Routing method, device, equipment, storage medium and product

Abstract

The invention discloses a routing method and device, equipment, a storage medium and a product. The method applied to the routing equipment comprises the following steps: receiving a routing rule message; the routing rule message is a BGP FlowSpec message and carries service information of the service; and updating a forwarding table based on the routing rule message, and determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information. Therefore, according to the embodiment of the invention, the service information is used as the matching priority identifier of the routing rule and is added to the BGP FlowSpec message, and the routing equipment performs matching priority sorting on the configured routing rules based on the service information, so that the routing equipment preferentially responds to the routing rule processing flow of the high-priority service in a multi-service parallel scene; and the accuracy of flow control is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of flow control, and in particular to a routing method, device, equipment, storage medium and product. BACKGROUND

[0002] Border Gateway Protocol Flow Specification (BGP Flow Specification, BGP FlowSpec) is an extended protocol of BGP protocol. A Software-Defined Networking (SDN) controller distributes routing rules such as flow control policies to a routing device for processing flow in the form of a BGP FlowSpec message. After receiving the BGP FlowSpec message, the routing device updates the routing rules corresponding to the BGP FlowSpec message to a configured BGP FlowSpec forwarding table. The routing rules of the BGP FlowSpec include flow matching conditions and processing actions. When the routing device receives flow, the flow attributes are matched with the flow matching conditions of each routing rule in the BGP FlowSpec forwarding table, and the flow is processed by discarding, forwarding or limiting flow based on the processing actions of the routing rules matched successfully, so as to realize flow scheduling or mitigating network attacks.

[0003] Since flow may be matched with multiple routing rules successfully at the same time, in the related art, the routing device sorts the routing rules in the forwarding table in matching priority by the type serial numbers of the flow matching conditions corresponding to the routing rules. When flow is matched with multiple routing rules successfully at the same time, the flow is processed based on the routing rule with a smaller type serial number in priority. However, when flow is controlled based on the above routing method, there may be a problem that network attacks cannot be mitigated. For example, the type serial number of the flow matching condition for the destination address is 1, and the type serial number of the flow matching condition for the source address is 2. When an external attack source attacks a server, even if the routing device is configured with a routing rule for discarding flow when the source address of the flow is determined to be the attack source, based on the type serial number, the routing device preferentially forwards the flow according to the routing rule for forwarding the flow to the server when the destination address of the flow is determined to be the server, and the attack flow is incorrectly forwarded to the server, affecting network security. SUMMARY

[0004] Therefore, the embodiments of the present application provide a routing method, device, equipment, storage medium and product, aiming to improve the accuracy of flow control.

[0005] The technical scheme of the embodiments of the present application is implemented as follows:

[0006] In a first aspect, the embodiments of the present application provide a routing method applied to a routing device, and the method comprises:

[0007] receiving a route rule message; the route rule message is a BGP FlowSpec message and carries service information of a service;

[0008] updating a forwarding table based on the route rule message, and determining a matching priority of a route rule indicated by the route rule message in the forwarding table based on the service information.

[0009] The method further includes:

[0010] obtaining a priority rule, the priority rule including a mapping relationship between the service information and priority information;

[0011] The determining of the matching priority of the route rule indicated by the route rule message in the forwarding table based on the service information includes:

[0012] querying the priority rule based on the service information to determine priority information corresponding to the route rule indicated by the route rule message;

[0013] sorting each route rule based on the priority information corresponding to each route rule in the forwarding table, and determining the matching priority of the route rule indicated by the route rule message in the forwarding table based on a sorting result.

[0014] The route rule message further carries user information of the service.

[0015] The determining of the matching priority of the route rule indicated by the route rule message in the forwarding table based on the service information includes:

[0016] determining the matching priority of the route rule indicated by the route rule message in the forwarding table based on the service information and the user information.

[0017] The method further includes:

[0018] obtaining a priority rule, the priority rule including a mapping relationship between the service information, the user information and priority information;

[0019] The determining of the matching priority of the route rule indicated by the route rule message in the forwarding table based on the service information and the user information includes:

[0020] querying the priority rule based on the service information and the user information to determine priority information corresponding to the route rule of the route rule message;

[0021] The routing rules in the forwarding table are sorted based on the priority information corresponding to each routing rule in the forwarding table, and a matching priority of the routing rule indicated by the routing rule message in the forwarding table is determined based on a sorting result.

[0022] In the foregoing solution, the matching priority of the routing rule indicated by the routing rule message in the forwarding table is determined based on the service information, and includes:

[0023] The routing rules in the forwarding table are sorted based on the service information corresponding to each routing rule in the forwarding table, and a matching priority of the routing rule indicated by the routing rule message in the forwarding table is determined based on a sorting result.

[0024] In the foregoing solution, the priority rule further includes default priority information corresponding to the routing rule, and the method further includes:

[0025] The matching priority of the routing rule indicated by the routing rule message without carrying the service information in the forwarding table is determined based on the default priority information.

[0026] In a second aspect, an embodiment of the present application provides a routing method applied to a routing management device, and the method includes:

[0027] Data indicating a routing rule of a service is acquired.

[0028] A routing rule message is generated based on the routing rule indicated by the data, and the routing rule message is a BGPFlowSpec message and carries service information of the service.

[0029] The routing rule message is sent to a routing device.

[0030] The routing device determines a matching priority of the routing rule indicated by the routing rule message in a forwarding table based on the service information.

[0031] In the foregoing solution, the routing rule message is generated based on the routing rule, and includes:

[0032] An extended community attribute field corresponding to the routing rule message is generated based on the service information.

[0033] In the foregoing solution, the traffic matching condition of the routing rule further includes user information, and the routing rule message is generated based on the routing rule, and includes:

[0034] An extended community attribute field corresponding to the routing rule message is generated based on the service information and the user information of the service.

[0035] The routing device determines a matching priority of a routing rule indicated by the routing rule message in the forwarding table based on the service information and the user information.

[0036] In a third aspect, an embodiment of the present application provides a routing device applied to a routing device, the device comprising:

[0037] A first receiving module configured to receive a routing rule message, the routing rule message being a BGP FlowSpec message and carrying service information of a service;

[0038] An updating module configured to update a forwarding table based on the routing rule message, and determine a matching priority of a routing rule indicated by the routing rule message in the forwarding table based on the service information.

[0039] In a fourth aspect, an embodiment of the present application provides a routing device applied to a routing management device, the device comprising:

[0040] A second receiving module configured to acquire data of a routing rule indicating a service;

[0041] A generating module configured to generate a routing rule message based on the routing rule indicated by the data, the routing rule message being a BGP FlowSpec message and carrying the service information;

[0042] A sending module configured to send the routing rule message to a routing device;

[0043] The routing device determines a matching priority of a routing rule indicated by the routing rule message in a forwarding table based on the service information.

[0044] In a fifth aspect, an embodiment of the present application provides a routing device, the routing device comprising a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the steps of the method in the first aspect when running the computer program.

[0045] In a sixth aspect, an embodiment of the present application provides a routing management device, the routing management device comprising a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the steps of the method in the second aspect when running the computer program.

[0046] In a seventh aspect, an embodiment of the present application provides a storage medium, the storage medium storing a computer program, the computer program being executed by a processor to implement the steps of the method in the first aspect or the second aspect.

[0047] In an eighth aspect, an embodiment of the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the method of the first aspect or the second aspect.

[0048] The technical scheme provided by the embodiment of the present application is applied to a routing device; a routing rule message is received; the routing rule message is a BGP FlowSpec message and carries service information of a service; based on the routing rule message, a forwarding table is updated, and based on the service information, a matching priority of a routing rule indicated by the routing rule message in the forwarding table is determined. In this way, the embodiment of the present application adds the service information as the matching priority identifier of the routing rule to the BGP FlowSpec message, and the routing device performs matching priority ordering on each routing rule configured based on the service information, so that the routing device prioritizes the routing rule processing traffic of a high-priority service in a multi-service parallel scenario, and the accuracy of traffic control is improved. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 A path diagram for a BGP FlowSpec route;

[0050] Figure 2 A path diagram for attack traffic routing in the related art;

[0051] Figure 3 A flowchart of a routing method according to an embodiment of the present application;

[0052] Figure 4 A path diagram for attack traffic routing according to an embodiment of the present application;

[0053] Figure 5 A flowchart of a routing method according to another embodiment of the present application;

[0054] Figure 6 A structural diagram of a routing device according to an embodiment of the present application;

[0055] Figure 7 A structural diagram of a routing device according to another embodiment of the present application;

[0056] Figure 8 A structural diagram of a routing device according to an embodiment of the present application;

[0057] Figure 9 A structural diagram of a routing management device according to an embodiment of the present application. DETAILED DESCRIPTION

[0058] The present application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0060] The application provides a routing method, in particular a BGP FlowSpec routing method, aiming to improve the accuracy of traffic control.

[0061] Before the technical solutions of the application are described in detail, the BGP FlowSpec technology involved is first described.

[0062] BGP FlowSpec is an extended protocol of BGP protocol, used for distributing traffic control rules (i.e. routing rules) in a network. An SDN controller in the network converts routing rules into BGP FlowSpec messages and distributes them to corresponding routing devices. After receiving the BGP FlowSpec messages carrying routing rules, the routing devices record the corresponding routing rules in a FlowSpec forwarding table, i.e. the routing devices can configure one or more routing rules at the same time and process traffic based on each routing rule in the FlowSpec forwarding table. The routing rules indicated by the BGP FlowSpec protocol include traffic matching conditions and processing actions. When receiving traffic, the routing devices match the traffic attributes with the traffic matching conditions of each routing rule in the BGP FlowSpec forwarding table, and process the traffic based on the processing actions of the routing rule matched successfully, such as discarding, forwarding or throttling the traffic.

[0063] Here, the BGP FlowSpec message includes BGP network layer reachability information (NLRI) and extended community attributes. The NLRI information usually carries traffic matching condition information, and the extended community attribute usually carries processing action information.

[0064] Among them, the type of traffic matching condition based on IPv4 is shown in Table 1, and the type of traffic matching condition based on IPv6 is shown in Table 2.

[0065] Table 1

[0066]

[0067]

[0068] Table 2

[0069]

[0070]

[0071] It should be noted that by dynamically distributing the routing rules to the routing devices in the network through the BGP FlowSpec protocol, the traffic control strategy in which the routing devices perform traffic processing based on the routing rules can not only achieve the traffic scheduling function, but also effectively alleviate the upstream Distributed Denial of Service (DDOS) attack; wherein the DDOS attack is a malicious network attack means, by manipulating a large number of devices distributed in different locations, sending a large number of invalid requests or garbage traffic to the target server, network or application, causing the target resource to be exhausted so as to be unable to provide services for normal users.

[0072] Specifically, as shown in Figure 1 For the DDOS attack, the traffic analysis device (which can be an SDN controller) in the network identifies the IP address of the attack source, and distributes the BGP FlowSpec message generated based on the IP address of the attack source to each routing device (i.e. the edge device in Figure 1 The routing rule indicated by the BGP FlowSpec message is to discard the traffic if the source address match is successful; it is easy to understand that after the routing device is configured with the corresponding routing rule, when receiving the traffic from the attack source, the traffic is discarded based on the successful source address match, avoiding the attack traffic being forwarded to the server.

[0073] It should be noted that since the FlowSpec forwarding table of the routing device can be configured with multiple routing rules at the same time, and the traffic attribute can be matched with the traffic matching conditions of multiple routing rules at the same time, the routing device needs to set a corresponding matching priority for the configured routing rules, and when the traffic attribute is matched with the traffic matching conditions of multiple routing rules at the same time, the traffic is processed according to the processing action of the routing rule with the highest matching priority.

[0074] Based on this, in the related art, the routing device usually sorts each routing rule based on the type sequence number of the NLRI information of the configured routing rule to determine the matching priority, and the smaller the type sequence number of the routing rule, the higher the corresponding matching priority (the type sequence number can be as shown in Table 1 and Table 2). For example, the source address and the destination address of the traffic are matched with different routing rules respectively, since the type sequence number of the routing rule with the traffic matching condition of the source address is 2, and the type sequence number of the routing rule with the traffic matching condition of the destination address is 1, the routing device processes the traffic according to the processing action of the routing rule with the traffic matching condition of the destination address.

[0075] However, when the routing device performs routing based on the above FlowSpec routing rule sorting method, there can be a case where the upstream DDOS attack cannot be effectively alleviated.

[0076] For example, as shown in Figure 2 R1, R2, R3 and R4 are routing devices, traffic sent to routing device R1 can be forwarded to a CDN server via a R1-R2-R4 routing path, and can be forwarded to a DDOS cleaning center via a R1-R3-R4 routing path; the address of the CDN server is A.A.A.A / 16, and the address of the DDOS attack source is B.B.B.B. In order to make CDN service traffic sent to routing device R1 successfully forwarded to the CDN server, and DDOS service traffic sent by the DDOS attack source forwarded to the DDOS cleaning center for cleaning, in the related art, routing rule 1 and routing rule 2 are arranged respectively, and a BGP FlowSpec message is issued to routing device R1 by a controller, so that routing device R1 is configured with routing rule 1 and routing rule 2, wherein routing rule 1 is a routing rule arranged for CDN service traffic, specifically, if the destination address is A.A.A.A / 16, the traffic is forwarded to the CDN server; and routing rule 2 is a routing rule arranged for DDOS attack traffic, specifically, if the source address is B.B.B.B, the traffic is forwarded to the DDOS cleaning center.

[0077] Based on the above FlowSpec routing rule sorting method in the related art, when a DDOS attack source attempts to attack a content delivery network (CDN) server, attack traffic is sent to routing device R1, and routing device R1 identifies that the source address of the attack traffic is B.B.B.B and the destination address is A.A.A.A / 16, determines that the configured routing rule 1 and routing rule 2 are matched successfully at the same time, and based on the type serial number corresponding to routing rule 1 is 1 and the type serial number corresponding to routing rule 2 is 2, routing device R1 forwards the attack traffic to the CDN server via R1-R2-R4 routing path according to routing rule 1, and does not forward the attack to the DDOS router for cleaning according to routing rule 2 and R1-R3-R4 routing path; obviously, although routing device R1 is configured with routing rules for mitigating upstream DDOS attacks, the attack traffic is still incorrectly forwarded to the CDN server, causing the CDN server to be attacked and affecting network security.

[0078] Exemplarily, to solve the above problem, an embodiment of the present application provides a routing method applied to a routing device, as shown in Figure 3 The method comprises the following steps:

[0079] Step 301, receiving a routing rule message; the routing rule message is a BGP FlowSpec message and carries service information of a service.

[0080] At step 302, the forwarding table is updated based on the routing rule message, and the matching priority of the routing rule indicated by the routing rule message in the forwarding table is determined based on the service information.

[0081] Here, the routing device is a device performing a processing action on the traffic, including but not limited to a router.

[0082] It can be understood that, in addition to carrying the service information, the routing rule message of the embodiments of the present application also carries information representing the traffic matching condition and information representing the processing action, and the routing device determines the traffic matching condition and the processing action of the routing rule to be configured based on the routing rule message; wherein the traffic matching condition at least includes each type of condition as shown in Table 1 and Table 2, and the processing action at least includes actions such as discarding, forwarding, and rate limiting.

[0083] Here, the forwarding table in step 302 is a forwarding table for storing BGP FlowSpec routing rules.

[0084] Here, the matching priority of the routing rule represents the order of the traffic matching condition of the routing rule, and when the traffic received by the routing device is successfully matched with multiple routing rules at the same time, the routing device preferentially processes the traffic based on the processing action of the routing rule with the highest matching priority.

[0085] It should be noted that the routing rule message of the embodiments of the present application can carry the service information of the service, and the routing device determines the matching priority based on the service information of the configured routing rule, rather than ordering each routing rule based on the type number of the NLRI information of the configured routing rule to determine the matching priority.

[0086] Here, the service information of the service includes at least one of the following: service name and service ID.

[0087] In some embodiments, the service name and / or service ID of the service is configured by a network management end such as an SDN controller.

[0088] It should be noted that in the scenario of simultaneously issuing BGP FlowSpec routing rules by multiple services, the routing rule issued by a service usually only considers the traffic control policy of the service itself and may not be applicable to processing traffic of other services, for example, the routing rule issued by a CDN service only expects to forward the CDN service traffic that is successfully matched to a CDN server, and does not expect to forward other service traffic that is successfully matched to the CDN server; based on this, the embodiments of the present application add service information to the routing rule message to indicate the service type of the traffic to be controlled, and the routing device determines the matching priority of each routing rule to be configured based on the service information, so that the routing device preferentially matches the routing rule of the high-priority service when processing the traffic, and correctly processes the received traffic.

[0089] It can be understood that, for the problem that the above-mentioned DDOS attack traffic can be misforwarded to the CDN server, in the embodiment of the application, the routing device can determine that the routing rule 1 is the routing rule issued for the CDN service and the routing rule 2 is the routing rule issued for the DDOS service based on the service information carried by the routing rule message, and by defining that the matching priority of the routing rule issued for the DDOS service is higher than that of the routing rule issued for the CDN service, even if the traffic attribute of the DDOS attack traffic received by the routing device matches the routing rule 1 and the routing rule 2 at the same time, the routing device will still correctly forward the DDOS attack traffic to the DDOS cleaning center according to the routing rule 2 with higher matching priority.

[0090] It can be understood that, in the embodiment of the application, the service information is taken as the matching priority identifier of the routing rule and added to the BGP FlowSpec message, and the routing device sorts the matching priorities of the routing rules based on the service information, so that the routing device processes the traffic based on the service information of the traffic in the multi-service parallel scene, and preferentially responds to the routing rule of the high-priority service, thereby improving the accuracy of traffic control.

[0091] In some embodiments, the method further includes: obtaining a priority rule, the priority rule including a mapping relationship between the service information and the priority information.

[0092] Correspondingly, determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information includes: querying the priority rule based on the service information to determine the priority information corresponding to the routing rule indicated by the routing rule message; sorting the routing rules based on the priority information corresponding to each routing rule in the forwarding table, and determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the sorting result.

[0093] Here, the routing device can pre-configure the priority rules of the BGP FlowSpec routing rules of each service, for example, the service ID 100 is the service ID of the CDN service, and the service ID 200 is the service ID of the DDOS service. Before the routing device obtains the BGP FlowSpec routing rules, the pre-configured priority rules define the mapping relationship between the service information and the priority information, including: Business ID: 100, priority: 100; Business ID: 200, priority: 200; that is, the service ID 100 corresponds to the priority information 100, and the service ID 200 corresponds to the priority information 200. When the routing device receives the routing rule message carrying the service ID 200, queries the priority rules to determine that the priority information corresponding to the routing rule is 200, and sorts the routing rule and other routing rules in the BGP FlowSpec forwarding table based on the priority information. Based on the sorting result, it is determined that the matching priority of the routing rule is higher than the routing rule indicated by the routing rule message carrying the service ID 100, that is, when the routing device processes the traffic, the routing rule of the DDOS service is matched first, and when the routing rule of the DDOS service is not matched successfully, the routing rule of the CDN service is matched.

[0094] In some embodiments, the routing rule message also carries user information of the service.

[0095] Correspondingly, based on the service information, determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table comprises: based on the service information and the user information, determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table.

[0096] Here, the user information of the service includes at least one of the following: a user name and a user ID.

[0097] In some embodiments, the user name and / or the user ID of the service are configured by a network management end such as an SDN controller.

[0098] It can be understood that the user information of the service represents the source of the service traffic. The embodiments of the present application add the service information and the user information to the routing rule message to indicate the specific service traffic of the specific user to be controlled. The routing device determines the matching priority of each routing rule based on the service information and the user information, so that the routing device matches the routing rule of the high-priority service of the high-priority user first when processing the traffic, and correctly processes the received traffic.

[0099] Correspondingly, the method further comprises: obtaining priority rules, the priority rules including the mapping relationship between the service information, the user information and the priority information.

[0100] Correspondingly, the method further comprises: determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information and the user information, comprising: querying the priority rule based on the service information and the user information to determine the priority information corresponding to the routing rule of the routing rule message; sorting each routing rule based on the priority information corresponding to each routing rule in the forwarding table, and determining the matching priority of the routing rule of the routing rule message in the forwarding table based on the sorting result.

[0101] It can be understood that the priority rule pre-configured by the routing device defines the mapping relationship between the service information, the user information and the priority information, so that the routing device can correctly process the specific service traffic of the specific user.

[0102] In an example, the service ID 100 is the service ID of the CDN service, the user ID of user 1 is 100, and the user ID of user 2 is 200; the routing device pre-configures the priority rule defining the mapping relationship between the service information and the priority information before obtaining the BGP FlowSpec routing rule, which includes: UserID: 100, Business ID: 100, priority: 100; UserID: 200, Business ID: 100, priority: 200; that is, the user ID 100 and the service ID 100 correspond to the priority information 100, and the user ID 200 and the service ID 100 correspond to the priority information 200; in order to enable the CDN service of user 2 whose destination port is port 1 to be set with a quality of service (QoS) identifier, the SDN controller issues a routing rule message carrying the user ID 200 and the service ID 100 to the routing device, and the routing device receives the routing rule message and queries the priority rule to determine that the priority information corresponding to the routing rule is 200, and then sorts the routing rule and other routing rules in the BGP FlowSpec forwarding table based on the priority information, and based on the sorting result, determines that the matching priority of the routing rule is higher than that of the routing rule indicated by the routing rule message carrying the user ID 100 and the service ID 100. Therefore, when the routing device receives the CDN service traffic of user 2, even if the CDN service traffic matches the traffic matching condition (such as the destination address) of the routing rule indicated by the routing rule message carrying the user ID 100 and the service ID 100, the routing device will still set the QoS identifier for the CDN service traffic based on the routing rule with a higher matching priority.

[0103] In some embodiments, the priority rule further comprises default priority information corresponding to the routing rule; and the method further comprises: determining the matching priority of the routing rule indicated by the routing rule message not carrying the service information in the forwarding table based on the default priority information.

[0104] It can be understood that the embodiments of the present application take into account the conventional BGP FlowSpec protocol. When the routing device receives a conventional routing rule message that does not carry service information, the routing device determines the matching priority of the routing rule in the forwarding table based on the pre-defined default priority information corresponding to the routing rule. For example, the default priority is configured as 50, which is used to determine the matching priority.

[0105] In some embodiments, based on the service information, the routing device determines the matching priority of the routing rule indicated by the routing rule message in the forwarding table, including: based on the service information corresponding to each routing rule in the forwarding table, sorting each routing rule, and based on the sorting result, determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table.

[0106] It can be understood that in some embodiments, the routing device does not need to pre-configure the priority rule representing the mapping relationship between the service information and the priority information. The network management end (which can be an SDN controller) assigns the service information according to the priority corresponding to the service when assigning the service information. For example, the service ID of the CDN service is assigned as the first identification 1, and the service ID of the DDOS service is assigned as the first identification 2, so that the routing device does not need to query the priority rule, and directly determines the matching priority of the corresponding routing rule in the forwarding table based on the service information carried by the received routing rule message.

[0107] In some embodiments, the routing device records the service information and / or user information of the routing rule matched by the processed traffic, and displays the corresponding service information and / or user information during debugging to assist in quickly locating network problems and improving the efficiency of network maintenance.

[0108] According to Figure 2 the network architecture shown in FIG. 1, the present application further provides an application example based on the method described in the above embodiments. In this example, the routing device R1 is pre-configured with a priority rule, which includes: User ID: 100, Business ID: 100, priority: 100; User ID: 200, Business ID: 200, priority: 200; default priority: 50; that is, the user ID 100 and the service ID 100 correspond to the priority information 100, the user ID 200 and the service ID 200 correspond to the priority information 200, and the default priority information is 50.

[0109] In the example, the CDN user issues a traffic control policy indicating the CDN service to the SDN controller through the northbound interface, and the traffic control policy is specifically that if the destination address is A.A.A.A / 16, the traffic is forwarded to the CDN server; the DDOS user issues a traffic control policy indicating the DDOS attack prevention service to the SDN controller through the northbound interface, and the traffic control policy is specifically that if the source address is B.B.B.B, the traffic is forwarded to the DDOS cleaning center.

[0110] In the example, after the SDN controller receives the traffic control policies issued by the CDN user and the DDOS user, the SDN controller generates BGP FlowSpec messages based on the assigned user ID and service ID and issues the BGP FlowSpec messages to the routing device R1, and the BGP FlowSpec messages indicate routing rule 1 and routing rule 2 respectively, wherein routing rule 1 is specifically that the user ID is 100, the service ID is 100, if the destination address is A.A.A.A / 16, the traffic is forwarded to the CDN server; routing rule 2 is specifically that the user ID is 200, the service ID is 200, if the source address is B.B.B.B, the traffic is forwarded to the DDOS cleaning center.

[0111] In the example, the routing device R1 queries the priority rules based on the user ID and service ID carried in the received BGP FlowSpec messages, and determines that the priority information corresponding to routing rule 1 is 100 and the priority information corresponding to routing rule 2 is 200; after the routing rules are sorted based on the priority information, the BGP FlowSpec forwarding table of the routing device R1 is: 1, routing rule 2: if the source address is B.B.B.B, the traffic is forwarded to the DDOS cleaning center; 2, routing rule 1: if the destination address is A.A.A.A / 16, the traffic is forwarded to the CDN server. When the routing device R1 receives attack traffic sent by a DDOS attack source with the address B.B.B.B, the routing device R1 determines that the attack traffic matches routing rule 2 and routing rule 1 based on the source address and the destination address of the attack traffic, and since the matching priority of routing rule 2 is higher than the matching priority of routing rule 1, the attack traffic is redirected and forwarded to the DDOS cleaning center through the R1-R3-R4 routing path as shown in FIG. 5, and will not be forwarded to the CDN server through R1-R2-R4 based on the destination address A.A.A.A / 16 of the attack traffic. Figure 4

[0112] Based on the above technical concept, the embodiment of the present application further provides a routing method applied to a routing management device, as shown in FIG. 5, the method comprises the following steps: Figure 5

[0113] Step 501, receiving data indicating a routing rule of a service. ​​

[0114] In step 502, a routing rule message is generated based on the routing rule indicated by the data, and the routing rule message is a BGP FlowSpec message and carries service information of the service.

[0115] In step 503, the routing rule message is sent to a routing device.

[0116] The routing device determines a matching priority of the routing rule indicated by the routing rule message in a forwarding table based on the service information.

[0117] Here, the routing management device is a network device for managing and configuring routing rules in an SDN network architecture, and includes at least one of an SDN controller and a router.

[0118] Here, the routing rule is a traffic control policy, and the routing rule can be generated by a user; here, the data indicating the routing rule of the service obtained by the routing management device can be received BGP FlowSpec message data, can be data of a custom data structure issued by a user, or can be data directly configured by a user on the routing management device, and the method, approach and data format structure of the data indicating the routing rule of the service obtained by the routing management device are not limited in the embodiment of the application.

[0119] Here, the service information of the service includes at least one of a service name and a service ID; the service name and / or service ID of the service is configured by a network management end such as an SDN controller.

[0120] It can be understood that after the routing management device receives the data indicating the routing rule of the service, the routing rule is converted into a BGP FlowSpec message and the corresponding service information is added and then issued to the routing device, so that the routing device can determine the matching priority of the routing rule indicated by the BGP FlowSpec message in the forwarding table based on the service information.

[0121] Here, the routing device can be preconfigured with a priority rule, and based on the mapping relationship in the priority rule and the service information carried by the routing rule message, the priority of the routing rule indicated by the received routing rule message in the BGP FlowSpec forwarding table is determined.

[0122] It can be understood that the service information is used as the matching priority identifier of the routing rule and added to the BGP FlowSpec message in the embodiment of the application, and the routing device is instructed to preferentially respond to the routing rule of a high-priority service based on the service information of the traffic in a multi-service parallel scenario, and the accuracy of traffic control is improved.

[0123] It can be understood that, based on the BGP FlowSpec protocol, the routing rule message generated by the routing management device of the embodiments of the present application includes an NLRI message and an extended community attribute, the NLRI message carries information representing the traffic matching condition of the indicated routing rule, and the extended community attribute carries information representing the processing action of the indicated routing rule.

[0124] Exemplarily, based on the data-indicated routing rule, the routing rule message is generated, including: generating an extended community attribute field corresponding to the routing rule message based on the service information of the service.

[0125] Here, the embodiments of the present application newly define a BGP extended community attribute for identifying the service information of the service, the service information representing the service type, and the message format of the extended community attribute is: business info<Business ID / Business Name>, wherein Business ID is the service ID, and Business Name is the service name.

[0126] Here, the extended community attribute for identifying the service information can be carried in the path attribute of the BGP FlowSpec message.

[0127] In some embodiments, the network management end such as the SDN controller assigns the service information to the service based on the allocation rule.

[0128] Here, the allocation rule can be determined based on the matching priority of the routing rule corresponding to the service. For example, the network management end assigns the service ID of the CDN service as the first identification 1 and the service ID of the DDOS service as the first identification 2 based on the preset allocation rule, to indicate that the matching priority of the routing rule of the DDOS service is higher than the matching priority of the routing rule of the CDN service when the routing device orders the matching priority of each routing rule in the BGP FlowSpec forwarding table.

[0129] In some embodiments, based on the data-indicated routing rule, the routing rule message is generated, including: generating an extended community attribute field corresponding to the routing rule message based on the service information and the user information of the service. Wherein, the routing device further determines the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information and the user information.

[0130] Here, the user information of the service includes at least one of the following: user name and user ID.

[0131] Here, the user name and / or user ID of the service is configured by the network management end such as the SDN controller.

[0132] It is understood that, in this embodiment, a new BGP extended community attribute is defined to identify the business information and user information of the service. The business information represents the service type, and the user information represents the source of the service traffic. The message format of this extended community attribute is: business info<User ID / User Name,Business ID / BusinessName> Where UserID is the user ID and User Name is the user name.

[0133] Similarly, extended community attributes that identify business and user information can be carried in the path attribute of the BGP FlowSpec message.

[0134] In order to implement the method of the embodiments of this application, the embodiments of this application also provide a routing device applied to a routing device. The routing device of the routing device corresponds to the routing method of the routing device described above, and the steps in the routing method embodiments of the routing device are also fully applicable to the embodiments of this device.

[0135] like Figure 6 As shown, the routing device of the routing equipment includes a first receiving module 601 and an updating module 602. The first receiving module 601 is used to receive routing rule messages; the routing rule messages are BGP FlowSpec messages and carry service information of the service; the updating module 602 is used to update the forwarding table based on the routing rule messages, and determine the matching priority of the routing rules indicated by the routing rule messages in the forwarding table based on the service information.

[0136] In some embodiments, the routing device further includes a configuration module 603, which is used to: obtain priority rules, the priority rules including the mapping relationship between service information and priority information.

[0137] In some embodiments, the update module 602 is specifically used to: query priority rules based on service information to determine the priority information corresponding to the routing rule indicated by the routing rule message; sort each routing rule based on the priority information corresponding to each routing rule in the forwarding table, and determine the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the sorting result.

[0138] In some embodiments, the routing rule message also carries user information of the service; the update module 602 is specifically used to: determine the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information and the user information.

[0139] In some embodiments, the configuration module 603 is further configured to: obtain priority rules, the priority rules including the mapping relationship between business information, user information and priority information.

[0140] In some embodiments, the update module 602 is specifically used to: query priority rules based on service information and user information to determine the priority information corresponding to the routing rules of the routing rule message; sort each routing rule based on the priority information corresponding to each routing rule in the forwarding table, and determine the matching priority of the routing rule of the routing rule message in the forwarding table based on the sorting result.

[0141] In some embodiments, the update module 602 is specifically used to: sort each routing rule based on the service information corresponding to each routing rule in the forwarding table, and determine the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the sorting result.

[0142] In some embodiments, the priority rule also includes default priority information corresponding to the routing rule; the update module 602 is further configured to: determine the matching priority of the routing rule indicated by the routing rule message that does not carry service information in the forwarding table based on the default priority information.

[0143] It should be noted that the routing device provided in the above embodiments is only illustrated by the division of the above program modules. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the routing device and the routing method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0144] In order to implement the method of the embodiments of this application, the embodiments of this application also provide a routing device applied to a routing management device. The routing device of the routing management device corresponds to the routing method of the routing management device described above, and the steps in the routing method embodiments of the routing management device are also fully applicable to the embodiments of this device.

[0145] like Figure 7 As shown, the routing device of the routing management equipment includes a second receiving module 701, a generating module 702, and a sending module 703. The second receiving module 701 receives routing rules for services; the generating module 702 generates routing rule messages based on the routing rules. These routing rule messages are BGP FlowSpec messages and carry service information; the sending module 703 sends the routing rule messages to the routing device. The routing device determines the matching priority of the routing rules indicated in the routing rule messages in its forwarding table based on the service information.

[0146] In some embodiments, the generation module 702 is specifically used to: generate extended community attribute fields corresponding to routing rule messages based on business information.

[0147] In some embodiments, the generating module 702 is specifically configured to generate an extended community attribute field corresponding to the routing rule message based on the service information and the user information of the service. The routing device further determines a matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information and the user information.

[0148] It should be noted that the routing device provided in the above embodiments is only used for routing, and the above-mentioned division of program modules is used as an example. In actual applications, the above-mentioned processing can be completed by different program modules according to needs, that is, the internal structure of the device is divided into different program modules to complete all or part of the above-mentioned processing. In addition, the routing device and the routing method provided in the above embodiments belong to the same concept, and the specific implementation process is described in the method embodiments, which will not be repeated here.

[0149] Based on the hardware implementation of the above program modules, and in order to realize the routing method applied to the routing device in the embodiments of the present application, the embodiments of the present application further provide a routing device. As shown in Figure 8 The routing device 800 includes at least one processor 801, a memory 802, a user interface 803, and at least one network interface 804. The various components in the routing device 800 are coupled together by a bus system 805. It can be understood that the bus system 805 is used to realize the connection and communication between the components. The bus system 805 includes a data bus, a power bus, a control bus, and a status signal bus in addition to the bus system 805. However, in order to clearly illustrate, all kinds of buses are marked as the bus system 805 in the Figure 8 .

[0150] The user interface 803 can include a display, a keyboard, a mouse, a trackball, a click wheel, a key, a button, a touchpad, or a touch screen, etc.

[0151] The memory 802 in the embodiments of the present application is used to store various types of data to support the operation of the routing device 800. Examples of these data include any computer programs used for operation on the routing device 800.

[0152] The routing method applied to the routing device disclosed by the embodiments of the present application can be applied in the processor 801 or implemented by the processor 801. The processor 801 can be an integrated circuit chip with a signal processing capability. In the implementation process, each step of the routing method can be completed by the integrated logic circuit of hardware in the processor 801 or the instruction in the form of software. The processor 801 mentioned above can be a general processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 801 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the hardware decoding processor can be directly embodied to execute the steps, or the hardware and software modules in the decoding processor can be combined to execute the steps. The software module can be located in the storage medium, and the storage medium is located in the memory 802. The processor 801 reads the information in the memory 802, and combines the hardware to complete the steps of the routing method applied to the routing device provided in the embodiments of the present application.

[0153] In the exemplary embodiments, the routing device 800 can be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general processors, controllers, micro controllers (MCUs), microprocessors (Microprocessors), or other electronic elements, to execute the routing method mentioned above.

[0154] It can be understood that the memory 802 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an EEPROM, a ferromagnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM can be used, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct rambus random access memory (DRRAM). The memory 802 described in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0155] Here, the routing device includes but is not limited to a router.

[0156] Based on the hardware implementation of the program module, and in order to implement the routing method applied to the routing management device in the embodiments of the present application, the embodiments of the present application further provide a routing management device, as shown in the following table. Figure 9 The routing management device 900 includes at least one processor 901, a memory 902, a user interface 903, and at least one network interface 904. The various components in the routing management device 900 are coupled together by a bus system 905. It can be understood that the bus system 905 is used to realize the connection communication between the components. The bus system 905 includes not only a data bus, but also a power bus, a control bus, and a status signal bus. However, in order to clearly illustrate, all the buses are marked as the bus system 905 in the following. Figure 9

[0157] The user interface 903 can include a display, a keyboard, a mouse, a trackball, a click wheel, a key, a button, a touchpad, or a touch screen, etc.

[0158] The memory 902 in the embodiments of the present application is used to store various types of data to support the operation of the routing management device 900. Examples of these data include any computer programs used for operation on the routing management device 900.

[0159] The routing method applied to the routing management device disclosed in the embodiments of the present application can be applied in the processor 901 or implemented by the processor 901. The processor 901 can be an integrated circuit chip with signal processing capability. In the implementation process, the steps of the routing method can be completed by the integrated logic circuit or the instruction in the software form of the hardware in the processor 901. The processor 901 mentioned above can be a general processor, a DSP, or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc. The processor 901 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, it can be directly embodied as a hardware coding processor to execute, or executed by a combination of hardware and software modules in the coding processor. The software module can be located in the storage medium, which is located in the memory 902. The processor 901 reads the information in the memory 902 and combines the hardware to complete the steps of the routing method applied to the routing management device provided in the embodiments of the present application.

[0160] In the exemplary embodiments, the routing management device 900 can be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, routing management devices, MCUs, microprocessors, or other electronic elements, for executing the routing method mentioned above.

[0161] ​It can be understood that the memory 902 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be ROM, PROM, EPROM, EEPROM, FRAM, Flash Memory, magnetic surface memory, optical disc, or read-only optical disc; the magnetic surface memory can be disk memory or tape memory. The volatile memory can be RAM used as an external cache. By way of example but not limitation, many forms of RAM can be used, such as SRAM, SSRAM, DRAM, SDRAM, DDRSDRAM, ESDRAM, SLDRAM, DRRAM. The memory 902 described in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0162] Here, the route management device includes at least one of the following: an SDN controller and a router.

[0163] In an exemplary embodiment, the embodiments of the present application also provide a storage medium, i.e., a computer storage medium, which can be a computer readable storage medium, such as a memory 802 storing a computer program executable by the processor 801 of the routing device 800 to complete the steps described in the routing method applied to the routing device by the embodiments of the present application; and a memory 902 storing a computer program executable by the processor 901 of the route management device 900 to complete the steps described in the routing method applied to the route management device by the embodiments of the present application. The computer readable storage medium can be a memory such as ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0164] In an exemplary embodiment, the embodiments of the present application also provide a computer program product including a computer program executable by the processor 801 of the routing device 800 and executable by the processor 901 of the route management device 900 to complete the steps described in the method of the embodiments of the present application.

[0165] It should be noted that "first", "second", and the like are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0166] In addition, the technical solutions described in the embodiments of the present application can be arbitrarily combined without conflict.

[0167] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A routing method, characterized in that, Applied to routing devices, the method includes: Receive routing rule messages; the routing rule messages are Border Gateway Protocol FlowSpec messages and carry service information of the service; Based on the routing rule message, update the forwarding table, and based on the service information, determine the matching priority of the routing rule indicated by the routing rule message in the forwarding table.

2. The method according to claim 1, characterized in that, The method further includes: Obtain priority rules, which include the mapping relationship between business information and priority information; The step of determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information includes: Based on the business information, the priority rule is queried to determine the priority information corresponding to the routing rule indicated by the routing rule message; Based on the priority information corresponding to each routing rule in the forwarding table, each routing rule is sorted, and based on the sorting result, the matching priority of the routing rule indicated by the routing rule message in the forwarding table is determined.

3. The method according to claim 1, characterized in that, The routing rule message also carries user information for the service; determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information includes: Based on the business information and the user information, the matching priority of the routing rule indicated by the routing rule message in the forwarding table is determined.

4. The method according to claim 3, characterized in that, The method further includes: Obtain priority rules, which include the mapping relationship between business information, user information, and priority information; The step of determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information and the user information includes: Based on the business information and the user information, the priority rules are queried to determine the priority information corresponding to the routing rules of the routing rule message; Based on the priority information corresponding to each routing rule in the forwarding table, the routing rules are sorted, and based on the sorting result, the matching priority of the routing rule of the routing rule message in the forwarding table is determined.

5. The method according to claim 1, characterized in that, The step of determining the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information includes: Based on the service information corresponding to each routing rule in the forwarding table, the routing rules are sorted, and based on the sorting results, the matching priority of the routing rule indicated by the routing rule message in the forwarding table is determined.

6. The method according to claim 2 or 4, characterized in that, The priority rule also includes default priority information corresponding to the routing rule; the method further includes: Based on the default priority information, the matching priority of the routing rule indicated by the routing rule message that does not carry service information in the forwarding table is determined.

7. A routing method, characterized in that, Applied to a routing management device, the method includes: Obtain the routing rules data indicating the service; Based on the routing rules indicated by the data, a routing rule message is generated. The routing rule message is a BGPFlowSpec message and carries the service information of the service. Send the routing rule message to the routing device; The routing device determines the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information.

8. The method according to claim 7, characterized in that, The routing rule generated based on the data indication includes: Based on the service information of the aforementioned service, an extended community attribute field corresponding to the routing rule message is generated.

9. The method according to claim 7, characterized in that, The routing rule generated based on the data indication includes: Based on the business information and user information of the aforementioned business, an extended community attribute field corresponding to the routing rule message is generated. The routing device further determines the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information and the user information.

10. A routing device, characterized in that, Applied to routing devices, the apparatus includes: The first receiving module is used to receive routing rule messages; the routing rule messages are BGP FlowSpec messages and carry service information of the service. The update module is used to update the forwarding table based on the routing rule message, and to determine the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information.

11. A routing device, characterized in that, Applied to a routing management device, the device includes: The second receiving module acquires the routing rules indicating the service. The generation module is used to generate a routing rule message based on the routing rules indicated by the data. The routing rule message is a BGP FlowSpec message and carries the service information of the service. The sending module is used to send the routing rule message to the routing device; The routing device determines the matching priority of the routing rule indicated by the routing rule message in the forwarding table based on the service information.

12. A routing device, characterized in that, The routing device includes: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, performs the steps of the method according to any one of claims 1 to 6.

13. A routing management device, characterized in that, The routing management device includes: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, performs the steps of the method according to any one of claims 7 to 9.

14. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6 or any one of claims 7 to 9.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6 or any one of claims 7 to 9.

Images