Traffic shunting and forwarding method and device, electronic equipment and storage medium

Abstract

The invention provides a flow shunting and forwarding method and device, electronic equipment and a storage medium, relates to the technical field of data communication, and is applied to a shunt forwarding system. The shunt forwarding system comprises a front-end light splitting acquisition system, a shunt (an exchange forwarding unit and a service logic processing unit taking a programmable exchange chip as a bottom plate) and a rear-end service system. The method comprises the following steps: the front-end light splitting acquisition system acquires original flow data; the original flow data is accessed to the diverter through a switching chip of the diverter, and target flow data is obtained after the original flow data is processed through a switching forwarding unit or target flow data is obtained after the original flow data is processed through a service logic processing unit based on the service processing type of the original flow data; and the switching forwarding unit of the shunt forwards the target flow data to a back-end service system. According to the invention, finer convergence and shunting of the traffic screening function are realized, part of back-end processing tasks are moved forward, and the precision of traffic screening and the quality of back-end service traffic are greatly improved.

Description

Technical Field

[0001] The present application relates to the field of data communication technology, and in particular to a method, device, electronic device and storage medium for traffic diversion and forwarding. Background Art

[0002] The network splitter uses the core network's optical splitting technology to efficiently capture and aggregate network traffic, further split the traffic, and ensure that the data is smoothly transmitted to the back-end business analysis system. With the vigorous development of applications such as short videos and live broadcasts, the massive increase in traffic data has made traffic management a certain challenge. For most back-end systems, this type of video traffic data is of low value. If a large amount of this type of traffic data flows into the back-end system, it will increase system costs and affect business processing efficiency. Summary of the invention

[0003] The purpose of this application is to provide a method, device, electronic device and storage medium for traffic diversion and forwarding, so as to alleviate the above-mentioned technical problems existing in the prior art, and to realize a convergence and diversion device with more sophisticated traffic screening function through a front-end acquisition system, so as to output more valuable data for back-end processing.

[0004] In a first aspect, the present invention provides a method for traffic splitting and forwarding, the method is applied to a splitter forwarding system, the splitter forwarding system includes a front-end optical splitting collection system, a splitter and a back-end business system, wherein the splitter includes a switching forwarding unit and a business logic processing unit with a programmable switching chip as a baseboard;

[0005] Methods include:

[0006] The front-end spectroscopic collection system collects raw traffic data;

[0007] The original traffic data is connected to the splitter through the switching chip of the splitter, and the target traffic data is obtained by processing through the switching forwarding unit or the business logic processing unit based on the service processing type of the original traffic data;

[0008] The switching forwarding unit of the splitter forwards the target traffic data to the backend business system.

[0009] In an optional implementation, based on the service processing type of the original traffic data, selecting to obtain the target traffic data after processing by a switching forwarding unit or obtaining the target traffic data after processing by a service logic processing unit includes:

[0010] Determine whether the service processing type of the original traffic data is traffic aggregation or traffic balancing output;

[0011] If yes, the original traffic data is processed by the switching and forwarding unit to obtain the target traffic data;

[0012] If not, the original traffic data is processed by the service logic processing unit and the switching forwarding unit to obtain the target traffic data.

[0013] In an optional implementation, the service logic processing unit includes a first service logic processing unit; and obtaining target traffic data after the service logic processing unit and the switching forwarding unit process the original traffic data includes:

[0014] Performing business matching of flow locking rules on the original traffic data through the first business logic processing unit;

[0015] Determine whether the original traffic data matches the flow locking rule;

[0016] If the flow locking rule is matched, the original message corresponding to the original traffic data is processed according to the first processing action specified by the flow locking rule, and the target message obtained after the processing is transmitted to the back-end business system through the switching forwarding unit;

[0017] If the flow locking rule is not matched, the next four layers of business rules are matched. If the message hits the next four layers of business rules, the original message is processed according to the second processing action specified by the next four layers of business rules, and the target message obtained after processing is output to the back-end business system through the switching forwarding unit.

[0018] In an optional implementation, the business logic processing unit includes further including a second business logic processing unit;

[0019] The method also includes:

[0020] If the original traffic data does not match the lower four layer service rules, the original message will be marked and forwarded to the switching forwarding unit;

[0021] After parsing the marking information, the switching and forwarding unit transmits the original traffic data to the second service logic processing unit according to the marking information, and the second service logic processing unit processes the original traffic data.

[0022] In an optional implementation manner, processing the original traffic data by the second service logic processing unit includes:

[0023] Performing deep message analysis on the original message corresponding to the original traffic data through the second business logic processing unit, and matching application layer analysis rules according to the message analysis content;

[0024] If the original message hits the application layer analysis rule, the original message is processed according to the third processing action specified by the application layer analysis rule, and the target message obtained after processing is sent to the switching forwarding unit to be output to the back-end business system, and at the same time, the second business logic processing unit extracts the lower four layers of information from the original message that hits the rule;

[0025] The message encapsulation of the flow-locked reflective private message is performed based on the private message header, the lower four layer information, and the third processing action, and the flow-locked reflective private message is sent to the switching and forwarding unit.

[0026] In an optional implementation, the lower four layers of information include quintuple information.

[0027] In an optional embodiment, the method further comprises:

[0028] After the switching and forwarding unit identifies the flow-locked reflective private message, it forwards the message to the next four-layer service processing unit;

[0029] After parsing the flow locking reflection private message, the lower four-layer service processing unit converts the parsed content into the lower four-layer rules of the flow locking function and sends them to the first service logic processing unit;

[0030] If a message hits the flow locking rule later, it is directly forwarded and output without passing through the second business logic processing unit.

[0031] In a second aspect, the present invention provides a device for traffic splitting and forwarding, the device is applied to a splitter forwarding system, the splitter forwarding system includes a front-end optical splitting collection system, a splitter and a back-end business system, wherein the splitter includes a switching forwarding unit and a business logic processing unit with a programmable switching chip as a baseboard;

[0032] The device includes:

[0033] The acquisition module is used for the front-end spectroscopic acquisition system to collect raw flow data;

[0034] A processing module, used to connect the original traffic data to the splitter through the switching chip of the splitter, and select to obtain the target traffic data after processing through the switching forwarding unit or the business logic processing unit based on the service processing type of the original traffic data;

[0035] The forwarding module is used for the switching forwarding unit of the splitter to forward the target traffic data to the back-end business system.

[0036] In a third aspect, the present invention provides an electronic device including a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the method of traffic diversion and forwarding of any of the aforementioned implementations.

[0037] In a fourth aspect, the present invention provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the method of traffic diversion and forwarding of any one of the aforementioned implementation modes.

[0038] The method, device, electronic device, and storage medium provided by the present application have the following beneficial effects:

[0039] By improving the function of the network splitter and integrating an advanced business logic processing unit, that is, the splitter includes a switching forwarding unit and a business logic processing unit based on a programmable switching chip, traffic filtering for services above the L4 layer is achieved, thereby moving some back-end processing tasks forward, greatly improving the accuracy of traffic screening and the quality of back-end business traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 A schematic diagram of the structure of a splitter forwarding system provided in an embodiment of the present application;

[0042] Figure 2 A flow chart of a method for traffic diversion and forwarding provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of the structure of a flow divider provided in an embodiment of the present application;

[0044] Figure 4 A schematic diagram of a flow-locked private message format provided in an embodiment of the present application;

[0045] Figure 5 A structural diagram of a device for traffic splitting and forwarding provided in an embodiment of the present application;

[0046] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0048] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0049] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0050] In the field of network data collection and analysis, network splitters play a vital role. They use the core network's optical splitting technology to efficiently capture and aggregate network traffic, further split it, and ensure that data is smoothly transmitted to the back-end business analysis system. This process plays a decisive role in performing core tasks such as network intrusion detection and network detection analysis.

[0051] In recent years, the booming development of applications such as short videos and live broadcasts has made streaming media technology the main driving force behind the surge in Internet traffic. It enables real-time transmission of audio and video content, greatly improving the user's online experience. However, this also poses severe challenges to network traffic management. Video content dominates Internet traffic, and for most back-end systems, the value of this type of video traffic is relatively low. If it is allowed to flow into the back-end, it will increase system costs and affect business processing efficiency. Therefore, the front-end acquisition system faces higher requirements and urgently needs aggregation and diversion equipment with more sophisticated traffic screening functions to output more valuable data for back-end processing.

[0052] In addition, with the innovation of advanced logic processing chips and programmable switching chips, the pre-processing of some back-end services has become more feasible, providing new solutions for traffic management. Advanced logic processing chips refer to devices that can implement traffic analysis, processing and forwarding through software. These include network processors (NPs), field programmable gate arrays (FPGAs), multi-core MIPS processors or central processing units (CPUs). Of course, any device with software-customizable traffic management functions can be classified into this category.

[0053] Based on this, the embodiments of the present application provide a method, device, electronic device and storage medium for traffic diversion and forwarding, which can realize a more sophisticated traffic filtering function of the diverter by configuring advanced logical processors with different business processing capabilities, and at the same time use flow-locked private messages to complete rule reflection, thereby realizing traffic acceleration of the application layer business logic processing unit and improving the processing performance of the entire system.

[0054] An embodiment of the present application provides a method for traffic diversion and forwarding, which is applied to a diverter forwarding system, wherein the diverter forwarding system includes a front-end optical splitting acquisition system, a diverter and a back-end business system, wherein the diverter includes a switching forwarding unit and a business logic processing unit based on a programmable switching chip.

[0055] For ease of understanding, a schematic diagram of the structure of a splitter forwarding system is provided, see Figure 1 As shown, the front-end optical splitter collection system connects the original traffic to the diversion system through the port of the switching chip. The diverter is mainly composed of a switching chip responsible for forwarding traffic within the system (that is, the aforementioned switching forwarding unit with a programmable switching chip as the baseboard), a TypeA business logic chip responsible for processing the lower four layers of business, and a TypeB business logic chip responsible for processing the application layer business (that is, the aforementioned business logic processing unit). The data collected by the front-end optical splitter collection system is connected to the diversion system through the switching chip of the diverter. After the traffic is processed by different business chips, the filtered traffic is forwarded to the back-end business system.

[0056] Applied to the above-mentioned shunt system, see Figure 2 As shown, the method for traffic splitting and forwarding provided in the embodiment of the present application mainly includes the following steps:

[0057] Step S110: the front-end spectroscopic collection system collects raw flow data.

[0058] Step S120, the original traffic data is connected to the splitter through the switching chip of the splitter, and based on the service processing type of the original traffic data, the target traffic data is obtained by processing through the switching forwarding unit or the service logic processing unit.

[0059] Step S130: the switching forwarding unit of the splitter forwards the target traffic data to the backend service system.

[0060] For ease of understanding, the specific implementation methods of the main improvements of the present application are described in detail below.

[0061] In order to filter and classify the original traffic data, some simple traffic processing is directly processed and forwarded, and other traffic processing is performed corresponding business processing, thereby improving the efficiency of traffic processing. In one embodiment, the above-mentioned business processing type based on the original traffic data is selected to obtain the target traffic data after processing by the switching forwarding unit or the target traffic data after processing by the business logic processing unit. In the specific implementation, the following steps 1 to 3 may be included:

[0062] Step 1, determine whether the service processing type of the original traffic data is traffic aggregation or traffic balancing output, if yes, execute step 2, if no, execute step 3;

[0063] Step 2, the original traffic data is processed by the switching and forwarding unit to obtain the target traffic data;

[0064] Step 3: The original traffic data is processed by the service logic processing unit and the switching forwarding unit to obtain the target traffic data.

[0065] In practical applications, the business logic processing unit may include a first business logic processing unit and a second business logic processing unit. In more detail, the first business logic processing unit may be a TypeA business logic chip responsible for the lower four-layer business processing (also referred to as the lower four-layer business processing unit), and the second business logic processing unit may be a TypeB business logic chip responsible for the application layer business processing (also referred to as the application layer business processing unit). On this basis, the structural diagram of the above-mentioned splitter can also be seen in Figure 3 shown.

[0066] Applied to the specific structure of the above splitter, in one implementation, the above step 3, i.e., obtaining the target traffic data after the original traffic data is processed by the service logic processing unit and the switching forwarding unit, may further include the following steps 3.1 to 3.4:

[0067] Step 3.1, the first business logic processing unit performs business matching of the flow locking rule on the original traffic data; the flow locking rule specifically refers to the lower four-layer business rules generated by the second business logic processing unit through flow locking reflection private messages, which are mainly distinguished from the ordinary lower four-layer business rules here because their priority is higher than that of the ordinary lower four-layer business rules.

[0068] Step 3.2, determine whether the original traffic data matches the flow locking rule. If it matches the flow locking rule, execute step 3.3; if it does not match the flow locking rule, execute step 3.4.

[0069] Step 3.3, process the original message corresponding to the original traffic data according to the first processing action specified by the flow locking rule, and transmit the target message obtained after processing to the back-end business system through the switching forwarding unit; the first processing action may include direct forwarding / discarding / message modification (stripping tunnel messages, message headers), etc.

[0070] Step 3.4, if the flow locking rule is not matched, the lower four-layer business rule matching is performed. If the message hits the lower four-layer business rule, the original message is processed according to the second processing action specified by the lower four-layer business rule, and the target message obtained after processing is output to the back-end business system through the switching forwarding unit. The second processing action may include direct forwarding / discarding / message modification (stripping tunnel messages, message headers), etc. The lower four-layer business rules mainly refer to the rule matching below the transport layer in the OSI model, including source and destination IP, protocol number, source and destination port number, etc.

[0071] Furthermore, if the original traffic data does not hit the lower four layers of business rules, the original message will be marked and forwarded to the switching forwarding unit; after the switching forwarding unit parses the marking information, the original traffic data will be transmitted to the second business logic processing unit according to the marking information, and the original traffic data will be processed by the second business logic processing unit.

[0072] In practical applications, in order to quickly, efficiently and intuitively obtain the flow of original traffic during processing, the original messages corresponding to the original traffic data can be marked, thereby facilitating business processing and improving processing efficiency.

[0073] Optionally, in actual applications, messages of different flow directions may be marked accordingly, or only one or several of them may be marked for distinction, or no marking may be performed (try not to choose this method). You can make the corresponding selection according to the actual business situation, and no specific scenario is limited here.

[0074] In one implementation, after the original traffic data is transmitted to the second service logic processing unit, the second service logic processing unit processes the original traffic data, which may further include steps A to C:

[0075] Step A, deep message parsing is performed on the original message corresponding to the original traffic data by the second business logic processing unit, and application layer analysis rule matching is performed according to the message parsing content; application layer analysis rule usually refers to deep analysis of the application layer of the message, extracting characteristic character strings in the message for matching or identifying and matching the application layer load information and data flow information. Here, part of the DPI service is pre-placed to the diverter to achieve this.

[0076] Step B, if the original message hits the application layer analysis rule, the original message is processed according to the third processing action specified by the application layer analysis rule, and the target message obtained after processing is sent to the switching forwarding unit to output to the back-end business system, and at the same time, the second business logic processing unit extracts the lower four layers of information from the original message that hits the rule. Optionally, the lower four layers of information may include five-tuple information. The third processing action may include direct forwarding / discarding / message modification (stripping tunnel messages, message headers), etc.

[0077] Step C, based on the private message header, the lower four layer information, and the third processing action, the message encapsulation of the flow locking reflection private message is performed, and the flow locking reflection private message is sent to the switching forwarding unit. For the format of the flow locking private message, see Figure 4 shown.

[0078] Further, the method of sending the flow lock reflection private message to the switching forwarding unit also includes steps D to F:

[0079] Step D, after the switching forwarding unit identifies the flow-locked reflective private message, it forwards the message to the next four-layer service processing unit;

[0080] Step E, after the lower four-layer service processing unit parses the flow locking reflection private message, it converts the parsed content into the lower four-layer rules of the flow locking function and sends them to the first service logic processing unit;

[0081] Step F: If a message subsequently hits the flow locking rule, it is directly forwarded and output without passing through the second business logic processing unit.

[0082] Finally, the switching and forwarding unit is responsible for forwarding the messages that hit the basic convergence and diversion services, the messages that hit the rules of the lower four layers of services, and the messages that hit the rules of the application layer to the backend business system.

[0083] In summary, the embodiment of the present application improves the function of the network splitter and integrates an advanced logic processing unit to filter the traffic of services above the L4 layer, thereby moving some back-end processing tasks forward, greatly improving the accuracy of traffic screening and the quality of back-end service traffic. In addition, the present invention also introduces an innovative method that uses flow-locked private messages to achieve rule reflection and complete the accelerated processing of traffic, thereby further improving system performance.

[0084] Based on the above method embodiment, the embodiment of the present application also provides a device for traffic splitting and forwarding, which is applied to a splitter forwarding system, and the splitter forwarding system includes a front-end optical splitting collection system, a splitter and a back-end business system, wherein the splitter includes a switching forwarding unit and a business logic processing unit with a programmable switching chip as the baseboard;

[0085] See also Figure 5As shown, the device mainly includes the following parts:

[0086] The collection module 510 is used for collecting raw flow data by the front-end optical spectrometry collection system;

[0087] The processing module 520 is used to connect the original traffic data to the splitter through the switching chip of the splitter, and select to obtain the target traffic data after processing through the switching forwarding unit or the target traffic data after processing through the business logic processing unit based on the service processing type of the original traffic data;

[0088] The forwarding module 530 is used for the switching forwarding unit of the splitter to forward the target traffic data to the backend service system.

[0089] In a feasible implementation manner, the processing module 520 is further used to:

[0090] Determine whether the service processing type of the original traffic data is traffic aggregation or traffic balancing output;

[0091] If yes, the original traffic data is processed by the switching and forwarding unit to obtain the target traffic data;

[0092] If not, the original traffic data is processed by the service logic processing unit and the switching forwarding unit to obtain the target traffic data.

[0093] In a feasible implementation manner, the business logic processing unit includes a first business logic processing unit; the processing module 520 is further used to:

[0094] Performing business matching of flow locking rules on the original traffic data through the first business logic processing unit;

[0095] Determine whether the original traffic data matches the flow locking rule;

[0096] If the flow locking rule is matched, the original message corresponding to the original traffic data is processed according to the first processing action specified by the flow locking rule, and the target message obtained after the processing is transmitted to the back-end business system through the switching forwarding unit;

[0097] If the flow locking rule is not matched, the next four layers of business rules are matched. If the message hits the next four layers of business rules, the original message is processed according to the second processing action specified by the next four layers of business rules, and the target message obtained after processing is output to the back-end business system through the switching forwarding unit.

[0098] In a feasible implementation manner, the business logic processing unit further includes a second business logic processing unit;

[0099] The above device also includes a second processing module, which is used to:

[0100] If the original traffic data does not match the lower four layer service rules, the original message will be marked and forwarded to the switching forwarding unit;

[0101] After parsing the marking information, the switching and forwarding unit transmits the original traffic data to the second service logic processing unit according to the marking information, and the second service logic processing unit processes the original traffic data.

[0102] In a feasible implementation manner, the second processing module is further used for:

[0103] Performing deep message analysis on the original message corresponding to the original traffic data through the second business logic processing unit, and matching application layer analysis rules according to the message analysis content;

[0104] If the original message hits the application layer analysis rule, the original message is processed according to the third processing action specified by the application layer analysis rule, and the target message obtained after processing is sent to the switching forwarding unit to be output to the back-end business system, and at the same time, the second business logic processing unit extracts the lower four layers of information from the original message that hits the rule;

[0105] The message encapsulation of the flow-locked reflective private message is performed based on the private message header, the lower four layer information, and the third processing action, and the flow-locked reflective private message is sent to the switching and forwarding unit.

[0106] In a feasible implementation manner, the lower four layers of information include five-tuple information.

[0107] In a feasible implementation manner, the above device further includes: a flow locking rule reflection module, which is used to:

[0108] After the switching and forwarding unit identifies the flow-locked reflective private message, it forwards the message to the next four-layer service processing unit;

[0109] After parsing the flow locking reflection private message, the lower four-layer service processing unit converts the parsed content into the lower four-layer rules of the flow locking function and sends them to the first service logic processing unit;

[0110] If a message hits the flow locking rule later, it is directly forwarded and output without passing through the second business logic processing unit.

[0111] The device for traffic diversion and forwarding provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for parts not mentioned in the embodiment of the device for traffic diversion and forwarding, reference may be made to the corresponding contents in the aforementioned method embodiment of traffic diversion and forwarding.

[0112] The present application also provides an electronic device, such as Figure 6As shown, it is a schematic diagram of the structure of the electronic device, wherein the electronic device 100 includes a processor 61 and a memory 60, the memory 60 stores computer executable instructions that can be executed by the processor 61, and the processor 61 executes the computer executable instructions to implement any of the above-mentioned traffic diversion and forwarding methods.

[0113] exist Figure 6 In the illustrated embodiment, the electronic device further includes a bus 62 and a communication interface 63 , wherein the processor 61 , the communication interface 63 and the memory 60 are connected via the bus 62 .

[0114] Among them, the memory 60 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 63 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. The bus 62 can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 62 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0115] The processor 61 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 61. The above processor 61 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor 61 reads the information in the memory and completes the steps of the traffic splitting and forwarding method of the aforementioned embodiment in combination with its hardware.

[0116] An embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the above-mentioned traffic diversion and forwarding method. The specific implementation can be found in the aforementioned method embodiment, which will not be repeated here.

[0117] The computer program products of the traffic diversion and forwarding methods, devices, electronic devices, and storage media provided in the embodiments of the present application include computer-readable storage media storing program codes. The instructions included in the program codes can be used to execute the methods in the previous method embodiments. For specific implementations, please refer to the method embodiments, which will not be repeated here.

[0118] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0119] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0120] In the description of the present application, it should be noted that the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for traffic diversion and forwarding, characterized in that: The method is applied to a splitter forwarding system, which includes a front-end optical splitting collection system, a splitter and a back-end business system, wherein the splitter includes a switching forwarding unit and a business logic processing unit with a programmable switching chip as a baseboard; The method comprises: The front-end spectroscopic collection system collects raw flow data; The original traffic data is connected to the splitter through the switching chip of the splitter, and the target traffic data is obtained by processing through the switching forwarding unit or the target traffic data is obtained by processing through the service logic processing unit based on the service processing type of the original traffic data; The switching forwarding unit of the splitter forwards the target traffic data to a backend service system.

2. The method for traffic splitting and forwarding according to claim 1, characterized in that: Selecting, based on the service processing type of the original traffic data, to obtain target traffic data after processing by the switching forwarding unit or to obtain target traffic data after processing by the service logic processing unit includes: Determine whether the service processing type of the original traffic data is traffic aggregation or traffic balancing output; If yes, the original flow data is processed by the switching and forwarding unit to obtain the target flow data; If not, the original traffic data is processed by the service logic processing unit and the switching and forwarding unit to obtain the target traffic data.

3. The method for traffic splitting and forwarding according to claim 2, characterized in that: The service logic processing unit includes a first service logic processing unit; the target traffic data is obtained after the original traffic data is processed by the service logic processing unit and the switching forwarding unit, including: Performing business matching of flow locking rules on the original traffic data by the first business logic processing unit; Determining whether the original traffic data matches a flow locking rule; If the flow locking rule is matched, the original message corresponding to the original traffic data is processed according to the first processing action specified by the flow locking rule, and the target message obtained after the processing is transmitted to the back-end business system through the switching forwarding unit; If the flow locking rule is not matched, the lower four layers of business rules are matched. If the message hits the lower four layers of business rules, the original message is processed according to the second processing action specified by the lower four layers of business rules, and the target message obtained after processing is output to the back-end business system through the switching forwarding unit.

4. The method for traffic splitting and forwarding according to claim 3, characterized in that: The business logic processing unit also includes a second business logic processing unit; The method further comprises: If the original traffic data does not match the lower four-layer service rules, the original message is marked and then forwarded to the switching forwarding unit; After parsing the marking information, the switching and forwarding unit transmits the original traffic data to the second service logic processing unit according to the marking information, and the second service logic processing unit processes the original traffic data.

5. The method for traffic splitting and forwarding according to claim 4, characterized in that: Processing the original traffic data by the second service logic processing unit includes: Performing deep message parsing on the original message corresponding to the original traffic data through the second business logic processing unit, and matching application layer analysis rules according to the message parsing content; If the original message hits the application layer analysis rule, the original message is processed according to the third processing action specified by the application layer analysis rule, and the target message obtained after processing is sent to the switching forwarding unit to be output to the back-end business system, and at the same time, the second business logic processing unit extracts the lower four layers of information from the original message that hits the rule; The message encapsulation of the flow-locked reflective private message is performed based on the private message header, the lower four layer information, and the third processing action, and the flow-locked reflective private message is sent to the switching and forwarding unit.

6. The method for traffic splitting and forwarding according to claim 5, characterized in that: The lower four layers of information include five-tuple information.

7. The method for traffic splitting and forwarding according to claim 6, characterized in that: The method further comprises: After the switching and forwarding unit identifies the flow-locked reflective private message, it forwards the message to the next four-layer service processing unit; After parsing the flow locking reflection private message, the lower four-layer service processing unit converts the parsed content into the lower four-layer rules of the flow locking function and sends them to the first service logic processing unit; If a message subsequently hits the flow locking rule, it is directly forwarded and output without passing through the second business logic processing unit.

8. A device for traffic diversion and forwarding, characterized in that: The device is applied to a splitter forwarding system, which includes a front-end optical splitting collection system, a splitter and a back-end service system, wherein the splitter includes a switching forwarding unit and a service logic processing unit with a programmable switching chip as a baseboard; The device comprises: A collection module, used for the front-end spectroscopic collection system to collect raw flow data; A processing module, used for connecting the original traffic data to the splitter through the switching chip of the splitter, and selecting, based on the service processing type of the original traffic data, to obtain the target traffic data after processing by the switching forwarding unit or by the service logic processing unit; A forwarding module is used for the switching forwarding unit of the splitter to forward the target traffic data to a backend business system.

9. An electronic device, characterized in that: It includes a processor and a memory, the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the method for traffic diversion and forwarding as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by the processor, the computer-executable instructions prompt the processor to implement the method for traffic diversion and forwarding as described in any one of claims 1 to 7.

Images