FC protocol switching equipment access control method and device and readable medium

Abstract

The invention provides an FC protocol switching equipment access control method and device and a readable medium. The method comprises the following steps: extracting message header information of an FC message; obtaining a processing rule which is not traversed at present and has the highest priority; processing the message header information to form processed message header information; performing Hash operation on the basis of the processed message header information, taking a Hash operation result as an address, searching an access control list by taking the address as an index, and obtaining a corresponding processing mode; processing the FC message according to the processing mode; and judging a processing mode and executing corresponding operation. According to the scheme, rapid identification and filtering of the FC protocol message are effectively realized, the field to be filtered, the processing mode after filtering and the priority can be flexibly configured, the flexibility of access control is remarkably improved, and the capability of adapting to different application scenes is enhanced.

Description

Technical Field

[0001] The present invention relates to the fields of FC network communication switching equipment, integrated circuit design and integrated circuit data processing, and in particular to an FC protocol switching equipment access control method, device and readable medium to improve the flexibility and adaptability of FC protocol switching equipment access control. Background Art

[0002] Fibre Channel (FC) networks are widely used in aerospace, data storage and other fields. In some large networks or complex application scenarios, FC switching devices need to use access control lists (ACLs) to complete operations such as message detection, filtering and permission control.

[0003] Existing FC access control list technology is generally implemented based on Ethernet switching design, which does not take into account the characteristics of FC networks. In addition, access control policies usually use fixed message information or a combination of message information, resulting in poor configuration flexibility and difficulty in meeting the differentiated requirements of different application scenarios. Summary of the invention

[0004] In view of this, in order to solve at least part of the technical problems existing in the above-mentioned prior art, the present invention provides the following technical solutions: In one aspect, the present invention provides an FC protocol switching device access control method, the method comprising: S1. Parse the received FC message and extract the message header information; S2. Obtain the processing rule with the highest priority that has not been traversed yet; S3, processing the message header information based on the processing rule obtained in S2 to form processed message header information; S4, performing a hash operation based on the processed message header information, using the hash operation result as the address, searching the access control list with the address as the index, and obtaining the corresponding processing method; S5. Process the FC message according to the processing method obtained in S4; S6, judging whether the processing mode in S4 is forwarding or discarding, if the processing mode is not forwarding or discarding, returning to S2 to obtain the next priority processing rule; if the processing mode is forwarding or discarding, executing the corresponding forwarding or discarding, and ending; If there is a next-level priority processing rule, continue to execute until the corresponding processing method is forwarding or discarding, and end; if the corresponding processing method is not forwarding or discarding after traversing all processing rules, do not process the FC message and end.

[0005] Preferably, the processing rules at least include: the fields of interest in the message header information, the corresponding processing methods and priorities; The S3 further includes: retaining the original values ​​of the fields in the message header information concerned in the processing rule, and setting the fields in the message header information not concerned in the processing rule to fixed values.

[0006] Preferably, S3 further includes: If the message header information does not include the VFT header, a fixed value data with the same length as the VFT header is added at the corresponding position to complete the message header information.

[0007] Preferably, the processing methods include: discarding, forwarding, copying, capturing, sending a report to a driver, and modifying the content of the message.

[0008] Preferably, the S4 further comprises: After obtaining the processing method, obtaining the simulated message header stored corresponding to the processing method, and comparing the processed message header information with the simulated message header to confirm consistency; After determining the processing rule, pre-calculating and storing the simulated message header and the address; the simulated message header is associated with the address and the processing method and stored; In the processing rule, the value of the field of interest is determined.

[0009] Preferably, if the processed message header information is inconsistent with the simulated message header, the corresponding message is deemed not to be processed; The message is deemed as not being processed, that is, no processing is performed on the message, and the message is transmitted to other modules of the FC protocol switching device to perform other processing except the access control method.

[0010] Preferably, in S4, if there is no corresponding processing method, it is deemed that no processing is performed; The message is deemed as not being processed, that is, no processing is performed on the message, and the message is transmitted to other modules of the FC protocol switching device to perform other processing except the access control method.

[0011] Preferably, the calculation method of the simulated message header is: The values ​​of the fields of interest in the message header information determined in the processing rule are retained, and the values ​​of other fields of no interest are set to fixed values; By default, all message header information includes a VFT header, and the VFT header is a field that is not of concern in the processing rules.

[0012] On the other hand, the present invention also provides an FC protocol switching device access control device, the device comprising: Receiving module, message header extraction module, message header processing rule query module, message header processing module, filtering mode query module, filtering processing module, filtering processing mode judgment module and sending module; The receiving module is used to receive FC messages; The message header extraction module is used to extract message header information of the FC message; The message header processing rule query module is used to obtain the processing rule corresponding to the current message header information; The message header processing module is used to set the message header fields that are not concerned to fixed values ​​according to the processing rules to form processed message header information; The filtering mode query module is used to query the corresponding processing mode based on the processed message header information; The filtering processing module is used to process the FC message according to the processing method obtained by query; The filtering mode judgment module is used to determine whether to continue to traverse the next priority processing rule according to whether the current processing mode will cause the message to be discarded or forwarded; if the processing mode is not forwarding or discarding, continue to traverse the next priority processing rule; if the processing mode is forwarding or discarding, send the FC message to the sending module to perform corresponding forwarding or discarding; The sending module is used to execute FC message discarding, or send the FC message to complete FC message forwarding, or send the FC message when the message is deemed not to be processed.

[0013] Preferably, the sending module is connected to the routing module, the switching module and the elastic cache in the FC protocol switching device. When the FC message is deemed not to be processed, the sending module transmits the FC message to one or more of the routing module, the switching module and the elastic cache.

[0014] In a third aspect, the present invention further provides a computer-readable medium, characterized in that when the computer-readable medium is read by a processor and the program therein is executed, the FC protocol switching device access control method as described above is executed.

[0015] Compared with the existing technology, this solution effectively realizes the rapid identification and filtering of FC protocol messages, and can flexibly configure the fields to be filtered, the processing method after filtering and the priority of the processing rules as needed, which significantly improves the flexibility of access control and significantly enhances the ability to adapt to different application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 This is a flow chart of a method for processing FC messages according to an embodiment of the present invention; Figure 2 This is a working process diagram of the FC message processing device according to an embodiment of the present invention; Figure 3 A schematic diagram of a method for processing a message header and generating processing rules according to an embodiment of the present invention; Figure 4 A detailed flow chart of the access control method according to an embodiment of the present invention; Figure 5 A schematic diagram of a software framework for configuring an access control list according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. It should be clear that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Those skilled in the art should know that the following specific embodiments or specific implementations are a series of optimized settings listed by the present invention to further explain the specific content of the invention, and these settings can be combined or used in association with each other, unless the present invention clearly states that some or a specific embodiment or implementation cannot be associated or used together with other embodiments or implementations. At the same time, the following specific embodiments or implementations are only used as the most optimized settings, and are not to be understood as limiting the scope of protection of the present invention.

[0020] In view of the problems existing in the prior art, this solution provides an access control solution for FC protocol switching devices, which can well adapt to the characteristics of FC devices, realize rapid identification and filtering of FC protocol messages, and significantly improve the flexibility of access.

[0021] In one embodiment, in combination Figure 1 As shown, the main implementation methods of this solution are as follows: Step 1: Parse the received FC message and extract its complete original message header information; Step 2: Get the processing rule with the highest priority that has not been traversed yet; Step 3: Process the message header information according to the preset processing rules obtained, and set the fields in the message header information that are preset as not to be concerned to fixed values. The processing rules can be configured to pay attention to or not pay attention to any one or more fields in the message; Step 4: Perform a hash operation on the message header information processed in step 3, use the hash operation result as an index, search the access control list, and obtain the processing method corresponding to the processed message header information; Step 5: Process the FC message according to the processing method obtained by query; Step 6: If the processing method obtained in step 4 is not forwarding or discarding, return to step 2 to check whether there are any processing rules with lower priority; if there are any processing rules with lower priority, continue to execute until the corresponding processing method is forwarding or discarding, or exhaust all preset processing rules. Here, in one embodiment, if there is no discarding or forwarding method after exhaustion, the message will not be processed, and will directly leave the access control module or access control device proposed by the present invention and enter other modules of the entire system for corresponding processing. In this case, other possible subsequent processing is not within the scope of the solution of the present invention.

[0022] The following will elaborate on the specific implementation methods.

[0023] In a preferred embodiment, in combination Figure 3 As shown, the demand for processing rules can be generated by the upper-layer protocol or user configuration. The content of the processing rule requirement information mainly includes: the fields that need to be paid attention to in the message header, the processing method after the field matches, and the priority of the rules. After the configuration software receives the input processing rule requirement information, it first records the position of the field of concern, and marks the position of other fields as not concerned, thereby generating processing rules. Then generate a simulated message header field with the same length as the FC message header carrying the VFT header, set the fields that need to be paid attention to to the input values, and set other fields to fixed values, such as 0. After the values ​​of each field are processed as described above, a hash operation is performed on the processed fields, and the result of the operation is used as an index to form a hash table. Figure 3 Address A in the record field information and the corresponding processing rules and priorities.

[0024] The hardware configuration information generated by the above steps includes two parts: one part is the record of the message header processing rules and their corresponding hash results, and the other part is the result obtained by applying a specific processing method to the simulated FC message header field (i.e. Figure 3 The two parts are associated through the hash result, that is, Figure 3The address A in is the result of the hash operation.

[0025] In this embodiment, the preferred method is that the hardware configuration information needs to be arranged from high to low priority, and is sent to the hardware module for processing rule query in sequence through the configured hardware configuration module to ensure that the processing rules stored in the hardware are also arranged in order from high to low priority. The total number of processing rules is limited by the capabilities of the hardware module, and traversing all the processing rule information stored in the hardware module can ensure that all processing rules are traversed.

[0026] The significance of access control is that users / upper layer protocols can add additional control mechanisms defined by users / protocols based on the normal forwarding path according to the current application scenario. Therefore, in this embodiment, the access control mechanism can be set as a module / component in the switching device by default, and there are corresponding forwarding mechanisms before and after the message enters the module. These specific forwarding mechanisms can refer to the existing forwarding mechanisms. These specific forwarding mechanisms are not within the scope of protection of the present invention and are not used as improvements of this solution.

[0027] From this, it can be understood that when the processing rules are exhausted and no corresponding message processing method is found, the message processing method at this time is determined by the forwarding mechanism of other modules by default, that is, this type of situation is considered as not being processed in this solution. Therefore, it is normal that the processing method determined by the access control mechanism is not to process it.

[0028] The following, combined Figure 3 , Figure 4 As shown, the detailed process of access control is further explained.

[0029] Step 01, when the message enters the access control list hardware, the device provided by this solution first receives the message; Step 02: Extract complete message header information; Step 03: The device extracts the processing rule with the highest current priority. If there is no processing rule or all processing rules have been traversed, it directly goes to step 08 to send the message. Step 04, process the message header information according to the extracted processing rules, retain the part of the message header information that the processing rules pay attention to, and set the fields in other message header information that are not concerned to a fixed value, such as 0. In this embodiment, the message header is considered to carry the VFT header by default during processing. If the actual message does not carry the VFT header, 0-valued data of the same length as the VFT header is supplemented at the corresponding position to complete its length. Then perform a hash operation on the processed message header; Step 05: Use the result of the hash operation in step 04 as the address, such as Figure 3As shown, the corresponding processing rule is queried according to the address, and the corresponding processing method is obtained. If the corresponding processing method is not found, it is deemed that no processing is performed; The above processing methods are mainly for the current message, and include but are not limited to: discarding, forwarding, copying, capturing, sending a report to the driver, modifying the content of the message, etc.

[0030] After obtaining the processing method, it is also necessary to extract the simulated message header stored together with the processing method, compare it with the currently processed message header, and confirm that they are consistent to avoid hash collision, that is, the source data is inconsistent but the hash value is consistent. If the comparison result is that the currently processed message header information is inconsistent with the simulated message header, the currently obtained processing method is invalid and is deemed not to be processed. In this embodiment, when it is deemed not to be processed, the message is transferred to other modules of the FC protocol switching device, and is determined according to the forwarding and processing mechanism of other modules in the FC protocol switching device, for example, it is processed according to the conventional processing mechanism in the prior art. Further, when it is deemed not to be processed, the corresponding message is generally not processed, leaving the access control mechanism proposed by the present invention, and sent to other modules or processing logic of the FC protocol switching device, such as routing module, switching module, elastic cache, etc., wherein the routing module can, for example, determine the exit port according to the specific address to perform other routing processing on the message, and the switching module can complete the actual message forwarding work, etc., which is only used as an example here.

[0031] Step 06: Determine the message processing method based on the query result. If the query result (i.e. the processing method found) is discard or forward, mark the message accordingly. If the query result is copy, copy the message and mark the forwarding path corresponding to the newly generated message. If the query result is no processing, no processing is performed and the subsequent step 07 is executed; Step 07: After the message is processed, it is necessary to determine whether the current processing method will lead to the forwarding or discarding of the message. If the message will not be forwarded or discarded, return to step 03 to continue to query other processing rules with lower priority; In this embodiment, the maximum number of loops is to traverse all processing rules, and forwarding or discarding of messages is considered an operation with a very large impact, which will cause the loop to exit early without waiting for all traversals to be completed.

[0032] Step 08: If the message is forwarded or discarded, or has traversed all processing rules, the message is transmitted to the sending module for corresponding discarding or forwarding operations. If it is deemed not to be processed or not to be processed, it is sent to other subsequent modules in the FC protocol switching device through the sending module to continue processing the message. These subsequent processes are not in the logic of the access control method proposed by the present invention and will not be discussed in detail. The remaining messages are then received, or the processing rules are changed.

[0033] Before executing the above step 01, preferably, the processing rules and their priority values ​​are preset in combination with the actual access control requirements, and the corresponding message processing method is also configured based on the access control requirements.

[0034] For example, assume that the user's access control requirements are: 1. Copy the packets with the r_ctl field of the FC packet header as 0x02 and the type field as 0x49, and forward them to port 0; 2. Discard all packets with the destination ID as 0x200001; 3. Forward the packets with the source ID as 0x100001 to port 1. The priorities of the three requirements are reduced in sequence.

[0035] At this time, the configuration software generates three configuration rules accordingly: the first one is to copy the message and forward the copied message to port 0 when r_ctl=0x02 and type=0x49, which is the first priority. The second one is to discard the message when Did=0x200001, which is the second priority. The third one is to forward the message to port 1 when Sid=0x100001, which is the third priority. The three rules are written into the device to form the processing rules.

[0036] Here, preferably, a hash operation is performed according to each processing rule to determine the address. For example, for the first processing rule, all fields in the message header information that the rule does not pay attention to are set to 0, and then the values ​​of the two fields r_ctl=0x02 and type=0x49 are combined to perform a hash operation to obtain the corresponding address A, and then the address A and the corresponding processing rule and priority are stored.

[0037] At the same time, after obtaining address A, the processing method corresponding to the corresponding processing rule is associated with address A and stored. For example, the processing method of the first processing rule in this embodiment is: copy the message and forward it to port 0, then address A is stored in correspondence with the processing method, and the corresponding simulated message header is stored at the same time. The simulated message header is obtained in advance based on the processing rule calculation: for example, for the first processing rule, the fields of interest in its message header information are r_ctl and type, then we retain the actual values ​​of these two fields, i.e., r_ctl=0x02 and type=0x49, and set the values ​​of other fields to 0, which is consistent with the above. In addition, in this embodiment, we assume that the message header information carries the VFT header. If the message does not carry the VFT header, then generate a simulated message header field of the same length as the FC message header carrying the VFT header, and set the values ​​of the medium-length VFT header to 0. At this time, the simulated message header is obtained, and the simulated message header is associated with address A and the corresponding specific processing method (i.e., copy the message and forward the copied message to port 0) and stored. Other preset processing rules, processing methods, settings between simulated message headers and corresponding addresses, and associated storage methods are the same as above. One of the purposes of storing simulated message headers is verification. Since there is a certain probability that different original data will have the same result after hashing, that is, hash collision, the method designed in this solution to retain the simulated message header is equivalent to setting and retaining an important part of the original data, which is used to compare and verify with the data processed by the processing rules of the actual message header received. If they are consistent, it is normal. If they are inconsistent, it proves that a hash collision has occurred. In this case, we can regard the corresponding message as not processed.

[0038] After the preset processing rules are set, the message reception starts, and the access control and processing of the message are performed according to the preset processing rules. It can be understood that the setting of the processing rules here can be regarded as an initialization process, that is, the processing rules are initialized and configured in advance, and the subsequent message processing can be judged and processed according to the initialized processing rules. When the processing rules need to be changed, they can be initialized again, and then the access control and processing of subsequent messages can be started.

[0039] Next, the subsequent processing of the message will be described in combination with the above embodiment.

[0040] When the r_ctl field in the FC message header information entering the device is 0x02, the type field is 0x49, the destination ID is 0x200001, and the source ID is 0x100001, the processing rules set above are traversed. First, the message is processed according to the first priority processing rule (that is, when R_ctl=0x02 and Type=0x49, the message is copied and the copied message is forwarded to port 0), all fields except r_ctl and type in the message header information are set to 0, and the processed message header information is hashed.

[0041] Based on the result of the hash operation, we can determine the address. For example, we can calculate address A, and then use address A as an index to query the corresponding processing method, confirm that the corresponding processing method is replication, and mark the replication message to be forwarded to port 0.

[0042] Here, the copy processing method will not cause the message to be discarded or sent, so the loop continues to traverse the next priority processing rule. According to the second priority processing rule, all fields except the Did field in the original FC message header entering the device are set to a value, for example, set to 0, and the message header information processed according to the second priority processing rule is hashed, for example, address B is obtained at this time.

[0043] According to the result of the hash operation (i.e. address B, Figure 3 (not shown) inquires about the processing method, confirms that the corresponding processing method is discard, then the message is marked as discarded, and the processing method at this time will cause the message to be discarded, so the loop will no longer be performed at this time, the third priority rule is invalid, and the message can be sent. Here, the subsequent discarding operation of the message can be performed by other modules of the FC protocol switching device, and the module provided in this solution sends the marked message to the corresponding module (or other subsequent processing modules) for processing. It can be understood that the subsequent discarding of the message and other operations can be implemented using modules in the prior art, and it is not the inventive point of the present invention. Its specific process and operation method are well known to those skilled in the art and will not be repeated here.

[0044] Therefore, after the above steps are executed, the final message is discarded, and its duplicate message is forwarded to port 0, meeting the access control requirements.

[0045] In additional special cases, such as when other fields in the FC message header information entering the device remain unchanged and the source ID becomes 0x100002. Since the source ID is set to 0 in the first two priority rule processing, the change of the source ID will not affect the result of the hash calculation, the message can still be copied and discarded normally, and the fields that are not concerned will not affect the access control results, meeting the access control requirements.

[0046] In summary, this solution can filter any message header field or field combination, control the priority of processing rules and configure the post-filtering behavior during implementation, which can well meet the needs of flexible access control.

[0047] In another embodiment, the solution of the present invention can also be implemented by means of a device, Figure 2 As shown, the device includes: a receiving module, a message header extraction module, a message header processing rule query module, a message header processing module, a filtering mode query module, a filtering processing module, a filtering processing mode judgment module, and a sending module.

[0048] The receiving module is used to receive FC messages; The message header extraction module is used to extract message header information of the FC message; The message header processing rule query module is used to obtain the processing rule corresponding to the current message header information; The message header processing module is used to set the message header fields that are not concerned to fixed values ​​according to the processing rules to form processed message header information; The filtering mode query module is used to query the corresponding processing mode based on the processed message header information; The filtering processing module is used to process the FC message according to the processing method obtained by query; The filtering mode judgment module is used to determine whether to continue to traverse the next priority processing rule according to whether the current processing mode will cause the message to be discarded or forwarded; if the processing mode is not forwarding or discarding, continue to traverse the next priority processing rule; if the processing mode is forwarding or discarding, send the FC message to the sending module to perform corresponding forwarding or discarding; The sending module is used to execute FC message discarding, or send the FC message to complete FC message forwarding, or send the FC message when the message is deemed not to be processed.

[0049] The sending module is connected to the routing module, the switching module and the elastic cache in the FC protocol switching device. When the FC message is deemed not to be processed, the sending module transmits the FC message to one or more of the routing module, the switching module and the elastic cache.

[0050] In another embodiment, the solution of the present invention can also be implemented by configuring software for access control lists of FC protocol switching devices, such as Figure 5 shown.

[0051] The software includes a message header processing rule configuration module, a hardware configuration module, and an input and output module.

[0052] The message header processing rule configuration module is used to record processing rule information and its priority, and record the processing method corresponding to the processing rule.

[0053] The hardware configuration module is used to realize communication with the hardware and complete the writing of hardware configuration information.

[0054] The input and output modules are used to complete the communication with the upper layer protocol or the user. When the configuration software is executed, the FC protocol switching device access control method described in the above embodiment can be completed.

[0055] In addition, it should be noted that in the above embodiments, each module can be one or more hardware modules specially configured to perform the corresponding steps, or implemented by a processor configured to perform the corresponding steps, or stored in a computer-readable medium for implementation by a processor, or implemented by some combination. The devices proposed in the above embodiments or the devices involved can be implemented using a bus architecture. The bus architecture can include any number of interconnected buses and bridges, depending on the specific application and overall design constraints of the hardware.

[0056] Any process or method description in the flow chart or otherwise described herein can be understood as a module, fragment or portion of a code representing one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiment of the present scheme includes other implementations, wherein the functions may not be performed in the order shown or discussed, including performing the functions in a substantially simultaneous manner or in a reverse order according to the functions involved, which should be understood by a technician in the technical field of the embodiment of the present scheme. The processor performs the various methods and processes described above. In some embodiments, part or all of the software program can be loaded and / or installed via a memory and / or a communication interface. When the software program is loaded into the memory and executed by the processor, one or more steps in the method described above can be performed. Alternatively, in other embodiments, the processor can be configured to perform one of the above methods by any other appropriate means (e.g., by means of firmware).

[0057] The logic and / or steps represented in the flowchart or otherwise described herein may be embodied in any readable storage medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch instructions from and execute instructions on an instruction execution system, apparatus, or device), or used in conjunction with such instruction execution systems, apparatuses, or devices.

[0058] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for controlling access to FC protocol switching equipment, characterized in that: The method comprises: S1. Parse the received FC message and extract the message header information; S2. Obtain the processing rule with the highest priority that has not been traversed yet; S3, processing the message header information based on the processing rule obtained in S2 to form processed message header information; S4, performing a hash operation based on the processed message header information, using the hash operation result as the address, searching the access control list with the address as the index, and obtaining the corresponding processing method; S5. Process the FC message according to the processing method obtained in S4; S6, judging whether the processing mode in S4 is forwarding or discarding, if the processing mode is not forwarding or discarding, returning to S2 to obtain the next priority processing rule; if the processing mode is forwarding or discarding, executing the corresponding forwarding or discarding, and ending; If there is a next-level priority processing rule, continue to execute until the corresponding processing method is forwarding or discarding, and end; if the corresponding processing method is not forwarding or discarding after traversing all processing rules, do not process the FC message and end.

2. The method according to claim 1, characterized in that The processing rules at least include: the fields of interest in the message header information, the corresponding processing methods and priorities; The S3 further includes: retaining the original values ​​of the fields in the message header information concerned in the processing rule, and setting the fields in the message header information not concerned in the processing rule to fixed values.

3. The method according to claim 1, characterized in that The S3 further comprises: If the message header information does not include the VFT header, a fixed value data with the same length as the VFT header is added at the corresponding position to complete the message header information.

4. The method according to claim 1, characterized in that The S4 further comprises: After obtaining the processing method, obtaining the simulated message header stored corresponding to the processing method, and comparing the processed message header information with the simulated message header to confirm consistency; After determining the processing rule, pre-calculating and storing the simulated message header and the address; the simulated message header is associated with the address and the processing method and stored; In the processing rule, the value of the field of interest is determined.

5. The method according to claim 4, characterized in that If the processed message header information is inconsistent with the simulated message header, the corresponding message is deemed not to be processed; The message is deemed as not being processed, that is, no processing is performed on the message, and the message is transmitted to other modules of the FC protocol switching device to perform other processing except the access control method.

6. The method according to claim 1, characterized in that In S4, if there is no corresponding processing method, it is deemed that no processing is performed; The message is deemed as not being processed, that is, no processing is performed on the message, and the message is transmitted to other modules of the FC protocol switching device to perform other processing except the access control method.

7. The method according to claim 4, characterized in that The calculation method of the simulated message header is: The values ​​of the fields of interest in the message header information determined in the processing rule are retained, and the values ​​of other fields of no interest are set to fixed values; By default, all message header information includes a VFT header, and the VFT header is a field that is not of concern in the processing rules.

8. An FC protocol switching device access control device, characterized in that The device comprises: Receiving module, message header extraction module, message header processing rule query module, message header processing module, filtering mode query module, filtering processing module, filtering processing mode judgment module and sending module; The receiving module is used to receive FC messages; The message header extraction module is used to extract message header information of the FC message; The message header processing rule query module is used to obtain the processing rule corresponding to the current message header information; The message header processing module is used to set the message header fields that are not concerned to fixed values ​​according to the processing rules to form processed message header information; The filtering mode query module is used to query the corresponding processing mode based on the processed message header information; The filtering processing module is used to process the FC message according to the processing method obtained by query; The filtering mode judgment module is used to determine whether to continue to traverse the next priority processing rule according to whether the current processing mode will cause the message to be discarded or forwarded; if the processing mode is not forwarding or discarding, continue to traverse the next priority processing rule; if the processing mode is forwarding or discarding, send the FC message to the sending module to perform corresponding forwarding or discarding; The sending module is used to execute FC message discarding, or send the FC message to complete FC message forwarding, or send the FC message when the message is deemed not to be processed.

9. The device according to claim 8, characterized in that The sending module is connected to the routing module, the switching module and the elastic cache in the FC protocol switching device. When the FC message is deemed not to be processed, the sending module transmits the FC message to one or more of the routing module, the switching module and the elastic cache.

10. A computer-readable medium, characterized in that When the readable medium is read by a processor and the program therein is executed, the FC protocol switching device access control method according to any one of claims 1 to 7 is executed.

Images