example, it is assumed that the statistical period includes statistical time points The hit flow data of these statistical time points can be represented as a sequence . The flow change value of the statistical time interval between the statistical time points and can be represented as . For example, .

[0071] The flow accumulation change value of each table entry in the entire statistical period can be obtained by counting the flow change value of each statistical time interval, which can reflect the change of the hit flow of each table entry in the entire statistical period.

[0072] In the embodiment, the time interval between each two adjacent statistical time points is regarded as a statistical time interval, the flow change value of each statistical time interval is calculated first, and then the flow accumulation change value is obtained by counting the flow change values, so that the calculation of the flow accumulation change value can be efficiently and intuitively performed.

[0073] In an example embodiment, obtaining the flow cumulative change value of the entry according to the flow change values of the statistical time intervals can comprise: obtaining time decay coefficients of the statistical time intervals relative to a current time point; and obtaining the flow cumulative change value of the entry according to the time decay coefficients of the statistical time intervals and the flow change values of the statistical time intervals.

[0074] In the process of calculating the flow cumulative change value of the entry according to the flow change values of the statistical time intervals, the time decay coefficients of the statistical time intervals can be obtained first, and then the flow cumulative change value can be calculated according to the time decay coefficients and the flow change values of the statistical time intervals.

[0075] For example, the time decay coefficients of the statistical time intervals can be determined according to the distances of the statistical time intervals relative to the current time. For example, the time decay coefficients of the statistical time intervals farther from the current time can be set smaller, and the time decay coefficients of the statistical time intervals closer to the current time can be set larger. Then, the flow cumulative change value can be calculated according to the time decay coefficients and the flow change values of the statistical time intervals, so that the flow change values of the statistical time intervals closer to the current time can have a greater contribution to the flow cumulative change value.

[0076] In the embodiment, by setting the time decay coefficients of the statistical time intervals, and calculating the flow cumulative change value of the entry according to the time decay coefficients and the flow change values, the contribution of the flow change values of the statistical time intervals to the flow cumulative change value can be adjusted according to the distances of the statistical time intervals relative to the current time point, so that the flow cumulative change value obtained can better reflect the change of the hit flow of the entry in the recent period.

[0077] In an example embodiment, obtaining the time decay coefficients of the statistical time intervals relative to the current time point can comprise: obtaining the time decay coefficients according to the interval durations between the current time point and the latter statistical time points of the adjacent two statistical time points forming the statistical time intervals; and / or obtaining the flow cumulative change value of the entry according to the time decay coefficients of the statistical time intervals and the flow change values of the statistical time intervals can comprise: obtaining the flow cumulative change value of the entry by weighted summing the flow change values of the statistical time intervals according to the time decay coefficients of the statistical time intervals.

[0078] Specifically, the time decay coefficients of the statistical time intervals can be obtained according to the interval durations between the current time point and the latter statistical time points of the adjacent two statistical time points forming the statistical time intervals. The current time point can refer to the time of performing the flow statistics of the entry, or can refer to the last time point in the statistical time points.

[0079] Exemplarily, assuming that the time point t is a current time point, for a statistical time interval between and , its corresponding time decay coefficient can be expressed as: wherein, the closer the statistical time interval is to the current time point, the greater the corresponding time decay coefficient is.

[0080] Wherein, according to the time decay coefficient and the flow change value corresponding to each statistical time interval, the time decay coefficient can be taken as a weight coefficient of the flow change value, and the flow cumulative change value of the table entry in the entire statistical period is calculated by weighted summation. Exemplarily, the calculation process of the flow cumulative change value can be expressed as:

[0081]

[0082] wherein, is the flow cumulative change value of the table entry, is the current time point, is the statistical time point to corresponding to the flow change value, is the time decay coefficient corresponding to the statistical time interval.

[0083] In this embodiment, by obtaining the time decay coefficient according to the interval length between the subsequent statistical time point of the statistical time interval and the current time point, the corresponding time decay coefficient can be conveniently and quickly set for different statistical time intervals. And by using the time decay coefficient and the flow change value to calculate the flow cumulative change value of the table entry by weighted summation, the flow cumulative change value which can objectively reflect the hit activity of the table entry can be obtained by combining the cumulative effect and the time decay factor.

[0084] In an exemplary embodiment, after screening the second table entry in the original table entry set according to the flow statistical information of each table entry, the method can further include: taking the screened second table entry as a new second table entry; according to the new second table entry, exchanging part or all of the table entries in the second access control list and the first access control list, so that the second access control list is composed of the new second table entry, and the first access control list at least contains the new first table entry; the new first table entry is the table entry in the original table entry set except the new second table entry.

[0085] The network device can reacquire the traffic statistical information of each table item in the original table item set at intervals of a period of time, and filter new second table items from the original table item set according to the new traffic statistical information, and take the remaining table items in the original table item set as new first table items. Then, the second access control list and part or all of the table items in the first access control list can be exchanged according to the new second table items, so that the second access control list can be composed of the new second table items, and the new first table items are stored in the first access control list. Based on this, the updating of the second access control list and the first access control list can be realized.

[0086] Exemplarily, after obtaining the new second table items, the new second table items can be compared with the original second table items in the second access control list. If the new second table items are inconsistent with the original second table items, it indicates that the original first table items are included in the new second table items, and the new first table items are included in the original second table items. In this case, the original first table items and the original second table items can be exchanged, so as to realize the updating of the second access control list and the first access control list.

[0087] In this embodiment, by re-filtering the second table items from the original table item set, and updating the second access control list and the first access control list according to the new second table items, the second access control list and the first access control list can be dynamically adjusted according to the change of the hit situation of the table items over time, so that the second access control list can be continuously composed of the table items that are more likely to be hit, and the search efficiency of the matching table items is guaranteed for a long time.

[0088] In order to further illustrate the access control list information processing method of the present application, the following will be described in detail by embodiments:

[0089] Exemplarily, the network device can execute the access control list information processing method in this embodiment by using an access control list storage and query device as shown in Figure 4 As shown in Figure 4 , the device includes a table item acquisition and storage module, a table item hit statistical module, a table item activity statistical module, a table item updating module, and a table item search module.

[0090] The table item acquisition and storage module can be used to acquire the initial configuration information of the access control list, generate the table items of the access control list, and store them in the internal memory. As shown in Figure 5 , the table items generated according to the initial configuration information can include table item 1, table item 2, table item 3, and table item 4, which can be stored in the internal memory and form an original table item set.

[0091] The table entry hit statistics module can be used to count the hit traffic of each entry in the original table entry set, and obtain the traffic statistics information of each entry. For example, the traffic statistics information of an entry can include the traffic statistics value of the entry at each statistical time point obtained by the table entry hit statistics module counting the hit traffic of the entry at multiple discrete statistical time points.

[0092] The table activity statistics module can be used to obtain the traffic statistics information of each table in the original table set, and obtain the cumulative traffic change value of each table based on the traffic statistics information of each table.

[0093] For example, the table item activity statistics module can calculate the traffic change value of each statistical time interval formed by two adjacent statistical time points based on the traffic statistics value of the table item at each statistical time point, and obtain the time decay coefficient of each statistical time interval relative to the current time point. Then, by combining the cumulative effect and time decay factors, it calculates the cumulative traffic change value of the table item based on the traffic change value of the table item in each statistical time interval and the time decay coefficient. By calculating the cumulative traffic change value of the table item, the activity of each table item can be quantified.

[0094] For example, assume that the statistical period includes statistical time points. The hit traffic data for these statistical time points is a sequence. For the statistical time point arrive The statistical time interval between them, the change in flow rate can be expressed as The calculation process for the cumulative change in flow rate can be expressed as follows: ,in, This represents the cumulative change in flow rate for each item in the table. At the current time point, For statistical time points arrive The traffic change value corresponding to the statistical time interval between them This is the time decay coefficient corresponding to this statistical time interval.

[0095] The table entry update module can be used to filter out the second table entry from the original table entry set based on the magnitude of the cumulative traffic change value of each table entry in the original table entry set, and store it in the second access control list of the network processing chip's cache space. As for the first table entry in the original table entry set other than the second table entry, it is stored in the first access control list of the internal memory.

[0096] For example, as Figure 5The original entry set is shown as an example, assuming that entry 1 corresponds to 1.1.1.1 / permit, entry 2 corresponds to 2.2.2.2 / deny, entry 3 corresponds to 3.3.3.3 / permit, and entry 4 corresponds to 4.4.4.4 / deny. During the statistical period T1, data traffic with destination addresses of 1.1.1.1 and 3.3.3.3 continuously enters the network device, and the entry activity statistical module calculates that the traffic cumulative change values of entry 1 and entry 3 are higher, so the entry updating module can take entry 1 and entry 3 as the second entries, and take entry 2 and entry 4 as the first entries. As shown in Figure 6 The entry updating module can store entry 1 and entry 3 as the second entries in the second access control list of the cache space of the network processing chip, and store entry 2 and entry 4 as the first entries in the first access control list of the internal memory.

[0097] The entry updating module can also be used to update the second access control list and the first access control list. Specifically, the entry activity statistical module can update the traffic statistical information of each entry in the original entry set over time, the entry updating module can obtain the updated traffic statistical information, and re-select the second entries in the original entry set. Then, the second entries selected can be taken as new second entries, and according to the new second entries, part or all of the entries in the second access control list and the first access control list are exchanged, so that the second access control list is composed of the new second entries, and the first access control list at least contains the new first entries.

[0098] Exemplarily, assuming that the second access control list and the first access control list before updating are as shown in Figure 6 During the statistical period T2, data traffic with destination addresses of 1.1.1.1 and 2.2.2.2 continuously enters the network device, and the entry activity statistical module calculates that the traffic cumulative change values of entry 1 and entry 2 are higher, so the entry updating module can take entry 1 and entry 2 as the new second entries, and take entry 3 and entry 4 with lower traffic cumulative change values as the new first entries. As shown in Figure 7 The entry updating module can exchange entry 3 in the original second access control list with entry 2 in the original first access control list, so that the second access control list can be composed of the new second entries (entry 1 and entry 2), and the first access control list contains the new first entries (entry 3 and entry 4).

[0099] The entry searching module can be used to receive a packet, and then search for a matching entry of the packet in the second access control list, and if the matching entry of the packet is not found in the second access control list, search for the matching entry in the first access control list.

[0100] Exemplarily, the lookup process of the table entry lookup module can be as shown in Figure 8 . In which, the table entry lookup module can be deployed in the network processing chip. It can receive a packet, and then look up the second table entry matching the packet in the second access control list in the cache space of the network processing chip. If there is a hit second table entry, it can be taken as the matching table entry of the packet, and relevant actions such as statistics, committed access rate (CAR), discarding, redirection, etc. are performed. While when no matching table entry is hit in the second access control list, the first access control list in the memory can be queried using the ACL key value. Similarly, if there is a hit first table entry, it can be taken as the matching table entry of the packet, and relevant actions are performed; while if there is no hit first table entry, the lookup of the first access control list is ended. Exemplarily, still taking the second access control list and the first access control list as shown in Figure 6 , since the table entry 1 and the table entry 3 are stored in the second access control list, for the packet with the destination address of 1.1.1.1 or 3.3.3.3, the network processing chip can directly look up the matching table entry in the cache space, without going around to look up in the memory, thereby greatly improving the lookup efficiency and reducing the lookup time consumption.

[0101] In this embodiment, by storing the second access control list in the cache space of the NP chip, and through the statistics and update of the traffic cumulative change value of the table entry, the linkage between the second access control list and the first access control list is realized. By storing the commonly used access control list table entry in the cache space of the NP chip, the advantage of fast access speed of the in-chip cache can be fully utilized, the table lookup performance of the ACL table entry is comprehensively improved, and the service processing delay is reduced. Moreover, in this embodiment, based on the traffic statistics information of the ACL table entry in the statistics period, combined with the factors of cumulative effect and time decay, the traffic cumulative change value of each ACL table entry is calculated, the ACL table entry which is more likely to be hit at present is screened out and stored in the second access control list, thereby further improving the table lookup efficiency.

[0102] It should be understood that although the steps in the flowcharts involved in the embodiments described above are shown in sequence according to the arrows, the steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the execution of the steps is not strictly limited in sequence, and the steps can be executed in other sequences. Moreover, at least some of the steps in the flowcharts involved in the embodiments described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of the steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least part of other steps or stages.

[0103] Based on the same inventive concept, the embodiments of the present application also provide a router. The implementation scheme for solving the problem provided by the router is similar to the implementation scheme described in the above method, so the specific limitations in one or more router embodiments provided below can refer to the limitations of the access control list information processing method described above, and will not be repeated here.

[0104] In an exemplary embodiment, as shown in Figure 9 A router is provided, comprising: a network processing chip and an internal memory.

[0105] The network processing chip is configured to receive a packet.

[0106] The network processing chip is further configured to search for a matching entry of the packet in a second access control list; the second access control list is stored in a cache space of the network processing chip; and the second access control list contains second entries filtered from the original entry set.

[0107] The network processing chip is further configured to search for the matching entry in a first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list contains at least first entries; and the first entries are entries in the original entry set except the second entries.

[0108] Based on the same inventive concept, the embodiments of the present application also provide an access control list information processing device for implementing the above-mentioned access control list information processing method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more access control list information processing device embodiments provided below can refer to the limitations of the access control list information processing method described above, and will not be repeated here.

[0109] In an exemplary embodiment, as shown inFigure 10 As shown, an access control list information processing apparatus 1000 is provided, comprising:

[0110] a packet receiving module 1001, configured to receive a packet;

[0111] a first searching module 1002, configured to search for a matching entry of the packet in a second access control list; the second access control list is stored in a cache space of a network processing chip; the second access control list contains second entries screened from an original entry set;

[0112] a second searching module 1003, configured to search for the matching entry in a first access control list if the matching entry is not found in the second access control list; the first access control list is stored in an internal memory; the first access control list contains at least first entries; the first entries are entries in the original entry set except the second entries.

[0113] In an exemplary embodiment, the second entries are screened from the original entry set by the following steps: obtaining traffic statistical information of each entry in the original entry set; and screening the second entries in the original entry set according to the traffic statistical information of each entry.

[0114] In an exemplary embodiment, the screening of the second entries in the original entry set according to the traffic statistical information of each entry comprises: obtaining a traffic cumulative change value of each entry according to the traffic statistical information of each entry; and screening the second entries from the original entry set according to the size of the traffic cumulative change value of each entry.

[0115] In an exemplary embodiment, the traffic statistical information comprises a traffic statistical value of an entry at each statistical time point; and the obtaining of a traffic cumulative change value of each entry according to the traffic statistical information of each entry comprises: obtaining a traffic change value of each statistical time interval according to the traffic statistical value of the entry at each statistical time point; each adjacent two statistical time points form the statistical time interval; and obtaining the traffic cumulative change value of the entry according to the traffic change value of each statistical time interval.

[0116] In an exemplary embodiment, the obtaining of the traffic cumulative change value of the entry according to the traffic change value of each statistical time interval comprises: obtaining a time decay coefficient of each statistical time interval relative to a current time point; and obtaining the traffic cumulative change value of the entry according to the time decay coefficient corresponding to each statistical time interval and the traffic change value of each statistical time interval.

[0117] In an exemplary embodiment, the obtaining the time decay coefficient of each of the statistical time intervals relative to a current time point comprises: obtaining the time decay coefficient according to an interval length between a later statistical time point of two adjacent statistical time points forming the statistical time interval and the current time point; and / or the obtaining the cumulative flow change value of the entry according to the time decay coefficient corresponding to each of the statistical time intervals and the flow change value of each of the statistical time intervals comprises: performing weighted summation on the flow change value of each of the statistical time intervals according to the time decay coefficient corresponding to each of the statistical time intervals to obtain the cumulative flow change value of the entry.

[0118] In an exemplary embodiment, the apparatus further comprises: an entry updating module configured to take the screened second entry as a new second entry; and an entry swapping module configured to swap part or all of the entries in the second access control list and the first access control list according to the new second entry, so that the second access control list is composed of the new second entry and the first access control list contains at least the new first entry; and the new first entry is an entry in the original entry set except the new second entry.

[0119] Each of the above-mentioned modules of the access control list information processing apparatus can be realized by software, hardware, or a combination thereof, in whole or in part. Each of the above-mentioned modules can be embedded in or independent of a processor in a network device in hardware form, or stored in a memory in a network device in software form, so as to be called and executed by a processor to perform operations corresponding to each of the above-mentioned modules.

[0120] In an exemplary embodiment, a network device, which can be a server, has an internal structure diagram as shown in Figure 11 The network device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the network device is configured to provide computing and control capabilities. The memory of the network device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The input / output interface of the network device is configured to exchange information between the processor and external devices. The communication interface of the network device is configured to communicate with external terminals through a network connection. The computer program is executed by the processor to implement an access control list information processing method.

[0121] Those skilled in the art can understand that,Figure 11 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the network device to which the scheme of the present application is applied. The specific network device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] In an exemplary embodiment, a network device is provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above method embodiments when executing the computer program.

[0123] In an embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program implements the steps in the above method embodiments when executed by a processor.

[0124] In an embodiment, a computer program product is provided, including a computer program, and the computer program implements the steps in the above method embodiments when executed by a processor.

[0125] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0126] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0127] The technical features of the above embodiments can be combined in any manner. To make the description concise, all possible combinations of the technical features in the above embodiments are not described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0128] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A method for processing access control list information, characterized in that, The method includes: Receive message; The matching entry for the packet is searched in the second access control list; the second access control list is stored in the cache space of the network processing chip; the second entries in the second access control list are filtered from the original entry set; the second entries are filtered from the original entry set through the following steps: obtaining the traffic statistics information of each entry in the original entry set; filtering the second entries in the original entry set according to the traffic statistics information of each entry. If the matching entry is not found in the second access control list, the matching entry is searched in the first access control list; the first access control list is stored in the internal memory; the first access control list contains at least a first entry; the first entry is an entry in the original entry set other than the second entry; The method further includes: using the filtered second entry as a new second entry; swapping some or all entries in the second access control list and the first access control list according to the new second entry, such that the second access control list is composed of the new second entry, and the first access control list contains at least the new first entry; the new first entry is an entry in the original entry set other than the new second entry.

2. The method according to claim 1, characterized in that, The step of filtering the second table entry from the original table entry set based on the traffic statistics information of each table entry includes: Based on the traffic statistics information of each of the table entries, the cumulative change value of traffic for each of the table entries is obtained; The second entry is obtained from the original entry set based on the magnitude of the cumulative change value of the flow rate of each entry.

3. The method according to claim 2, characterized in that, The traffic statistics information includes the traffic statistics values ​​of the table entries at each statistical time point; The step of obtaining the cumulative change value of traffic for each of the table entries based on the traffic statistics information of each table entry includes: Based on the flow statistics at each statistical time point, the flow change value for each statistical time interval is obtained; each two adjacent statistical time points form the statistical time interval. The cumulative change value of the flow rate for each statistical time interval is obtained.

4. The method according to claim 3, characterized in that, The step of obtaining the cumulative change value of the flow rate of the table entry based on the flow rate change value of each of the statistical time intervals includes: Obtain the time decay coefficient of each statistical time interval relative to the current time point; The cumulative change value of the flow rate of the table entry is obtained based on the time decay coefficient corresponding to each statistical time interval and the flow rate change value of each statistical time interval.

5. The method according to claim 4, characterized in that, The step of obtaining the time decay coefficient of each statistical time interval relative to the current time point includes: The time decay coefficient is obtained based on the time interval between the later statistical time point and the current time point among two adjacent statistical time points that form the statistical time interval. And / or, The step of obtaining the cumulative flow change value of the table entry based on the time decay coefficient corresponding to each statistical time interval and the flow change value of each statistical time interval includes: Based on the time decay coefficient corresponding to each statistical time interval, the flow change values ​​of each statistical time interval are weighted and summed to obtain the cumulative flow change value of the table entry.

6. A router, characterized in that, include: Network processing chips and internal memory; The network processing chip is used to receive messages; The network processing chip is further configured to search for a matching entry of the packet in a second access control list; the second access control list is stored in the cache space of the network processing chip; the second entries in the second access control list are filtered from the original entry set; the second entries are filtered from the original entry set through the following steps: obtaining traffic statistics information of each entry in the original entry set; filtering the second entries in the original entry set according to the traffic statistics information of each entry; The network processing chip is further configured to search for the matching entry in the first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list contains at least a first entry; the first entry is an entry in the original entry set other than the second entry; The network processing chip is further configured to use the filtered second entry as a new second entry; and to swap some or all entries in the second access control list and the first access control list according to the new second entry, so that the second access control list is composed of the new second entry, and the first access control list contains at least the new first entry; the new first entry is an entry in the original entry set other than the new second entry.

7. An access control list information processing device, characterized in that, The device includes: The message receiving module is used to receive messages; A first lookup module is used to search for a matching entry of the packet in a second access control list; the second access control list is stored in the cache space of the network processing chip; the second entries in the second access control list are filtered from the original entry set; the second entries are filtered from the original entry set through the following steps: obtaining traffic statistics information of each entry in the original entry set; filtering the second entries in the original entry set according to the traffic statistics information of each entry; The second search module is used to search for the matching entry in the first access control list if the matching entry is not found in the second access control list; the first access control list is stored in the internal memory; the first access control list contains at least a first entry; the first entry is an entry in the original entry set other than the second entry; The table entry update module is used to use the filtered second table entry as the new second table entry; The entry swapping module is used to swap some or all entries in the second access control list and the first access control list according to the new second entry, so that the second access control list is composed of the new second entry, and the first access control list contains at least the new first entry; the new first entry is an entry in the original entry set other than the new second entry.

8. A network device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images