A traffic blocking method and related equipment based on distributed DPI system

Abstract

The present application provides a traffic blocking method and related equipment based on a distributed DPI system, the method comprising: the main control board receives and parses the first blocking rule sent through the northbound interface, and sends the non-quintuple matching rule in the first blocking rule to the message processing unit in full; the programmable switching chip forwards the network message to the message processing unit; the message processing unit performs matching judgment on the network message according to the non-quintuple matching rule; when it is identified that the network message hits the non-quintuple matching rule, the corresponding key feature information is reported to the main control board; the main control board generates a second blocking rule based on the key feature information and sends it to the programmable switching chip; the programmable switching chip writes the received second blocking rule into an internal configurable rule table, and executes traffic blocking when subsequent network messages hit the second blocking rule. The present application can achieve accurate classification, identification and blocking of complex, encrypted or dynamically changing traffic in the network.

Description

Technical Field

[0001] The present application relates to the field of computer network technology, and in particular to a traffic blocking method and related equipment based on a distributed DPI system. Background Art

[0002] With the widespread adoption of internet technologies, global network traffic is experiencing explosive growth. As data transmission continues to expand, enterprises and carriers face increasingly severe network security threats and compliance management challenges, such as bandwidth abuse control, service prioritization, and malicious traffic identification and control.

[0003] At the same time, the existing network environment structure and communication protocol formats have also undergone significant changes. In particular, the proportion of encrypted communication traffic, represented by HTTPS, continues to rise. This makes traditional blocking methods that rely on static matching based on five-tuple features (i.e., source / destination IP, source / destination port, and transport protocol) ineffective. This leads to increased missed blocking rates and even makes it impossible to effectively prevent and control encrypted malicious communications.

[0004] Furthermore, traditional blocking systems often use a centralized architecture. When used in high-concurrency, high-throughput, and highly complex network environments, they face processing bottlenecks, response delays, and untimely rule updates, making them difficult to meet the current demands of network operations and security. Therefore, a network traffic blocking solution with stronger identification capabilities, higher throughput performance, and a more flexible deployment architecture is urgently needed. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, this application provides a traffic blocking method and related equipment based on a distributed DPI system, aiming to achieve efficient identification and precise blocking of network traffic in high-throughput and complex traffic environments, so as to improve the system's processing throughput and real-time response.

[0006] In order to achieve the above objectives and other advantages, the present application adopts the following technical solutions:

[0007] In a first aspect, some embodiments of the present application provide a traffic blocking method based on a distributed DPI system, wherein the DPI system includes a main control board and multiple service boards, wherein the main control board communicates with the multiple service boards via a system control bus, and wherein the service boards integrate at least one programmable switching chip and multiple message processing units. The method includes:

[0008] The main control board receives and parses the first blocking rule sent through the northbound interface, and sends the non-quintuple matching rule in the first blocking rule to the multiple message processing units in full;

[0009] The programmable switching chip receives the network message entering the DPI system and forwards the network message to any of the message processing units;

[0010] The message processing unit performs matching judgment on the network message according to the non-five-tuple matching rule;

[0011] When it is identified that the network message hits the non-five-tuple matching rule, the corresponding key feature information is reported to the main control board, the key feature information including the destination IP address, destination port number and protocol type of the network message;

[0012] The main control board generates a second blocking rule that can be identified by the programmable switching chip according to the key feature information, and sends the second blocking rule to the programmable switching chip;

[0013] The programmable switching chip writes the received second blocking rule into an internal configurable rule table, and performs traffic blocking when subsequent network packets hit the second blocking rule.

[0014] According to a traffic blocking method based on a distributed DPI system provided by the present application, the main control board receives and parses a first blocking rule sent through a northbound interface, and sends a full set of non-quintuple matching rules in the first blocking rule to multiple message processing units, including the following steps:

[0015] When parsing the first blocking rule, the main control board determines a rule delivery path according to a field type included in the first blocking rule;

[0016] If the first blocking rule only includes field information based on the quintuple, the first blocking rule is directly sent to the programmable switching chip, and the programmable switching chip performs the corresponding blocking operation;

[0017] If the first blocking rule includes non-quintuple application layer field information, the first blocking rule is sent to multiple message processing units in full as a non-quintuple matching rule.

[0018] According to a traffic blocking method based on a distributed DPI system provided by the present application, the non-quintuple application layer field information includes: one or more of: a URL field, an SNI field, and an application feature field.

[0019] According to a traffic blocking method based on a distributed DPI system provided by the present application, the step of the message processing unit performing a matching judgment on the network message according to the non-five-tuple matching rule includes:

[0020] The message processing unit parses the network message to obtain at least one application layer field information;

[0021] Comparing the application layer field information with the non-quintuple matching rules item by item;

[0022] If the application layer field information meets any matching condition set in the non-quintuple matching rule, the network message is deemed to hit the non-quintuple matching rule, and the matching condition includes: string equality matching, prefix matching, inclusion relationship matching or regular expression-based pattern matching.

[0023] According to a traffic blocking method based on a distributed DPI system provided by the present application, the main control board generates a second blocking rule that can be identified by the programmable switching chip based on the key feature information, and sends it to the programmable switching chip, including the following steps:

[0024] The main control board uses the destination IP address, destination port number and protocol type in the key feature information as matching fields and sets a corresponding blocking action field;

[0025] constructing a second blocking rule based on the matching field and the blocking action field, wherein the blocking action field includes at least one of discarding, redirecting, or mirroring;

[0026] The main control board calls the control interface of the programmable switching chip and issues the second blocking rule.

[0027] According to a traffic blocking method based on a distributed DPI system provided by the present application, the programmable switching chip writes the received second blocking rule into an internal configurable rule table, and performs traffic blocking steps when a subsequent network message hits the second blocking rule, including:

[0028] Writing the matching field and the corresponding blocking action in the second blocking rule into the rule table of the programmable switching chip;

[0029] When the programmable switching chip subsequently receives a new network message, it determines whether the new network message meets the second blocking rule according to the matching condition in the rule table;

[0030] If the new network message hits the second blocking rule, the programmable switching chip performs a corresponding blocking action on the network message; if the new network message does not hit the second blocking rule, the programmable switching chip continues to forward the network message along the original forwarding path.

[0031] According to a traffic blocking method based on a distributed DPI system provided by the present application, each of the message processing units determines the composite identification information of the message processing unit by its own identification ID in the business board, the identification ID of the business board where it is located, and the IP address of the main control board communicating with the business board;

[0032] The composite identification information is used to uniquely identify each of the message processing units in the DPI system, thereby enabling the main control board to implement rule issuance, hit result tracking and status management for multiple message processing units.

[0033] In a second aspect, some embodiments of the present application further provide an electronic device, comprising:

[0034] One or more processors; and a memory storing computer program instructions, wherein when the computer program instructions are executed, the processor executes any of the above-described traffic blocking methods based on the distributed DPI system.

[0035] On the third aspect, some embodiments of the present application also provide a computer-readable storage medium on which computer programs and / or instructions are stored. When the computer programs and / or instructions are executed by a processor, a traffic blocking method based on a distributed DPI system as described in any one of the above is implemented.

[0036] In a fourth aspect, some embodiments of the present application also provide a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements a traffic blocking method based on a distributed DPI system as described in any one of the above.

[0037] Compared with related technologies, the solution provided in the embodiment of the present application breaks through the limitation of existing DPI systems that only perform static matching and blocking based on quintuple fields, and supports the identification and matching of non-quintuple application layer fields such as URL, SNI, and application identification fields, enabling the system to conduct deeper analysis and accurate identification of encrypted traffic, non-standard protocols, or dynamic port behaviors, adapting to the development trend of highly complex modern network traffic. At the same time, based on the matrix-type message processing unit structure on multiple business boards, the received network messages can be parsed in parallel and matched at high speed, realizing the distributed execution of blocking logic on multiple processing units, significantly improving the overall processing throughput and response speed of the system, and being suitable for real-time traffic blocking needs in large-scale concurrent scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other implementation methods can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 This is a schematic diagram of the system architecture of the distributed DPI system provided in an embodiment of the present application;

[0040] Figure 2 This is a flow chart of a traffic blocking method based on a distributed DPI system provided in an embodiment of the present application;

[0041] Figure 3 This is a logical diagram of the configuration and distribution of blocking rules provided in the embodiment of the present application;

[0042] Figure 4 This is a logical diagram of the DPU reporting key information of the hit traffic and sending it to the programmable switching chip to perform traffic blocking, as provided in an embodiment of the present application;

[0043] Figure 5 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0045] The following terms are used in this article.

[0046] DPI (Deep Packet Inspection) is a content-based network data analysis technology that performs multi-level content parsing and field extraction on packets during network forwarding. Compared to traditional matching methods based solely on the five-tuple (source / destination IP address, source / destination port, and protocol type), DPI technology can further identify application-layer features in packets, such as URL fields, SNI fields, HTTP header fields, and application protocol types.

[0047] First embodiment

[0048] The first embodiment of the present application relates to a traffic blocking method based on a distributed DPI system. The DPI system includes a main control board and multiple service boards. The main control board communicates with the multiple service boards through a system control bus. The service board integrates at least one programmable switching chip and multiple message processing units.

[0049] Reference Figure 1 As shown in the figure, the DPI system primarily consists of a front-end chassis and multiple XDR general-purpose application servers. The front-end chassis is the hardware platform responsible for network traffic parsing and initial blocking within the system. It employs a modular board-based structure, consisting of a main control board and multiple service boards. Each service board is installed via a slot within a unified chassis structure and communicates with the main control board via the system control bus. Each service board integrates multiple message processing units, which communicate with the programmable switching chip within the same board via an internal interconnect structure to control the flow of network messages and distribute tasks.

[0050] The main control board (SCB) is the system's centralized management unit, primarily responsible for receiving policy control instructions from the northbound interface, parsing blocking rules, identifying and judging non-quintuple fields, and simultaneously issuing rules and processing and transmitting hit information. The SCB communicates with multiple service boards via the system control bus to achieve unified control of data processing nodes across the entire system.

[0051] Multiple service boards (SBUs) perform blocking operations and are deployed in different slots within the same chassis. Each SBU integrates at least one programmable switch chip, which receives incoming network traffic and performs forwarding, pre-matching, and packet distribution. Multiple packet processing units (DPUs), as computing units that perform deep packet inspection, identify protocols, extract fields, and determine whether a packet matches a blocking rule.

[0052] Each message processing unit determines the composite identification information of the message processing unit through its own identification ID in the business board, the identification ID of the business board it is located in, and the IP address of the main control board communicating with the business board; the composite identification information is used to uniquely identify each message processing unit in the DPI system, thereby enabling the main control board to implement rule issuance, hit result tracking and status management for multiple message processing units.

[0053] For example, combining the main control board IP address "10.1.0.1," the service board ID "Slot03," and the packet processing unit ID "DPU02" uniquely identifies a specific packet processing unit instance within the entire distributed DPI system. The main control board can issue precise, non-quintuple blocking rules to specific packet processing units as needed. When a DPU reports a blocking hit, the main control board can quickly identify its source. This composite identification information allows the main control board to monitor DPU operating status, archive logs, and collect performance data.

[0054] Optionally, each service board also includes a local CPU control module for assisting in scheduling the DPU node to perform operations such as flow control management, state perception, and rule execution status feedback.

[0055] The DPU nodes on multiple business boards together constitute a distributed parallel processing architecture, that is, a matrix processing structure composed of several message processing units is formed in the system. This structure can perform multi-channel concurrent parsing, field matching and blocking judgment on network messages flowing into the system.

[0056] Through the above-mentioned architectural deployment, the system achieves horizontally scalable message processing capabilities, that is, each DPU independently performs matching tasks, and multiple DPUs collaborate to complete distributed parsing and judgment under high-traffic conditions, thereby having high-throughput concurrent processing capabilities and the ability to accurately match diversified blocking rules.

[0057] This matrix architecture not only improves the system's processing efficiency in complex traffic environments (such as high concurrency, multi-protocol, and encrypted traffic), but also supports on-demand expansion of hardware deployment strategies, making the system adaptable and maintainable in carrier-level, enterprise-level, or data center-level network traffic management scenarios.

[0058] Reference Figure 2 As shown, the method may include the following steps:

[0059] Step S1: The main control board receives and parses the first blocking rule sent through the northbound interface, and sends all non-quintuple matching rules in the first blocking rule to multiple message processing units.

[0060] A northbound interface is an interface located on the system control or management plane and used to receive control instructions, configuration data, or policy rules from an external control system, policy platform, or management center. In this embodiment, the northbound interface is used by the main control board to receive the first blocking rule from the upper-layer policy control platform (such as an XDR server, security management system, policy server, etc.). It supports structured data exchange based on protocols such as RESTful API, NetConf, and gRPC.

[0061] The first blocking rule is a traffic blocking rule (blocking rule configuration package) sent by the upper-layer policy control system to the DPI system's main control board via the northbound interface. This rule is typically described in a structured format and includes several blocking conditions and their corresponding blocking actions. Blocking conditions can cover both network and application layer fields, including traditional five-tuple information (source IP, destination IP, source port, destination port, and protocol type) as well as non-five-tuple fields (such as URL, SNI, and AppInfo application feature fields).

[0062] The tap_master management process on the main control board monitors and maintains northbound interface connections, periodically or in real time receiving blocking rules issued by the policy control platform. Received blocking rules are parsed, field extraction, and type determination performed. If a rule entry contains application layer fields, such as URLs and SNIs, which are not quintuple fields, it is considered a "non-quintuple matching rule."

[0063] Because programmable switching chips (such as those based on the P4 programming language) feature hardware-accelerated rule tables specifically designed for matching static fields like quintuples, they support writing rules directly into TCAM or SRAM entries, enabling rapid judgment and blocking action execution. Therefore, when the blocking rule is based solely on a quintuple rule (such fields reside at the network and transport layers and can be directly parsed and matched by the programmable switching chip), the tap_master process can bypass the DPU processing and directly convert the rule entry into a matching command recognizable by the programmable switching chip for rapid distribution. Directly writing rule entries into the switching chip's rule table enables instant blocking at the data layer, reducing system blocking response latency, freeing up DPU computing resources, and improving overall blocking efficiency and rule processing throughput.

[0064] In the distributed architecture of a DPI system, network packets first arrive at the programmable switching chip, which then forwards the traffic to any DPU. This means that after entering the system, network traffic may be forwarded to any DPU for processing, and it's uncertain which DPU will receive the traffic. To ensure that any DPU receiving the traffic can promptly identify and execute non-quintuple rules, these rules must be distributed simultaneously to all DPUs in full. This ensures accurate blocking and consistent system response, simplifies traffic scheduling logic, and enables parallel identification and seamless blocking under distributed conditions.

[0065] Step S2: The programmable switching chip receives the network message entering the DPI system and forwards the network message to any message processing unit.

[0066] Regarding step S2, specifically, the network messages entering the system can originate from mirrored flows, bypass flows, or main link import flows. The programmable switching chip performs basic header parsing on each received message, and then forwards the message according to the traffic distribution strategy. Traffic distribution strategies may include hash load balancing scheduling, polling scheduling, flow table-based pre-allocation mechanisms, or random scheduling mechanisms, etc., which distribute network traffic in a balanced or policy-oriented manner to any message processing unit for deep packet inspection. In this way, the switching chip is responsible for traffic reception and distribution, and the message processing unit performs deep inspection and rule matching, realizing the decoupling of the control layer and the data layer in the DPI system.

[0067] Step S3: The message processing unit performs matching judgment on the network message according to the non-five-tuple matching rule.

[0068] Regarding step S3, specifically, during the parsing process, the message processing unit extracts key information from the application layer fields for blocking matching, including but not limited to application layer feature fields such as URL fields, SNI fields, and App Info fields. Subsequently, the DPU matches the extracted field information with the locally stored non-five-tuple matching rules one by one. Matching methods may include: exact matching, prefix matching, inclusion relationship matching, regular expression matching, etc. If a field in the network message hits a non-five-tuple rule, it is considered that the message meets the blocking conditions. In this way, by performing the extraction and matching judgment of the non-five-tuple field in the message processing unit, not only can the deep fields such as pre-encryption information and application feature information be identified, but the scope of application of the blocking strategy can also be greatly expanded, so that the DPI system has the ability to identify and respond to complex, encrypted, and diversified traffic, thereby achieving a more accurate and adaptable traffic blocking mechanism.

[0069] Step S4: When it is identified that the network message hits the non-five-tuple matching rule, the corresponding key feature information is reported to the main control board. The key feature information includes the destination IP address, destination port number and protocol type of the network message.

[0070] Specifically, regarding step S4, when a network message is identified as traffic subject to blocking, the message processing unit extracts key feature information from the message and reports it to the main control board to rapidly construct hardware-recognizable blocking rules for data-plane blocking. This key feature information includes, but is not limited to, fields such as the destination IP address (the destination node address of the current network message); the destination port number (the target service port); and the protocol type (e.g., TCP, UDP, ICMP, etc.), used to identify the upper-layer transport protocol. The message processing unit transmits this key feature information as a blocking hit event to the main control board's policy scheduling module (e.g., the tap_master management process) via a control link established with the main control board (e.g., an internal message queue, bus messages, shared memory, or an event notification mechanism). This step allows the complex rule hit results identified by the message processing unit to be converted into multi-tuple features that the main control board can use to construct simplified blocking rules. This reduces the complexity and execution cost of subsequent data-plane blocking rules, improving the overall blocking efficiency and adaptability of the system.

[0071] Step S5: The main control board generates a second blocking rule that can be identified by the programmable switching chip based on the key feature information, and sends the second blocking rule to the programmable switching chip.

[0072] Specifically, regarding step S5, when the main control board receives key feature information reported by any message processing unit, it deems the target traffic suspicious or that it has hit a non-five-tuple blocking rule. At this point, the main control board constructs a second blocking rule applicable to the programmable switching chip based on this key feature information. The second blocking rule is a simplified matching rule generated based on data-level execution requirements. Its fields typically include: destination IP address, destination port number, protocol type, matching action, priority, or validation parameters. The main control board encapsulates the second blocking rule and sends it to the switching chip through the control interface established with the programmable switching chip. Because the second blocking rule has a clear structure, high matching efficiency, and is easy to load into chip tables, it can be directly written into the programmable switching chip's storage structure (such as TCAM or SRAM). This eliminates the need for subsequent processing by the DPU node, enabling immediate hardware-level blocking of the hitting traffic, significantly reducing overall system processing latency. The main control board can set cancellation rules, effective time limits or linkage trigger adjustments in response to other system events for the second blocking rules issued, thereby enhancing the flexibility, intelligence and security policy closed-loop capabilities of the entire system.

[0073] Step S6: The programmable switching chip writes the received second blocking rule into an internal configurable rule table, and performs traffic blocking when subsequent network packets hit the second blocking rule.

[0074] Specifically, regarding step S6, after the main control board generates the second blocking rule and sends it to the programmable switching chip on the service board via the control channel, the switching chip receives the blocking rule and writes it into its internal configurable rule table. This rule table is the switching chip's hardware-level matching execution mechanism, typically based on the chip's internal TCAM or SRAM storage structure, forming the rule table within the switching chip. Because the programmable switching chip has the ability to dynamically modify matching table entries during runtime, that is, it can directly add, delete, and modify rule table entries without powering down the system, restarting, or interrupting the current forwarding process, it has hot-swapping capabilities, enabling online validation and updating of blocking policies.

[0075] Each secondary blocking rule is written as a table entry, including match fields (such as destination IP address, destination port number, and protocol type), action fields (such as drop, redirect, mirror, and tag), and a priority field (used to distinguish the execution order when multiple rules are matched simultaneously). This writing process is completed using control interface protocols supported by the switch chip (such as P4Runtime, OpenFlow, NetConf, and proprietary driver APIs), ensuring low-latency, line-speed rule execution in the data path. After the rule is written, the switch chip automatically loads it into the flow table. Subsequently, when a new network packet enters the switch chip, it quickly matches the packet header fields. If a match is found in the secondary blocking rule, blocking is immediately performed according to the action defined in the rule (for example, discarding the packet). If a match is not found, the rule continues to be matched according to other table entries, or the default action is executed (such as forwarding or handing over to the DPU for further processing). This prevents traffic from being repeatedly transmitted back to the main control board or DPU, improving overall system throughput and resource efficiency.

[0076] It is not difficult to find that, compared with the related art, the solution provided in the embodiment of the present application proposes an inventive concept of elevating the blocking action to the hardware layer of the switching chip, breaking through the limitation of the existing DPI system that only performs static matching and blocking based on the five-tuple field, and supports the identification and matching of non-five-tuple application layer fields such as URL, SNI, and application identification fields, so that the system can conduct deeper analysis and accurate identification of encrypted traffic, non-standard protocols or dynamic port behaviors, and adapt to the development trend of highly complex modern network traffic. At the same time, based on the matrix message processing unit structure on multiple business boards, the received network messages can be parsed in parallel and matched at high speed, realizing the distributed execution of blocking logic on multiple processing units, significantly improving the overall processing throughput and response speed of the system, and being suitable for the real-time traffic blocking needs in large-scale concurrent scenarios.

[0077] Second embodiment

[0078] The second embodiment of the present application relates to a traffic blocking method based on a distributed DPI system. The second embodiment is an improvement on the first embodiment. The specific improvement is that: in the second embodiment of the present application, a specific implementation method is provided in which a main control board receives and parses the first blocking rule sent through the northbound interface, and sends the non-five-tuple matching rules in the first blocking rule in full to multiple message processing units. That is, step S1 can further include the following steps:

[0079] Step S101: When parsing the first blocking rule, the main control board determines the rule delivery path according to the field type included in the first blocking rule;

[0080] Step S102: If the first blocking rule only includes field information based on the quintuple, the first blocking rule is directly sent to the programmable switching chip, and the programmable switching chip performs the corresponding blocking operation;

[0081] Step S103: If the first blocking rule includes non-quintuple application layer field information, the first blocking rule is sent to multiple message processing units in full as a non-quintuple matching rule.

[0082] For example, after receiving the first blocking rule sent via the northbound interface, the main control board can identify the matching field type involved in the rule through field parsing. This identification process can extract and classify the field content in the rule based on a structured rule format (such as JSON, YAML, or a dedicated protocol format). If, as determined in step S101, the first blocking rule only contains five-tuple field information, the main control board can directly convert the rule into a hardware blocking instruction suitable for the P4 switch chip and send it to the programmable switch chip on the corresponding service board via the control channel. After receiving the rule, the switch chip can load it into its internal rule table and immediately execute the blocking action when a subsequent network message hits it.

[0083] Furthermore, the delivery process supports hot-plugging during runtime to avoid business interruption, and can support policy parameters such as rule priority configuration, timed effectiveness and version management.

[0084] If the first blocking rule contains non-five-tuple field information, that is, the rule involves application layer fields (such as URL, SNI, App Info, etc.), the main control board will process the rule as a non-five-tuple matching rule. To ensure that traffic can be accurately identified when passing through any message processing unit, the main control board will send this type of rule to all message processing units in full. Figure 3 As shown, the control relationship, data processing path and configuration broadcast mechanism between the main control board and the business board are demonstrated.

[0085] Furthermore, the sending can be implemented through the tap_master process of the main control board in batch broadcast or rule synchronization mechanism to ensure that each DPU has complete matching capabilities to avoid blocking omissions or path dependency problems.

[0086] Illustratively, non-quintuple field information includes any one of the following items or a combination thereof: URL field, SNI field, and application feature field. The URL field is used to indicate the resource location address in the HTTP request message; the SNI field is used to identify the target server domain name during the TLS handshake phase; the application feature field refers to field information that can identify the application type; and the App Info field refers to field information that identifies the application type, such as User-Agent, Host, App ID, and fingerprint features.

[0087] It is not difficult to find that in the embodiment of the present application, the appropriate distribution path is dynamically selected based on the field type. For basic five-tuple rules, a hardware direct path is used, which can immediately generate and execute blocking actions, reducing processing links and being suitable for high-speed blocking scenarios. Complex non-five-tuple rules are fully distributed to each DPU, ensuring that each DPU has complete recognition capabilities, preventing blocking omissions or identification path dependencies. This improves the adaptability and flexibility of blocking rule execution, maximizing the utilization of computing and switching resources.

[0088] Third embodiment

[0089] The third embodiment of the present application relates to a traffic blocking method based on a distributed DPI system. The third embodiment is an improvement on the first or second embodiment. The specific improvement is that: in the third embodiment of the present application, a specific implementation method is provided in which a message processing unit performs matching judgment on network messages based on non-five-tuple matching rules. That is, step S3 can further include the following steps:

[0090] Step S301: The message processing unit parses the network message to obtain at least one application layer field information;

[0091] Step S302: comparing the application layer field information with the non-quintuple matching rules item by item;

[0092] Step S303: If the application layer field information meets any matching condition set in the non-quintuple matching rule, the network message is deemed to have hit the non-quintuple matching rule. The matching conditions include: string equality matching, prefix matching, inclusion relationship matching, or regular expression-based pattern matching.

[0093] For example, after receiving a network message forwarded by the switch chip, the message processing unit (DPU) first performs protocol decoding on the message, parsing it layer by layer down to the application layer content to extract one or more fields that can be used for identification. Each non-quintuple matching rule contains at least one matching field and its corresponding matching pattern, which define the hit condition. After extracting the application layer fields, the message processing unit then compares them with the locally stored non-quintuple matching rules one by one.

[0094] Furthermore, the matching process can be implemented using a high-performance rule engine and support the following comparison methods: such as string equality matching, prefix matching, inclusion relationship matching, or regular expression-based pattern matching.

[0095] During the field comparison process, if any application layer field in the network message meets the set conditions in a non-five-tuple matching rule, the message processing unit will determine that the network message hits the non-five-tuple matching rule and output the hit status as the matching result.

[0096] Furthermore, the DPU forms structured data containing the matching rule ID, hit field value, hit type, and key triplet information (destination IP, destination port, protocol type) extracted from the network message, and reports it to the main control board as a hit event to trigger the subsequent generation and rapid issuance of the second blocking rule, see steps S4 and S5.

[0097] It is not difficult to find that in the embodiments of the present application, the message processing unit can accurately parse the application layer fields in network messages, no longer limited to traditional five-tuple rules. This enables the system to identify encrypted communication traffic, proxy forwarding traffic, traffic generated by mobile applications, and traffic based on content distribution networks that hide the true access intent. Because the identification is based on deep fields and semantic structure, it avoids the limitations of static five-tuple rules (judgment based solely on IP addresses or port numbers), making blocking operations more targeted, effectively reducing the risk of false blocking, and improving the ability to accurately identify target traffic.

[0098] Fourth embodiment

[0099] The fourth embodiment of this application relates to a traffic blocking method based on a distributed DPI system. The fourth embodiment is an improvement on the first embodiment. Specifically, the fourth embodiment provides a specific implementation method for a main control board to construct a second blocking rule based on key feature information and issue it to achieve rapid blocking at the hardware level. That is, step S5 can further include the following steps:

[0100] Step S501: The main control board uses the destination IP address, destination port number, and protocol type in the key feature information as matching fields and sets the corresponding blocking action field;

[0101] Step S502: constructing a second blocking rule based on the matching field and the blocking action field, where the blocking action field includes at least one of discard, redirect, or mirror.

[0102] Step S503: the main control board calls the control interface of the programmable switching chip and issues a second blocking rule.

[0103] For example, Figure 4 As shown, the DPU reports the key feature information of the blocking hit to the main control board. The main control board uses the three fields of the key feature information (destination IP address, destination port number, and protocol type) as the matching fields in the subsequent blocking rules to construct the matching conditions in the second blocking rule to identify the target traffic that needs to be blocked subsequently. The main control board determines the corresponding blocking action field based on the current system policy configuration or the hit rule level, that is, the processing action to be performed when the network message hits the above matching field. Action fields include but are not limited to: Drop, Redirect, Mirror, Mark, etc. The tap_master process of the main control board encapsulates the matching field and the blocking action field into the second blocking rule and sends it to the programmable switching chip for execution to achieve rapid blocking of subsequent traffic.

[0104] The main control board can set action types based on preset policy templates, hit frequency, user behavior level, device alarm policy, etc. For example, if a low-risk rule is hit, the mirroring action is used; if a medium-risk rule is hit, the redirection action is used; and if a high-risk or attack-type rule is hit, the discard action is used.

[0105] Furthermore, to ensure that rules can be hot-inserted without affecting current business, the main control board can perform incremental write operations in an online configuration manner, and can ensure the effectiveness of the rules through asynchronous callback or write confirmation mechanism.

[0106] It should be noted that the fourth embodiment of the present application may also be an improvement based on any one or more of the first to third embodiments.

[0107] It's easy to see that in this embodiment of the present application, the main control board dynamically constructs structured blocking rules based on the hit results reported by the message processing unit and sends these rules to the programmable switching chip for execution. This achieves hierarchical decoupling of identification and execution. Upon receiving the hit information, the main control board can generate rules in real time and hot-insert them into the switching chip's matching table, allowing subsequent traffic to be immediately blocked by hardware in the data path, significantly reducing response latency.

[0108] Fifth embodiment

[0109] The fifth embodiment of this application relates to a method for traffic blocking based on a distributed DPI system. The fifth embodiment is an improvement on the first embodiment. Specifically, the fifth embodiment provides a specific implementation method for implementing traffic blocking based on a second blocking rule on a programmable switching chip. That is, step S6 may further include the following steps:

[0110] Step S601: writing the matching field and the corresponding blocking action in the second blocking rule into the rule table of the programmable switching chip;

[0111] Step S602: When the programmable switching chip subsequently receives a new network message, it determines whether the new network message meets the second blocking rule according to the matching conditions in the rule table;

[0112] If the new network message hits the second blocking rule, step S603 is executed: the programmable switching chip performs a corresponding blocking action on the network message; if the new network message does not hit the second blocking rule, step S604 is executed: the programmable switching chip continues to forward the network message along the original forwarding path.

[0113] For example, after generating the second blocking rule, the main control board sends it to the programmable switching chip on the corresponding service board via a control interface. The programmable switching chip maintains an internal rule table, which can be implemented using TCAM, SRAM, or other high-speed addressable storage structures. The main control board writes the rule as a structured table entry via a control channel interface such as P4Runtime, OpenFlow, or NetConf. This process supports runtime hot-swapping without restarting services or interrupting service flows.

[0114] Reference Figure 4 As shown in the figure, after the rule table is loaded, the programmable switching chip begins to perform rapid matching judgments on each network message that subsequently enters the system. After the message enters, the chip automatically extracts its header information fields (such as destination IP, destination port, and protocol type) and compares these fields with the matching fields in the loaded rule table one by one. If the current network message does not hit any table entry in the second blocking rule, the programmable switching chip will continue to send the message to the next-hop network node or target node according to the original forwarding path. If the current network message meets the matching field of any valid table entry in the second blocking rule, the programmable switching chip will immediately perform blocking processing on the message according to the action field corresponding to the rule. This blocking action takes effect immediately in the data plane hardware, has line-speed processing capabilities, and can complete blocking judgment and processing within microseconds.

[0115] It should be noted that the fifth embodiment of the present application may also be an improvement based on any one or more of the first to fourth embodiments.

[0116] It's easy to see that in this embodiment, through high-speed matching, judgment, and action execution of blocking rules on the programmable switching chip, a closed-loop control path from identification to response is implemented, improving the system's ability to handle highly concurrent and complex traffic. The programmable switching chip supports flexible configuration of multiple blocking strategies, enhancing the system's blocking strategy diversity. Traffic that misses a target remains forwarded smoothly, ensuring system service continuity and stability.

[0117] The step division of the above various methods is only for the purpose of clear description. During implementation, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications or introducing insignificant designs to the algorithm or process without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0118] In addition, some embodiments of the present application further provide an electronic device. The electronic device may be various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, etc. The electronic device may also be various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices.

[0119] The electronic device includes: one or more processors; and a memory storing computer program instructions, and when the computer program instructions are executed, the processor executes the traffic blocking method based on the distributed DPI system provided in any one or more of the above embodiments. Figure 5An exemplary structural diagram of the electronic device is disclosed. The electronic device includes: one or more processors 1101, a memory 1102, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses and can be installed on a common motherboard or installed in other ways as needed. The processor can process instructions executed within the electronic device, including instructions stored in or on the memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In some other embodiments, if necessary, multiple processors and / or multiple buses can be used with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, with each device providing some of the necessary operations. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0120] The electronic device may further include: an input device 1103 and an output device 1104. The processor 1101, the memory 1102, the input device 1103 and the output device 1104 may be connected via a bus or other means. Figure 5 The bus connection is taken as an example.

[0121] Input device 1103 can receive input digital or character information and generate key signal input related to user settings and function control of the electronic device. Examples include a touch screen, keypad, mouse, trackpad, touchpad, pointing stick, one or more mouse buttons, trackball, joystick, and other input devices. Output device 1104 may include a display device, auxiliary lighting devices (e.g., LEDs), and tactile feedback devices (e.g., vibration motors). The display device may include, but is not limited to, a liquid crystal display, a light emitting diode display, and a plasma display. In some embodiments, the display device may be a touch screen.

[0122] To provide user interaction, the electronic device may be a computer. The computer includes a display device (e.g., a cathode ray tube or LCD monitor) for displaying information to the user, and a keyboard and pointing device (e.g., a mouse) through which the user can provide input to the computer. Other types of devices may also be used to provide user interaction; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback), and input from the user may be received in any form (e.g., voice input or tactile input).

[0123] In the embodiments of the present application, a computer program / instruction is stored on a computer-readable medium. When executed by a processor, the computer program / instruction implements the traffic blocking method based on a distributed DPI system provided in any one or more of the above-described embodiments. The computer-readable medium may be included in the electronic device described in the above-described embodiments, or it may exist independently and not be incorporated into the device. The computer-readable medium carries one or more computer-readable instructions.

[0124] The memory 1102 can be used as a non-transitory computer-readable storage medium to store non-transitory software programs, non-transitory computer executable programs, and modules. The processor 1101 executes the non-transitory software programs, instructions, and modules stored in the memory 1102 to execute various functional applications and data processing of the server, thereby implementing the program instructions / modules corresponding to the method provided in any one or more of the above embodiments of the present application.

[0125] The memory 1102 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device, etc. In addition, the memory 1102 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1102 may optionally include a memory remotely located relative to the processor 1101, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0126] It should be noted that the computer-readable medium described in this application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above. Computer-readable media may be, for example, but not limited to: electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or components, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination of the above. In this application, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or device.

[0127] Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and can be implemented using any method or technology for information storage. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory, static random access memory, dynamic random access memory, other types of random access memory, read-only memory, electrically erasable programmable read-only memory, flash memory or other memory technology, compact discs, digital versatile discs or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0128] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network or a wide area network, or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0129] In the above embodiments, all or part of the steps or functions of the present invention may be implemented using software, hardware, firmware, or any combination thereof. For example, implementation may be achieved using a dedicated integrated circuit, a general-purpose computer, or any other similar hardware device. In some embodiments, the software program of the present application may be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) may be stored in a computer-readable recording medium, such as a RAM memory, a magnetic or optical drive, a floppy disk, or the like. In addition, some steps or functions of the present application may be implemented using hardware, for example, as a circuit that cooperates with a processor to perform the various steps or functions.

[0130] The computer program product provided in the embodiments of the present application includes one or more computer programs / instructions that, when executed by a processor, fully or partially produce the processes or functions described in accordance with the embodiments of the present application. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive).

[0131] The flowcharts or block diagrams in the accompanying drawings illustrate the possible architectures, functions and operations of the devices, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment or part of code, and the module, program segment or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, as well as the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-specific system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0132] The scope of this application is defined by the appended claims rather than the foregoing description and is therefore intended to encompass within this application all changes that come within the meaning and range of equivalents of the claims. Any reference signs in the claims should not be construed as limiting the claims to which they relate. In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in a device claim may also be implemented by one unit or device through software or hardware. Words such as "first" and "second" are only used to distinguish the description and do not indicate any particular order, nor should they be understood as indicating or implying relative importance.

[0133] The above descriptions are merely specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art may easily propose variations or substitutions within the technical scope disclosed in the present application, and such variations or substitutions shall be encompassed within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the scope of protection of the claims, and the above descriptions shall be regarded as exemplary and non-limiting.

Claims

1. A traffic blocking method based on a distributed DPI system, characterized in that: The DPI system includes a main control board and multiple service boards, wherein the main control board communicates with the multiple service boards via a system control bus, and the service boards integrate at least one programmable switching chip and multiple message processing units. The method includes: The main control board receives and parses the first blocking rule sent through the northbound interface, and sends the non-quintuple matching rule in the first blocking rule to the multiple message processing units in full; The programmable switching chip receives the network message entering the DPI system and forwards the network message to any of the message processing units; The message processing unit performs matching judgment on the network message according to the non-five-tuple matching rule; When it is identified that the network message hits the non-five-tuple matching rule, the corresponding key feature information is reported to the main control board, the key feature information including the destination IP address, destination port number and protocol type of the network message; The main control board generates a second blocking rule that can be identified by the programmable switching chip according to the key feature information, and sends the second blocking rule to the programmable switching chip; The programmable switching chip writes the received second blocking rule into an internal configurable rule table, and performs traffic blocking when subsequent network packets hit the second blocking rule.

2. The traffic blocking method based on the distributed DPI system according to claim 1 is characterized in that: The main control board receives and parses the first blocking rule sent through the northbound interface, and sends the non-quintuple matching rule in the first blocking rule to the multiple message processing units in full, including: When parsing the first blocking rule, the main control board determines a rule delivery path according to a field type included in the first blocking rule; If the first blocking rule only includes field information based on the quintuple, the first blocking rule is directly sent to the programmable switching chip, and the programmable switching chip performs the corresponding blocking operation; If the first blocking rule includes non-quintuple application layer field information, the first blocking rule is sent to multiple message processing units in full as a non-quintuple matching rule.

3. The traffic blocking method based on the distributed DPI system according to claim 2 is characterized in that: The non-quintuple application layer field information includes: one or more of a URL field, an SNI field, and an application feature field.

4. The traffic blocking method based on a distributed DPI system according to claim 1 or 2, characterized in that: The step of the message processing unit performing matching judgment on the network message according to the non-five-tuple matching rule includes: The message processing unit parses the network message to obtain at least one application layer field information; Comparing the application layer field information with the non-quintuple matching rules item by item; If the application layer field information meets any matching condition set in the non-quintuple matching rule, the network message is deemed to hit the non-quintuple matching rule, and the matching condition includes: string equality matching, prefix matching, inclusion relationship matching or regular expression-based pattern matching.

5. The traffic blocking method based on the distributed DPI system according to claim 1 is characterized in that: The step of generating, by the main control board, a second blocking rule that can be identified by the programmable switching chip based on the key feature information, and sending the second blocking rule to the programmable switching chip includes: The main control board uses the destination IP address, destination port number and protocol type in the key feature information as matching fields and sets a corresponding blocking action field; constructing a second blocking rule based on the matching field and the blocking action field, wherein the blocking action field includes at least one of discarding, redirecting, or mirroring; The main control board calls the control interface of the programmable switching chip and issues the second blocking rule.

6. The traffic blocking method based on a distributed DPI system according to claim 1 or 5, characterized in that: The programmable switching chip writes the received second blocking rule into an internal configurable rule table, and performs traffic blocking when a subsequent network message hits the second blocking rule, including: Writing the matching field and the corresponding blocking action in the second blocking rule into the rule table of the programmable switching chip; When the programmable switching chip subsequently receives a new network message, it determines whether the new network message meets the second blocking rule according to the matching condition in the rule table; If the new network message hits the second blocking rule, the programmable switching chip performs a corresponding blocking action on the network message; if the new network message does not hit the second blocking rule, the programmable switching chip continues to forward the network message along the original forwarding path.

7. The traffic blocking method based on the distributed DPI system according to claim 1 is characterized in that: Each of the message processing units determines the composite identification information of the message processing unit by its own identification ID in the business board, the identification ID of the business board where it is located, and the IP address of the main control board communicating with the business board; The composite identification information is used to uniquely identify each of the message processing units in the DPI system, thereby enabling the main control board to implement rule issuance, hit result tracking and status management for multiple message processing units.

8. An electronic device, characterized in that: The electronic device comprises: One or more processors; and a memory storing computer program instructions, wherein when the computer program instructions are executed, the processor executes the traffic blocking method based on the distributed DPI system as described in any one of claims 1-7.

9. A computer-readable storage medium having a computer program and / or instructions stored thereon, characterized in that: When the computer program and / or instructions are executed by the processor, the traffic blocking method based on the distributed DPI system as described in any one of claims 1 to 7 is implemented.

10. A computer program product comprising a computer program and / or instructions, characterized in that When the computer program and / or instruction is executed by a processor, the traffic blocking method based on the distributed DPI system as described in any one of claims 1 to 7 is implemented.

Images