URPF checking method, device and equipment based on QoS flow priority and medium

Abstract

The embodiment of the invention discloses a URPF checking method and device based on QoS flow priority, equipment and a medium. The method comprises the steps that flow is divided into multiple priorities according to a QoS mechanism; configuring a plurality of loopback interfaces to redirect traffic to each loopback interface and enable or disable URPF check in each loopback interface; after the specified flow is received, redirecting the specified flow to a specified loopback interface according to the priority corresponding to the specified flow; when the specified loopback interface starts the URPF check, performing the URPF check through the specified loopback interface and forwarding the specified traffic; and when the URPF check is forbidden by the specified loopback interface, forwarding the specified flow through the specified loopback interface.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a URPF inspection method, device, equipment and medium based on QoS traffic priority. Background Art

[0002] URPF (Unicast Reverse Path Forwarding) is a network security technology designed to prevent IP address forgery attacks. It works by verifying whether the source IP address of a data packet matches the interface through which the packet arrives at the router. This check ensures that the path of the packet is valid, that is, the packet is indeed sent from the source address it claims, and is not maliciously tampered with. URPF checks are usually implemented in routers or firewalls in the network to enhance the security of the network. During the URPF check process, the source IP address of the packet is compared with the reverse path of its arrival interface (that is, the path that the packet should theoretically return). If there is a match, the packet is considered credible and allowed to pass; if there is a mismatch, the packet may be discarded to prevent potential forgery attacks.

[0003] In the existing URPF inspection process, the priority information of QoS (Quality of Service) traffic is usually not fully considered because system resources are allocated to the inspection of all traffic, which may cause processing delays for high-priority traffic, thereby affecting the transmission quality and user experience of these traffic. Summary of the invention

[0004] One or more embodiments of the present specification provide a URPF inspection method, apparatus, device and medium based on QoS traffic priority, which are used to solve the technical problems raised by the background technology.

[0005] One or more embodiments of this specification adopt the following technical solutions:

[0006] One or more embodiments of this specification provide a URPF inspection method based on QoS traffic priority, the method comprising:

[0007] Divide traffic into multiple priorities based on QoS mechanism;

[0008] Configuring multiple loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface;

[0009] After receiving the specified traffic, redirecting the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic;

[0010] When the designated loopback interface enables URPF check, performing URPF check through the designated loopback interface and forwarding the designated traffic;

[0011] When the URPF check is disabled on the designated loopback interface, the designated traffic is forwarded through the designated loopback interface.

[0012] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0013] Improve the processing efficiency of high-priority traffic: By dividing traffic into multiple priorities according to the QoS mechanism, the system can give priority to high-priority traffic. This approach ensures that high-priority traffic (such as voice or video calls) can pass the URPF check faster, reducing processing delays, thereby improving the transmission quality of these flows.

[0014] Improved user experience: As high-priority traffic is processed faster, the user experience is significantly improved. For real-time applications, such as video conferencing or online gaming, reduced latency can significantly improve the fluidity and responsiveness of interactions.

[0015] Optimize system resource allocation: By configuring multiple loopback interfaces and enabling or disabling URPF inspection, the system can dynamically allocate resources based on the priority of traffic. This means that the system can focus on performing URPF inspection on traffic with higher security requirements, while traffic with lower security requirements can skip or reduce inspection, thereby improving overall resource utilization.

[0016] Furthermore, the multiple priorities include a first priority and a second priority, the first priority has a higher priority than the second priority; the first priority corresponds to a loopback interface with URPF check disabled, and the second priority corresponds to a loopback interface with URPF check enabled.

[0017] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0018] Fast forwarding of high-priority traffic: Mapping the first-priority (higher priority) traffic to the loopback interface with URPF check disabled ensures that the traffic is quickly forwarded without URPF check, thereby reducing latency and improving the transmission efficiency of critical business traffic.

[0019] Second-priority traffic security check: The second-priority traffic corresponds to the loopback interface with URPF check enabled, which means that these traffic will be security checked before forwarding, which helps prevent IP address forgery attacks and enhance network security.

[0020] Further, the URPF check includes a plurality of URPF modes, the second priority includes a plurality of sub-priorities, and the plurality of sub-priorities correspond to corresponding URPF modes respectively;

[0021] Performing a URPF check through the designated loopback interface and forwarding the designated traffic includes:

[0022] Determine a designated sub-priority corresponding to the designated traffic, and determine a designated URPF mode corresponding to the designated sub-priority;

[0023] The designated URPF mode is checked through the designated loopback interface, and the designated traffic is forwarded.

[0024] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0025] Flexible security policies: By assigning different URPF modes to different sub-priorities, network administrators can implement more refined security policies and select appropriate URPF inspection methods based on the security requirements of different traffic.

[0026] Optimize resource allocation: For traffic with lower security risks, a more relaxed URPF mode can be used to reduce the computing resources required for inspection. For high-risk traffic, a stricter mode can be used to ensure security.

[0027] Improve processing efficiency: By assigning a specific URPF mode to each sub-priority level, the system can optimize processing for different traffic types and improve overall network processing efficiency.

[0028] Enhanced network performance: For high-priority traffic, selecting the Fast URPF mode can reduce latency and ensure the performance of critical business applications, such as real-time video calls or transactional data transmission.

[0029] Furthermore, the traffic is divided into multiple priorities according to the QoS mechanism, including:

[0030] According to the QoS mechanism, traffic with a delay requirement higher than a preset value is set as the first priority, and traffic with a delay requirement not higher than the preset value is set as the second priority.

[0031] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0032] Prioritize critical applications: Set traffic with latency requirements higher than a preset value as the first priority, ensuring that these traffic (such as real-time video conferencing, online games or financial services) are given priority, thereby reducing latency and improving user experience.

[0033] Optimize network resource allocation: By prioritizing traffic through QoS mechanisms, network administrators can allocate network resources more efficiently and ensure that latency-sensitive applications receive sufficient bandwidth and priority.

[0034] Further, before performing the URPF check through the designated loopback interface, the method further includes:

[0035] Get the network load ratio;

[0036] Performing a comprehensive URPF check when the network load ratio is lower than a preset ratio;

[0037] When the network load ratio is not lower than a preset ratio, a URPF check is performed on specific traffic.

[0038] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0039] Optimized resource utilization: By obtaining the network load ratio, you can decide whether to perform a comprehensive URPF check based on the current network load. When the network load is low, a comprehensive check can ensure network security, while when the load is high, the check frequency can be reduced to optimize resource utilization.

[0040] Reduce unnecessary inspections: When the network load ratio is lower than the preset ratio, comprehensive URPF inspection can more effectively detect and prevent IP address spoofing attacks. When the network load is high, only checking specific traffic can reduce unnecessary use of network processing capacity.

[0041] Further, when the designated loopback interface disables URPF check, forwarding the designated traffic through the designated loopback interface includes:

[0042] When the designated loopback interface disables URPF checking, obtaining a pre-stored source IP address list;

[0043] If the source IP address of the designated traffic is in the source IP address list, the designated traffic is forwarded through the designated loopback interface.

[0044] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0045] Enhanced network security: By checking the pre-stored source IP address list, it can ensure that only those known and trusted IP addresses can forward traffic through the specified loopback interface, thereby increasing the security of the network.

[0046] Simplified IP address verification: Since URPF checks usually require verifying whether the source IP address is in the local routing table, disabling URPF and using a source IP address list instead can simplify the verification process and reduce the complexity of the routing table.

[0047] Furthermore, the method further comprises:

[0048] Deploy traffic monitoring nodes in the network to collect traffic data in real time, including bandwidth usage, latency, and packet loss rate;

[0049] Building a traffic feature database based on the traffic data;

[0050] Based on the traffic data, a supervised learning algorithm is used to train a traffic prediction model, wherein the traffic prediction model predicts future traffic changes based on historical traffic patterns and real-time network conditions;

[0051] Obtaining a pre-written dynamic priority adjustment algorithm, wherein the dynamic priority adjustment algorithm dynamically adjusts the priority based on changes in traffic;

[0052] The future traffic changes predicted by the traffic prediction model are input into the dynamic priority adjustment algorithm to adjust the priority of the traffic in real time.

[0053] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0054] Improve prediction accuracy: Using supervised learning algorithms to train traffic prediction models can more accurately predict future traffic changes based on historical traffic patterns and real-time network conditions, reducing unnecessary network congestion.

[0055] Dynamic resource allocation: The traffic prediction model is used to predict future traffic changes. The network can dynamically allocate network resources based on the prediction results to optimize network performance.

[0056] Reduce network congestion: Real-time adjustment of traffic priority can ensure that business-critical or high-priority traffic gets more bandwidth and resources when needed, thereby reducing network congestion.

[0057] Improve network efficiency: The dynamic priority adjustment algorithm can adjust the priority in real time according to the changes in traffic, improving the overall work efficiency of the network.

[0058] One or more embodiments of this specification provide a URPF inspection device based on QoS traffic priority, including:

[0059] Traffic division unit, which divides traffic into multiple priorities according to the QoS mechanism;

[0060] An interface configuration unit, configuring a plurality of loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface;

[0061] A redirection unit, after receiving the specified traffic, redirects the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic;

[0062] A first forwarding unit, when the URPF check is enabled on the designated loopback interface, performs a URPF check through the designated loopback interface and forwards the designated traffic;

[0063] The second forwarding unit forwards the designated traffic through the designated loopback interface when the URPF check is disabled on the designated loopback interface.

[0064] One or more embodiments of this specification provide a URPF inspection device based on QoS traffic priority, including:

[0065] at least one processor; and,

[0066] a memory communicatively connected to the at least one processor; wherein,

[0067] The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0068] Divide traffic into multiple priorities based on QoS mechanism;

[0069] Configuring multiple loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface;

[0070] After receiving the specified traffic, redirecting the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic;

[0071] When the designated loopback interface enables URPF check, performing URPF check through the designated loopback interface and forwarding the designated traffic;

[0072] When the URPF check is disabled on the designated loopback interface, the designated traffic is forwarded through the designated loopback interface.

[0073] One or more embodiments of this specification provide a non-volatile computer storage medium storing computer executable instructions, which can achieve the following when executed by a computer:

[0074] Divide traffic into multiple priorities based on QoS mechanism;

[0075] Configuring multiple loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface;

[0076] After receiving the specified traffic, redirecting the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic;

[0077] When the designated loopback interface enables URPF check, performing URPF check through the designated loopback interface and forwarding the designated traffic;

[0078] When the URPF check is disabled on the designated loopback interface, the designated traffic is forwarded through the designated loopback interface.

[0079] At least one of the above technical solutions adopted in the embodiments of this specification can achieve the following beneficial effects:

[0080] Improve the processing efficiency of high-priority traffic: By dividing traffic into multiple priorities according to the QoS mechanism, the system can give priority to high-priority traffic. This approach ensures that high-priority traffic (such as voice or video calls) can pass the URPF check faster, reducing processing delays, thereby improving the transmission quality of these flows.

[0081] Improved user experience: As high-priority traffic is processed faster, the user experience is significantly improved. For real-time applications, such as video conferencing or online gaming, reduced latency can significantly improve the fluidity and responsiveness of interactions.

[0082] Optimize system resource allocation: By configuring multiple loopback interfaces and enabling or disabling URPF inspection, the system can dynamically allocate resources based on the priority of traffic. This means that the system can focus on performing URPF inspection on traffic with higher security requirements, while traffic with lower security requirements can skip or reduce inspection, thereby improving overall resource utilization. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0084] Figure 1 A flowchart of a URPF inspection method based on QoS traffic priority provided by one or more embodiments of this specification;

[0085] Figure 2A schematic diagram of the structure of a URPF inspection device based on QoS traffic priority provided in one or more embodiments of this specification;

[0086] Figure 3 A schematic diagram of the structure of a URPF inspection device based on QoS traffic priority provided in one or more embodiments of this specification. DETAILED DESCRIPTION

[0087] The embodiments of this specification provide a URPF checking method, apparatus, device and medium based on QoS traffic priority.

[0088] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0089] Figure 1 A flowchart of a URPF inspection method based on QoS traffic priority provided by one or more embodiments of this specification is provided, and the process can be executed by a switch. Certain input parameters or intermediate results in the process allow manual intervention and adjustment to help improve accuracy.

[0090] The method steps of the embodiment of this specification are as follows:

[0091] S101, dividing traffic into multiple priorities according to a QoS mechanism.

[0092] In the embodiments of this specification, the switch can use the QoS mechanism to divide the traffic into several priorities (first priority, second priority) according to the priority level, and the number of priorities can be set according to actual conditions.

[0093] S102, configuring multiple loopback interfaces to redirect traffic to each loopback interface and enable or disable URPF check in each loopback interface.

[0094] In the embodiment of the present specification, the switch can be configured with several loopback interfaces for traffic redirection and enabling or disabling URPF-related functions, that is, enabling or disabling URPF check. For example, the traffic corresponding to the first priority is redirected to the loopback interface with URPF check disabled, and the traffic corresponding to the second priority is redirected to the loopback interface with URPF check enabled.

[0095] S103: After receiving the designated traffic, redirect the designated traffic to a designated loopback interface according to a priority corresponding to the designated traffic.

[0096] In the embodiment of the present specification, after obtaining the designated traffic from the port, the switch first determines the priority of the designated traffic, and redirects the designated traffic to the loopback interface designated by the device according to the priority.

[0097] S104: When the designated loopback interface enables URPF check, perform URPF check through the designated loopback interface and forward the designated traffic.

[0098] S105: When the designated loopback interface disables URPF check, forward the designated traffic through the designated loopback interface.

[0099] In the embodiment of the present specification, the plurality of priorities include a first priority and a second priority, the priority of the first priority is greater than the second priority; the first priority corresponds to a loopback interface with URPF check disabled, and the second priority corresponds to a loopback interface with URPF check enabled. That is, according to the QoS mechanism, the traffic with a delay requirement higher than a preset value is set as the first priority, and the traffic with a delay requirement not higher than a preset value is set as the second priority.

[0100] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0101] Fast forwarding of high-priority traffic: Mapping the first-priority (higher priority) traffic to the loopback interface with URPF check disabled ensures that the traffic is quickly forwarded without URPF check, thereby reducing latency and improving the transmission efficiency of critical business traffic.

[0102] Second-priority traffic security check: The second-priority traffic corresponds to the loopback interface with URPF check enabled, which means that these traffic will be security checked before forwarding, which helps prevent IP address forgery attacks and enhance network security.

[0103] Furthermore, the URPF check includes multiple URPF modes, the second priority includes multiple sub-priorities, and the multiple sub-priorities correspond to corresponding URPF modes respectively; when the URPF check is performed through the designated loopback interface and the designated traffic is forwarded, the designated sub-priority corresponding to the designated traffic can be determined, and the designated URPF mode corresponding to the designated sub-priority can be determined; the designated URPF mode is checked through the designated loopback interface, and the designated traffic is forwarded.

[0104] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0105] Flexible security policies: By assigning different URPF modes to different sub-priorities, network administrators can implement more refined security policies and select appropriate URPF inspection methods based on the security requirements of different traffic.

[0106] Optimize resource allocation: For traffic with lower security risks, a more relaxed URPF mode can be used to reduce the computing resources required for inspection. For high-risk traffic, a stricter mode can be used to ensure security.

[0107] Improve processing efficiency: By assigning a specific URPF mode to each sub-priority level, the system can optimize processing for different traffic types and improve overall network processing efficiency.

[0108] Enhanced network performance: For high-priority traffic, selecting the Fast URPF mode can reduce latency and ensure the performance of critical business applications, such as real-time video calls or transactional data transmission.

[0109] Furthermore, before performing the URPF check through the designated loopback interface, the network load ratio may be obtained first; when the network load ratio is lower than a preset ratio, a comprehensive URPF check may be performed; when the network load ratio is not lower than a preset ratio, a URPF check may be performed on specific traffic.

[0110] The network load ratio can be used to monitor network traffic through traffic analysis tools such as Wireshark, PRTG, etc. The preset ratio can set a preset threshold for the network load ratio based on network needs and business criticality. For example, if the preset ratio is 70%, a comprehensive URPF check will be performed when the network load is below this ratio. When the network load ratio is below the preset ratio, a comprehensive URPF check is performed on all traffic entering and leaving the network. When the network load ratio is not lower than the preset ratio, only specific traffic is URPF checked. Identify and mark traffic that requires special protection, such as sensitive data transmission or critical business traffic. Perform URPF checks only on these marked traffic.

[0111] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0112] Optimized resource utilization: By obtaining the network load ratio, you can decide whether to perform a comprehensive URPF check based on the current network load. When the network load is low, a comprehensive check can ensure network security, while when the load is high, the check frequency can be reduced to optimize resource utilization.

[0113] Reduce unnecessary inspections: When the network load ratio is lower than the preset ratio, comprehensive URPF inspection can more effectively detect and prevent IP address spoofing attacks. When the network load is high, only checking specific traffic can reduce unnecessary use of network processing capacity.

[0114] Furthermore, when the designated loopback interface disables URPF check, in the process of forwarding the designated traffic through the designated loopback interface, when the designated loopback interface disables URPF check, obtain a pre-stored source IP address list; if the source IP address of the designated traffic is in the source IP address list, forward the designated traffic through the designated loopback interface.

[0115] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0116] Enhanced network security: By checking the pre-stored source IP address list, it can ensure that only those known and trusted IP addresses can forward traffic through the specified loopback interface, thereby increasing the security of the network.

[0117] Simplified IP address verification: Since URPF checks usually require verifying whether the source IP address is in the local routing table, disabling URPF and using a source IP address list instead can simplify the verification process and reduce the complexity of the routing table.

[0118] Furthermore, the embodiments of the present specification may also deploy traffic monitoring nodes in the network to collect traffic data in real time, including bandwidth utilization, delay and packet loss rate; construct a traffic feature database based on the traffic data; based on the traffic data, use a supervised learning algorithm to train a traffic prediction model, the traffic prediction model predicts future traffic changes based on historical traffic patterns and real-time network conditions; obtain a pre-written dynamic priority adjustment algorithm, the dynamic priority adjustment algorithm dynamically adjusts the priority based on traffic changes; input the future traffic changes predicted by the traffic prediction model into the dynamic priority adjustment algorithm, and adjust the priority of the traffic in real time.

[0119] It should be noted that the above content can be implemented through the following specific implementation plans:

[0120] 1. Deploy traffic monitoring nodes

[0121] Select monitoring nodes: Select appropriate network devices or servers as traffic monitoring nodes.

[0122] Deployment tools: Deploy traffic monitoring tools such as Wireshark, PRTG, or OpenVPN on the monitoring nodes.

[0123] Configuration collection: Configuration monitoring tools collect network traffic data in real time, including bandwidth utilization, latency, and packet loss rate.

[0124] 2. Build a traffic feature database

[0125] Data storage: Create a traffic characteristics database at the monitoring node or in a central database.

[0126] Data collection: Regularly collect traffic data from monitoring nodes and extract key features, such as protocol type, source IP, destination IP, port number, traffic size, etc.

[0127] Data insertion: Insert the collected traffic characteristic data into the traffic characteristic database.

[0128] 3. Training traffic prediction model

[0129] Choose an algorithm: Choose an appropriate supervised learning algorithm, such as linear regression, decision tree, random forest, or neural network.

[0130] Data preprocessing: Clean and preprocess the data in the traffic feature database, including missing value processing, outlier processing, and feature scaling.

[0131] Feature selection: Select the features that have the greatest impact on traffic prediction.

[0132] Model training: Use historical traffic data to train the traffic prediction model so that it can predict future traffic changes based on historical traffic patterns and real-time network conditions.

[0133] 4. Pre-written dynamic priority adjustment algorithm

[0134] Algorithm design: Design a dynamic priority adjustment algorithm that can adjust traffic priority according to real-time traffic changes.

[0135] Algorithm implementation: Convert the algorithm into executable code and deploy it on network devices.

[0136] 5. Adjust traffic priority in real time

[0137] Real-time prediction: The future traffic change data predicted by the traffic prediction model is input into the dynamic priority adjustment algorithm.

[0138] Priority adjustment: The algorithm dynamically adjusts the priority of traffic based on prediction results, ensuring that critical traffic receives higher bandwidth and lower latency.

[0139] Implement adjustments: Apply the adjusted priority settings to network devices through the network management interface or scripts.

[0140] It should be noted that the embodiments of this specification have the following beneficial effects through the above contents:

[0141] Improve prediction accuracy: Using supervised learning algorithms to train traffic prediction models can more accurately predict future traffic changes based on historical traffic patterns and real-time network conditions, reducing unnecessary network congestion.

[0142] Dynamic resource allocation: The traffic prediction model is used to predict future traffic changes. The network can dynamically allocate network resources based on the prediction results to optimize network performance.

[0143] Reduce network congestion: Real-time adjustment of traffic priority can ensure that business-critical or high-priority traffic gets more bandwidth and resources when needed, thereby reducing network congestion.

[0144] Improve network efficiency: The dynamic priority adjustment algorithm can adjust the priority in real time according to the changes in traffic, improving the overall work efficiency of the network.

[0145] URPF (Reverse Path Filtering) is a technology commonly used in network security. Its purpose is to check whether the source IP address of a data packet matches the path that the data packet passes through, thereby preventing source address forgery and reflection attacks. URPF is mainly used on routers or switches. It ensures the legitimacy of data packets by verifying the reverse path of the data packet.

[0146] QoS (Quality of Service) technology is used to manage the priorities of different traffic in the network. QoS is a network security mechanism and a technology used to solve problems such as network delay and congestion. By classifying, marking and scheduling data traffic, QoS can ensure that high-priority traffic (such as real-time video and voice communication) gets higher bandwidth and lower latency, while less important traffic (such as file transfer) will be scheduled to low-priority channels.

[0147] In the existing technology, URPF and QoS are usually used independently. QoS can help optimize network bandwidth allocation and ensure the real-time performance of high-priority traffic, while URPF is mainly used to prevent traffic from illegal source addresses. However, existing implementations often fail to effectively combine the two, resulting in the failure to fully utilize the priority information of QoS traffic during URPF inspection, thus affecting the efficiency and accuracy of URPF inspection.

[0148] Currently, there is a patented technology that combines ACL (access control list) and urpf. First, obtain the flow message, and use ACL to determine whether it is a specified flow message; if it is a specified flow message, redirect the flow to the first target loopback interface preconfigured in the switch, otherwise redirect it to the second target loopback interface preconfigured in the switch. The urpf function is not enabled in the first target loopback interface, and the urpf function is enabled in the second target loopback interface.

[0149] The above existing solutions have the following disadvantages:

[0150] 1. The combination of ACL and URPF is often based on static traffic filtering rules. When processing different types of traffic, the priority differences of traffic may not be fully considered. URPF (Reverse Path Filtering) usually checks all traffic, which may cause unnecessary delays or additional computing burdens for high-priority traffic (such as real-time video, voice traffic, etc.), affecting the real-time performance of the network.

[0151] 2. The solution combining ACL and URPF is usually fixed in traffic classification and processing, relying on manually configured ACL rules to identify which traffic needs to be checked by URPF. This method has poor responsiveness to the dynamic needs of different traffic types and lacks flexibility.

[0152] 3. In the traditional solution combining ACL and URPF, URPF check treats all traffic (regardless of priority) in the same way, which may lead to some security risks. For example, low-priority traffic may not be fully checked for paths and there is a risk of forged source addresses. Moreover, URPF check itself will increase the computational burden of the network and affect the real-time performance of high-priority traffic.

[0153] 4. The combination of ACL and URPF usually requires manual configuration of complex ACL rules to identify traffic and decide how to handle traffic based on these rules. As the network scale expands, the management and maintenance of ACL rules will become more and more complicated, especially when dynamic adjustments are required according to different business needs, the workload of manual management will increase significantly.

[0154] 5. In a dynamically changing network environment, the nature and load of traffic often fluctuate. The traditional ACL+URPF solution relies on static rule configuration, which makes it difficult to respond to changes in network load in real time. It may cause performance bottlenecks when the network load is high, or affect network security when the traffic type changes.

[0155] In view of these shortcomings, the purpose of the embodiments of this specification is:

[0156] The QoS mechanism is used to prioritize traffic and then perform URPF checks to optimize network performance and security. Specifically, the embodiments of this specification are intended to:

[0157] 1. Improve the efficiency of URPF inspection and reduce the delay caused by inspection, especially in high-priority traffic (such as voice and video);

[0158] 2. While ensuring network security, ensure that high-priority traffic is better protected and prevent high-priority data from being affected by URPF checks.

[0159] The embodiment of this specification provides a URPF inspection method based on QoS traffic priority, which is implemented by the following steps:

[0160] 1. The switch uses the QoS mechanism to divide traffic into several priorities (such as high priority, medium priority, and low priority) according to their priority; configure several loopback interfaces to redirect traffic and enable or disable URPF-related functions;

[0161] 2. After the switch obtains traffic from the port, it first determines the priority of the traffic and redirects the traffic to the loopback interface specified by the device based on the priority;

[0162] 3. Finally, if the redirection is to a loopback interface configured with the URPF function, the loopback interface will perform URPF related checks and then forward related traffic; if the redirection is to a loopback interface not configured with the URPF function, it will be forwarded directly;

[0163] Traffic with higher priority will be prioritized to pass the reverse path verification check, reducing the delay caused by URPF check. For low-priority traffic, a strategy with higher delay tolerance can be used to perform strict URPF checks.

[0164] For example, switch A sends traffic to switch B, and then the traffic is divided into several priorities according to the QoS mechanism inside the switch (just a simple example, the traffic is divided into high and low priorities. In fact, QoS can divide the traffic into up to 8 priorities). The high-priority traffic is forwarded to loopback port 1 inside the switch, and loopback port 1 is not configured with the URPF function, that is, the source address of the traffic is not checked. The low-priority traffic is forwarded to loopback port 2 inside the switch, and loopback port 2 is configured with the URPF function, that is, the source address of the traffic is checked. Finally, the high- and low-priority traffic is forwarded to other devices according to the corresponding loopback port.

[0165] The embodiments of this specification have the following beneficial effects:

[0166] 1. Improve network performance: The embodiments of this specification combine QoS traffic priority with the URPF check mechanism to perform effective URPF checks without affecting high-priority traffic, thereby improving network performance and real-time data transmission.

[0167] 2. Reduce latency: By prioritizing high-priority traffic and reducing the inspection complexity of low-priority traffic, the embodiments of this specification can effectively reduce network latency, especially in real-time data transmission scenarios such as video and voice.

[0168] 3. Improved security: Despite the optimization of traffic priority and URPF check process, the embodiments of this specification still maintain a high level of attention to network security and avoid security vulnerabilities caused by traffic scheduling.

[0169] Figure 2 A structural diagram of a URPF inspection device based on QoS traffic priority provided for one or more embodiments of this specification includes: a traffic division unit 201, an interface configuration unit 202, a redirection unit 203, a first forwarding unit 204 and a second forwarding unit 205.

[0170] A traffic division unit 201 divides traffic into multiple priorities according to a QoS mechanism;

[0171] An interface configuration unit 202 is configured to configure a plurality of loopback interfaces to implement traffic redirection to each loopback interface and enable or disable URPF check in each loopback interface;

[0172] The redirection unit 203, after receiving the designated traffic, redirects the designated traffic to the designated loopback interface according to the priority corresponding to the designated traffic;

[0173] A first forwarding unit 204, when the designated loopback interface enables URPF check, performs URPF check through the designated loopback interface and forwards the designated traffic;

[0174] The second forwarding unit 205 forwards the designated traffic through the designated loopback interface when the URPF check is disabled on the designated loopback interface.

[0175] Figure 3 A structural diagram of a URPF inspection device based on QoS traffic priority provided for one or more embodiments of this specification includes:

[0176] at least one processor; and,

[0177] a memory communicatively connected to the at least one processor; wherein,

[0178] The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0179] Divide traffic into multiple priorities based on QoS mechanism;

[0180] Configuring multiple loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface;

[0181] After receiving the specified traffic, redirecting the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic;

[0182] When the designated loopback interface enables URPF check, performing URPF check through the designated loopback interface and forwarding the designated traffic;

[0183] When the URPF check is disabled on the designated loopback interface, the designated traffic is forwarded through the designated loopback interface.

[0184] One or more embodiments of this specification provide a non-volatile computer storage medium storing computer executable instructions, which can achieve the following when executed by a computer:

[0185] Divide traffic into multiple priorities based on QoS mechanism;

[0186] Configuring multiple loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface;

[0187] After receiving the specified traffic, redirecting the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic;

[0188] When the designated loopback interface enables URPF check, performing URPF check through the designated loopback interface and forwarding the designated traffic;

[0189] When the URPF check is disabled on the designated loopback interface, the designated traffic is forwarded through the designated loopback interface.

[0190] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0191] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0192] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0193] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0194] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0195] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above units may be implemented in the form of hardware or software.

[0196] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0197] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A URPF inspection method based on QoS traffic priority, characterized in that: include: Divide traffic into multiple priorities based on QoS mechanism; Configuring multiple loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface; After receiving the specified traffic, redirecting the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic; When the designated loopback interface enables URPF check, performing URPF check through the designated loopback interface and forwarding the designated traffic; When the URPF check is disabled on the designated loopback interface, the designated traffic is forwarded through the designated loopback interface.

2. The method according to claim 1, characterized in that The multiple priorities include a first priority and a second priority, the first priority has a higher priority than the second priority; the first priority corresponds to a loopback interface with URPF check disabled, and the second priority corresponds to a loopback interface with URPF check enabled.

3. The method according to claim 2, characterized in that The URPF check includes a plurality of URPF modes, the second priority includes a plurality of sub-priorities, and the plurality of sub-priorities correspond to corresponding URPF modes respectively; Performing a URPF check through the designated loopback interface and forwarding the designated traffic includes: Determine a designated sub-priority corresponding to the designated traffic, and determine a designated URPF mode corresponding to the designated sub-priority; The designated URPF mode is checked through the designated loopback interface, and the designated traffic is forwarded.

4. The method according to claim 2, characterized in that: The traffic is divided into multiple priorities according to the QoS mechanism, including: According to the QoS mechanism, traffic with a delay requirement higher than a preset value is set as the first priority, and traffic with a delay requirement not higher than the preset value is set as the second priority.

5. The method according to claim 4, characterized in that Before performing the URPF check through the designated loopback interface, the method further includes: Get the network load ratio; Performing a comprehensive URPF check when the network load ratio is lower than a preset ratio; When the network load ratio is not lower than a preset ratio, a URPF check is performed on specific traffic.

6. The method according to claim 4, characterized in that When the designated loopback interface disables URPF check, forwarding the designated traffic through the designated loopback interface includes: When the designated loopback interface disables URPF checking, obtaining a pre-stored source IP address list; If the source IP address of the designated traffic is in the source IP address list, the designated traffic is forwarded through the designated loopback interface.

7. The method according to claim 1, characterized in that The method further comprises: Deploy traffic monitoring nodes in the network to collect traffic data in real time, including bandwidth usage, latency, and packet loss rate; Building a traffic feature database based on the traffic data; Based on the traffic data, a supervised learning algorithm is used to train a traffic prediction model, wherein the traffic prediction model predicts future traffic changes based on historical traffic patterns and real-time network conditions; Obtaining a pre-written dynamic priority adjustment algorithm, wherein the dynamic priority adjustment algorithm dynamically adjusts the priority based on changes in traffic; The future traffic changes predicted by the traffic prediction model are input into the dynamic priority adjustment algorithm to adjust the priority of the traffic in real time.

8. A URPF inspection device based on QoS traffic priority, characterized in that: include: Traffic division unit, which divides traffic into multiple priorities according to the QoS mechanism; An interface configuration unit, configuring a plurality of loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface; A redirection unit, after receiving the specified traffic, redirects the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic; A first forwarding unit, when the URPF check is enabled on the designated loopback interface, performs a URPF check through the designated loopback interface and forwards the designated traffic; The second forwarding unit forwards the designated traffic through the designated loopback interface when the URPF check is disabled on the designated loopback interface.

9. A URPF inspection device based on QoS traffic priority, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: Divide traffic into multiple priorities based on QoS mechanism; Configuring multiple loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface; After receiving the specified traffic, redirecting the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic; When the designated loopback interface enables URPF check, performing URPF check through the designated loopback interface and forwarding the designated traffic; When the URPF check is disabled on the designated loopback interface, the designated traffic is forwarded through the designated loopback interface.

10. A non-volatile computer storage medium, characterized in that: Computer executable instructions are stored, and when the computer executable instructions are executed by a computer, the following can be achieved: Divide traffic into multiple priorities based on QoS mechanism; Configuring multiple loopback interfaces to redirect traffic to each loopback interface and enabling or disabling URPF checks in each loopback interface; After receiving the specified traffic, redirecting the specified traffic to the specified loopback interface according to the priority corresponding to the specified traffic; When the designated loopback interface enables URPF check, performing URPF check through the designated loopback interface and forwarding the designated traffic; When the URPF check is disabled on the designated loopback interface, the designated traffic is forwarded through the designated loopback interface.

Images