Policy flow control method and device based on P4 language and deep packet inspection

Abstract

The present invention provides a policy flow control method and device based on the P4 language and deep packet inspection. The method includes: building a distributed flow control architecture to implement flow protocol identification and dynamic issuance of flow control rules; using a P4 programmable switch to implement basic traffic processing, combined with a data processor (DPU) to complete scheduled service processing, and performing traffic regulation through a dual-rate three-color marking model; using an L3 interface to forward traffic to an XDR subsystem, matching the flow control rules issued by the L2 interface based on the protocol identification results, and generating a binary containing the destination IP address, port, and rule information; sending the binary to the P4 device of the corresponding service board via the L4 interface, dynamically loading the flow control rules, and implementing flow matching and control based on the destination IP address and port; and streamlining routing rules using the master control card IP address and service card number carried by the L3 interface to avoid redundant rule loading. The present invention can cope with dynamic application scenarios and complex network environments.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of network layer flow control, and in particular to a policy flow control method and device based on P4 language and deep packet inspection. Background Art

[0002] Currently, traditional network traffic control primarily relies on the following technologies: First, ACL-based access control statically matches traffic based on predefined IP quintuples (source / destination IP, port, and protocol) (e.g., firewalls prohibiting specific IP segments from accessing sensitive ports). While this approach offers advantages in ease of deployment and hardware compatibility, static rules cannot dynamically adapt to port reuse (e.g., HTTPS uniformly uses port 443) or IP spoofing attacks. Second, queue scheduling mechanisms utilize algorithms such as FIFO, PQ, and WFQ to allocate bandwidth resources (e.g., WFQ assigns VoIP traffic to a higher-priority queue to ensure call quality). While this can alleviate sudden congestion, it relies on manually configured weights and lacks real-time awareness of changing application requirements (e.g., dynamic bitrate adjustment for video streams). Finally, token bucket traffic shaping, based on RFC2697 / 2698 standards, controls traffic peaks by using the token issuance rate (e.g., limiting burst downloads for individual users at CDN edge nodes). While this approach allows for precise bandwidth control, it requires predefined thresholds and cannot adapt to network fluctuations. These technologies suffer from common shortcomings, including insufficient dynamism, limited real-time performance, weak application-layer awareness, and scalability bottlenecks. Therefore, developing a policy flow control method and device based on P4 language and deep packet inspection that can effectively overcome the defects in the above-mentioned related technologies has become a technical problem that needs to be urgently solved in the industry. Summary of the Invention

[0003] In response to the above-mentioned problems existing in the prior art, an embodiment of the present invention provides a policy flow control method and device based on P4 language and deep packet inspection.

[0004] In the first aspect, an embodiment of the present invention provides a policy flow control method based on P4 language and deep packet inspection, including: constructing a distributed flow control architecture, connecting the front-end system with the XDR subsystem to realize dynamic issuance of flow protocol identification and flow control rules; using a P4 programmable switch to realize basic flow processing, combining with the data processor DPU to complete predetermined business processing, and performing flow supervision through a dual-rate three-color marking model; using an L3 interface to forward traffic to the XDR subsystem, matching the flow control rules issued by the L2 interface based on the protocol identification results, and generating a tuple containing the destination IP, port and rule information; sending the tuple to the P4 device of the corresponding business board through the L4 interface, dynamically loading the flow control rules, and realizing flow matching and control based on the destination IP and port; under the distributed flow control architecture, the routing rules are simplified through the main control card IP and business card number carried by the L3 interface to avoid redundant rule loading.

[0005] Based on the content of the above method embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention, the front-end system consists of a main control board and a service board, the main control board controls peripheral devices through CPLD, and the service board collaboratively processes traffic through CPU, DPU and P4 switch.

[0006] Based on the content of the above method embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention adopts a dual token bucket structure, including a C bucket and a P bucket, which correspond to the CIR / CBS and PIR / PBS parameters respectively, to achieve hierarchical control of the committed information rate and peak information rate.

[0007] Based on the content of the above method embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention, after the redundant rule loading is avoided, also includes: L1 interface transmission service-independent instructions, including mirroring and blocking, L2 interface transmission service-related instructions, including application rate limiting and blocking, and L3 interface forwarding of a predetermined number of packets and NetFlow statistical information.

[0008] Based on the content of the above method embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention, the XDR subsystem performs traffic shaping through the token bucket algorithm of RFC 2697 / 2698 standard, and combines with P4 language related equipment to realize real-time token replenishment and excess traffic marking.

[0009] Based on the content of the above method embodiments, the policy flow control method based on P4 language and deep packet inspection provided in the embodiments of the present invention, the distributed flow control architecture forms a predetermined density processing matrix through linear stacking of business boards, and the main control board uniformly controls the business boards, eliminating the performance bottleneck of the centralized controller.

[0010] Based on the content of the above method embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention has a matching delay of less than or equal to 50 milliseconds, dynamically adjusts the committed information rate and peak information rate parameters, and realizes adaptive bandwidth fluctuation compensation.

[0011] In the second aspect, an embodiment of the present invention provides a policy flow control device based on P4 language and deep packet inspection, including: a first main module, which is used to implement the construction of a distributed flow control architecture, connect the front-end system with the XDR subsystem, and realize the dynamic issuance of flow protocol identification and flow control rules; a second main module, which is used to implement basic flow processing using a P4 programmable switch, complete predetermined business processing in combination with a data processor DPU, and perform flow supervision through a dual-rate three-color marking model; a third main module, which is used to implement the use of an L3 interface to forward traffic to the XDR subsystem, match the flow control rules issued by the L2 interface based on the protocol identification results, and generate a tuple containing the destination IP, port and rule information; a fourth main module, which is used to implement the sending of the tuple to the P4 device of the corresponding business board through the L4 interface, dynamically load the flow control rules, and realize flow matching and control based on the destination IP and port; a fifth main module, which is used to implement the simplification of routing rules through the main control card IP and business card number carried by the L3 interface under the distributed flow control architecture to avoid redundant rule loading.

[0012] In a third aspect, an embodiment of the present invention provides an electronic device, including:

[0013] At least one processor, at least one memory and a communication interface; wherein,

[0014] The processor, memory and communication interface communicate with each other;

[0015] The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the policy flow control method based on P4 language and deep packet inspection provided by any one of the various implementation methods of the first aspect.

[0016] In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable a computer to execute the policy flow control method based on P4 language and deep packet inspection provided by any one of the various implementation methods of the first aspect.

[0017] The policy flow control method and device based on P4 language and deep packet inspection provided by the embodiment of the present invention implement intelligent flow control through distributed architecture and P4 language, significantly improving dynamic adaptability. It adopts XDR subsystem to identify protocol types in real time and accurately issues rules to corresponding business boards through L4 interface, supporting HTTPS port reuse scenarios. The distributed N-to-N architecture eliminates the latency of the centralized controller and combines with the linear stacking processing matrix of the business boards to achieve 10G-level traffic concurrency. The P4 Meter dual token bucket mechanism and three-color marking support bandwidth adaptive fluctuation compensation. The hardware collaborative design enables the CPU / DPU / P4 switch to divide the work of processing general logic, advanced services and line-speed forwarding. The overall throughput exceeds 100Gbps and the memory usage of rule issuance is reduced by 40%, effectively coping with dynamic application scenarios and complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 A schematic diagram of the flow of a policy flow control method based on P4 language and deep packet inspection provided by an embodiment of the present invention;

[0020] Figure 2 A schematic diagram of the structure of a policy flow control device based on P4 language and deep packet inspection provided by an embodiment of the present invention;

[0021] Figure 3 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention;

[0022] Figure 4 A schematic diagram of the unified DPI system architecture provided by an embodiment of the present invention;

[0023] Figure 5 A schematic diagram of the interface configuration principle provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. This combination is not subject to the constraints of the sequence of steps and / or structural composition mode, but must be based on the ability of ordinary technicians in this field to implement it. When the combination of technical solutions is mutually contradictory or cannot be implemented, it should be considered that this combination of technical solutions does not exist and is not within the scope of protection required by the present invention. If there are step numbers in the following embodiments, they are only set for the convenience of explanation and description, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0025] The embodiment of the present invention provides a policy flow control method based on P4 language and deep packet inspection, see Figure 1 The method includes: building a distributed flow control architecture, connecting the front-end system with the XDR subsystem to realize traffic protocol identification and dynamic issuance of flow control rules; using a P4 programmable switch to realize basic traffic processing, combining with a data processor DPU to complete predetermined business processing, and performing traffic supervision through a dual-rate three-color marking model; using an L3 interface to forward traffic to the XDR subsystem, matching the flow control rules issued by the L2 interface based on the protocol identification result, and generating a tuple containing the destination IP, port and rule information; sending the tuple to the P4 device of the corresponding business board through the L4 interface, dynamically loading the flow control rules, and realizing traffic matching and control based on the destination IP and port; under the distributed flow control architecture, the routing rules are simplified through the main control card IP and business card number carried by the L3 interface to avoid redundant rule loading.

[0026] Specifically, ACL-based access control statically matches traffic based on a predefined IP quintuple (source / destination IP, port, and protocol). For example, a firewall prohibits specific IP segments from accessing sensitive ports. Its advantages lie in simple deployment and strong hardware compatibility, but it lacks dynamic adaptability and cannot mitigate port reuse (for example, HTTPS uniformly uses port 443) or IP spoofing attacks. Queue scheduling mechanisms use algorithms such as FIFO (First-In-First-Out), PQ (Priority Queuing), and WFQ (Weighted Fair Queuing) to allocate bandwidth resources. For example, WFQ can assign VoIP traffic to a higher priority queue to ensure call quality. These solutions can alleviate bursty traffic congestion, but rely on manually configured weights and lack the ability to detect real-time application requirements (such as dynamic changes in video stream bitrate). Token bucket traffic shaping: Based on RFC 2697 / 2698, it controls traffic peaks by using the token issuance rate and marks or drops excess traffic. Typical applications include limiting burst download traffic at CDN edge nodes to prevent link overload. While it can precisely control bandwidth, it requires predefined thresholds and cannot adapt to network changes (such as bandwidth fluctuations).

[0027] Based on the content of the above method embodiment, as an optional embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention, the front-end system is composed of a main control board and a service board, the main control board controls peripheral devices through CPLD, and the service board collaboratively processes traffic through CPU, DPU and P4 switch.

[0028] Based on the content of the above method embodiment, as an optional embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention adopts a dual token bucket structure, including a C bucket and a P bucket, which correspond to the CIR / CBS and PIR / PBS parameters respectively, to achieve hierarchical control of the committed information rate and peak information rate.

[0029] Specifically, P4 Meter is a traffic policing mechanism based on a programmable data plane. Its core design combines a token bucket algorithm with the Two-Rate Three-Color Marker (trTCM) model. The following is a detailed explanation of its working mechanism: P4 Meter uses two independent token buckets (C bucket and P bucket), each corresponding to two rate parameters: CIR (Committed Information Rate), corresponding to the CBS (Committed Burst Size) bucket, which guarantees basic traffic bandwidth; PIR (Peak Information Rate), corresponding to the PBS (Peak Burst Size) bucket, which allows burst traffic but strictly limits it. Each token bucket generates tokens at a fixed rate (CIR / PIR), and the number of tokens does not exceed the bucket capacity (CBS / PBS). Excess tokens are discarded to ensure that burst traffic does not exceed a preset threshold of 8. When a packet arrives, P4 Meter processes it according to the following logic: Red Mark (Discard): If the packet size exceeds the remaining tokens in the P bucket, it is marked red without deducting tokens. Yellow Marking (Rate-Limited Forwarding): If the P bucket has sufficient traffic but the C bucket does not, the token is marked yellow, the P bucket token is deducted, and the C bucket is not updated. Green Marking (Normal Forwarding): If both buckets have sufficient traffic, the token is marked green, and 18 tokens are deducted from both buckets. Regardless of whether a packet passes, the token bucket is continuously replenished on a timed basis to ensure continuous traffic policing.

[0030] Based on the content of the above method embodiment, as an optional embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention, after the redundant rule loading is avoided, also includes: L1 interface transmission service-independent instructions, including mirroring and blocking, L2 interface transmission service-related instructions, including application rate limiting and blocking, and a predetermined number of packets and NetFlow statistical information before L3 interface forwarding.

[0031] For details, please refer to Figure 5Flow control rules are sent to the XDR subsystem via the L2 interface in the figure. When traffic reaches the front-end processor (FEP), it is forwarded to the XDR via the L3 interface. The XDR subsystem then performs protocol identification on the traffic forwarded by the L3 interface. After successful protocol identification, it matches the rules sent by the L2 interface. If a match is found, the XDR subsystem sends the traffic's binary tuple (destination IP address, destination port, and flow control rule information) to the P4 of the service board via the L4 interface. The P4 of the service board then adds flow control rules based on the binary tuple. The service board then only needs to match the destination IP address and port in the packet to perform flow control, regardless of the specific application of the traffic, allowing it to adapt to dynamic application scenarios. Table 1 describes and contains the contents of each interface.

[0032] Table 1

[0033]

[0034] The unified DPI system architecture diagram shows an N-to-N relationship between the XDR and the service boards. Similarly, the front-end processor system and the XDR also have an N-to-N relationship. This distributed architecture completely avoids the performance bottlenecks associated with centralized controllers. To ensure accurate routing of rules generated by the L4 interface in distributed scenarios, traffic forwarded by the L3 interface includes information about the corresponding service board (primarily the IP address of the front-end processor main control card and the service board number). Based on this L3 interface information, the XDR accurately sends flow control rules to the corresponding P4 board on the service board, preventing P4 boards on other service boards from receiving useless rules and running out of memory.

[0035] Based on the content of the above method embodiment, as an optional embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention, the XDR subsystem performs traffic shaping through the token bucket algorithm of the RFC 2697 / 2698 standard, and combines P4 language related equipment to realize real-time token replenishment and excess traffic marking.

[0036] For details, please refer to Figure 4The unified DPI system primarily consists of chassis-type devices and general-purpose application servers. The hardware platform for the XDR subsystem is a general-purpose application server, as is the hardware platform for the interface adapter subsystem. These can also be co-located on a single general-purpose server. The hardware platform for the front-end processor subsystem is a chassis-type device comprised of multiple heterogeneous logical processors, further divided into a main control board (MCU) and service boards (SBUs). The MCU is responsible for unified management of the other SBUs, ensuring that the SBUs are linearly stacked to form a high-port-density, high-computing-power service processing matrix, thus implementing the core functions of unified DPI. The MCU's control logic consists of a CPU and a CPLD. Due to its low computing power, the CPU is only responsible for general control logic, while the CPLD is responsible for controlling peripherals (such as fans, LEDs, and power supplies). The SBU's control logic consists of a CPU, a DPU, a programmable switch chip, and a CPLD. Due to its low computing power, the CPU is only responsible for general control logic. The DPU is a high-performance processing unit responsible for advanced service traffic processing. The programmable switch chip implements basic service traffic processing using the P4 programming language.

[0037] Based on the content of the above method embodiment, as an optional embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention, the distributed flow control architecture forms a predetermined density processing matrix through linear stacking of business boards, and the main control board uniformly controls the business boards to eliminate the performance bottleneck of the centralized controller.

[0038] Based on the content of the above method embodiment, as an optional embodiment, the policy flow control method based on P4 language and deep packet inspection provided in the embodiment of the present invention has a matching delay of less than or equal to 50 milliseconds, and dynamically adjusts the committed information rate and peak information rate parameters to achieve adaptive bandwidth fluctuation compensation.

[0039] The policy flow control method based on P4 language and deep packet inspection provided by the embodiment of the present invention realizes intelligent flow control through distributed architecture and P4 language, significantly improving dynamic adaptability. It adopts XDR subsystem to identify protocol types in real time and accurately issues rules to corresponding business boards through L4 interface, supporting HTTPS port reuse scenarios. The distributed N-to-N architecture eliminates the latency of the centralized controller and combines with the linear stacking processing matrix of the business boards to achieve 10G-level traffic concurrency. The P4 Meter dual token bucket mechanism and three-color marking support bandwidth adaptive fluctuation compensation. The hardware collaborative design enables the CPU / DPU / P4 switch to divide the work of processing general logic, advanced services and line-speed forwarding. The overall throughput exceeds 100Gbps and the memory usage of rule issuance is reduced by 40%, effectively coping with dynamic application scenarios and complex network environments.

[0040] The implementation basis of each embodiment of the present invention is to implement programmed processing through a device with processor functions. Therefore, in engineering practice, the technical solutions and functions of each embodiment of the present invention can be encapsulated into various modules. Based on this reality, on the basis of the above embodiments, an embodiment of the present invention provides a policy flow control device based on P4 language and deep packet inspection, which is used to execute the policy flow control method based on P4 language and deep packet inspection in the above method embodiment. Figure 2 The device includes: a first main module, which is used to build a distributed flow control architecture, connect with the XDR subsystem through the front-end system, and realize traffic protocol identification and dynamic issuance of flow control rules; a second main module, which is used to implement basic traffic processing using a P4 programmable switch, complete predetermined business processing in combination with a data processor DPU, and perform traffic supervision through a dual-rate three-color marking model; a third main module, which is used to implement forwarding traffic to the XDR subsystem using an L3 interface, match the flow control rules issued by the L2 interface based on the protocol identification result, and generate a tuple containing the destination IP, port and rule information; a fourth main module, which is used to send the tuple to the P4 device of the corresponding business board through the L4 interface, dynamically load the flow control rules, and realize traffic matching and control based on the destination IP and port; a fifth main module, which is used to implement, under the distributed flow control architecture, the simplification of routing rules through the main control card IP and business card number carried by the L3 interface to avoid redundant rule loading.

[0041] The policy flow control device based on P4 language and deep packet inspection provided by the embodiment of the present invention adopts Figure 2 Several modules in it implement intelligent flow control through distributed architecture and P4 language, significantly improving dynamic adaptability. The XDR subsystem is used to identify protocol types in real time and accurately issue rules to the corresponding business board through the L4 interface, supporting HTTPS port reuse scenarios; the distributed N-to-N architecture eliminates the latency of the centralized controller and combines the linear stacking processing matrix of the business board to achieve 10G-level traffic concurrency; the P4 Meter dual token bucket mechanism and three-color marking support bandwidth adaptive fluctuation compensation; the hardware collaborative design enables the CPU / DPU / P4 switch to divide the work of processing general logic, advanced services and line-speed forwarding, with an overall throughput exceeding 100Gbps and a 40% reduction in memory usage for rule issuance, effectively responding to dynamic application scenarios and complex network environments.

[0042] It should be noted that the device in the device embodiment provided by the present invention can be used to implement the method in the above-mentioned method embodiment as well as the method in other method embodiments provided by the present invention. The only difference is that the corresponding functional modules are set. The principle is basically the same as the principle of the above-mentioned device embodiment provided by the present invention. As long as those skilled in the art refer to the specific technical solutions in other method embodiments on the basis of the above-mentioned device embodiment, obtain the corresponding technical means and the technical solutions composed of these technical means by combining technical features, and ensure the practicality of the technical solutions, they can improve the device in the above-mentioned device embodiment to obtain the corresponding device class embodiment, thereby obtaining the corresponding device class embodiment for implementing the methods in other method class embodiments. For example:

[0043] Based on the content of the above-mentioned device embodiment, as an optional embodiment, the policy flow control device based on P4 language and deep packet inspection provided in the embodiment of the present invention also includes: a first sub-module, used to realize that the front-end system is composed of a main control board and a service board, the main control board controls peripheral devices through CPLD, and the service board collaboratively processes traffic through CPU, DPU and P4 switch.

[0044] Based on the content of the above device embodiment, as an optional embodiment, the policy flow control device based on P4 language and deep packet inspection provided in the embodiment of the present invention further includes: a second sub-module, which is used to implement that the P4 Meter adopts a dual token bucket structure, including a C bucket and a P bucket, which correspond to the CIR / CBS and PIR / PBS parameters respectively, to achieve hierarchical control of the committed information rate and the peak information rate.

[0045] Based on the content of the above-mentioned device embodiment, as an optional embodiment, the policy flow control device based on P4 language and deep packet inspection provided in the embodiment of the present invention further includes: a third sub-module, which is used to implement the avoidance of redundant rule loading, and also includes: L1 interface transmission service-independent instructions, including mirroring and blocking, L2 interface transmission service-related instructions, including application speed limit and blocking, and a predetermined number of packets and NetFlow statistical information before L3 interface forwarding.

[0046] Based on the content of the above-mentioned device embodiment, as an optional embodiment, the policy flow control device based on P4 language and deep packet inspection provided in the embodiment of the present invention further includes: a fourth sub-module, which is used to implement the XDR subsystem to perform traffic shaping through the token bucket algorithm of the RFC 2697 / 2698 standard, and to combine P4 language related equipment to realize real-time token replenishment and excess traffic marking.

[0047] Based on the content of the above-mentioned device embodiment, as an optional embodiment, the policy flow control device based on P4 language and deep packet inspection provided in the embodiment of the present invention also includes: a fifth sub-module, which is used to realize the distributed flow control architecture to form a predetermined density processing matrix through linear stacking of business boards, and the main control board uniformly controls the business boards to eliminate the performance bottleneck of the centralized controller.

[0048] Based on the content of the above-mentioned device embodiment, as an optional embodiment, the policy flow control device based on P4 language and deep packet inspection provided in the embodiment of the present invention further includes: a sixth sub-module, which is used to implement the matching delay of the flow control rule to be less than or equal to 50 milliseconds, dynamically adjust the committed information rate and peak information rate parameters, and realize bandwidth adaptive fluctuation compensation.

[0049] The method of the embodiment of the present invention is implemented by electronic devices, so it is necessary to introduce the relevant electronic devices. Based on this purpose, the embodiment of the present invention provides an electronic device, such as Figure 3 As shown, the electronic device includes: at least one processor, a communications interface, at least one memory, and a communications bus, wherein the at least one processor, the communications interface, and the at least one memory communicate with each other via the communications bus. The at least one processor can call logic instructions in the at least one memory to execute all or part of the steps of the methods provided in the aforementioned method embodiments.

[0050] In addition, the logic instructions in the at least one memory described above can be implemented as a software functional unit and, when sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each method embodiment of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0051] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0052] Through the description of the above embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or can also be implemented using hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in various embodiments or portions thereof.

[0053] The flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present invention. Based on this understanding, each box in the flowchart or block diagram can represent a module, program segment or part of the code, and the module, program segment or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, or sometimes in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0054] It should be noted that the terms "include", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include..." do not exclude the presence of other identical elements in the process, method, article or device that includes the elements. Any "predetermined threshold", "preset threshold" or similar expressions that do not indicate a specific value can be determined by a person of ordinary skill in the art through simple experiments or corresponding debugging.

[0055] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A policy flow control method based on P4 language and deep packet inspection, characterized in that: include: Construct a distributed flow control architecture. The interface adapter subsystem is connected to the front-end system and XDR subsystem through L1 and L2 interfaces respectively. The front-end system is connected to the XDR subsystem through L3 and L4 interfaces to realize the dynamic distribution of flow protocol identification and flow control rules. When the traffic reaches the front-end system, the P4 programmable switch on the service board is used to implement basic traffic processing, and the data processor DPU is combined to complete the scheduled business processing. The dual-rate three-color marking model is used to regulate traffic. The front-end system uses the L3 interface to forward the traffic containing the front-end main control card IP and business card number to the XDR subsystem. In the system, the XDR subsystem matches the flow control rules issued by the interface adapter subsystem through the L2 interface based on the protocol identification results, and generates a two-tuple containing the destination IP, port and flow control rule information; the XDR subsystem sends the two-tuple to the P4 device of the corresponding business board that performs basic traffic processing through the L4 interface, and dynamically loads the flow control rules based on the two-tuple to achieve traffic matching and control based on the destination IP and port; in the distributed flow control architecture, the two-tuple is sent to the P4 device of the corresponding business board through the main control card IP and business card number carried by the L3 interface to streamline routing rules and avoid redundant rule loading; The front-end system consists of a main control board and a service board. The main control board controls peripheral devices through CPLD, and the service board processes traffic through CPU, DPU and P4 switch. P4 Meter adopts a dual token bucket structure, including C bucket and P bucket, which correspond to CIR / CBS and PIR / PBS parameters respectively, to achieve hierarchical control of committed information rate and peak information rate.

2. The policy flow control method based on P4 language and deep packet inspection according to claim 1 is characterized in that: After the redundancy avoidance rules are loaded, the following are also included: L1 interface transmission service-independent instructions, including mirroring and blocking, L2 interface transmission service-related instructions, including application rate limiting and blocking, L3 interface forwarding of a predetermined number of packets and NetFlow statistics.

3. The policy flow control method based on P4 language and deep packet inspection according to claim 2 is characterized in that: The XDR subsystem performs traffic shaping through the token bucket algorithm of RFC 2697 / 2698 standard, and realizes real-time token replenishment and excess traffic marking in combination with P4 language related equipment.

4. The policy flow control method based on P4 language and deep packet inspection according to claim 3 is characterized in that: The distributed flow control architecture forms a predetermined density processing matrix through linear stacking of service boards, and the main control board uniformly controls the service boards, eliminating the performance bottleneck of the centralized controller.

5. The policy flow control method based on P4 language and deep packet inspection according to claim 4 is characterized in that: The matching delay of the flow control rule is less than or equal to 50 milliseconds, and the committed information rate and peak information rate parameters are dynamically adjusted to achieve adaptive bandwidth fluctuation compensation.

6. A policy flow control device based on P4 language and deep packet inspection, characterized in that: include: The first main module is used to build a distributed flow control architecture. The interface adapter subsystem is connected to the front-end system and XDR subsystem through L1 and L2 interfaces respectively. The front-end system is connected to the XDR subsystem through L3 and L4 interfaces to realize the dynamic distribution of flow protocol identification and flow control rules. The second main module is used to implement basic flow processing using P4 programmable switches, complete scheduled business processing in combination with data processors DPU, and perform flow supervision through a dual-rate three-color marking model. The third main module is used to implement the front-end system to use L3 interfaces to forward traffic containing the front-end master card IP and business card number to the XDR subsystem. The XDR subsystem Based on the protocol identification results, the interface adapter subsystem matches the flow control rules issued through the L2 interface to generate a tuple containing the destination IP, port and flow control rule information; the fourth main module is used to enable the XDR subsystem to send the tuple through the L4 interface to the P4 device of the corresponding business board that performs basic traffic processing, and dynamically load the flow control rules according to the P4 device of the corresponding business board of the tuple to achieve traffic matching and control based on the destination IP and port; the fifth main module is used to implement, under the distributed flow control architecture, the master control card IP and business card number carried by the L3 interface to send the tuple to the P4 device of the corresponding business board to streamline routing rules and avoid redundant rule loading.

7. An electronic device, characterized in that: include: At least one processor, at least one memory and a communication interface; wherein, The processor, memory and communication interface communicate with each other; The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the method according to any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer instructions, which enable a computer to execute the method of any one of claims 1 to 5.

Images