Strategy search method and apparatus

Abstract

Embodiments of the present application provide a strategy search method and apparatus. The method comprises: receiving a data packet from another device, and acquiring an attribute value set of a first attribute of an endpoint of the data packet; determining a search key set on the basis of the attribute value set; on the basis of a first search key, searching a first storage unit for a strategy matched with the first search key, and on the basis of a second search key, searching a second storage unit for a strategy matched with the second search key, to obtain a strategy set corresponding to the attribute value set, wherein the search step based on the first search key and the search step based on the second search key are executed in parallel; and processing the data packet on the basis of the strategy set. By means of the function of parallel search, a plurality of strategies corresponding to a plurality of attribute values can be found in a shortest possible time.

Description

A strategy search method and apparatus

[0001] This application claims priority to Chinese Patent Application No. 202410697702.3, filed with the State Intellectual Property Office of China on May 30, 2024, entitled "A Strategy Search Method and Apparatus", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of network technology, and in particular to a strategy search method and apparatus. Background Technology

[0003] A policy is a crucial piece of data that guides forwarding devices in determining how to process received packets. For example, policies include, but are not limited to, security policies, access control policies, packet filtering policies, Quality of Service (QoS) policies, or Modular Quality of Service (MQC) command-line policies. A policy typically contains a key and an action identifier. The key indicates the matching condition. The action identifier indicates the processing action the forwarding device should take on the packet if the matching condition is met. The process of processing packets using a policy is as follows: After receiving a packet, the forwarding device obtains the attribute values ​​of the packet's endpoints, determines a lookup key based on the attribute values, and then searches for the corresponding policy based on the lookup key. During the policy search, the forwarding device compares the lookup key with the keys in the stored policies. If the forwarding device finds a policy whose key matches the lookup key, it indicates that the policy is the policy corresponding to the attribute value, i.e., the target policy in the match. The forwarding device will then further process the packet according to the action identifier in the target policy.

[0004] Previously, each attribute of a network object in a communication network could generally only have one attribute value. A network object is an entity with attributes that can act as the initiator or destination of data packets. For example, a network object includes a user (or terminal or access subject) as the initiator of a data packet; or a server (or network application or access object) as the destination of a data packet. When configuring policies, network administrators typically configure them based on a single attribute value. That is, the network administrator configures the policy corresponding to each attribute value for the forwarding device. Taking the attribute as the identity, and the attribute value as finance or sales, as an example, the network administrator configures policy 1 for finance and policy 2 for sales. Policy 1 allows access to the audit server, cashier server, and expense reimbursement server. Policy 2 allows access to the audit server, cashier server, expense reimbursement server, product data server, order server, after-sales server, and customer service server.

[0005] However, with societal development, application scenarios have emerged where a single attribute has multiple values ​​(i.e., the same network object has multiple attribute values ​​for the same attribute), but the strategy is still configured based on a single attribute value. Taking the attribute as an identity example, there are often scenarios in enterprises where employees are temporarily transferred. For instance, employee B from the finance department is temporarily transferred to the sales department. Employee B needs to have both finance and sales permissions. In this case, employee B's identity attribute has both finance and sales attribute values.

[0006] In scenarios with multiple values ​​for a single attribute, if the forwarding device determines the lookup key for each attribute value individually and sequentially searches for matching strategies based on each lookup key, the time required for the lookup strategy will be excessive, leading to a significant performance degradation. For example, if a network object has n attribute values ​​for the same attribute, the forwarding device might search for strategy 1 based on lookup key 1 for attribute value 1 in clock cycle 1, then search for strategy 2 based on lookup key 2 for attribute value 2 in clock cycle 2, and so on. The forwarding device would need to perform n lookup strategy operations, and the time required to find all strategies corresponding to the n attribute values ​​would also reach n clock cycles. Summary of the Invention

[0007] This application provides a strategy lookup method and apparatus. In scenarios where a single attribute of a network object can simultaneously have multiple attribute values, the parallel lookup function helps to find multiple strategies corresponding to multiple attribute values ​​in the shortest possible time. The technical solution is as follows.

[0008] A first aspect provides a policy lookup method applied to a forwarding device, the forwarding device including a memory, the memory including a first storage unit and a second storage unit, the method comprising: receiving a data packet from another device; obtaining an attribute value set of a first attribute of an endpoint of the data packet, the endpoint of the data packet including an initiating network object of the data packet or a destination network object of the data packet, the attribute value set including a first attribute value and a second attribute value of the first attribute; determining a lookup key set based on the attribute value set, the lookup key set including a first lookup key corresponding to the first attribute value and a second lookup key corresponding to the second attribute value; searching for a policy matching the first lookup key from the first storage unit based on the first lookup key, and searching for a policy matching the second lookup key from the second storage unit based on the second lookup key, to obtain a policy set corresponding to the attribute value set, the policy set including a first policy and a second policy, the first policy corresponding to the first attribute value and matching the first lookup key, the second policy corresponding to the second attribute value and matching the second lookup key, the lookup step based on the first lookup key and the lookup step based on the second lookup key being executed in parallel; and processing the data packet based on the policy set.

[0009] Based on the method provided in the first aspect, in scenarios where an attribute of a data packet endpoint can have multiple attribute values ​​simultaneously, since the corresponding policies are searched from multiple storage units based on the multiple attribute values, and the actions of searching for policies from multiple storage units are performed in parallel, multiple policies corresponding to multiple attribute values ​​can be found within one clock cycle. This reduces the time consumption caused by sequentially searching for policies corresponding to each attribute value from a storage unit, and greatly improves the speed of policy search.

[0010] In some implementations, before searching for a strategy matching the first lookup key in the first storage unit based on the first lookup key, the method further includes: in response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, storing a first strategy corresponding to the first attribute value in the first storage unit, and storing a second strategy corresponding to the second attribute value in the second storage unit.

[0011] By storing the strategies corresponding to different attribute values ​​of the same attribute in different storage units in the memory, the separate storage of strategies is achieved, thereby supporting parallel execution of strategy lookup for different storage units.

[0012] In some implementations, in response to the absence of a network object with both a first attribute value and a third attribute value in the communication network where the forwarding device is located, a first strategy corresponding to the first attribute value and a third strategy corresponding to the third attribute value are stored in the first storage unit.

[0013] In some implementations, in response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, and the first policy corresponding to the first attribute value and the second policy corresponding to the second attribute value are both stored in the first storage unit, the second policy is migrated from the first storage unit to the second storage unit.

[0014] In some embodiments, after storing a first strategy corresponding to the first attribute value in the first storage unit and a second strategy corresponding to the second attribute value in the second storage unit, the method further includes:

[0015] Record a first correspondence and a second correspondence. The first correspondence includes the first attribute value and the identifier of the first storage unit. The second correspondence includes the second attribute value and the identifier of the second storage unit.

[0016] Because the mapping between attribute values ​​and storage units is recorded after successful policy storage, the forwarding device can easily identify which storage unit to look up the policy corresponding to the attribute value during the subsequent policy lookup phase. This eliminates the need to traverse all storage units in the memory to find the policy, thus improving lookup speed. Furthermore, it eliminates the need for network administrators to manually configure which storage unit is used for each attribute value's policy, reducing configuration complexity.

[0017] In some implementations, the first storage unit includes one or more slices, the first policy corresponding to the first attribute value includes multiple policy entries, and storing the first policy corresponding to the first attribute value in the first storage unit includes: if the total storage capacity required by the multiple policy entries does not exceed the storage capacity of one slice, storing the multiple policy entries in one slice.

[0018] By storing multiple policy entries corresponding to multiple attribute values ​​of the same attribute on the same slice as much as possible, and by finding the policy entry corresponding to the same attribute value from a single slice as much as possible, it helps to reduce the number of times policy entries are searched and also reduces the risk of wasting parallel search capabilities caused by searching for policy entries from different slices.

[0019] In some implementations, if the total storage capacity required by the plurality of policy entries exceeds the storage capacity of one slice, different policy entries among the plurality of policy entries are stored in different slices of the plurality of policy entries.

[0020] Considering the limited storage capacity of a slice, by storing multiple policy entries corresponding to multiple attribute values ​​of the same attribute in different slices, the storage pressure of a single slice can be distributed, reducing the risk of storage failure for multiple policy entries corresponding to multiple attribute values ​​of the same attribute.

[0021] In some implementations, before searching for a strategy matching the first lookup key from the first storage unit based on the first lookup key, the method further includes: obtaining an identifier of the first storage unit based on the first attribute value and a first correspondence, and determining the first storage unit based on the identifier of the first storage unit, wherein the first correspondence includes the first attribute value and the identifier of the first storage unit; before searching for a second strategy corresponding to the second attribute value from the second storage unit corresponding to the second attribute value based on the second lookup key, the method further includes: obtaining an identifier of the second storage unit based on the second attribute value and a second correspondence, and determining the second storage unit based on the identifier of the second storage unit, wherein the second correspondence includes the second attribute value and the identifier of the second storage unit.

[0022] Because the correspondence between attribute values ​​and storage units is maintained, and the storage units are determined based on this correspondence, it is deterministic which storage unit each lookup key matches with the policy entry stored therein. Each lookup key does not need to match with every policy stored in every storage unit in the memory; instead, it only needs to match with the policy stored in the storage unit corresponding to the attribute value (e.g., the storage unit that actually stores the policy corresponding to the attribute value). Therefore, compared to traversing every storage unit in the memory based on the lookup key to find the policy corresponding to the attribute value, the search range is significantly reduced, the number of times the lookup key needs to match with the policy entries in the storage unit is reduced, and the unnecessary waste of power caused by searching for policies in storage units that do not store policies corresponding to attribute values ​​is reduced, thus lowering the power consumption of policy lookup.

[0023] In some implementations, the lookup step based on the first lookup key and the lookup step based on the second lookup key are executed in parallel within the same clock cycle.

[0024] Since the first and second strategies are found within the same clock cycle, the speed of obtaining multiple strategies corresponding to multiple attribute values ​​of the same attribute is improved, thereby increasing the efficiency of strategy lookup.

[0025] In some implementations, obtaining the attribute value set of the first attribute of the endpoint of the data packet includes: obtaining the attribute value set of the first attribute of the endpoint carried in the data packet; or, obtaining the attribute value set of the first attribute of the endpoint based on the field content carried in the data packet and a third correspondence, wherein the third correspondence includes the field content and the attribute value set of the first attribute.

[0026] Based on the above implementation method, the solution is applicable to both cases where the data packet directly carries the set of attribute values ​​of the first attribute of the network object and cases where the set of attribute values ​​implicitly indicates the first attribute of the network object.

[0027] In some implementations, the network object includes a user, the first attribute includes a security group, and the attribute value set includes multiple security groups to which the user belongs; or, the first attribute includes a user, the first attribute value includes a job position, and the attribute value set includes multiple job positions to which the user belongs; or, the first attribute includes a terminal location, the first attribute value includes a security zone, and the attribute value set includes multiple security zones to which the terminal location belongs.

[0028] Secondly, a policy lookup method is provided, applied to a forwarding device, the forwarding device including a memory. The method includes: receiving a data packet from another device; obtaining a set of attribute values ​​of a first attribute of an endpoint of the data packet, wherein the endpoint of the data packet includes an initiating network object of the data packet or a destination network object of the data packet, and the set of attribute values ​​of the first attribute includes a first attribute value and a second attribute value of the first attribute; determining a lookup key based on the set of attribute values ​​of the first attribute, the lookup key including a first packet encoding and a first attribute value sequence encoding, wherein the first packet encoding is used to identify a first packet, the first packet including the first attribute value and the second attribute value, and in the first attribute value sequence encoding, a first bit corresponding to the first attribute value is set to a first bit value, and a second bit corresponding to the second attribute value is set to a second bit value. The system retrieves a strategy from the memory that matches the lookup key based on the lookup key, thereby obtaining a strategy set corresponding to the attribute value set. The strategy set includes a first strategy and a second strategy. The first strategy corresponds to the first attribute value and matches the lookup key, and the second strategy corresponds to the second attribute value and matches the lookup key. The first strategy includes a first block code and a first mask sequence. In the first mask sequence, the first bit corresponding to the first attribute value is set to the first bit value, and the other bits in the first mask sequence besides the first bit bit include the mask. The second strategy includes the first block code and a second mask sequence. In the second mask sequence, the second bit corresponding to the second attribute value is set to the second bit value, and the other bits in the second mask sequence besides the second bit bit include the mask. The data packet is then processed based on the strategy set.

[0029] To address the limitation of representing only (k+m) attribute values ​​due to each bit in the lookup key representing a single attribute value, a new approach is proposed. This addresses the issue of limited attribute values ​​that can be represented by (k+m) bits, as each bit in the lookup key represents a single attribute value. The lookup key, containing both block encoding and attribute value sequence encoding, is matched against the block encoding and mask sequence contained in the policy entries. This allows for the search of multiple policies corresponding to multiple attribute values. Furthermore, the number of bits in the block encoding can grow exponentially with the number of attribute values ​​that can be represented. Therefore, a lookup key of (k+m) bits (k bits of block encoding and m bits of attribute value sequence encoding) can represent at most 2... k With *m attribute values, a large number of attribute values ​​can be represented using fewer bits, thus saving the number of bits required to represent attribute values ​​in policy entries, and consequently saving the storage space occupied by policy entries in memory, thereby saving storage overhead.

[0030] Furthermore, since the attribute value sequences stored in the multiple policy entries corresponding to multiple attribute values ​​all contain masks, the mask matching function can hit multiple policy entries within one clock cycle, thereby reducing the total time required to find multiple policy entries corresponding to multiple attribute values ​​and improving the performance of policy lookup.

[0031] In some implementations, prior to the strategy of searching the memory for a match based on the lookup key, the method further includes:

[0032] In response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, the first attribute value and the second attribute value are assigned to the first group based on constraints. The constraints include that each set of attribute values ​​of the same attribute is at least a subset of the set of attribute values ​​in a group, and that an attribute value is assigned to at least one group, and that a group belongs to only one attribute.

[0033] By introducing the aforementioned constraints, the technical difficulty of distinguishing and configuring the correspondence between groups and attributes is reduced. It eliminates the need to differentiate attribute values ​​for different attributes within the same group, thus lowering the complexity of management and configuration. Furthermore, it reduces the risk of being unable to represent potential sets of attribute values ​​through group encoding.

[0034] In some implementations, after classifying the first attribute value and the second attribute value into the first group based on constraints, the method further includes:

[0035] The first group is encoded to obtain the first group code;

[0036] The first attribute value is encoded to obtain the first mask sequence, and the second attribute value is encoded to obtain the second mask sequence;

[0037] The first block code and the first mask sequence are stored in the first strategy, and the first block code and the second mask sequence are stored in the second strategy.

[0038] In some implementations, the set of attribute values ​​for the first attribute of the endpoint of the data packet includes:

[0039] Obtain the attribute value set of the first attribute and the attribute value set of the second attribute of the endpoint of the data packet. The endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet. The attribute value set of the second attribute includes the third attribute value and the fourth attribute value of the second attribute.

[0040] Determining the lookup key based on the set of attribute values ​​of the first attribute includes:

[0041] Based on the attribute value set of the first attribute and the attribute value set of the second attribute, a lookup key is determined. The lookup key further includes a second group code and a second attribute value sequence code. The second group code is used to identify a second group, which includes a third attribute value and a fourth attribute value. In the second attribute value sequence code, the third bit corresponding to the third attribute value includes a third bit value, and in the fourth attribute value sequence code, the fourth bit corresponding to the fourth attribute value includes a fourth bit value. Accordingly,

[0042] The first strategy further includes the second block code and the third mask sequence. In the third mask sequence, the third bit corresponding to the third attribute value includes the third bit value, and the other bits in the third mask sequence besides the third bit include the mask. The second strategy further includes the second block code and the third mask sequence. The strategy set further includes the third strategy and the fourth strategy. The third strategy includes the first block code, the first mask sequence, the second block code, and the fourth mask sequence. In the fourth mask sequence, the fourth bit corresponding to the fourth attribute value includes the fourth bit value, and the other bits in the fourth mask sequence besides the fourth bit include the mask. The fourth strategy includes the first block code, the second mask sequence, the second block code, and the fourth mask sequence.

[0043] In some implementations, the set of strategies is found within the same clock cycle.

[0044] In some implementations, the set of attribute values ​​for the first attribute of the endpoint of the data packet includes:

[0045] Obtain the set of attribute values ​​for the first attribute of the endpoint carried in the data packet; or,

[0046] Based on the field content and corresponding relationship carried in the data message, the attribute value set of the first attribute of the endpoint is obtained, and the corresponding relationship includes the field content and the attribute value set of the first attribute.

[0047] Thirdly, a policy lookup device is provided, disposed in a forwarding device, the forwarding device including a memory, the memory including a first storage unit and a second storage unit, the device comprising:

[0048] A receiving unit is configured to receive a data packet from another device and obtain a set of attribute values ​​of a first attribute of the endpoint of the data packet. The endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet. The set of attribute values ​​includes a first attribute value of the first attribute and a second attribute value of the first attribute.

[0049] The processing unit is configured to determine a set of lookup keys based on the set of attribute values, wherein the set of lookup keys includes a first lookup key corresponding to the first attribute value and a second lookup key corresponding to the second attribute value;

[0050] A lookup unit is configured to search for a strategy matching the first lookup key in the first storage unit based on the first lookup key, and to search for a strategy matching the second lookup key in the second storage unit based on the second lookup key, so as to obtain a strategy set corresponding to the attribute value set. The strategy set includes a first strategy and a second strategy. The first strategy corresponds to the first attribute value and matches the first lookup key, and the second strategy corresponds to the second attribute value and matches the second lookup key. The lookup step based on the first lookup key and the lookup step based on the second lookup key are executed in parallel.

[0051] The processing unit is further configured to process the data packets based on the policy set.

[0052] In some embodiments, the processing unit is further configured to, in response to the existence of a network object in the communication network where the forwarding device is located that simultaneously possesses the first attribute value and the second attribute value, store a first strategy corresponding to the first attribute value in the first storage unit and a second strategy corresponding to the second attribute value in the second storage unit; or, in response to the absence of a network object in the communication network where the forwarding device is located that simultaneously possesses the first attribute value and the third attribute value, store the first strategy corresponding to the first attribute value and the third strategy corresponding to the third attribute value in the first storage unit; or, in response to the existence of a network object in the communication network where the forwarding device is located that simultaneously possesses the first attribute value and the second attribute value, and both the first strategy corresponding to the first attribute value and the second strategy corresponding to the second attribute value are stored in the first storage unit, migrate the second strategy from the first storage unit to the second storage unit.

[0053] In some embodiments, the processing unit is further configured to record a first correspondence and a second correspondence, wherein the first correspondence includes the first attribute value and the identifier of the first storage unit, and the second correspondence includes the second attribute value and the identifier of the second storage unit.

[0054] In some implementations, the first storage unit includes one or more slices, and the first policy corresponding to the first attribute value includes multiple policy entries. The processing unit is configured to store the multiple policy entries in one slice if the total storage capacity required by the multiple policy entries does not exceed the storage capacity of one slice; or, if the total storage capacity required by the multiple policy entries exceeds the storage capacity of one slice, store different policy entries among the multiple policy entries in different slices among the multiple slices.

[0055] In some embodiments, the processing unit is configured to obtain an identifier of the first storage unit based on the first attribute value and a first correspondence, determine the first storage unit based on the identifier of the first storage unit, wherein the first correspondence includes the first attribute value and the identifier of the first storage unit; obtain an identifier of the second storage unit based on the second attribute value and a second correspondence, determine the second storage unit based on the identifier of the second storage unit, wherein the second correspondence includes the second attribute value and the identifier of the second storage unit.

[0056] In some implementations, the processing unit is configured to execute the lookup step based on the first lookup key and the lookup step based on the second lookup key in parallel within the same clock cycle.

[0057] In some implementations, the processing unit is configured to obtain a set of attribute values ​​for the first attribute of the endpoint carried in the data packet; or, based on the field content carried in the data packet and a third correspondence, obtain a set of attribute values ​​for the first attribute of the endpoint, wherein the third correspondence includes the field content and the set of attribute values ​​for the first attribute.

[0058] In some implementations, the network object includes a user, the first attribute includes a security group, and the set of attribute values ​​includes multiple security groups to which the user belongs; or,

[0059] The first attribute includes a user, the first attribute value includes a job title, and the set of attribute values ​​includes multiple job titles to which the user belongs; or,

[0060] The first attribute includes the terminal location, the first attribute value includes a security zone, and the set of attribute values ​​includes multiple security zones to which the terminal location belongs.

[0061] Fourthly, a policy lookup device is provided, disposed in a forwarding device, the forwarding device including a memory, the device comprising:

[0062] A receiving unit is configured to receive a data packet from another device and obtain a set of attribute values ​​for a first attribute of the endpoint of the data packet. The endpoint of the data packet includes either the initiating network object of the data packet or the destination network object of the data packet. The set of attribute values ​​for the first attribute includes a first attribute value and a second attribute value of the first attribute.

[0063] The processing unit is configured to determine a lookup key based on the set of attribute values ​​of the first attribute. The lookup key includes a first group code and a first attribute value sequence code. The first group code is used to identify a first group. The first group includes the first attribute value and the second attribute value. In the first attribute value sequence code, the first bit corresponding to the first attribute value is set to the first bit value, and the second bit corresponding to the second attribute value is set to the second bit value.

[0064] A lookup unit is configured to search for a strategy matching the lookup key in the memory based on the lookup key, so as to obtain a strategy set corresponding to the attribute value set. The strategy set includes a first strategy and a second strategy. The first strategy corresponds to the first attribute value and matches the lookup key, and the second strategy corresponds to the second attribute value and matches the lookup key. The first strategy includes a first block code and a first mask sequence. In the first mask sequence, the first bit corresponding to the first attribute value is set to the first bit value, and the other bits in the first mask sequence other than the first bit bit include the mask. The second strategy includes the first block code and a second mask sequence. In the second mask sequence, the second bit corresponding to the second attribute value is set to the second bit value, and the other bits in the second mask sequence other than the second bit bit include the mask.

[0065] The processing unit is further configured to process the data packets based on the policy set.

[0066] In some implementations, the processing unit is further configured to, in response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, classify the first attribute value and the second attribute value into the first group based on constraints, wherein the constraints include that each set of attribute values ​​of the same attribute is at least a subset of the set of attribute values ​​in a group, and that an attribute value is assigned to at least one group, and that a group belongs to only one attribute.

[0067] In some embodiments, the processing unit is further configured to encode the first group to obtain the first group code; encode the first attribute value to obtain the first mask sequence; and encode the second attribute value to obtain the second mask sequence; store the first group code and the first mask sequence in the first strategy, and store the first group code and the second mask sequence in the second strategy.

[0068] In some implementations, the processing unit is configured to obtain a set of attribute values ​​for a first attribute and a set of attribute values ​​for a second attribute of the endpoint of the data packet. The endpoint of the data packet includes either the initiating network object of the data packet or the destination network object of the data packet. The set of attribute values ​​for the second attribute includes a third attribute value and a fourth attribute value of the second attribute. Based on the set of attribute values ​​for the first attribute and the set of attribute values ​​for the second attribute, a lookup key is determined. The lookup key further includes a second block code and a second attribute value sequence code. The second block code is used to identify a second block. The second block includes a third attribute value and a fourth attribute value. In the second attribute value sequence code, the third bit corresponding to the third attribute value includes a third bit value, and in the fourth attribute value sequence code, the fourth bit corresponding to the fourth attribute value includes a fourth bit value. Accordingly,

[0069] The first strategy further includes the second block code and the third mask sequence. In the third mask sequence, the third bit corresponding to the third attribute value includes the third bit value, and the other bits in the third mask sequence besides the third bit include the mask. The second strategy further includes the second block code and the third mask sequence. The strategy set further includes the third strategy and the fourth strategy. The third strategy includes the first block code, the first mask sequence, the second block code, and the fourth mask sequence. In the fourth mask sequence, the fourth bit corresponding to the fourth attribute value includes the fourth bit value, and the other bits in the fourth mask sequence besides the fourth bit include the mask. The fourth strategy includes the first block code, the second mask sequence, the second block code, and the fourth mask sequence.

[0070] In some implementations, the set of strategies is found within the same clock cycle.

[0071] In some implementations, the processing unit is configured to obtain a set of attribute values ​​for the first attribute of the endpoint carried in the data packet; or, based on the field content and the corresponding relationship carried in the data packet, obtain a set of attribute values ​​for the first attribute of the endpoint, wherein the corresponding relationship includes the field content and the set of attribute values ​​for the first attribute.

[0072] Fifthly, a computer-readable storage medium is provided, which stores at least one instruction that, when executed on a computer, causes the computer to perform the method provided in the first aspect or any alternative method of the first aspect.

[0073] In a sixth aspect, a computer program product is provided, the computer program product comprising one or more computer program instructions, which, when loaded and run by a computer, cause the computer to perform the method provided in the first aspect or any alternative method of the first aspect.

[0074] In a seventh aspect, a chip is provided, including a memory and a processor, the memory for storing computer instructions, and the processor for calling and executing the computer instructions from the memory to perform the methods described in the first aspect and any possible implementation thereof.

[0075] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0076] Figure 1 is a schematic diagram illustrating the matching of a lookup key extracted from a data packet with a policy entry stored in a TCAM, according to an embodiment of this application.

[0077] Figure 2 is a schematic diagram of a forwarding device using a lookup key to compare policy entries stored in TCAM according to an embodiment of this application;

[0078] Figure 3 is a schematic diagram of a strategy configuration in a single-attribute, single-value scenario provided by an embodiment of this application;

[0079] Figure 4 is a schematic diagram of a method for configuring additional policy entries based on a multi-value set according to an embodiment of this application;

[0080] Figure 5 is a schematic diagram of a search strategy using Scheme 2 provided in an embodiment of this application;

[0081] Figure 6 is a schematic diagram of a search strategy using Scheme 3 provided in an embodiment of this application;

[0082] Figure 7 is a schematic diagram of a serial search strategy provided in an embodiment of this application;

[0083] Figure 8 is a schematic diagram of a parallel search strategy provided in an embodiment of this application;

[0084] Figure 9 is a schematic diagram of another parallel search strategy provided in an embodiment of this application;

[0085] Figure 10 is a schematic diagram of the architecture of a network system provided in an embodiment of this application;

[0086] Figure 11 is a flowchart of a strategy search method provided in an embodiment of this application;

[0087] Figure 12 is a flowchart of another strategy search method provided in an embodiment of this application;

[0088] Figure 13 is a flowchart of another strategy search method provided in an embodiment of this application;

[0089] Figure 14 is a schematic diagram of a strategy search device provided in an embodiment of this application;

[0090] Figure 15 is a schematic diagram of another strategy search device provided in an embodiment of this application;

[0091] Figure 16 is a schematic diagram of the structure of a forwarding device provided in an embodiment of this application. Detailed Implementation

[0092] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0093] The following explains some terms and concepts involved in the embodiments of this application.

[0094] (1) Masks and mask matching

[0095] A mask is a bit value that can match both 0 and 1. Bit values ​​typically include 0 and 1, while a mask represents a third bit value besides 0 and 1. Masks are usually represented by an asterisk ("*"). A mask signifies "Don't Care," meaning that it can match any bit value, whether it's 0 or 1. Mask matching, also known as fuzzy matching, refers to the method of matching a mask with a bit value. Many memories have a third state—a mask—in addition to 0 and 1 for each storage location. Taking a ternary content addressable memory (TCAM) that supports mask matching as an example, please refer to Figure 1. Figure 1 shows a specific example of how to match a lookup key extracted from a data packet with a policy entry stored in the TCAM. As shown in Figure 1, the lookup key extracted by the forwarding device from the data packet is 1000. The search for key1000 matches policy entry 1, which contains the bit value sequence 1000; policy entry 3, which contains the bit value sequence 10*0; and policy entry 5, which contains the bit value sequence *000. As shown in Figure 1, the mask matching method supports performing a single match search to hit multiple data entries in the TCAM. This is one manifestation of TCAM's parallel search capability, essentially a capability of TCAM mask matching. In Figure 1, to distinguish between policy entries that match the search key and those that do not, bold italics represent the keys stored in policy entries that match the search key, while non-bold, non-italicized text represents the keys stored in policy entries that do not match the search key.

[0096] (2) Attributes

[0097] Attributes are used to describe the characteristics of a specific network object (such as a user initiating access or a network resource being accessed). In some embodiments of this application, attributes are obtained by the forwarding device based on the received packet. For example, an attribute is a field carried in the packet, and the attribute value is a field value extracted from the field carried in the packet. For example, if the attribute is a source IP address, the attribute value is the source Internet Protocol (IP) address value extracted from the source IP address field of the packet, such as 192.168.1.1. Another example is a destination IP address, and the attribute value is the destination IP address value extracted from the destination IP address field of the packet. Yet another example is an attribute obtained by parsing or converting fields carried in the packet. For example, attributes may include source identity, destination identity, company, location, security level, port, department, or position.

[0098] For example, after receiving a data packet, the forwarding device extracts attribute values ​​from the data packet and constructs a lookup key based on the extracted attribute values. Then, the forwarding device compares this lookup key with policy entries stored in the TCAM. If a policy is matched, the forwarding device executes the action corresponding to that policy entry. For example, referring to Figure 2, taking the extraction of identity attributes as an example, after the forwarding device extracts the source IP address and destination IP address from the data packet, it converts the source IP address and destination IP address into two attribute values: a source security group identifier (ID) and a destination security group ID. These two security group IDs constitute the important content of the lookup key, which the forwarding device then uses to compare with policy entries stored in the TCAM.

[0099] (3) Attribute value set

[0100] An attribute value set is a collection of multiple attribute values. For example, an attribute value set includes one or more attribute values ​​of one or more attributes. An attribute value set is also called a multi-value set or a multi-value combination. For example, attribute A has attribute values ​​a, b, and c. One set of attribute values ​​for attribute A is, for example, {attribute value a, attribute value b}. Another set of attribute values ​​for attribute A is, for example, {attribute value a, attribute value c}. Yet another set of attribute values ​​for attribute A is, for example, {attribute value b, attribute value c}. As a concrete example, attribute A is identity, and the range of values ​​for identity attributes includes the Financial Security Group, Sales Security Group, and Operations Security Group. If an employee belongs to both the Financial Security Group and the Sales Security Group, then the set of attribute values ​​for attribute A would be, for example, {Financial Security Group, Sales Security Group}.

[0101] (4) Domain grouping and grouping encoding

[0102] Domain groups, also known as groups or attribute value groups, consist of one or more attribute values ​​for the same attribute. The attribute values ​​within a domain group may be ordered. Group encoding, also called domain group encoding, domain code, or domain group identifier, identifies the group to which a set of attribute values ​​(e.g., a set of identity values) belongs. Group encoding is, for example, a domain group number. Different domain groups typically have different group encodings. The main function of group encoding is to increase the number of attribute values ​​that can be represented. For example, the number of attribute values ​​that a group encoding can represent is a power of 2 related to the number of bits in the group encoding. If a group encoding consists of k bits, it can represent 2^k groups. If each group represents one attribute value, a k-bit group encoding can represent at most 2^k attribute values; if each group represents N attribute values, a k-bit group encoding can represent at most N*2^k attribute values. Therefore, the number of attribute values ​​that a group encoding can represent can grow exponentially with the number of bits in the group encoding. In some implementations, different domain groups have different group codes, which can distinguish attribute values ​​in different domain groups, thereby helping to characterize more possible attribute values.

[0103] In some implementations, the block encoding takes the form of a bitmap, and the block encoding is a binary sequence. For example, the block encoding for domain1 is [...] 001, the block encoding for domain2 is [...] 010, and the block encoding for domain3 is [...] 011. The ellipsis [...] indicates bits present in the block encoding but not shown. The length of the block encoding is set, for example, based on the number of attribute values ​​to be represented. For example, the more attribute values ​​to be represented, the longer the block encoding.

[0104] (5) Attribute value sequence encoding

[0105] An attribute value sequence code is used to represent a set of attribute values ​​for the same attribute, or in other words, to represent which attribute values ​​an attribute has. For example, an attribute value sequence code is used to represent a set of attribute values ​​for an attribute that are attribute values ​​in a domain group. In some implementations, the attribute value sequence code has the form of a bitmap. To distinguish between attribute value sequence codes stored in the description strategy and attribute value sequence codes constructed based on data packets, this specification uses "mask sequence" to describe attribute value sequence codes stored in the strategy and "attribute value sequence code" to describe attribute value sequence codes constructed based on data packets throughout the document.

[0106] The attribute value sequence encoding constructed based on the data packet is used to identify which attribute values ​​were obtained based on the data packet. Optionally, the attribute value sequence encoding uses bits set to predetermined bit values ​​to identify that the attribute value corresponding to that bit was obtained based on the data packet (e.g., the data packet carries the attribute value corresponding to that bit, or the field content in the data packet can be parsed and converted into the attribute value corresponding to that bit). If multiple bits in the attribute value sequence encoding are all set to predetermined bit values, it indicates that multiple attribute values ​​of the same attribute were obtained simultaneously based on the data packet. For example, the data packet carries multiple attribute values ​​corresponding to those multiple bits, or the field content in the data packet can be parsed and converted into multiple attribute values ​​corresponding to those multiple bits.

[0107] Optionally, the attribute value sequence constructed based on the data packet is a binary sequence. For example, each bit in the attribute value sequence encoding is either 1 or 0. A bit value of 1 indicates that the corresponding attribute value was obtained based on the data packet, and a bit value of 0 indicates that the corresponding attribute value was not obtained based on the data packet. Multiple bits in the attribute value sequence encoding are set to 1, thereby representing multiple attribute values ​​of the same attribute obtained based on the data packet. For example, if the data packet carries both attribute value 1 and attribute value 2 for attribute A, the forwarding device sets the first two bits to 1 and the third to last bits to 0 in the attribute value sequence encoding of attribute A in the lookup key constructed based on the data packet.

[0108] As a concrete example, attribute A represents identity. Attribute value 1 of attribute A is the Financial Security Group, which corresponds to the first bit in the attribute value sequence encoding. Attribute value 2 of attribute A is the Sales Security Group, which corresponds to the second bit in the attribute value sequence encoding. If, based on the IP address of a data packet initiated by employee B, both the Financial Security Group and the Sales Security Group identifiers are obtained, then the forwarding device will set both the first and second bits to 1 in the attribute value sequence encoding constructed based on this data packet, thus indicating that employee B belongs to both the Financial Security Group and the Sales Security Group.

[0109] In some implementations, if the i-th bit in the attribute value sequence encoding is 1, it indicates that the i-th attribute value in the corresponding domain group has been obtained based on the data packet. If multiple bits in the attribute value sequence encoding are all 1, it indicates that multiple attribute values ​​in the corresponding domain group have been obtained based on the data packet.

[0110] In some implementations of the attribute value sequence encoding (mask sequence) in the strategy stored in TCAM, the attribute value sequence encoding in the strategy has the form of a bit value sequence, where each bit in the attribute value sequence encoding has a value of 1, 0, or *. Specifically, a bit value of 1 indicates that the strategy matches a data packet carrying the attribute value corresponding to the bit; a bit value of 0 indicates that the strategy matches a data packet not carrying the attribute value corresponding to the bit; and a bit value of * indicates that the strategy can match a data packet regardless of whether the data packet carries the attribute value corresponding to the bit.

[0111] In some implementations, the order of bits in the attribute value sequence encoding corresponds to the order of attribute values ​​in the domain group. For example, if the i-th bit in the attribute value sequence encoding is 1 (only one bit is set to 1), it indicates that the i-th attribute value in the corresponding domain group is present, and the values ​​of all other bits are masks (*). The meaning of the mask in the attribute value sequence encoding of the strategy is that if any bit value other than the mask matches the corresponding bit value in the lookup key, the strategy will be successful. For example, if all bit values ​​other than the mask match the corresponding bit value in the lookup key, the strategy will be successful.

[0112] In some implementations, the length of the attribute value sequence encoding is equal to the attribute value capacity of the domain group. For example, the domain group includes m attribute values, and the length of the attribute value sequence encoding is m bits.

[0113] (6) Storage unit (slice)

[0114] Storage space in a TCAM can be partitioned and managed. Each partitioned storage unit in a TCAM is called a slice, which can also be referred to as a bank, block, storage slice, or cell. A slice can receive one lookup key and output the matching strategy within that slice in one clock cycle. However, a slice cannot simultaneously receive multiple lookup keys and output multiple corresponding strategies in one clock cycle. TCAMs typically have parallel lookup capabilities. One manifestation of parallel lookup capability is that multiple slices within the same TCAM can receive multiple lookup keys in the same clock cycle, thus performing strategy lookups in parallel based on these multiple lookup keys. Another manifestation of parallel lookup capability is that slices from multiple TCAMs can also receive multiple lookup keys in the same clock cycle, thus performing strategy lookups in parallel based on these multiple lookup keys.

[0115] (7) Strategy set

[0116] A policy can also be called a policy entry or access control list. A policy includes a key and an action identifier. The key stored in the policy may optionally be pre-configured by the network administrator. For further explanation of policies, please refer to the background section and the following descriptions in this manual.

[0117] A policy set refers to a collection of multiple policies. For example, a policy set includes multiple policies corresponding to multiple attribute values ​​for the same attribute. In some implementations, a policy is used to indicate the processing action corresponding to an attribute value. For example, an access control policy is used to indicate the access control action corresponding to an identity. As an example, attribute A has attribute values ​​a, b, and c. The policy set corresponding to attribute A includes policy 1, policy 2, and policy 3. Policy 1 is used to indicate the processing action to be performed on a data packet containing attribute value a. Policy 2 is used to indicate the processing action to be performed on a data packet containing attribute value b. Policy 3 is used to indicate the processing action to be performed on a data packet containing attribute value c.

[0118] (8) Access Control Policy

[0119] Access control policies are used to control a visitor's access to network resources. For example, an access control policy includes a key and a permission identifier. The key identifies the visitor's identity. The permission identifier identifies the corresponding identity's access rights to network resources.

[0120] (9) Action Markers

[0121] Action identifiers, also known as action indexes, are used to indicate the processing action to be performed on a packet. In some implementations, both the action identifier and the key are fields within the policy. When a forwarding device receives a data packet and searches the policy, if the search key constructed based on the data packet matches a key in the policy, the forwarding device will execute the action indicated by the action identifier on the data packet. In some implementations, the action identifier is in the form of numbers (such as a sequence of binary bit values), for example, 01 indicates forwarding the data packet, 00 indicates discarding the data packet, 10 indicates outputting an alarm signal, and 11 indicates redirecting the data packet. In other implementations, the action identifier is in the form of a string, for example, the action identifier is permit (forward), deny (discard), or redirect (redirect).

[0122] (10) Security Group

[0123] A security group is a collection of users, network devices, endpoints, or resources that share the same access control policy. A security group can also be understood as a user identity group. Each security group has a corresponding security group identifier. The security group identifier is used to identify the corresponding security group. For example, the security group identifier is a security group ID or a security group tag (SGT). Security groups are often referred to as identities. Access control lists based on security groups are called security group (SGACLs). Security group-based access control lists define a pair of policy enforcement rules between a source security group and a destination security group. The source security group ID is used to identify the security group to which the source IP address belongs, thus identifying the identity of the source. The destination security group ID is used to identify the security group to which the destination IP address belongs, thus identifying the identity of the destination.

[0124] (11) Memory and storage units

[0125] In this embodiment, the storage unit is equivalent to a sub-component within the memory component. A storage unit is, for example, independently manageable storage space within the memory. The memory is used to store policies. A storage unit is used to store one or more policy entries; for example, different storage units are used to store different policy entries corresponding to different attribute values. For instance, a storage unit can receive a lookup key within one clock cycle and output the policy entry in that storage unit that matches the lookup key.

[0126] Optionally, the memory used for the storage strategy is a TCAM, and the storage unit is a slice within the TCAM. Alternatively, the memory used for the storage strategy is a type of memory other than a TCAM, and correspondingly, the storage unit is a storage unit within a type of memory other than a TCAM. In some embodiments, the memory is RAM, and the storage unit is a memory chip (memory particle), storage array group, storage array, or storage row / column within the RAM. RAM is, for example, random access memory (RAM), read-only memory (ROM), dynamic random access memory (DRAM), or storage class memory (SCM). In other embodiments, the memory is a hard disk, such as a hard disk drive (HDD) or a solid-state drive (SSD).

[0127] The following are examples illustrating the application scenarios of embodiments of this application.

[0128] This application applies to scenarios where a network object has multiple attribute values ​​for one attribute (or an attribute can take multiple values), and the forwarding device searches for multiple policies corresponding to these multiple attribute values. For example, during the process of a terminal initiating a data packet to access network resources, after the forwarding device along the forwarding path between the terminal and the network resources receives the data packet, the forwarding device obtains multiple attribute values ​​for the same attribute based on the data packet. By using the method provided in this application, the forwarding device can search for multiple policies corresponding to the multiple attribute values ​​of the same attribute in parallel, thereby reducing the policy search time, improving the performance of policy search, reducing the power consumption of policy search, and also helping to apply the multiple policies to process data packets more quickly, thus improving the performance of data packet processing.

[0129] The aforementioned parallel search for multiple strategies corresponding to the same attribute means finding multiple strategies corresponding to the same attribute within a single clock cycle. In some implementations of the parallel search strategy, the forwarding device employs a separate search strategy approach. For example, within a single clock cycle, the forwarding device matches multiple search keys with policy entries stored in multiple slices of the TCAM to obtain multiple policies matching multiple search keys. Since multiple slices can perform parallel search matching with multiple search keys within the same clock cycle, the forwarding device's action of searching for policies corresponding to attribute values ​​from different slices can be executed simultaneously, thus enabling multiple policies to be matched within a single clock cycle. In other implementations of the parallel search strategy, the forwarding device matches the search key with a key containing a mask in the TCAM. Since the mask can match both bit values ​​0 and 1, multiple policies in the TCAM can be matched by performing a single matching search, thus enabling multiple policies to be matched within a single clock cycle.

[0130] The following examples further illustrate the application scenarios.

[0131] Previously, each attribute of a data packet sent by a terminal could typically only take one value, and network administrators usually configured policies based on a single attribute value. Taking identity as an example, enterprises would generally set up corresponding security groups based on departments or positions, and then divide different employees into different security groups. Usually, an employee could only belong to one security group, meaning that an employee's identity attribute would only have one attribute value.

[0132] For example, please refer to Figure 3, which shows a schematic diagram of policy configuration in a single-attribute, single-value scenario. Each row in Figure 3 represents a policy entry, and each column represents a network resource (server) whose access permissions can be configured. A √ in Figure 3 indicates access permission to the corresponding server, and an × indicates no access permission to the corresponding server. The network administrator configures Policy 1 for the Financial Security Group and Policy 2 for the Sales Security Group. Policy 1 allows access to the Audit Server, Cashier Server, and Reimbursement Server. Policy 2 allows access to the Product Data Server, Order Server, After-Sales Server, Customer Service Server, and Transaction Server. The attribute values ​​for the identity attribute include Financial Security Group and Sales Security Group. The network administrator configures the policy for the Financial Security Group to allow access to the Audit Server, Cashier Server, and Reimbursement Server, and configures the policy for the Sales Security Group to allow access to the Product Data Server, Order Server, After-Sales Server, Customer Service Server, and Transaction Server. The network administrator assigns employee A and employee B from the Financial Security Group to the Financial Security Group, and assigns employee C from the Sales Security Group to the Sales Security Group.

[0133] However, with societal development, data access models have become increasingly complex and refined, leading to application scenarios with multiple values ​​for a single attribute (i.e., the same network object having multiple attribute values ​​for the same attribute). Yet, the strategies are still configured based on a single attribute value. Taking identity as an example, companies often have employee secondments. For instance, employee B from the Finance Security Group might be temporarily seconded to the Sales Security Group. Employee B would need permissions for both the Finance Security Group and the Sales Security Group, resulting in a situation where employee B's identity attribute needs to have two values: one for Finance Security Group and one for Sales Security Group. For such scenarios with multiple attribute values, the following solutions are available.

[0134] Option 1: Configure additional attribute values ​​and corresponding strategy entries for a multi-valued set of the same attribute.

[0135] In some implementations, if an attribute A of a network object has multiple attribute values, the network administrator adds an attribute value S, which represents a set of multiple values ​​for attribute A. A set of multiple values ​​refers to a collection of multiple attribute values ​​for the same attribute. For example, if attribute A has attribute values ​​a, b, and c, the network administrator adds attribute value S, which represents the set of attribute values ​​a, b, and c. The network administrator then configures a corresponding policy entry for attribute value S, which indicates the resources that a network object with attribute value S can access. In this embodiment, attribute A is used to refer to an attribute that can simultaneously take multiple attribute values; the meaning of attribute A in the following text is the same.

[0136] For example, attribute A is identity, and the multi-value set of attribute A is the Financial Security Group and the Sales Security Group. Employee B's attribute A having a multi-value set means that employee B simultaneously has access permissions for both the Financial Security Group and the Sales Security Group. The following example, along with Figure 4, illustrates how to configure additional policy entries based on multi-value sets. Referring to Figure 4, when employee B, who has already been assigned to the Financial Security Group, is temporarily transferred to the Sales Security Group, it's equivalent to employee B belonging to both groups. To represent that employee B simultaneously has access permissions for both groups, the network administrator creates a new security group called the Financial and Sales Security Group. The Financial and Sales Security Group is a new attribute value for the identity attribute. The attribute value Financial and Sales Security Group represents having both the Financial Security Group and Sales Security Group identity attributes. Employees within the Financial and Sales Security Group simultaneously have access permissions for both groups. The network administrator configured the servers accessible to the Finance Security Group and the Sales Security Group to be accessible to both Finance and Sales Security Groups. Then, the network administrator changed employee B's identity attribute value to Finance and Sales Security Group, so that employee B has permission to access servers allowed by both Finance Security Group and Sales Security Group.

[0137] Option 2: Use a serial lookup strategy for each attribute value in the multi-value set.

[0138] For example, when an attribute of a network object has multiple values, the forwarding device records all the attribute values ​​appearing on the same network object. When executing a policy, the forwarding device constructs a lookup key using each attribute value and then matches the policy using that lookup key. That is, the forwarding device uses a serial or cyclic lookup approach. For instance, if an attribute has N values, the forwarding device uses lookup key 1 (for attribute value 1) to find a matching policy in clock cycle 1; in clock cycle 2, it uses lookup key 2 (for attribute value 2); in clock cycle 3, it uses lookup key 3 (for attribute value 3); and so on, until in clock cycle N, the forwarding device uses lookup key N (for attribute value N) to find a matching policy.

[0139] In a specific example, still using the attribute as the identity attribute, please refer to Figure 5, which illustrates the lookup strategy under Scheme 2. First, the forwarding device records the correspondence between employee B's IP address and the ID of the financial security group, and the correspondence between employee B's IP address and the ID of the sales security group. During policy matching, the forwarding device receives a data packet initiated by employee B. The source IP address field of the data packet carries employee B's IP address (Src ip B). The forwarding device parses and extracts employee B's IP address from the data packet. Based on employee B's IP address, the forwarding device looks up the pre-recorded correspondence to obtain the IDs of the financial security group and the sales security group. The forwarding device constructs a first lookup key based on the financial security group ID and a second lookup key based on the sales security group ID. The forwarding device uses the first lookup key to match the policy for the first time, finding that access to the audit server, cashier server, and expense reimbursement server is allowed. The forwarding device uses the second lookup key to match the policy for the second time, finding that access to the audit server, cashier server, expense reimbursement server, product data server, order server, after-sales server, and customer service server is allowed.

[0140] Option 3: Use a bitmap to represent multiple values ​​for a single attribute.

[0141] In Scheme 3, a bitmap is used to represent the values ​​of a certain attribute. Each bit in the lookup key constructed based on the packet represents one attribute value. For example, if a bit value is 1, it means that the attribute has a value represented by that bit. Furthermore, when using a bitmap to represent multiple values ​​for a single attribute, the network administrator still configures policies based on a single attribute value. That is, in the policy entries stored in the TCAM, attributes with multiple value requirements are also represented using a bitmap, but this bitmap has only one bit valued at 1, with the remaining bits set to a mask "*". This means that as long as there is an attribute value corresponding to a bit value of 1, the policy entry will be matched. Similarly, in the lookup key, a bitmap is used to represent multiple attribute values. In this case, multiple bits in the attribute's bitmap are 1, and the remaining bits are 0, indicating that a certain attribute in the data packet has multiple attribute values. Because the bitmap has multiple bits with values ​​of 1, the lookup key can match policy entries in the TCAM with multiple attribute values. Alternatively, if the bit value of the key in the lookup key or strategy entry is 0, it means that the attribute has a corresponding attribute value. In the following examples, a bit value of 1 will be used to represent the value including the corresponding attribute value.

[0142] Taking identity attributes as an example, please refer to Figure 6, which illustrates the lookup strategy under Scheme 3. The identity attributes have three values ​​in sequence: Finance, Sales, and Legal. Finance corresponds to the first bit, Sales to the second bit, and Legal to the third bit. Therefore, the bitmap of the identity attribute stored in the TCAM's Finance security group strategy entry is "1**", with the first bit of this bitmap being 1, indicating the Finance security group. Similarly, the bitmap of the identity attribute stored in the TCAM's Sales security group strategy entry is "*1*", with the second bit of this bitmap being 1, indicating the Sales security group. Likewise, the bitmap of the identity attribute stored in the TCAM's Legal identity strategy entry is "**1", with the third bit of this bitmap being 1, indicating the Sales security group.

[0143] Similarly, for example, if employee B's identity attributes are "Finance" and "Sales," the network administrator establishes a mapping between user B's IP address and the identifier of the Finance security group, as well as another mapping between user B's IP address and the identifier of the Finance security group. When the forwarding device receives a data packet initiated by employee B, the source IP address field of the data packet carries employee B's IP address (Src ip B). The forwarding device parses and extracts employee B's IP address from the data packet. Based on employee B's IP address, the forwarding device looks up the pre-recorded mapping to obtain the IDs of the Finance security group and the Sales security group. The forwarding device converts the Finance security group ID and the Sales security group ID into a bitmap, resulting in a bitmap with the first three bits set to "110," i.e., 1100000000... in Figure 6, where the ellipsis represents the bits of attributes other than the identity attribute (not shown in the figure). The first bit and the second bit in this bitmap are both 1, indicating that employee B has two identity attributes: finance and sales. When performing strategy matching, if only identity attributes are considered, since the lookup key "110" matches "1**" stored in the finance strategy entry and "*1*" stored in the sales strategy entry, the lookup key will match both the finance strategy entry and the sales strategy entry, thus obtaining two strategy entries in one lookup match.

[0144] However, through research and analysis, the inventors discovered that each of the three solutions mentioned above has its own shortcomings.

[0145] When using Option 1, for an attribute value set consisting of multiple attribute values, it's necessary to configure not only each individual attribute value and its corresponding policy entry, but also the entire attribute value set as a whole. Since the policy entries for the entire attribute value set are essentially a superposition of the policy entries for each individual attribute value, it's equivalent to repeatedly configuring already configured policy entries. This leads to cumbersome configuration and an increased number of policy entries, potentially causing insufficient TCAM table resources. Furthermore, a significant increase in attribute values ​​can cause an explosion of attribute values, placing a huge workload on network administrators.

[0146] As shown in Figure 4, the policy corresponding to the Finance and Sales security group is essentially the superposition of the policy corresponding to the Finance security group and the policy corresponding to the Sales security group. Configuring the policy corresponding to the Finance and Sales security group is equivalent to reconfiguring the already configured policies corresponding to the Finance security group and the Sales security group. It can be seen that the policy configuration operation is cumbersome and the redundancy of the policy entries is also high, which wastes TCAM's storage resources.

[0147] To address the issue of cumbersome configuration and wasted storage resources caused by additional configuration of attribute values ​​and policy entries for the attribute value set in Scheme 1, some embodiments of this application determine a lookup key based on each attribute value in the attribute value set of attribute A, look up the corresponding policy based on the lookup key corresponding to each attribute value, and perform the policy lookup based on each lookup key in parallel. Therefore, it is possible to obtain the policy corresponding to each attribute value in the attribute value set almost simultaneously (e.g., within one clock cycle), without needing to additionally configure separate attribute values ​​or corresponding policy entries for the attribute value set of attribute A. Thus, while achieving policy matching for multiple values ​​of a single attribute within one clock cycle, the problem of wasting TCAM resources by adding policy entries to the attribute value set is solved.

[0148] For example, if employee B in the finance department has both the finance security group and the sales security group identity attributes, then a first lookup key is constructed based on the finance security group, and a second lookup key is constructed based on the sales security group. Using the first lookup key, the policy corresponding to the finance security group is searched, resulting in three policies: allowing access to the audit server, allowing access to the cashier server, and allowing access to the expense reimbursement server. Using the second lookup key, the policy corresponding to the sales security group is searched, resulting in five policies: allowing access to the product data server, allowing access to the order server, allowing access to the after-sales server, allowing access to the customer service server, and allowing access to the transaction server. The search is performed in parallel. In other words, the actions of searching for the policy corresponding to the finance security group and searching for the policy corresponding to the sales security group are executed almost simultaneously. Therefore, within one clock cycle, it is possible to simultaneously find eight policies corresponding to the set composed of the finance security group and the sales security group, without needing to configure separate policies or attribute values ​​specifically for the set composed of the finance security group and the sales security group. It is evident that the implementation method of this application greatly simplifies the complexity of policy configuration and saves the storage space required for policy entries.

[0149] When using Scheme 2, the forwarding device employs a serial or loop-based search method. After parsing multiple attribute values ​​from a packet, the forwarding device needs to sequentially perform a policy lookup step for each attribute value on the same slice. This excessive number of searches results in a long time spent finding multiple policies. This prolonged policy lookup time slows down the forwarding device's forwarding processing of packets based on policies, leading to a significant degrade in forwarding performance. The more attribute values ​​the forwarding device extracts from the packet (e.g., the more identities a user possesses in the example above), the more severe the performance degradation. This is because if an attribute in a data packet has N attribute values, to find the N policies corresponding to those N attribute values ​​(e.g., access permissions for N identities), the forwarding device would need to serially search for the policy corresponding to the first attribute value in the first clock cycle, the second in the second clock cycle, the ith in the ith clock cycle, and so on, taking N clock cycles in total. Therefore, this method results in the number of TCAM lookups increasing linearly with the number of attribute values. The number of clock cycles required to find N strategies also increases linearly with the number of attribute values. To find N strategies, N strategy lookups are required, occupying N clock cycles.

[0150] In a specific example, the attribute carried in the data packet is an identity attribute. Please refer to Figure 7, which illustrates a schematic diagram of the serial lookup strategy. For example, when a forwarding device receives a data packet, it extracts the source IP address from the data packet, for example, if the source IP address is 192.168.0.0. The forwarding device then looks up the corresponding security group ID based on the source IP address to obtain the financial security group GID 1, sales security group GID 2, and operations and maintenance security group GID N. The processor constructs lookup keys for each of the three security group IDs: financial GID 1, sales GID 2, and operations and maintenance security group GID N, and performs policy matching. For example, the processor constructs lookup key 1 based on financial GID 1, lookup key 2 based on sales GID 2, and lookup key N based on operations and maintenance security group GID N. In clock cycle 1, the processor searches for security policy 1 in TCAM slice X that matches search key 1; after finding security policy 1, the processor searches for security policy 2 in TCAM slice X that matches search key 2 in clock cycle 2; after finding security policy 2, the processor searches for the corresponding security policy in TCAM slice X that matches search key N in clock cycle N.

[0151] To address the issue in Scheme 2 where the serial lookup method, which searches for multiple policies corresponding to multiple attribute values ​​within the same slice, results in slow policy lookup speed and negatively impacts forwarding performance, some implementations in this application improve the serial lookup method to a parallel lookup method. This fully utilizes the parallel lookup capability of TCAM, allowing for the parallel lookup of multiple policies corresponding to multiple attribute values ​​across multiple slices for the same attribute. Since the actions of searching for policies corresponding to attribute values ​​in different slices can be performed simultaneously, the clock cycles required to find multiple policies do not increase significantly with the number of attribute values, thereby improving policy lookup speed, reducing the total time required to find all policies, and ultimately enhancing forwarding performance. For example, a forwarding device extracts N attribute values ​​of the same attribute from a packet, constructs N lookup keys based on these N attribute values, and then searches for policies corresponding to the N attribute values ​​in parallel from N slices within the same clock cycle. This achieves finding policies corresponding to N attribute values ​​within one clock cycle, reducing the clock cycles required to find policies corresponding to N attribute values ​​from N clock cycles to one clock cycle.

[0152] In a specific example, the attributes carried in the data packet are identity attributes. Please refer to Figure 8, which illustrates a schematic diagram of the parallel lookup strategy. In the scenario shown in Figure 8, three identity attribute values ​​are obtained based on the IP address carried in the data packet. The forwarding device constructs three lookup keys based on these three identity attribute values, and then uses these three lookup keys to find the policies corresponding to the three identity attribute values ​​within one clock cycle. Similarly, if the IP address contains more than three (e.g., N) identity attribute values, and the policies corresponding to the N identity attribute values ​​are stored in N slices, and the N slices support parallel lookup, then the forwarding device can simultaneously find the policies corresponding to the N identity attribute values ​​within one clock cycle.

[0153] Specifically, based on the IP address of employee A carried in the data packet, the forwarding device generates lookup key 1 for finance, lookup key 2 for sales, and lookup key N for legal affairs. The forwarding device performs lookup searches in parallel using lookup key 1, lookup key 2, and lookup key N within one clock cycle, thereby obtaining the strategies for finance, sales, and legal affairs within one clock cycle. In Figure 8, the arrow pointing from "Finance" to "Search key 1" indicates that "Search key 1" is constructed based on the attribute value "Finance". The arrow pointing from "Search key 1" to "Slice 1" indicates the strategy of searching for "Finance" from "Slice 1" based on "Search key 1". In Figure 8, the arrow pointing from "Sales" to "Search key 2" indicates that "Search key 2" is constructed based on the attribute value "Sales". The arrow pointing from "Search key 2" to "Slice 3" indicates the strategy of searching for "Finance" from "Slice 3" based on "Search key 2". In Figure 8, the arrow pointing from "Legal" to "Search key N" indicates that "Search key N" is constructed based on the attribute value "Legal". The arrow pointing from "Search key N" to "Slice 4" indicates the strategy of searching for "Legal" from "Slice 4" based on "Search key N".

[0154] When using Scheme 3, since each bit in the key represents one attribute value, and the storage capacity of a TCAM policy entry key is limited, when the number of possible attribute values ​​for an attribute increases, the TCAM may be unable to store the policy entry. Specifically, due to TCAM hardware limitations, the storage capacity of a TCAM policy entry key is generally less than or equal to 320 bits, resulting in a maximum of 320 possible attribute values. These 320 possible attribute values ​​could be, for example, 320 values ​​for a single attribute or a total of 320 values ​​for multiple attributes. If the number of attribute values ​​to be represented exceeds 320, the attribute value bitmap will exceed the maximum storage capacity of a TCAM policy entry key, leading to storage failure. For example, if a key is used only to represent the attribute value of one attribute, such as identity, where each bit in the key represents one identity value, and a policy stores the bitmaps of the source identity and the destination identity, a maximum of 160 identities can be represented. Because if the number of identities exceeds 160, both the bitmap representing the source identity and the bitmap representing the destination identity will exceed 160 bits. The sum of the number of bits in the source and destination identity bitmaps will exceed 320 bits (160 bits + 160 bits), causing them to exceed the general upper limit of 320 bits for the storage space of a TCAM policy entry key. Furthermore, when a key is used to represent the attribute values ​​of multiple attributes, each attribute value requires one bit in the key, resulting in an even larger number of bits in the key and thus a greater risk of exceeding the storage space of a TCAM policy entry key.

[0155] To address the issue in Scheme 3 where using each bit in the key to represent one attribute value results in a limited number of attribute values ​​that can be represented, some embodiments of this application provide a method for representing attribute values ​​using block encoding and attribute value sequence encoding. Using the block encoding method provided in this application, if the bitmap of the lookup key constructed based on the data packet includes k bits of block encoding and m bits of attribute value sequence encoding—in other words, each block is represented by k bits, and each block uses m bits to represent the attribute value sequence—then the lookup key can represent a total of 2k blocks, each containing m attributes. Therefore, when the attribute values ​​differ in different blocks, a (k+m)-bit lookup key can represent at most 2k*m attribute values. In contrast, in Scheme 3, the lookup key's bitmap includes k bits of block encoding and m bits of attribute value sequence encoding, thus representing at most (k+m) attribute values. Therefore, compared with the above scheme 3, the bitmap of the key in this embodiment, which combines group coding with the encoding of attribute value sequence, can represent a large number of attribute values, and can represent a large number of attribute values ​​with very few bits.

[0156] As a specific example, if the lookup key bitmap occupies a total of 18 bits, using the block encoding method provided in this application embodiment—for example, 8 bits are used to represent block encoding and the other 10 bits are used to represent attribute value sequence encoding—then the lookup key bitmap can represent a maximum of 28 * 10 attribute values. However, using scheme three, the lookup key bitmap can represent a maximum of (8 + 10) = 18 attribute values. Clearly, using the same number of bits, this embodiment significantly increases the number of attribute values ​​it can represent compared to scheme three, thus mitigating the limitation imposed by the limited TCAM storage length on the number of attribute values ​​that can be represented.

[0157] In some implementations, the block encoding occupies the high-order bits of the lookup key, while the attribute value sequence encoding occupies the low-order bits. For example, in a (k+m)-bit lookup key, the first k bits are the block encoding, and the last m bits are the attribute value sequence encoding. In other implementations, the block encoding occupies the low-order bits of the lookup key, while the attribute value sequence encoding occupies the high-order bits. For example, in a (k+m)-bit lookup key, the first m1 bits are the first field of the block encoding, the middle k bits are the attribute value sequence encoding, and the last m2 bits are the second field of the block encoding. This embodiment does not limit the order of the block encoding and the attribute value sequence encoding.

[0158] In some implementations, the key encoding of policy entries stored in the TCAM includes domain block encoding and attribute value sequence encoding. The lookup key constructed based on data packets also includes domain block encoding and attribute value sequence encoding. The main difference between these two types of keys is that in the attribute value sequence encoding of the policy entry corresponding to the i-th attribute value of attribute A stored in the TCAM, the i-th bit has a value of 1, while the bits of all other bits are "*". This indicates that, regardless of attributes other than attribute A, as long as the data packet includes the i-th attribute value of attribute A, it can successfully match the policy entry corresponding to the i-th attribute value of attribute A stored in the TCAM, regardless of whether the data packet includes other attribute values. In contrast, in the lookup key constructed by the forwarding device based on data packets, the bits corresponding to multiple attribute values ​​in the attribute value set carried in the data packet are all 1, indicating that the data packet carries multiple attribute values ​​of the same attribute simultaneously. Therefore, by utilizing the mask matching capability of TCAM, after performing a policy matching operation based on the lookup key constructed from the data packet, it can successfully match multiple policy entries stored in TCAM within one clock cycle. This enables the simultaneous retrieval of multiple policies corresponding to multiple attribute values ​​through a single policy lookup operation, thereby improving the speed of policy lookup.

[0159] As a specific example, if a forwarding device, based on a data packet containing both attribute values ​​'value1' and 'value2' for attribute A, sets the first bit of attribute value 'value1' and the second bit of attribute value 'value2' to 1, then the first two bits of the attribute value sequence for the lookup key attribute A are set to 1 while the other bits are set to 0. Meanwhile, in the TCAM, the attribute value sequence encoding for policy 1 corresponding to attribute value 'value1' has the first bit set to 1 while the other bits are set to *. Similarly, the attribute value sequence encoding for policy 2 corresponding to attribute value 'value2' in the TCAM has the second bit set to 1 while the other bits are set to *. Therefore, after the forwarding device performs policy matching using the TCAM mask matching capability to construct the lookup key based on the data packet, the lookup key can successfully match policy 1 and policy 2 stored in the TCAM within one clock cycle.

[0160] In some implementations of determining the domain group to which an attribute value belongs, the forwarding device, for an attribute A that has multiple attribute values, determines a multi-value set for attribute A, and then the forwarding device assigns the attribute values ​​to different domain groups based on the multi-value set. Constraints required to assign attribute values ​​to domain groups include, for example, that each attribute value is assigned to at least one domain group, and each multi-value set is at least a subset of the attribute value set in one domain group.

[0161] For example, as shown in Figure 9, the domain1 group is the attribute value group of attribute A, and the group code of the domain1 group is [……001]. The attribute value set in the domain1 group is {value 1, value 2, value 3, value 4}. In a data packet, attribute A has values ​​of value 2 and value 3. Attribute value 2 corresponds to the second bit in the attribute value sequence encoding. Attribute A has attribute value 2, which is represented by the second bit being set to 1 in the attribute value sequence encoding. Attribute A has attribute value 3, which is represented by the third bit being set to 1 in the attribute value sequence encoding. Attribute A has attribute values ​​2 and 3, which are represented by the second and third bits being both set to 1 in the attribute value sequence encoding. Therefore, the attribute value sequence encoding is [011000……]. In this case, the encoding of attribute A in the data packet is a combination of the domain1 group's block encoding [……001] and the attribute value sequence encoding [011000……]. For example, the encoding of attribute A in the data packet is [……001][011000……]. To distinguish between domain grouping encoding and attribute value sequence encoding, square brackets are added. The first square bracket is the grouping encoding of domain1, and the second square bracket is the attribute value sequence encoding. The encoding of attribute A actually stored in TCAM does not need to include square brackets.

[0162] The following examples illustrate the system operating environment applicable to the embodiments of this application.

[0163] Referring to Figure 10, Figure 10 shows a schematic diagram of the architecture of a network system 10 provided in an embodiment of this application. The network system 10 includes a local area network 110, an external network 120, and a security protection system 130.

[0164] Local area network 110 can also be called a private network or intranet. For example, LAN 110 is a campus network, a corporate intranet, or a school intranet. Multiple intranet hosts are deployed in LAN 110.

[0165] In some implementations, the internal network host acts as the access object (destination), providing access to network resources to authorized users on the external network 120. Network resources may be, for example, network applications. Examples of network applications include World Wide Web (web) applications, email applications, file storage and sharing applications, remote desktop applications, or instant messaging applications.

[0166] In other embodiments, the internal network hosts act as the access subjects (sources), initiating network access to computing devices in the external network 120. These multiple internal network hosts include, for example, terminals such as personal computers 111, servers 112, and IoT terminals such as printers 113. Different internal network hosts in the local area network 110 communicate via a private network (or intranet). In still other embodiments, some of the multiple internal network hosts act as access objects, while others act as access recipients; for example, the source and destination are different internal network hosts among the multiple internal network hosts.

[0167] External network 120 is, for example, the Internet or a cloud platform (e.g., a public cloud). Multiple computing devices are deployed in external network 120. Figure 10 illustrates this using an example where server 121 and terminal 122 are deployed in external network 120. In some embodiments, server 121 acts as the access subject, initiating network access to internal network hosts in local area network 110. In other embodiments, server 121 acts as the access object, providing accessed network resources to authorized users on internal network hosts.

[0168] Security system 130 is located between local area network 110 and external network 120. Security system 130 acts as a third party between the internal network host and server 121 in external network 120. Security system 130 includes one or more forwarding devices 131 and controller 132.

[0169] Forwarding device 131 includes, for example, at least one of firewall 131a, router 131b, or switch 131c. In some embodiments, forwarding device 131 is used to forward packets transmitted between local area network 110 and external network 120. For example, after receiving a packet from local area network 110, forwarding device 131 processes the packet according to a policy and then forwards the processed packet to external network 120. Alternatively, after receiving a packet from external network 120, forwarding device 131 processes the packet according to a policy and then forwards the processed packet to local area network 110. In still other embodiments, forwarding device 131 is used to forward packets transmitted between different internal network hosts within local area network 110.

[0170] Controller 132 is, for example, a server. In some implementations, controller 132 interacts with forwarding device 131 to issue policies to forwarding device 131. For example, a network administrator configures policies on controller 132 via command line or web interface, and controller 132 obtains the policies based on the network administrator's configuration. Controller 132 generates and sends management control plane protocol messages to forwarding device 131, the management control plane protocol messages carrying the policies. Forwarding device 131 receives and obtains the policies carried in the management control plane protocol messages.

[0171] The forwarding device 131 includes a network interface 1311, a memory 1312, and a processor 1313. The network interface 1311 is used to receive data packets from a first device other than the forwarding device 131, and optionally also to forward data packets to a second device other than the forwarding device 131. For example, the network interface 1311 is used to receive data packets from an intranet host in the local area network 110 and send data packets to a server 121 deployed in the external network 120. As another example, the network interface 1311 is used to receive data packets from a server 121 or a terminal 122 deployed in the external network 120 and send the received data packets to an intranet host in the local area network 110.

[0172] Memory 1312 is used to store policies for processing data packets received by network interface 1311. For example, memory 1312 stores policy entry 1, policy entry 2...policy entry n as shown in Figure 10. Further details about memory 1312 can be found in the explanation of terminology above.

[0173] The processor 1313 is used to obtain a lookup key based on the data packet received by the network interface 1311, search for a matching policy entry in the policy stored in the memory 1312 based on the lookup key, and process the data packet received by the network interface 1311 according to the found policy entry.

[0174] For more details on the internal hardware structure of the repeater 131, please refer to the description of the device embodiments in the following part of this specification, which will not be repeated here.

[0175] The method flow of the embodiments of this application is illustrated below.

[0176] Figure 11 is a flowchart of a strategy search method provided in an embodiment of this application.

[0177] Some implementations of the method shown in Figure 11 involve multiple attributes. To distinguish between different attributes, multiple different attributes are described using terms such as "first attribute" and "second attribute." For example, the first attribute is identity, and the second attribute is location.

[0178] The method shown in Figure 11 involves multiple attribute values ​​for the same attribute. To distinguish different attribute values ​​for the same attribute, "first attribute value" and "second attribute value" are used to describe the multiple attribute values. For example, the first attribute is identity, the first attribute value of the first attribute is finance, and the second attribute value of the first attribute is sales.

[0179] The method shown in Figure 11 involves multiple strategies corresponding to the same attribute. To distinguish between different strategies, the multiple strategies are described as "first strategy" and "second strategy." The first strategy is the strategy corresponding to the first attribute value. The second strategy is the strategy corresponding to the second attribute value.

[0180] The method shown in Figure 11 involves action identifiers in different strategies. To distinguish between different action identifiers, multiple action identifiers are described using terms such as "first action identifier" and "second action identifier." The first action identifier is the action identifier in the first strategy. The second action identifier is the action identifier in the second strategy.

[0181] The network deployment scenario on which the method shown in Figure 11 is based can optionally be as shown in Figure 10 above. For example, referring to Figure 10, the method shown in Figure 11 is executed by the forwarding device 131 in Figure 10. For example, the method shown in Figure 11 is executed by the firewall 131a, router 131b, or switch 131c in Figure 10. As an example, the data packet received in step S220 of the method shown in Figure 11 is generated and sent to the external network 120 by an internal host in the local area network 110, or the data packet received in step S220 of the method shown in Figure 11 is generated and sent to the internal host in the local area network 110 by a server 121 or terminal 122 in the external network 120. The forwarding device 131, as the device through which the forwarding path between the local area network 110 and the external network 120 passes, can receive data packets from the local area network 110 or the external network 120, and executes the method shown in Figure 11 upon receiving the data packet. The method shown in Figure 11 includes the following steps S204 to S290.

[0182] Step S204: The terminal sends a data packet.

[0183] Step S220: The forwarding device obtains the set of attribute values ​​of the first attribute of the endpoint of the data packet based on the data packet received by the network interface.

[0184] The attribute value set includes the first attribute value of the first attribute and the second attribute value of the first attribute. The relationship between the data message and the attribute value set can vary; two examples are provided below.

[0185] Scenario 1: The data packet directly carries the set of attribute values ​​for the first attribute.

[0186] In one scenario, the forwarding device parses the data packet to obtain the set of attribute values ​​for a first attribute carried in the data packet. For example, the data packet includes a first field whose name is the same as the attribute name of the first attribute, and the content of the first field includes the set of attribute values ​​for the first attribute. The location of the attribute value set within the data packet can vary. In some implementations, the attribute value set of the first attribute is carried in the data packet header. In some implementations, the attribute value set of the first attribute is carried in the data packet payload. This embodiment does not limit the location of the attribute value set within the data packet.

[0187] For example, the IP address field of a data packet carries an IP address. After parsing and conversion, this IP address can be used to obtain the identifier of the first security group to which the IP address belongs and the identifier of the second security group to which the IP address belongs. Here, the security group is a specific example of the first attribute, and the set of identifiers of the first security group and the second security group is a specific example of the attribute value set.

[0188] Scenario 2: The data packet does not directly carry the set of attribute values ​​for the first attribute, but the field content carried in the data packet can be parsed and transformed to obtain information about the set of attribute values ​​for the first attribute.

[0189] In scenario two, the forwarding device parses the data packet to obtain the field content carried in the data packet. Based on the field content carried in the data packet and the pre-configured correspondence between the field content and the attribute value set, the forwarding device obtains the attribute value set of the first attribute. Alternatively, the forwarding device performs calculations on the field content carried in the data packet based on an algorithm to obtain the attribute value set of the first attribute.

[0190] For example, the IP address field of the data packet carries the IP address. The forwarding device has pre-stored the correspondence between the IP address and the security group identifier. The forwarding device obtains the IP address carried in the IP address field of the data packet. Based on the IP address and the correspondence between the IP address and the security group identifier, the forwarding device obtains the identifier of the first security group to which the IP address belongs and the identifier of the second security group to which the IP address belongs.

[0191] In one example, the first attribute includes security groups, where the set of attribute values ​​for security groups is, for example, {security group a, security group b}, and another example is {security group a, security group c}. In another example, the first attribute includes job title, where the set of attribute values ​​for job titles is, for example, {R&D, testing}, and another example is {R&D, sales}. In yet another example, the first attribute includes the location of the terminal; the same location may belong to multiple security zones simultaneously, for example, the set of attribute values ​​for the location is {security zone a, security zone b}.

[0192] Taking the network scenario shown in Figure 10 as an example, for instance, a terminal 122 deployed on the Internet sends a data packet to a server 112 deployed on a local area network. During the forwarding process, the data packet passes through a forwarding device 131, causing the network interface 1311 of the forwarding device 131 to receive the data packet. As a specific example, a user belongs to three security groups simultaneously. This user initiates a data packet by triggering an operation on terminal 122, and the data packet carries the IP address of terminal 122. After receiving the data packet, the network interface 1311 of the forwarding device, based on the IP address of terminal 122 carried in the data packet, determines the source security group identifier corresponding to the source IP address to which the IP address of terminal 122 belongs, thus obtaining multiple source security group identifiers.

[0193] An endpoint can also be called a network node, forwarding node, network object, or network device. For example, the endpoint of a data packet is a device or system through which the data packet's forwarding path passes. The endpoint of a data packet includes either the initiating network object or the destination network object of the data packet. Optionally, the endpoint of a data packet may also include intermediate nodes of the data packet.

[0194] For example, when a terminal acts as the source device to initiate a data packet, the data packet may include an access request sent by the terminal, the destination of the data packet may be a network application provided by a server, the network object may include the terminal or the server, the attribute may include the security group to which the terminal belongs, and the attribute value set of the first attribute may include the identifiers of multiple security groups to which the terminal belongs. These identifiers are derived from the IP address of the terminal carried in the source IP address field of the data packet. Similarly, the first attribute may include the security group to which the server belongs, and the attribute value set of the first attribute may include the identifiers of multiple security groups to which the server belongs. These multiple security groups are derived from the IP address of the server carried in the destination IP address field of the data packet. In other embodiments, the server acts as the source device to initiate the data packet. This embodiment does not limit the source of the data packet or the initiator of the data packet.

[0195] In some implementations, the set of attribute values ​​for the first attribute is specifically obtained from the data packet by a processor in the forwarding device.

[0196] In step S240, the forwarding device determines the lookup key set based on the attribute value set.

[0197] A lookup key set refers to a collection of multiple lookup keys. For example, a lookup key set includes multiple lookup keys corresponding to multiple attribute values ​​in an attribute value set. For instance, a lookup key set includes a first lookup key corresponding to a first attribute value and a second lookup key corresponding to a second attribute value. Optionally, there is a one-to-one correspondence between the lookup keys in the lookup key set and the attributes in the attribute value set; one attribute value corresponds to one lookup key, and different attribute values ​​correspond to different lookup keys.

[0198] A lookup key is a key constructed during the policy lookup process. The lookup key is equivalent to a representation of the set of attribute values ​​in a data packet. It is used to find the policy corresponding to an attribute value from policy entries stored in memory. A lookup key identifies one or more attribute values. For example, a lookup key may include the encoding of one or more attribute values ​​for one or more attributes. For example, a first lookup key may include the encoding of a first attribute value. A second lookup key may include the encoding of a second attribute value. A lookup key may, for example, be in the form of a sequence of binary bit values. For example, a lookup key may consist of 0s and / or 1s. Considering that the key stored in the policy entry and the attribute value obtained from the data packet may not be directly matched due to format differences, the forwarding device converts the attribute value into a lookup key to facilitate subsequent policy matching processes based on the lookup key.

[0199] Regarding the method of determining the lookup key, in some implementations, the forwarding device maintains a correspondence between attribute values ​​and lookup keys. The forwarding device determines the lookup key corresponding to an attribute value based on the attribute value obtained from the data packet and the correspondence between the attribute value and the lookup key. For example, the forwarding device uses a first attribute value as an index to look up the correspondence between the attribute value and the lookup key, obtaining a first lookup key corresponding to the first attribute value; the forwarding device uses a second attribute value as an index to look up the correspondence between the attribute value and the lookup key, obtaining a second lookup key corresponding to the second attribute value. Optionally, the correspondence between attribute values ​​and lookup keys is in tabular form; in other words, the forwarding device uses a table lookup method to convert attribute values ​​into lookup keys. By using a table lookup conversion, the implementation complexity is relatively low. Alternatively, the correspondence between attribute values ​​and lookup keys is in the form of a function (such as a hash function).

[0200] In other implementations, when the attribute value is in numerical form, the forwarding device directly uses the attribute value as the lookup key. For example, the forwarding device determines the first attribute value as the first lookup key and the second attribute value as the second lookup key. For example, when the attribute value is an Internet Protocol version 4 (IPv4) address in dotted decimal representation (such as 192.168.1.1), the forwarding device directly uses the attribute value as the lookup key.

[0201] In some implementations, the multiple storage units used to store multiple strategies corresponding to multiple attribute values ​​are multiple slices in a TCAM. Alternatively, the memory used to store the strategies can be a type of memory other than a TCAM, and correspondingly, the multiple storage units used to store the multiple strategies corresponding to multiple attribute values ​​are storage units in a type of memory other than a TCAM. For example, multiple strategies corresponding to multiple attribute values ​​can be stored in multiple storage units in random access memory (RAM). Another example is storing multiple strategies corresponding to multiple attribute values ​​in multiple storage units in read-only memory (ROM). Yet another example is storing multiple strategies corresponding to multiple attribute values ​​in multiple storage units in dynamic random access memory (DRAM). Still another example is storing multiple strategies corresponding to multiple attribute values ​​in multiple storage units in storage class memory (SCM).

[0202] In some implementations, step S240 is specifically executed by the processor in the forwarding device.

[0203] In step S260, the forwarding device searches for a policy that matches the first lookup key in the first storage unit based on the first lookup key, and searches for a policy that matches the second lookup key in the second storage unit based on the second lookup key, so as to obtain the policy set corresponding to the attribute value set.

[0204] The strategy set includes multiple strategies corresponding to multiple attribute values ​​in the attribute value set of the first attribute. Each strategy in the strategy set includes a key that matches the lookup key. In this embodiment, the key in the strategy may optionally have the form of a binary bit value sequence composed of 0s and 1s, thus suitable for a strict matching method between the lookup key and the strategy (a match is made if the corresponding bit values ​​are the same). Alternatively, the key in the strategy may optionally have the form of a binary bit value sequence composed of * (mask) and 1s, thus suitable for a mask matching method between the lookup key and the strategy. This embodiment does not limit the data format of the key in the strategy.

[0205] In some implementations, the strategy set includes a first strategy and a second strategy. The first strategy corresponds to a first attribute value and matches a first lookup key. The first strategy includes keys that match the first lookup key. The second strategy corresponds to a second attribute value and matches a second lookup key. The second strategy includes keys that match the second lookup key.

[0206] As a concrete example, the first attribute is the user's identity, and the set of attribute values ​​for the first attribute is a set of n identities for the same user, where n is a positive integer greater than or equal to 2. The processor obtains the n identities of the same user through data packets. Based on the n identities, the processor determines n lookup keys. The processor then searches for the corresponding policies in parallel from n storage units based on the n lookup keys, thus achieving the goal of finding the policies corresponding to the n identities within one clock cycle. Specifically, the n storage units are used to store the policies corresponding to the n identities. One storage unit is used to store one or more policies corresponding to one identity. For example, storage unit 1 stores the policy corresponding to identity 1, storage unit 2 stores the policy corresponding to identity 2, and so on, with storage unit n storing the policy corresponding to identity n.

[0207] Regarding the specific process of the lookup strategy, for example, the processor determines the first memory cell by identifying the memory cell containing the first strategy; the processor determines the second memory cell by identifying the memory cell containing the second strategy; the processor compares the first lookup key bit by bit with each strategy entry in the first memory cell to determine whether the first lookup key matches each strategy entry in the first memory cell. In response to a match between the first strategy and the first lookup key in the first memory cell, the processor reads the first strategy from the first memory cell. In response to a match between the second strategy and the second lookup key in the second memory cell, the processor reads the second strategy from the second memory cell.

[0208] Since the action of searching for the first strategy based on the first search key will not interfere with the action of searching for the second strategy based on the second search key, in other words, the first strategy and the second strategy search independently, thus enabling parallel searching of the first strategy and the second strategy.

[0209] In some implementations, the lookup step based on the first lookup key and the lookup step based on the second lookup key are executed in parallel. For example, the lookup step based on the first lookup key and the lookup step based on the second lookup key are executed in parallel within the same clock cycle. For instance, within the first clock cycle, the memory looks up a first policy from the TCAM based on the first lookup key, and within the same first clock cycle, it looks up a second policy from the TCAM based on the second lookup key, thereby achieving policy matching for multiple attribute values ​​within the same clock cycle. This allows for the lookup of both the first and second policies within the same clock cycle, thus increasing the speed of obtaining multiple policies corresponding to multiple attribute values ​​of the same attribute, and consequently improving the efficiency of policy lookup.

[0210] Regarding how to determine which storage unit to look up the policy from, or in other words, how to determine which storage unit's policy entry to match the lookup key with, some implementations pre-store the correspondence between attribute values ​​and storage units in the forwarding device. When the forwarding device receives a data packet, it determines the storage unit corresponding to the attribute value based on the attribute value carried in the data packet and the pre-stored correspondence. The forwarding device then searches for the policy entry corresponding to the attribute value in the storage unit based on the lookup key corresponding to the attribute value. For example, the forwarding device compares the lookup key corresponding to the attribute value with the policy entry stored in the storage unit corresponding to the attribute value. If the lookup key and the policy entry in the storage unit satisfy the matching condition, then the policy entry is determined to be the policy entry corresponding to the attribute value.

[0211] The mapping between attribute values ​​and storage units includes, for example, the attribute value and the identifier of the storage unit. The identifier of the storage unit is used to identify the corresponding storage unit in the memory. For example, if the storage unit is a slice, the identifier of the storage unit is the unique number of the slice. When querying the policy corresponding to an attribute value, the forwarding device uses the attribute value as an index to query the mapping, obtains the identifier of the storage unit corresponding to the attribute value, and determines the corresponding storage unit based on the identifier of the storage unit.

[0212] To establish the correspondence between different attribute values ​​and storage units, the following text uses "first correspondence" to describe the correspondence between a first attribute value and a first storage unit, and "second correspondence" to describe the correspondence between a second attribute value and a second storage unit. The first correspondence includes the first attribute value and the identifier of the first storage unit. The second correspondence includes the second attribute value and the identifier of the second storage unit.

[0213] For example, during the process of searching for the first strategy and the second strategy, the forwarding device obtains the identifier of the first storage unit based on the first attribute value and the first correspondence, and determines the first storage unit based on the identifier of the first storage unit; the forwarding device obtains the identifier of the second storage unit based on the second attribute value and the second correspondence, and determines the second storage unit based on the identifier of the second storage unit, and then the forwarding device executes step S260.

[0214] For example, in the scenario shown in Figure 8, attribute values ​​value1 and value2 are specific examples of the first and second attribute values, slice 1 is a specific example of the first storage unit, and slice 2 is a specific example of the second storage unit. The forwarding device pre-stores a first correspondence between attribute value1 and the identifier of slice 1, and a second correspondence between attribute value2 and the identifier of slice 2. After obtaining attribute values ​​value1 and value2 based on the data packet, the forwarding device determines the identifier of slice 1 based on attribute value1 and the first correspondence, and determines the identifier of slice 2 based on attribute value2 and the second correspondence. The forwarding device retrieves the first strategy from slice 1 identified by the identifier of slice 1 based on lookup key 1, and retrieves the second strategy from slice 2 identified by the identifier of slice 2 based on lookup key 2.

[0215] Considering that searching for a strategy in all memory cells would require traversing all memory cells, resulting in high power consumption, this embodiment implements a method of targeted matching of specific memory cells based on attribute values ​​through the aforementioned correspondence between attribute values ​​and memory cells. Specifically, because the correspondence between attribute values ​​and memory cells is maintained, and memory cells are determined based on this correspondence, it is deterministic which memory cell each lookup key is matched with for a strategy entry. Each lookup key does not need to be matched with every strategy stored in every memory cell, but only with the strategy stored in the memory cell corresponding to the attribute value (e.g., the memory cell that actually stores the strategy corresponding to the attribute value). For example, the first lookup key only needs to be matched with the policy entries stored in the first storage unit (the storage unit corresponding to the first attribute value, which is also the storage unit storing the first policy), and does not need to be matched with the policy entries stored in the second storage unit; similarly, the second lookup key only needs to be matched with the policy entries stored in the second storage unit (the storage unit corresponding to the second attribute value, which is also the storage unit storing the second policy), and does not need to be matched with the policy entries stored in the first storage unit. Therefore, compared to traversing each storage unit in the memory based on the lookup key to find the policy corresponding to the attribute value, this significantly narrows the search range, reduces the number of times the lookup key needs to be matched with the policy entries in the storage unit, reduces the unnecessary waste of power caused by searching for policies in storage units that do not store policies corresponding to attribute values, and reduces the power consumption of policy lookup.

[0216] For example, referring to the scenario shown in Figure 8, for key 1, the forwarding device searches for a policy entry matching key 1 from the policy entries stored in slice 1, without needing to search for matching policy entries from other slices besides slice 1, such as slice 2, slice 3, and slice 4; for key 2, the forwarding device searches for a policy entry matching key 2 from the policy entries stored in slice 3, without needing to search for matching policy entries from other slices besides slice 3, such as slice 1, slice 2, and slice 4; for key N, the forwarding device searches for a policy entry matching key N from the policy entries stored in slice 4, without needing to search for matching policy entries from other slices besides slice 4, such as slice 1, slice 2, and slice 3. N matching strategy entries means that each key only needs to be matched with strategy entries in a specific slice, rather than with strategy entries in all slices. This makes the search matching range more precise and improves the performance of the search strategy.

[0217] Determining which storage unit to look up a policy from based on the correspondence between attribute values ​​and storage units is merely exemplary. When a lookup key corresponds to only one attribute value, the storage unit corresponding to the lookup key is determined based on the lookup key and its correspondence with storage units, and a lookup match is performed using the lookup key and the policy entry stored in that storage unit. In other embodiments, during the lookup of the first and second policies, the forwarding device determines the first storage unit based on the first lookup key and its correspondence with the first storage unit. The forwarding device determines the second storage unit based on the second lookup key and its correspondence with the second storage unit.

[0218] Step S280: The forwarding device processes the data packets based on the policy set.

[0219] The policy set includes multiple policies, each corresponding to an action. In some implementations, the forwarding device executes multiple actions corresponding to multiple policies in the policy set, or the forwarding device executes a single action corresponding to a single policy in the policy set. For example, if the multiple actions corresponding to multiple policies do not conflict, the forwarding device executes multiple actions. Conversely, if the multiple actions corresponding to multiple policies conflict, the forwarding device executes a single action. The selection of which one or more policy actions to execute by the forwarding device is determined, for example, based on configuration; this embodiment does not limit the specific processing action executed based on the policy set.

[0220] Optionally, the processor in the forwarding device obtains a first action identifier from a first policy, and performs the processing action indicated by the first action identifier on the data packet. Furthermore, the processor obtains a second action identifier from a second policy, and performs the processing action indicated by the second action identifier on the data packet. In some embodiments, the processor performs step S280 alone. In other embodiments, the processor instructs other components in the forwarding device to perform step S280.

[0221] For example, the first action identifier indicates forwarding, and the second action identifier indicates mirroring and redirection. The processor instructs the network interface to forward the data packet based on the first action identifier, copies the data packet based on the second action identifier to obtain a mirror packet, modifies the destination address of the mirror packet, and instructs the network interface to send the mirror packet to the modified destination address, thereby realizing step S290.

[0222] For example, the first action flag indicates discarding, and the second action flag indicates an alarm. The processor instructs the network interface to discard the data packet based on the first action flag, and generates an alarm message based on the second action flag, and instructs the input / output (IO) interface to output the alarm message.

[0223] The method provided in this embodiment, when multiple attribute values ​​of the same attribute are obtained based on data packets, can find multiple policies corresponding to multiple attribute values ​​within one clock cycle because the corresponding policies are searched from multiple storage units based on the multiple attribute values, and the search for policies from multiple storage units is performed in parallel. This reduces the time consumption caused by sequentially searching for policies corresponding to each attribute value from one storage unit, and greatly improves the speed of policy search.

[0224] The embodiment shown in Figure 11 focuses on describing the policy lookup process. Some embodiments of this application also provide a method for separately storing policies, thereby supporting parallel policy lookup for different storage units in the embodiment shown in Figure 11. The policy storage process is illustrated below. Optionally, the forwarding device first executes the following policy storage process, and after the policy is successfully stored, executes the embodiment shown in Figure 11 upon receiving a data packet.

[0225] To facilitate understanding, the following examples illustrate application scenarios related to policy storage.

[0226] Considering that a single network object may have multiple attribute values ​​of the same type (e.g., a user's identity belongs to multiple security groups simultaneously), storing multiple policies corresponding to multiple attribute values ​​in the same storage unit would result in a messy policy storage method. When multiple policies need to be found, the forwarding device needs to use multiple attribute values ​​to search for the corresponding policies from the same storage unit separately. Since a storage unit typically cannot match two lookup keys corresponding to two attribute values ​​within a single clock cycle (e.g., a slice cannot simultaneously receive multiple lookup keys and output multiple corresponding policies within a single clock cycle), the forwarding device needs to serially perform multiple policy lookup steps from the same storage unit using each lookup key. This results in N clock cycles being required to find N policies corresponding to N attribute values, causing excessively long policy lookup times and impacting policy lookup performance.

[0227] For example, please refer to Figure 8, which illustrates two policy storage methods. Policy storage method one in Figure 8 shows a rather messy method. The messiness lies in the fact that M policies corresponding to the same attribute are stored in the same slice in the TCAM, without considering the attribute corresponding to the policy when storing the policy. For example, in Figure 8, policies 1, 2...M are all policies corresponding to attribute A, and all M policies are stored in slice 0 of the TCAM. Figure 8(b) is a specific example of Figure 8(a). As shown in Figure 8(b), policies corresponding to multiple identities are stored in the same slice. For example, the Financial Security Group, Sales Security Group, and Legal Security Group are all attribute values ​​of identity attributes, but slice 0 in the TCAM stores policies for the Financial Security Group, Sales Security Group, and Legal Security Group simultaneously.

[0228] When using the strategy storage method shown in Figure 8, if an employee's identity belongs to both the Finance Security Group and the Sales Security Group, storing the policies of the Finance Security Group and the Sales Security Group in slice 0 of TCAM would require searching for the Finance Security Group's policy in slice 0 of TCAM using the Finance Security Group's identity, and searching for the Sales Security Group's policy in slice 0 of TCAM using the Sales Security Group's identity, which would take two clock cycles.

[0229] In view of this, some embodiments of this application provide a method for separating storage strategies. When the same network object in the communication network where the forwarding device is located has multiple attribute values ​​of the same attribute, multiple storage units in the memory store multiple strategies corresponding to the multiple attribute values ​​of the same attribute, so that the strategies corresponding to different attribute values ​​of the same attribute are located in different storage units in the memory, thereby realizing the separate storage of strategies and supporting parallel execution of strategy lookup for different storage units.

[0230] Taking the storage of two policies corresponding to two attribute values ​​of the same attribute as an example, in some implementations, in response to the existence of a network object with both a first attribute value and a second attribute value in the communication network where the forwarding device is located, the processor stores the first policy corresponding to the first attribute value in the first storage unit and the second policy corresponding to the second attribute value in the second storage unit. For example, in the case where an employee (or an IP address) has n attribute values ​​(e.g., n identities) of the same dimension, as shown in policy storage method two in Figure 8, the processor stores the policy for attribute value 1 (e.g., identity 1) in slice 1 of the TCAM, and the policy for attribute value 2 (e.g., identity 2) in slice 2 of the TCAM, and so on, storing the policy for attribute value n (e.g., identity n) in slice n of the TCAM, thereby achieving separate storage of policies corresponding to n attribute values ​​into n slices.

[0231] Because the forwarding device stores the first policy in the first storage unit and the second policy in the second storage unit, compared to storing the first policy and the second policy in the same storage unit, it is equivalent to splitting a single storage unit containing multiple policies into multiple storage units each containing one policy. This allows different policies to reside in different storage units. Therefore, when it is necessary to look up the first policy and the second policy, the processor can look up the first policy in the first storage unit and the second policy in the second storage unit, respectively. The actions of looking up the policy in the first storage unit and the actions of looking up the policy in the second storage unit can be executed in parallel within the same clock cycle, thereby shortening the clock cycle for finding the first policy and the second policy from two clock cycles to one clock cycle and improving the speed of policy lookup.

[0232] As an example, if the same attribute of a network object in the communication network where the forwarding device resides has N attribute values, the forwarding device stores N policies corresponding to the N attribute values ​​in N storage units, where N is greater than or equal to 2. A network object can serve as an endpoint of a data packet. For example, the network object can be the initiating network object (or source object) of a data packet. Or, the network object can be the destination network object (or destination object) of a data packet. For instance, the forwarding device stores policy 1 in storage unit 1, policy 2 in storage unit 2, and so on, storing policy N in storage unit N. Because N policies are stored in N storage units, it allows for the simultaneous retrieval of N policies from N storage units within the same clock cycle. Compared to retrieving N policies from a single storage unit, this reduces the total time required to find all policies from N clock cycles to one clock cycle, significantly improving the speed of policy lookup.

[0233] As a trigger condition for storing multiple policies corresponding to multiple attribute values ​​of the same attribute, network administrators configure the policy set corresponding to the attribute value set of the first attribute of a target network object via command line or web page, thereby triggering the forwarding device to receive a storage request. The storage request instructs the storage of the policy set corresponding to the attribute value set of the first attribute of the target network object. In response to the storage request, the forwarding device, based on the fact that the attribute value set includes multiple attributes (or in other words, it detects that multiple attribute values ​​of the same attribute exist simultaneously on the target network object), stores the policy set separately. For example, the forwarding device stores each policy in the policy set in a different storage unit.

[0234] As another possible implementation of storing multiple strategies corresponding to multiple attribute values ​​of the same attribute, the forwarding device receives a first storage request, which indicates storing a first strategy corresponding to a first attribute value of a first attribute of a target network object; in response to the first storage request, the forwarding device determines from the memory that there is no storage unit storing a strategy corresponding to the first attribute, and obtains a first storage unit; the forwarding device stores the first strategy in the first storage unit of the memory; the forwarding device receives a second storage request, which indicates storing a second strategy corresponding to a second attribute value of the target network object; in response to the second storage request, the forwarding device determines from the memory that there is no storage unit storing a strategy corresponding to the first attribute, and obtains a second storage unit; the forwarding device stores the second strategy in the second storage unit of the memory.

[0235] As another possible implementation of storing multiple strategies corresponding to multiple attribute values ​​of the same attribute, the forwarding device receives a first storage request, which indicates storing a first strategy corresponding to a first attribute value of a first attribute of a target network object; in response to the first storage request, the forwarding device determines a first storage unit based on a first correspondence between the first attribute value and a first storage unit; the forwarding device stores the first strategy in the first storage unit of the memory; the forwarding device receives a second storage request, which indicates storing a second strategy corresponding to a second attribute value of the target network object; in response to the second storage request, the forwarding device determines a second storage unit based on a first correspondence between the second attribute value and a second storage unit; the forwarding device stores the second strategy in the second storage unit of the memory.

[0236] The various strategy storage methods listed above are merely examples. Regardless of the strategy storage method used, as long as multiple strategies corresponding to multiple attribute values ​​of the same attribute are stored in multiple storage units respectively, it is possible to achieve single attribute multi-value strategy matching within the same clock cycle during the strategy lookup process, thereby helping to alleviate the performance degradation problem caused by serial lookup based on multiple lookup keys.

[0237] In some implementations, the forwarding device stores multiple policies corresponding to multiple attribute values ​​of the same attribute in multiple slices of a TCAM. For example, the first storage unit mentioned above is a first slice included in a TCAM, and the second storage unit mentioned above is a second slice included in the TCAM. In other words, the first slice in the TCAM stores a first policy, and the second slice in the TCAM stores a second policy. Subsequently, when the network interface in the forwarding device receives a data packet carrying the first attribute value and the second attribute value, the processor in the forwarding device searches for the first policy in the first slice of the first TCAM and searches for the second policy in the second slice of the first TCAM in parallel. Since multiple policies of the same attribute are located in multiple slices of the same TCAM, it supports parallel searching of different policies of the same attribute among multiple slices in the same TCAM.

[0238] In other embodiments, the forwarding device stores multiple policies corresponding to multiple attribute values ​​of the same attribute in multiple slices of multiple TCAMs. For example, the memory in the forwarding device includes a first TCAM and a second TCAM. The first storage unit is a first slice included in the first TCAM, and the second storage unit is a second slice included in the second TCAM. The first slice stores a first policy, and the second slice stores a second policy. Subsequently, when the network interface in the forwarding device receives a data packet carrying the first attribute value and the second attribute value, the processor in the forwarding device searches for the first policy in the first slice of the first TCAM and searches for the second policy in the second slice of the second TCAM in parallel. Since multiple policies of the same attribute are located in multiple slices of multiple TCAMs, it supports parallel searching of different policies of the same attribute among multiple slices of multiple TCAMs.

[0239] Regarding the storage method for multiple policies corresponding to multiple attribute values ​​of the same attribute, optionally, if the storage capacity of a single TCAM exceeds the storage capacity required for multiple policies (i.e., the storage capacity of a single TCAM is sufficient to store multiple policies corresponding to multiple attribute values ​​of the same attribute), the forwarding device stores policies corresponding to different attribute values ​​through different slices within the same TCAM. If the storage capacity required for multiple policies exceeds the storage capacity of a single TCAM (i.e., the storage capacity of a single TCAM is insufficient to store multiple policies corresponding to multiple attribute values ​​of the same attribute), the forwarding device stores policies corresponding to different attribute values ​​through different slices within multiple TCAMs, thereby alleviating the insufficient storage capacity of a single TCAM by distributing the storage of policies across multiple TCAMs.

[0240] For example, if the first attribute is identity, and an employee holds multiple identities, the forwarding device stores different policies corresponding to different identities in different slices within the TCAM. For instance, if the first attribute is identity, the first attribute's value is Financial Security Group, and the second attribute's value is Sales, and the forwarding device detects an employee whose identity belongs to both Financial Security Group and Sales, the forwarding device will store the policies corresponding to Financial Security Group and Sales in different slices. For example, referring to Figure 8, the policy corresponding to Financial Security Group is stored in slice 1 of the TCAM, and the policy corresponding to Sales is stored in slice 3 of the TCAM.

[0241] In some implementations, if multiple attribute values ​​of the same attribute do not appear simultaneously on the same network object (e.g., there are no employees with multiple identities), then it is not necessary to consider separately storing multiple policies corresponding to multiple attribute values. For example, in response to the absence of a network object that simultaneously has a first attribute value and a third attribute value, the forwarding device stores a first policy corresponding to the first attribute value and a third policy corresponding to the third attribute value in a first storage unit. For example, if the first attribute is identity, the first attribute value of the first attribute is financial security group, and the third attribute value of the first attribute is development security group, and the forwarding device has already stored the policy corresponding to the financial security group in slice 1 of the TCAM, if it is found that there is no employee whose identity simultaneously belongs to both the financial security group and the development security group, the forwarding device may optionally also store the policy corresponding to the development security group in slice 1 of the TCAM.

[0242] Taking the identity corresponding to the IP address as an example, policies for different identities corresponding to the same IP address are stored in different slices in the TCAM. For example, please refer to the policy storage method two shown in Figure 8. The meaning of "slice splitting" in Figure 8 is to store the different policies corresponding to attribute A stored in slice 0 into different slices. For example, considering that employee A in the company belongs to the financial security group, sales security group, and legal security group, the policies corresponding to the financial security group, sales security group, and legal security group are stored in different slices in the TCAM. For example, please refer to Figure 8(b), the policy of the financial security group is stored in slice 1 in the TCAM, the policy of the sales security group is stored in slice 3 in the TCAM, and the policy of the legal security group is stored in slice 4 in the TCAM. When a data packet initiated by employee A is received, a lookup key 1 identifying the financial security group, a lookup key 2 identifying the sales security group, and a lookup key N identifying the legal security group are generated based on the IP address of employee A carried in the data packet. By performing lookup key 1, lookup key 2, and lookup key N in parallel within one clock cycle, the policies of the financial security group, the sales security group, and the legal security group can be obtained within one clock cycle.

[0243] In other embodiments, when the memory is a type other than TCAM, the forwarding device stores different strategies corresponding to different attribute values ​​in different storage units in the other type of memory.

[0244] In some implementations, the processor in the forwarding device stores multiple policy entries corresponding to the same attribute value in the same storage unit. For example, the first storage unit includes one or more slices, and the first policy corresponding to the first attribute value includes multiple policy entries. If the total storage capacity required by the multiple policy entries included in the first policy does not exceed the storage capacity of one slice, the processor stores the multiple policy entries in the same slice. For example, if the first attribute is identity and the first attribute value is financial security group, then the processor stores multiple policy entries related to the financial security group (examples of multiple policy entries included in the first policy) in the same slice. Since storing multiple policy entries corresponding to the same attribute in the same slice as much as possible, and finding the policy entries corresponding to the same attribute value in one slice as much as possible, helps to reduce the number of times policy entries are searched, and also reduces the risk of wasting parallel search capabilities caused by searching for policy entries from different slices separately.

[0245] In some implementations, if the total storage capacity required by multiple policy entries corresponding to the same attribute value exceeds the storage capacity of a single slice, the forwarding device stores the different policy entries among the multiple policy entries corresponding to the same attribute value into different slices within multiple slices. For example, since the storage capacity of a single slice is limited, if a single slice cannot hold multiple policy entries corresponding to the same attribute value, the forwarding device stores the multiple policy entries corresponding to the same attribute value through multiple slices.

[0246] In some implementations, when different policy entries corresponding to the same attribute value are stored in different slices of multiple slices, when it is necessary to look up multiple policy entries corresponding to the same attribute value, the processor in the forwarding device searches for the multiple policy entries corresponding to the same attribute value in parallel from the multiple slices based on multiple lookup keys within the same clock cycle, thereby achieving parallel searching of multiple policy entries corresponding to the same attribute value. As an example, if the first attribute value corresponds to a first policy entry and a second policy entry, the memory stores the first policy entry in the first slice and the second policy entry in the second slice. When the network interface receives a data packet and obtains the first lookup key based on the data packet, the processor searches for a policy matching the first lookup key in the first slice to obtain the first policy entry, and then searches for a policy matching the first lookup key in the second slice based on the second lookup key to obtain the second policy entry. The steps of searching for the first policy entry and searching for the second policy entry are executed in parallel.

[0247] In some implementations, in response to the existence of a network object in the communication network where the forwarding device resides, possessing both a first attribute value and a second attribute value, and both the first policy corresponding to the first attribute value and the second policy corresponding to the second attribute value being stored in a first storage unit, the forwarding device migrates the second policy from the first storage unit to a second storage unit. For example, when it is determined that the first policy and the second policy are stored in the same storage unit, the forwarding device determines from the memory a storage unit that does not store a policy corresponding to any attribute value of the first attribute of the network object, thus obtaining the second storage unit; the forwarding device stores the second policy in the second storage unit and deletes the second policy from the first storage unit, so that the first policy and the second policy are stored in different storage units respectively. For example, previously, when the same employee simultaneously held both the financial security group and the sales security group identities, the policies corresponding to both the financial security group and the sales security group were stored in slice 1. When it is detected that the same employee simultaneously holds both the financial security group and the sales security group identities, the policy corresponding to the sales security group is migrated to slice 2, slice 3, or any slice other than slice 1.

[0248] Regarding the source of the correspondence used for policy lookup, in some implementations, after the forwarding device stores the first policy corresponding to the first attribute value in the first storage unit and the second policy corresponding to the second attribute value in the second storage unit, the forwarding device records a first correspondence based on the first attribute value and the identifier of the first storage unit, and records a second correspondence based on the second attribute value and the identifier of the second storage unit. The first correspondence includes the first attribute value and the identifier of the first storage unit, and the second correspondence includes the second attribute value and the identifier of the second storage unit. For example, the forwarding device writes the first attribute value into the key field of the correspondence and writes the identifier of the first storage unit into the value field of the correspondence to generate the first correspondence; the forwarding device writes the second attribute value into the key field of the correspondence and writes the identifier of the second storage unit into the value field of the correspondence to generate the second correspondence. Since the correspondence between the attribute value and the storage unit is recorded after the policy is successfully stored, the forwarding device can know which storage unit to look up the policy corresponding to the attribute value from during the policy lookup stage, without having to traverse all storage units in the memory to find the policy corresponding to the attribute value, thus improving the lookup speed. At the same time, it eliminates the need for network administrators to manually configure which storage unit is used for each attribute value's corresponding policy, thus reducing configuration complexity.

[0249] The embodiment in Figure 11 above focuses on describing a method of parallel search strategy by searching multiple strategies from multiple memory cells within one clock cycle. In other embodiments of this application, since the key is matched with the mask sequence in the strategy entry, and the mask can match both bit value 0 and bit value 1, it is also possible to hit multiple strategies simultaneously within one clock cycle, thereby realizing the parallel search strategy. The following is an example illustrated by the embodiment shown in Figure 12.

[0250] Figure 12 is a flowchart of a policy lookup method provided in an embodiment of this application. The network deployment scenario on which the method shown in Figure 12 is based may optionally be as shown in Figure 10 above. For example, referring to Figure 10, the method shown in Figure 12 is executed by the forwarding device 131 in Figure 10. For example, the method shown in Figure 12 is executed by the firewall 131a, router 131b, or switch 131c in Figure 10. As an example, the data packet received in step S320 of the method shown in Figure 12 is generated and sent to the external network 120 by an internal host in the local area network 110, or the data packet received in step S320 of the method shown in Figure 12 is generated and sent to the internal host in the local area network 110 by a server 121 or terminal 122 in the external network 120. The forwarding device 131, as the device through which the forwarding path between the local area network 110 and the external network 120 passes, can receive data packets from the local area network 110 or the external network 120, and executes the method shown in Figure 12 upon receiving the data packet. The method shown in Figure 12 includes steps S304 to S390.

[0251] The method shown in Figure 12 includes the following steps.

[0252] Step S304: The terminal sends a data packet.

[0253] Step S320: The forwarding device obtains the set of attribute values ​​of the first attribute of the endpoint of the data packet based on the data packet received by the network interface.

[0254] The endpoint of a data packet includes the network object that initiates the data packet or the network object that is the destination of the data packet. The set of attribute values ​​for the first attribute includes the first attribute value and the second attribute value of the first attribute.

[0255] In step S340, the forwarding device determines the lookup key based on the set of attribute values ​​of the first attribute.

[0256] The lookup key is used to represent the set of attribute values ​​for the first attribute. In this embodiment, both the grouping code and the attribute value sequence code are partial fields of the lookup key. For example, the lookup key is composed of the grouping code and the attribute value sequence code. For example, the lookup key includes the first grouping code and the first attribute value sequence code.

[0257] The first block encoding is used to identify a first block, which includes a first attribute value and a second attribute value. In the first attribute value sequence encoding, the first bit corresponding to the first attribute value is set to the first bit value, and the second bit corresponding to the second attribute value is set to the second bit value. The first bit is used in the first attribute value sequence encoding to indicate whether the data packet contains the first attribute value. For example, if the first bit is set to the first bit value, it indicates that the data packet contains the first attribute value. If the first bit is not set to the first bit value, it indicates that the data packet does not contain the first attribute value. Similarly, the second bit is used in the second attribute value sequence encoding to indicate whether the data packet contains the second attribute value. For example, if the second bit is set to the second bit value, it indicates that the data packet contains the second attribute value. If the second bit is not set to the second bit value, it indicates that the data packet does not contain the second attribute value.

[0258] By using the encoding method in attribute value sequence encoding, the attribute values ​​present in the data packet can be determined based on the bit values ​​of each bit in the attribute value sequence encoding, thus facilitating matching with multiple policy entries in TCAM. For example, if the data packet contains multiple attributes of the first attribute, and there are multiple bits set to 1 in the attribute value sequence encoding, this encoding method allows determination of which attribute values ​​of the first attribute are present based on which bits in the attribute value sequence encoding are set to 1.

[0259] The first strategy corresponds to the first attribute value and matches the lookup key, and the second strategy corresponds to the second attribute value and matches the lookup key. The first strategy includes a first block code and a first mask sequence. In the first mask sequence, the first bit corresponding to the first attribute value is set to the first bit value, and the other bits in the first mask sequence other than the first bit include the mask. The second strategy includes a first block code and a second mask sequence. In the second mask sequence, the second bit corresponding to the second attribute value is set to the second bit value, and the other bits in the second mask sequence other than the second bit include the mask.

[0260] Because the lookup key and attribute value sequence encoding adopt the above grouping encoding and attribute value sequence encoding method, it is possible to find multiple strategies by matching the action of a single strategy lookup. The following is an example of how to find multiple strategies by matching the action of a single lookup.

[0261] Specifically, during the search strategy process, since the first bit in the first attribute value sequence encoding is set to the first bit value, and the first bit in the first mask sequence in the first strategy is also set to the first bit value, and the other bits in the first mask sequence, excluding the first bit, include the mask, it can be seen that the first bit in the first attribute value sequence encoding and the first bit in the first mask sequence have the same bit value. The other bits in the first attribute value sequence encoding and the mask in the other bits in the first mask sequence satisfy the fuzzy matching condition. Therefore, when determining whether the first attribute value sequence encoding and the first mask sequence match, it can be determined that the first attribute value sequence encoding and the first mask sequence match, and then the strategy containing the first mask sequence will be used as the strategy that matches the search key, thereby finding the first strategy.

[0262] Similarly, in the process of this search strategy, since the second bit in the first attribute value sequence encoding is set to the second bit value, the second bit in the second mask sequence in the second strategy is also set to the second bit value. The other bits in the second mask sequence, excluding the second bit, include the mask. It can be seen that the second bit in the second attribute value sequence encoding and the second bit in the second mask sequence have the same bit value. The other bits in the second attribute value sequence encoding and the mask in the other bits in the second mask sequence satisfy the fuzzy matching condition. Therefore, when judging whether the second attribute value sequence encoding and the second mask sequence match, it can be determined that the second attribute value sequence encoding and the second mask sequence match. Then, the strategy containing the second mask sequence will be used as the strategy that matches the search key, thereby finding the second strategy.

[0263] As a concrete example, please refer to Figure 9. In the lookup key constructed from the data packet, the first three bits of the attribute value sequence encoding are 110. 110 indicates that both the financial security group and the sales security group exist simultaneously in the data packet. When performing a lookup match between this lookup key and policy entries in the TCAM, since the first bit of the attribute value sequence encoding in the lookup key is 1, the lookup key can match policy 1, where the first bit is 1 and the other bits are masked. Policy 1 is a policy entry targeting the financial security group, and the mask sequence in policy 1 is, for example, 1**… Similarly, since the second bit of the attribute value sequence encoding in the lookup key is 1, the lookup key can match policy 2, where the second bit is 1 and the other bits are masked. Policy 2 is a policy entry targeting the sales security group, and the mask sequence in policy 2 is, for example, *1*… The actions of matching policy 1 and policy 2 based on the lookup key can be completed within the same clock cycle, thereby achieving the matching of multiple policy entries within one clock cycle and improving the speed of policy entry lookup.

[0264] Furthermore, since the lookup key contains the first block code and the first attribute value sequence code, the number of attribute values ​​that the lookup key can represent is related to the number of bits in the lookup key by a power of 2. Therefore, a large number of attribute values ​​can be represented using a lookup key with a smaller number of bits. Similarly, the key in the policy entry in TCAM can also represent the policy corresponding to a large number of attribute values ​​using a key with a smaller number of bits, thereby saving storage space in TCAM and reducing the limitation on the number of attribute values ​​that can be represented by the limited storage length of TCAM to a certain extent.

[0265] For an attribute A with multiple attribute values, determine the multi-value set of attribute A, and then divide the attribute values ​​into different domain groups according to the multi-value set. Each attribute value is divided into at least one domain group, so that each multi-value set is at least a subset of the attribute value set in a domain group. The attribute values ​​in the domain group are ordered. In this case, attribute A extracted from each data packet is represented using both domain group encoding and attribute value sequence encoding (bitmap encoding, where 0 or 1 indicates a corresponding attribute value). For example, the attribute value list in the domain1 group (the domain group for attribute A, numbered "...001") is "r1, r2, r3, r4, ...". If attribute A in a data packet has values ​​r2 and r3, the encoding for this attribute can be [...001][011000...]. To distinguish between the domain group encoding and the attribute value sequence encoding, square brackets are used. The first bracket represents the domain1 group encoding, and the second bracket represents the attribute value sequence encoding. The second and third bits of this attribute value sequence encoding are 1, indicating that attribute A has two attribute values: the second attribute value r2 and the third attribute value r3 from domain1. The policy entries stored in TCAM also have attribute encoding that includes both domain group encoding and identity sequence encoding, except that the identity sequence encoding has only one bit set to "1", with the remaining bits set to "*".

[0266] For example, please refer to Figure 9. In Figure 9, attribute A is a specific example of the first attribute, domain 1 is a specific example of the first group, ... 001 is a specific example of the first group encoding. ... 001 indicates that the attribute value set belongs to domain 1, and the ellipsis indicates bits that may exist in the first group encoding but are not shown. value 1 is a specific example of the first attribute value, value 2 is a specific example of the second attribute value, 110000... is a specific example of the first attribute value sequence encoding, where the first bit in the attribute value sequence encoding is a specific example of the first bit, and the second bit in the attribute value sequence encoding is a specific example of the second bit. For example, value 1 is the financial security group, value 2 is the sales security group. If the attribute value sequence encoding constructed based on the data packet received from user A is 110000..., it indicates that user A has both the financial security group and the sales security group, because the bit values ​​of the first and second bits in the attribute value sequence encoding are both 1, thus representing that user A has two identities simultaneously.

[0267] Referring to Figure 9, during the process of determining the lookup key, the processor parses the attribute values ​​of attribute A from the data packet, including value 1 and value 2. The processor determines that value 1 and value 2 of attribute A are subsets of domain 1. The block code of domain 1 is 0000001, and the list of attribute values ​​in the domain 1 block is "value 1, value 2, value 3, value 4, ...". The processor sets the second and third bits of the attribute value sequence code to 1 to indicate that attribute A has attribute values ​​value 2 and value 3, making the attribute value sequence code [011000...], where the second bit of the attribute value sequence code is set to 1 to indicate that attribute A has attribute value value 2, and the third bit of the attribute value sequence code is set to 1 to indicate that attribute A has attribute value value 3. In this data packet, the encoding of attribute A is a combination of the domain1 group block code [...] 001 and the attribute value sequence code [...] 011000 [...]. For example, the encoding of attribute A in the data packet is [...] 001][011000 [...]. Square brackets are used to distinguish between the domain group code and the attribute value sequence code. The first square bracket represents the domain1 group code, and the second square bracket represents the attribute value sequence code. The encoding of attribute A actually stored in the TCAM may not include these square brackets.

[0268] In step S360, the forwarding device searches the memory for a policy that matches the lookup key based on the lookup key, so as to obtain the policy set corresponding to the attribute value set.

[0269] The strategy set includes multiple strategies corresponding to multiple attribute values ​​in the attribute value set. Each strategy in the strategy set includes a key that matches the lookup key. In this embodiment, the key in the strategy may optionally have the form of a binary bit value sequence composed of * (mask) and 1, thus being suitable for mask matching between the lookup key and the strategy. This embodiment does not limit the data format of the key in the strategy.

[0270] In some implementations, the policy set includes a first policy and a second policy corresponding to the attribute value. The first policy corresponds to a first attribute value in the policy set and matches the lookup key. The first policy includes a first block code and a first mask sequence. For example, the first policy includes a key and a first action identifier. The first action identifier in the first policy is used to identify the processing action to be performed on a data packet containing a first attribute value. For example, the first action identifier is an identifier indicating whether to allow or deny.

[0271] Regarding the process of finding a strategy, in some implementations, the processor searches for the strategy in each memory cell. For example, the processor traverses each memory cell, and for each traversed memory cell, the processor compares the search key with each strategy entry stored in the memory cell to determine whether the strategy entry matches the search key. In other implementations, the processor searches for the strategy in a specific memory cell indicated by a mapping relationship. For example, the processor determines the memory cell corresponding to an attribute value based on the mapping relationship between attribute values ​​and memory cells, and the processor compares the search key with the strategy entry stored in the memory cell corresponding to the attribute value to determine whether the strategy entry matches the search key.

[0272] The key in the first strategy includes a first block code and a first mask sequence. The first bit in the first mask sequence corresponding to the first attribute value is set to the first bit value. The first bit value in the first mask sequence indicates that the first strategy contains the first attribute value. Since the first bit in the first mask sequence of the first strategy is the first bit value, and the first bit in the first attribute value sequence code of the search key is also the first bit value, that is, the bit values ​​of the bits in the same sequential position in the first strategy and the search key are the same, therefore, when comparing the corresponding bits in the first strategy and the search key, it can be determined that the first bit in the first mask sequence of the first strategy matches the first bit in the first attribute value sequence code of the search key.

[0273] All bits in the first mask sequence other than the first bit include the mask. For example, any other bit in the first mask sequence other than the first bit includes the mask. Since the other bits in the first mask sequence of the first policy include the mask, and the mask can match both 0 and 1, the first policy can be matched if the data packet contains the value of the first attribute, without considering other attributes besides the first attribute.

[0274] The second strategy includes a first block encoding and a second mask sequence. The second bit corresponding to the second attribute value in the second mask sequence is set to the second bit value. Since the second bit in the second mask sequence of the second strategy is the second bit value, and the second bit in the first attribute value sequence encoding of the search key is also the second bit value, meaning the bit values ​​of the bits in the same sequential position in the second strategy and the search key are the same, when comparing the corresponding bits in the second strategy and the search key, it can be determined that the second bit in the second mask sequence of the second strategy matches the second bit in the first attribute value sequence encoding of the search key.

[0275] All bits in the second mask sequence other than the second bit include the mask. For example, any other bit in the second mask sequence other than the second bit includes the mask. Since the other bits in the second mask sequence of the second strategy include the mask, and the mask can match both 0 and 1, when comparing the second strategy with the corresponding bit in the lookup key, without considering attributes other than the second attribute, if the data packet contains the value of the second attribute, the second strategy can be matched.

[0276] As can be seen from the above description of the first mask sequence and the second mask sequence, when the data packet contains the first attribute value and the second attribute value, performing a lookup and matching action based on the lookup key can hit both the first policy and the second policy, thereby achieving policy matching of the two attribute values ​​within one clock cycle.

[0277] As a concrete example of a lookup strategy, during the process of searching for a strategy in memory, for a strategy entry stored in a memory cell, the processor compares the key in the strategy entry bit by bit with the lookup key to determine whether the key in the strategy entry matches the lookup key. The block encoding matching and attribute value sequence encoding matching are, for example, an AND (i.e., both must be satisfied) relationship. As an example, the processor compares the block encoding in the strategy entry with the block encoding in the lookup key, and compares the mask sequence in the strategy entry with the attribute value sequence encoding in the lookup key. If the block encoding in a strategy entry matches the block encoding in the lookup key, and the mask sequence in the strategy entry matches the attribute value sequence encoding in the lookup key, then the processor identifies that strategy entry as the strategy entry corresponding to the attribute value, reads and outputs that strategy entry.

[0278] A match is established when the block code in the policy entry matches the block code in the lookup key. For example, if the block code in the policy entry is the same as the block code in the lookup key, then the block code in the policy entry matches the block code in the lookup key. The same block code means that the bit value corresponding to each bit in the block code is identical. For instance, if the block code in the lookup key is [00000001], and the block code in the policy entry is also [00000001], then the block code in the policy entry matches the block code in the lookup key.

[0279] As a specific example, please refer to Figure 9. The lookup key constructed based on the data packet includes [00000001][110...]. When matching the policy entries in TCAM based on this lookup key, it is possible to hit the policies of multiple identities within one clock cycle using a single lookup key.

[0280] For policy entry 1 that searches for the key and the value 1 stored in TCAM, since the bit values ​​in each corresponding bit of the block code [00000001] in the search key are the same as those in the domain1 code [00000001] in policy entry 1, the block code [00000001] in the search key matches the domain1 code [00000001] in policy entry 1. Furthermore, since the first bit of the attribute value sequence encoding [110...] in the lookup key is 1, and the first bit of the mask sequence [1**..] in strategy 1 is also 1, the attribute value sequence encoding in the lookup key matches the first bit of the mask sequence in strategy 1. Also, since the bits other than the first bit of the mask sequence in strategy 1 are all *, the bits other than the first bit of the attribute value sequence encoding in the lookup key, whether 1 or 0, can match the mask sequence in strategy 1. Therefore, the attribute value sequence encoding [110...] in the lookup key matches the mask sequence [1**..] in strategy 1, and thus the lookup key can hit or match strategy entry 1.

[0281] Similarly, for policy entry 2 that searches for the key and the value2 stored in TCAM, since the bit values ​​of each corresponding bit in the block code [00000001] in the search key are the same as those in the domain1 code [00000001] in policy entry 1, and since the bit value of the second bit in the attribute value sequence code [110...] in the search key is 1 in both the second bit and the mask sequence [*1*..] in policy entry 2, the bit values ​​of the other bits in the attribute value sequence code in the search key, whether 1 or 0, can match the bit values ​​of the mask bits in the mask sequence in policy entry 2. Therefore, the attribute value sequence code in the search key matches the mask sequence in policy entry 2, and thus the search key can also match policy entry 2.

[0282] Similarly, for policy entry 3, which searches for the key and the value 3 stored in TCAM, since the bit values ​​of each corresponding bit in the block code [00000001] in the search key and the domain1 code [00000001] in policy entry 1 are the same, and since the bit value of the third bit in the attribute value sequence code [110...] in the search key is 0, while the bit value of the third bit in the mask sequence [**1..] in policy entry 3 is 1, there are bit values ​​that do not match between the attribute value sequence code in the search key and the mask sequence in policy entry 3. Therefore, the search key will not match policy entry 3.

[0283] Step S380: The forwarding device processes the data packets based on the policy set.

[0284] The method provided in this embodiment addresses the problem that the number of attribute values ​​that can be represented is limited because each bit in the lookup key represents one attribute value, resulting in (k+m) bits only being able to represent (k+m) attribute values. Since block encoding is used to represent attributes with multiple attribute values, the lookup key, which includes block encoding and attribute value sequence encoding, is matched with the block encoding and mask sequence contained in the policy entry to find multiple policies corresponding to multiple attribute values. The number of bits in the block encoding can grow exponentially with the number of attribute values ​​represented. A lookup key of (k+m) bits (k bits of block encoding and m bits of attribute value sequence encoding) can represent at most 2k*m attribute values. Therefore, a large number of attribute values ​​can be represented using fewer bits, thus saving the number of bits required to represent attribute values ​​in the policy entry, and consequently saving storage space occupied by the policy entry in memory, reducing storage overhead.

[0285] Furthermore, since the attribute value sequences stored in the multiple policy entries corresponding to multiple attribute values ​​all contain masks, the mask matching function can hit multiple policy entries within one clock cycle, thereby reducing the total time required to find multiple policy entries corresponding to multiple attribute values ​​and improving the performance of policy lookup.

[0286] The above implementation focuses on describing the policy lookup and matching process. The following examples illustrate the attribute value grouping process and the policy storage process. Regarding the relationship between these three processes—policy lookup and matching, attribute value grouping, and policy storage—in some implementations, the domain group to which the attribute value belongs is first determined based on the possible combinations of multiple attribute values ​​for the same attribute. Then, a key is determined based on the domain group, and the key is stored in the corresponding policy. Upon receiving a data packet, the corresponding policy is looked up using the key stored in the policy, as shown in Figure 11.

[0287] Regarding the method for determining the group to which an attribute value belongs, in some implementations, for an attribute value set including a first attribute value and a second attribute value, it is determined that the first attribute value belongs to both a first group and a second group, the second attribute value belongs to the first group, and the intersection of the groups to which the first attribute value belongs (the first group and the second group) and the group to which the second attribute value belongs (the first group) is determined to be the first group. Therefore, it is determined that the first group is used to represent the attribute value set. For example, in response to the existence of a network object that simultaneously has both a first attribute value and a second attribute value, the first attribute value and the second attribute value are assigned to the first group based on constraints. These constraints include a first constraint, a second constraint, and a third constraint.

[0288] The first constraint includes the requirement that a group belongs to only one attribute; for example, a group can only store multiple attribute values ​​of one attribute. For instance, the attribute value set of attribute A includes attribute value1 and attribute value2. Therefore, based on this first constraint, the processor assigns both attribute value1 and attribute value2 to domain group 1, sets bit 1 corresponding to attribute value1 to 1, and sets bit 2 corresponding to attribute value2 to 1, thus obtaining an attribute value sequence encoding where the first two bits are 1 and the other bits are 0. Because this constraint on the grouping of attribute values ​​is provided, various attribute value sets can be represented by the corresponding group encoding and attribute value sequence encoding.

[0289] As a specific example of a group satisfying the first constraint, the groups include domain group 1 and domain group 2. Domain group 1 belongs to the attribute of security groups, contains various types of security groups, and does not contain attribute values ​​for dimensions other than security groups. Domain group 2 belongs to the attribute of job positions, contains various types of job positions, and does not contain attribute values ​​for dimensions other than job positions. By introducing the first constraint, the technical difficulty of distinguishing and configuring the correspondence between groups and attributes is reduced. It eliminates the need to distinguish attribute values ​​for different attributes within the same group, thus reducing the complexity of management and configuration.

[0290] The second constraint is that each attribute value must be assigned to at least one group. An attribute value can be assigned to multiple groups repeatedly. For example, the first group includes q attribute values ​​of attribute A, and the second group may also include one or more of those q attribute values ​​of attribute A. After assigning attribute values ​​to groups, the question of which group to use to represent the set of attribute values ​​is addressed by the following third constraint in this embodiment.

[0291] The third constraint is that for each attribute, the set of attribute values ​​that can be taken simultaneously is at least a subset of the set of attribute values ​​in a group. For example, if an attribute can take q attribute values ​​simultaneously, then there exists at least one group that contains those q attribute values, so that the group can represent the corresponding set of attribute values, reducing the risk that the possible set of attribute values ​​cannot be represented by group encoding.

[0292] Regarding the strategy storage method, in some implementations, the group to which the attribute value set belongs is encoded to obtain the group encoding of the attribute value set; for the i-th attribute value in the attribute value set, the i-th attribute value is encoded to obtain a mask sequence. For the strategy of the i-th attribute value, the group encoding of the attribute value set to which the i-th attribute value belongs and the mask sequence of the i-th attribute value are stored in the strategy entry of the strategy in the TCAM. For example, the first group is encoded to obtain the first group encoding; the first attribute value is encoded to obtain the first mask sequence, and the second attribute value is encoded to obtain the second mask sequence; the first group encoding and the first mask sequence are stored in the first strategy, and the first group encoding and the second mask sequence are stored in the second strategy.

[0293] Since the policy entry stores the block code and mask sequence, it is equivalent to storing the basis for finding a match in the policy entry. Therefore, when a data packet is received, the block code and attribute value sequence code constructed based on the data packet are matched with the block code and mask sequence in the policy entry to determine whether the data packet matches the policy entry, and thus determine whether to execute the action corresponding to the policy entry on the data packet.

[0294] Regarding the method of encoding to obtain the mask sequence, in one possible implementation, if the domain group includes m attribute values, then the mask sequence is set as an m-bit sequence, in which the i-th attribute value sequence is encoded with the i-th bit as 1, and the other bits are *.

[0295] As a concrete example, please refer to Figure 9. Figure 9 shows a specific example of policy storage. The attribute values ​​stored in the policy entries in TCAM are represented in the form of "group encoding + mask sequence", where the mask sequence stored in the policy entry is represented in the form of a mask sequence. In Figure 9, identity is a specific example of an attribute. The mask sequence of value1 ([1**...]) is a specific example of the first mask sequence, the mask sequence of value2 ([*1*...]) is a specific example of the second mask sequence, policy 1 of value1 is a specific example of the first policy, policy 2 of value2 is a specific example of the second policy, and the encoding of group domain1 ([00000001]) is a specific example of group encoding.

[0296] For strategy 1 of value1 stored in TCAM, the encoding of the attribute value in strategy 1 of value1 includes the encoding of the group domain1 to which value1 belongs and the mask sequence of value1. The group to which value1 belongs is group domain1, and value1 is the first attribute value in group domain1. value1 corresponds to the first bit in the mask sequence. Therefore, the bit value of the first bit in the mask sequence of value1 is set to 1, and the bit values ​​of other bits are set to *. For example, strategy 1 of value1 includes [00000001][1**...].

[0297] For strategy 2 of value2 stored in TCAM, the encoding of the attribute value in strategy 2 of value2 includes the encoding of the group domain1 to which value2 belongs and the mask sequence of value2. The group to which value2 belongs is group domain1, and value2 is the second attribute value in group domain1. value2 corresponds to the second bit in the mask sequence. Therefore, the bit value of the second bit in the mask sequence of value2 is set to 1, while the bit values ​​of other bits are set to *. For example, strategy 2 of value2 includes [00000001][*1*...].

[0298] For strategy 3 of value3 stored in TCAM, the encoding of the attribute value in strategy 3 of value3 includes the encoding of the group domain1 to which value3 belongs and the mask sequence of value3. The group to which value3 belongs is group domain1, and value3 is the third attribute value in group domain1. value3 corresponds to the third bit in the mask sequence. Therefore, the bit value of the third bit in the mask sequence of value3 is set to 1, while the bit values ​​of other bits are set to *. For example, strategy 3 of value3 includes [00000001][**1...].

[0299] The above embodiments illustrate the process of policy lookup and matching by taking the case where a set of attribute values ​​for one attribute (the first attribute) is obtained based on a data packet as an example. Some embodiments of this application are also applicable to the case where a set of attribute values ​​for multiple attributes is obtained based on a data packet. The following, with reference to Figure 13, illustrates the process of finding a matching policy when a set of attribute values ​​for the first attribute and a set of attribute values ​​for the second attribute are obtained based on a data packet as examples.

[0300] Please refer to Figure 13, which is a flowchart of a strategy search method provided in an embodiment of this application. In the method shown in Figure 13, step S320 in the method shown in Figure 12 is replaced with step S320', and step S340 in the method shown in Figure 12 is replaced with step S340'.

[0301] In step S320', the processor obtains the set of attribute values ​​of the first attribute of the endpoint of the data packet and the set of attribute values ​​of the second attribute of the endpoint of the data packet based on the data packet received from another device through the network interface.

[0302] The endpoint of a data packet includes either the originating network object or the destination network object. The second attribute is, for example, an attribute different from the first attribute. For instance, the first attribute might be the source identity, and the second attribute might be the destination identity. Or, the first attribute might be the source identity, and the second attribute might be the location. The set of attribute values ​​for the second attribute includes the values ​​of the third and fourth attributes.

[0303] In step S340', the processor determines the lookup key based on the set of attribute values ​​of the first attribute and the set of attribute values ​​of the second attribute.

[0304] In scenarios where multiple strategies correspond to multiple attributes, the lookup key includes group codes corresponding to the multiple attribute values ​​of the multiple attributes and attribute value sequence codes corresponding to the multiple attribute values. For example, in the process of looking up the strategy corresponding to the first attribute value of the first attribute, the strategy corresponding to the second attribute value of the first attribute, the strategy corresponding to the third attribute value of the second attribute, and the strategy corresponding to the fourth attribute value of the second attribute, the lookup key includes not only the first group code of the first group to which the first attribute belongs and the first attribute value sequence code representing the first and second attribute values, but also the second group code of the second group to which the second attribute belongs and the second attribute value sequence codes representing the third and fourth attributes.

[0305] The second block code is used to identify the second block. The second block includes a third attribute value and a fourth attribute value. In the second attribute value sequence code, the third bit corresponding to the third attribute value includes the third bit value, and in the fourth attribute value sequence code, the fourth bit corresponding to the fourth attribute value includes the fourth bit value.

[0306] For example, please refer to Figure 9. In Figure 9, [00000001][110....]...[110...00000001][011....]... are specific examples of key lookup. Among them, [00000001] is a specific example of the first block code, [110....] is a specific example of the first attribute value sequence code, [110...00000001] is a specific example of the second block code, [011....] is a specific example of the second attribute value sequence code, and ... indicates the block code and attribute value sequence code of attribute values ​​other than the first and second attributes that may exist but are not shown.

[0307] In some implementations, the attribute values ​​present in different groups are different. In other words, the attribute values ​​in different groups do not overlap. For example, the attribute values ​​in the first group are different from those in the second group. In other words, the first attribute value, the second attribute value, the third attribute value, and the fourth attribute value are different. Because the attribute values ​​in different groups are different, the probability of wasting TCAM storage resources due to duplicate attribute values ​​in different groups is reduced, which helps to represent as many attribute value sets as possible with as few bits as possible.

[0308] In some implementations, the attribute values ​​in the domain group are ordered, and the order of the attribute value in the domain group is represented by the order of the bits corresponding to that attribute value in the attribute value sequence encoding. For example, the first attribute value in the domain group is represented by the value of the first bit in the attribute value sequence encoding, the second attribute value in the domain group is represented by the value of the second bit in the attribute value sequence encoding, and so on, with the i-th attribute value in the domain group being represented by the value of the i-th bit in the attribute value sequence encoding. For example, the first attribute value is in the first position in the first group, and the first bit is in the first position in the first attribute value sequence encoding; the second attribute value is in the second position in the first group, and the second bit is in the second position in the second attribute value sequence encoding; the third attribute value is in the first position in the second group, and the third bit is in the first position in the second attribute value sequence encoding; the fourth attribute value is in the second position in the second group, and the fourth bit is in the second position in the second attribute value sequence encoding. Since the order of bits in the attribute value sequence encoding corresponds to the order of attribute values ​​in the domain group, it is easy to remember which bit corresponds to which attribute value, thus reducing configuration complexity.

[0309] This embodiment uses the case where attribute values ​​for a first attribute and a second attribute are obtained based on a data packet as an example. When three or more attributes are obtained based on a data packet, the lookup key may optionally include the packet encoding of the groups to which the additional attributes belong, and the attribute value sequence encoding of the additional attributes. For example, if multiple source security groups are obtained based on the source IP address of the data packet, and multiple destination security groups are obtained based on the destination IP address of the data packet, the lookup key constructed based on the data packet includes the packet encoding of the domain groups to which the multiple source security groups belong, the attribute value sequence encoding representing the multiple source security groups, the packet encoding of the domain groups to which the multiple destination security groups belong, and the attribute value sequence encoding representing the multiple destination security groups.

[0310] The first strategy also includes a second block code and a third mask sequence. In the third mask sequence, the third bit corresponding to the third attribute value includes the third bit value, and the other bits in the third mask sequence besides the third bit include the mask. The second strategy also includes a second block code and a third mask sequence. The strategy set also includes a third strategy and a fourth strategy. The third strategy includes a first block code, a first mask sequence, a second block code, and a fourth mask sequence. In the fourth mask sequence, the fourth bit corresponding to the fourth attribute value includes the fourth bit value, and the other bits in the fourth mask sequence besides the fourth bit include the mask. The fourth strategy includes a first block code, a second mask sequence, a second block code, and a fourth mask sequence.

[0311] As a concrete example, please refer to Figure 9. After the forwarding device parses and extracts multiple attribute values ​​from the received data packet, it uses an encoding method of "domain block encoding + attribute value sequence encoding" to convert each attribute that can take multiple attribute values ​​into a bit value sequence. In the attribute value sequence encoding, the bit value of the i-th bit is 1, indicating that it has the i-th attribute value in the corresponding domain block.

[0312] If multiple bits in the attribute value sequence encoding are all set to 1, it indicates that the corresponding attribute can take multiple attribute values. All bits in the attribute value sequence encoding other than those set to 1 are set to 0. For example, please refer to Figure 9, which shows a specific example of the lookup strategy in the scenario where IP address 1 accesses IP address 2. The identity attribute can take multiple attribute values. The forwarding device extracts IP address 1 from the source IP address field in the data packet and IP address 2 from the destination IP address field in the data packet. IP address 1 corresponds to two identity attribute values, namely identity attribute value g_1 and identity attribute value g_2. IP address 2 corresponds to two identity attribute values, namely identity attribute value g_2 and identity attribute value g_3. The multiple identity attribute combinations [g_1, g_2] and [g_2, g_3] are both subsets of the identity attribute values ​​of packet domain1, so the domain encoding of the identity attributes corresponding to IP address 1 and IP address 2 is "00000001". Identity attribute values ​​g_1, g_2, and g_3 are the first, second, and third identities in packet domain1, respectively. Therefore, the attribute value sequence encoding for IP address 1 is "110...". This sequence encoding indicates that IP address 1 possesses both identity attribute values ​​g_1 and g_2. The ellipsis indicates other attributes that IP address 1 may possess besides those not shown. Similarly, the attribute value sequence encoding for IP address 2 is "011...". This sequence encoding indicates that IP address 2 possesses both identity attribute values ​​g_2 and g_3. The ellipsis indicates other attributes that IP address 2 may possess besides those not shown.

[0313] As shown in Figure 9, the lookup key based on the data packet is stored in the TCAM. The policy entries in the TCAM store the domain packet encoding of the source identity's domain, the attribute value sequence encoding of the source identity, the domain packet encoding of the destination identity's domain, and the attribute value sequence encoding of the destination identity. When the forwarding device matches the lookup key with the policy entries in the TCAM, if only identity attributes are compared, it can find that the lookup key will match policy entries 1, 2, and 3. That is, a single lookup matching operation can complete policy matching for multiple identity attribute values.

[0314] Policy entry 1 is the policy applied when identity attribute g_1 accesses identity attribute g_2. Policy entry 1 is represented as g_1→g_2 in Figure 9. The key stored in policy entry 1 includes the group code of domain1 to which identity attribute g_1 belongs, the attribute value sequence code of identity attribute g_1, the group code of domain1 to which identity attribute g_2 belongs, and the attribute value sequence code of identity attribute g_2. For example, the key stored in policy entry 1 might be [00000001][1**..]..…[00000001][*1*....]. In policy entry 1, the grouping code of domain1 to which identity attribute g_1 belongs is the same as the grouping code of the domain to which the source identity belongs in the lookup key. Furthermore, the attribute value sequence code 1** of identity attribute g_1 in policy entry 1 matches the attribute value sequence code 110 in the lookup key. In addition, the grouping code of domain1 to which identity attribute g_2 belongs in policy entry 1 is the same as the grouping code of the domain to which the destination identity belongs in the lookup key. Furthermore, the attribute value sequence code *1* of identity attribute g_2 in policy entry 1 matches the attribute value sequence code 001 of the source identity in the lookup key. Therefore, policy entry 1 can be matched based on the lookup key.

[0315] Policy entry 2 is the policy applied when identity attribute g_1 accesses identity attribute g_3. Policy entry 2 is represented as g_1→g_3 in Figure 9. The key stored in policy entry 2 includes the group code of domain1 to which identity attribute g_1 belongs, the attribute value sequence code of identity attribute g_1, the group code of domain1 to which identity attribute g_3 belongs, and the attribute value sequence code of identity attribute g_3. For example, the key stored in policy entry 2 might be [00000001][1**..]..…[00000001][**1....]. In policy entry 2, the grouping code of domain1 to which identity attribute g_1 belongs is the same as the grouping code of the domain to which the source identity belongs in the lookup key. Furthermore, the attribute value sequence code 1** of identity attribute g_1 in policy entry 2 matches the attribute value sequence code 110 of the source identity in the lookup key. In addition, the grouping code of domain1 to which identity attribute g_3 belongs in policy entry 2 is the same as the grouping code of the domain to which the destination identity belongs in the lookup key. Furthermore, the attribute value sequence code **1 of identity attribute g_3 in policy entry 2 matches the attribute value sequence code 011 of the destination identity in the lookup key. Therefore, policy entry 2 can be matched based on the lookup key.

[0316] Policy entry 3 is the policy applied when identity attribute g_2 accesses identity attribute g_3. Policy entry 3 is represented as g_2→g_3 in Figure 9. The key stored in policy entry 3 includes the domain group code of domain1 to which identity attribute g_2 belongs, the attribute value sequence code of identity attribute g_2, the domain group code of domain1 to which identity attribute g_3 belongs, and the attribute value sequence code of identity attribute g_3. For example, the key stored in policy entry 3 is [00000001][*1*..]...[00000001][**1...]. In strategy entry 3, the grouping code of domain1 to which identity attribute g_2 belongs is the same as the grouping code of the domain to which the source identity belongs in the lookup key. Furthermore, the attribute value sequence code *1* of identity attribute g_2 in strategy entry 3 matches the attribute value sequence code 011 of the source identity in the lookup key. Also, the grouping code of domain1 to which identity attribute g_2 belongs in strategy entry 3 is the same as the grouping code of the domain to which the destination identity belongs in the lookup key. Moreover, the attribute value sequence code **1 of identity attribute g_3 in strategy entry 3 matches the attribute value sequence code 011 of the destination identity in the lookup key. Therefore, strategy entry 3 can be matched based on the lookup key.

[0317] Policy entry 4 is the policy applied when identity attribute g_3 accesses identity attribute g_2. Policy entry 4 is represented as g_3→g_2 in Figure 9. The key stored in policy entry 4 includes the domain group code of domain1 to which identity attribute g_3 belongs, the attribute value sequence code of identity attribute g_3, the domain group code of domain1 to which identity attribute g_2 belongs, and the attribute value sequence code of identity attribute g_2. For example, the key stored in policy entry 4 is [00000001][**1..]...[00000001][*1*...]. In policy entry 4, the block code of domain1 to which identity attribute g_3 belongs is the same as the block code of the domain to which the source identity belongs in the lookup key. Also, the block code of domain1 to which identity attribute g_2 belongs in policy entry 4 is the same as the block code of the domain to which the destination identity belongs in the lookup key. However, the attribute value sequence code **1 of identity attribute g_3 in policy entry 4 does not match the attribute value sequence code 110 in the lookup key because the third bit of attribute value sequence code **1 of identity attribute g_3 has a value of 1, but the third bit of attribute value sequence code 110 in the lookup key has a value of 0. Therefore, policy entry 4 can be matched based on the lookup key.

[0318] In some implementations, the policy set is obtained within the same clock cycle. Specifically, since the memory supports mask matching, the attribute value sequence encoding in the lookup key can be matched with multiple mask sequences. Therefore, the forwarding device can obtain the first and second policies by performing a single TCAM lookup and matching operation. The mask matching method can also be referred to the description of Figure 1.

[0319] The methods described above for finding multiple policies separately from multiple storage units and for finding matching policies based on domain group encoding can be implemented independently or in combination. As an example of a combined implementation, in a scenario where multiple policies correspond to multiple domain groups are searched, the forwarding device stores the policies corresponding to multiple domain groups in multiple storage units. For example, the first policy corresponding to the first domain group is stored in the first storage unit, and the second policy corresponding to the second domain group is stored in the second storage unit. After the forwarding device receives a data packet and obtains the first set of attribute values ​​and the second set of attribute values ​​from the data packet, it determines the first storage unit based on the correspondence between the first set of attribute values ​​and the first storage unit. Based on a first lookup key containing the group encoding of the first domain group and the attribute value sequence encoding representing the first set of attribute values, the first policy is retrieved from the first storage unit. Based on a second lookup key containing the group encoding of the second domain group and the attribute value sequence encoding representing the second set of attribute values, the second policy is retrieved from the second storage unit.

[0320] Figure 14 is a schematic diagram of a policy lookup device 400 provided in an embodiment of this application. The policy lookup device 400 is disposed in a forwarding device, which includes a memory, including a first storage unit and a second storage unit. For example, the memory includes the TCAM in Figure 1. Alternatively, the policy lookup device 400 may be disposed in the forwarding device 131 in Figure 10.

[0321] The strategy lookup device 400 includes a receiving unit 410, a processing unit 420, and a lookup unit 430. The receiving unit 410 is used to receive the data packet sent in step S204; the processing unit 420 is used to execute steps S220 and S240; the lookup unit 430 is used to execute step S260; and the processing unit 420 is also used to execute step S280.

[0322] In some embodiments, the processing unit 420 is further configured to: 1) store a first policy corresponding to the first attribute value in a first storage unit and a second policy corresponding to the second attribute value in a second storage unit, in response to the existence of a network object with both a first attribute value and a second attribute value in the communication network where the forwarding device is located; 2) store a first policy corresponding to the first attribute value and a third policy corresponding to the third attribute value in a first storage unit, in response to the existence of a network object with both a first attribute value and a second attribute value in the communication network where the forwarding device is located, in response to the existence of a network object with both a first attribute value and a second attribute value in the communication network where the forwarding device is located, and both the first policy corresponding to the first attribute value and the second policy corresponding to the second attribute value are stored in the first storage unit; 3) migrate the second policy from the first storage unit to the second storage unit, in response to the existence of a network object with both a first attribute value and a second attribute value in the communication network where the forwarding device is located, and both the first policy corresponding to the first attribute value and the second policy corresponding to the second attribute value are stored in the first storage unit.

[0323] In some embodiments, the processing unit 420 is further configured to record a first correspondence and a second correspondence, wherein the first correspondence includes a first attribute value and an identifier of a first storage unit, and the second correspondence includes a second attribute value and an identifier of a second storage unit.

[0324] In some implementations, the first storage unit includes one or more slices, the first policy corresponding to the first attribute value includes multiple policy entries, and the processing unit 420 is configured to store multiple policy entries in one slice if the total storage capacity required by the multiple policy entries does not exceed the storage capacity of one slice; or, if the total storage capacity required by the multiple policy entries exceeds the storage capacity of one slice, store different policy entries in different slices of the multiple policy entries.

[0325] In some embodiments, the processing unit 420 is configured to obtain an identifier of a first storage unit based on a first attribute value and a first correspondence, determine the first storage unit based on the identifier of the first storage unit, wherein the first correspondence includes the first attribute value and the identifier of the first storage unit; obtain an identifier of a second storage unit based on a second attribute value and a second correspondence, determine the second storage unit based on the identifier of the second storage unit, wherein the second correspondence includes the second attribute value and the identifier of the second storage unit.

[0326] In some implementations, the processing unit 420 is configured to execute a lookup step based on a first lookup key and a lookup step based on a second lookup key in parallel within the same clock cycle.

[0327] In some implementations, the processing unit 420 is used to obtain the set of attribute values ​​of the first attribute of the endpoint carried in the data packet; or, based on the field content carried in the data packet and the third correspondence, to obtain the set of attribute values ​​of the first attribute of the endpoint, wherein the third correspondence includes the field content and the set of attribute values ​​of the first attribute.

[0328] The device embodiment described in Figure 14 is merely illustrative. For example, the division of the above units is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional units in the various embodiments of this application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0329] Each unit in the strategy lookup device 400 is implemented, in whole or in part, through software, hardware, firmware, or any combination thereof.

[0330] The following section, in conjunction with the forwarding device 600 described later, describes some possible implementations of the various functional units in the policy lookup device 400 using hardware or software.

[0331] In the case of software implementation, for example, the processing unit 420 and the lookup unit 430 are software functional units generated by at least one processor 601 in FIG16 after reading the program code stored in the memory 602.

[0332] In hardware implementations, for example, the various units described above in Figure 14 are implemented by different hardware components in the forwarding device. For instance, processing unit 420 and lookup unit 430 are implemented by a portion of the processing resources of at least one processor 601 in Figure 16 (e.g., one or two cores of a multi-core processor), or by programmable devices such as field-programmable gate arrays (FPGAs) or coprocessors. Receiving unit 410 is implemented by network interface 603 in Figure 16.

[0333] Figure 15 is a schematic diagram of a policy lookup device 500 provided in an embodiment of this application. The policy lookup device 500 is located in a forwarding device, which includes a memory. The policy lookup device 500 includes a receiving unit 510, a processing unit 520, and a lookup unit 530.

[0334] The receiving unit 510 is used to receive the data packet in step S304; the processing unit 520 is used to execute steps S320 to S340. The searching unit 530 is used to execute step S360.

[0335] In some implementations, the processing unit 520 is further configured to, in response to the existence of a network object in the communication network where the forwarding device is located, simultaneously having a first attribute value and a second attribute value, divide the first attribute value and the second attribute value into a first group based on constraints, the constraints including that each set of attribute values ​​of the same attribute is at least a subset of the set of attribute values ​​in a group, and that an attribute value is divided into at least one group, and that a group belongs to only one attribute.

[0336] In some embodiments, the processing unit 520 is further configured to encode the first group to obtain a first group code; encode the first attribute value to obtain a first mask sequence; and encode the second attribute value to obtain a second mask sequence; store the first group code and the first mask sequence in a first strategy, and store the first group code and the second mask sequence in a second strategy.

[0337] In some implementations, the processing unit 520 is used to obtain the attribute value set of the first attribute and the attribute value set of the second attribute of the endpoint of the data packet. The endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet. The attribute value set of the second attribute includes the third attribute value and the fourth attribute value of the second attribute. Based on the attribute value set of the first attribute and the attribute value set of the second attribute, a lookup key is determined. The lookup key also includes a second block encoding and a second attribute value sequence encoding. The second block encoding is used to identify the second block. The second block includes the third attribute value and the fourth attribute value. The third bit in the second attribute value sequence encoding corresponding to the third attribute value includes the third bit value. The fourth attribute value sequence encoding includes the third bit value corresponding to the fourth attribute value. The fourth bit corresponding to the value includes the fourth bit value; correspondingly, the first strategy also includes a second block code and a third mask sequence, in which the third bit corresponding to the third attribute value in the third mask sequence includes the third bit value, and the other bits in the third mask sequence other than the third bit include the mask; the second strategy also includes a second block code and a third mask sequence; the strategy set also includes a third strategy and a fourth strategy; the third strategy includes a first block code, a first mask sequence, a second block code, and a fourth mask sequence, in which the fourth bit corresponding to the fourth attribute value in the fourth mask sequence includes the fourth bit value, and the other bits in the fourth mask sequence other than the fourth bit include the mask; the fourth strategy includes a first block code, a second mask sequence, a second block code, and a fourth mask sequence.

[0338] In some implementations, the policy set is found within the same clock cycle.

[0339] In some implementations, the processing unit 520 is used to obtain the set of attribute values ​​of the first attribute of the endpoint carried in the data packet; or, based on the field content and the corresponding relationship carried in the data packet, it obtains the set of attribute values ​​of the first attribute of the endpoint, wherein the corresponding relationship includes the field content and the set of attribute values ​​of the first attribute.

[0340] The device embodiments described in Figure 15 are merely illustrative. For example, the division of the units described above is only a logical functional division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional units in the various embodiments of this application may be integrated into one processing unit 520, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0341] Each unit in the strategy lookup device 500 is implemented, in whole or in part, through software, hardware, firmware, or any combination thereof.

[0342] The following section, in conjunction with the forwarding device 600 described later, describes some possible implementations of the various functional units in the policy lookup device 500 using hardware or software.

[0343] In the case of software implementation, for example, the processing unit 520 and the lookup unit 530 described above are software functional units generated by at least one processor 601 in FIG16 after reading the program code stored in the memory 602.

[0344] In hardware implementations, for example, the various units described above in Figure 15 are implemented by different hardware components in the forwarding device. For instance, processing unit 520 is implemented using a portion of the processing resources of at least one processor 601 in Figure 16 (e.g., one or two cores of a multi-core processor), while lookup unit 530 is implemented using the remaining processing resources of at least one processor 601 in Figure 16 (e.g., other cores of a multi-core processor). Alternatively, it can be implemented using programmable devices such as a field-programmable gate array (FPGA) or a coprocessor. Receiving unit 510 is implemented using the network interface 603 in Figure 16.

[0345] Figure 16 is a schematic diagram of the structure of a forwarding device 600 provided in an embodiment of this application.

[0346] The forwarding device 600 includes at least one processor 601, a memory 602, and at least one network interface 603.

[0347] Processor 601 may be, for example, a general-purpose central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the embodiments of this application. For example, processor 601 may include an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. A PLD may be, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0348] Memory 602 may be, for example, read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; electrically erasable programmable read-only memory (EEPROM); compact disc read-only memory (CD-ROM) or other optical disc storage; optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.); magnetic disk storage media or other magnetic storage devices; or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Optionally, memory 602 exists independently and is connected to processor 601 via internal connection 604. Alternatively, memory 602 and processor 601 may be integrated together.

[0349] Network interface 603 uses any transceiver-like device for communicating with other devices or communication networks. Network interface 603 includes, for example, at least one of a wired network interface or a wireless network interface. The wired network interface is, for example, an Ethernet interface. The Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. The wireless network interface is, for example, a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

[0350] In some embodiments, processor 601 includes one or more CPUs, such as CPU0 and CPU1 shown in Figure 16.

[0351] In some embodiments, the forwarding device 600 may optionally include a plurality of processors, such as processor 601 and processor 605 shown in Figure 16. Each of these processors may be, for example, a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, a processor may optionally refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0352] In some embodiments, the forwarding device 600 further includes an internal connection 604. The processor 601, memory 602, and at least one network interface 603 are connected via the internal connection 604. The internal connection 604 includes pathways for transmitting information between the aforementioned components. Optionally, the internal connection 604 is a single board or a bus. Optionally, the internal connection 604 may be divided into an address bus, a data bus, a control bus, etc.

[0353] Optionally, the processor 601 implements the method in the above embodiments by reading program code stored in the memory 602, or the processor 601 implements the method in the above embodiments by internally stored program code. When the processor 601 implements the method in the above embodiments by reading program code stored in the memory 602, the memory 602 stores program code 610 that implements the method provided in the embodiments of this application.

[0354] For more details on how processor 601 implements the above functions, please refer to the descriptions in the previous method embodiments, which will not be repeated here.

[0355] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0356] A references B, which means that A is the same as B or A is a simple variation of B.

[0357] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be construed as indicating or implying relative importance. For example, a first attribute value and a second attribute value are used to distinguish different attribute values, not to describe a specific order of attribute values, and should not be construed as the first attribute value being more important than the second attribute value.

[0358] In this application, unless otherwise stated, "at least one" means one or more, and "multiple" means two or more. For example, multiple attribute values ​​refer to two or more attribute values.

[0359] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, they can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0360] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A strategy search method, characterized in that, Applied to a forwarding device, the forwarding device including a memory, the memory including a first storage unit and a second storage unit, the method includes: Receive a data packet from another device, obtain a set of attribute values ​​for a first attribute of the endpoint of the data packet, wherein the endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet, and the set of attribute values ​​includes a first attribute value and a second attribute value of the first attribute. A set of lookup keys is determined based on the set of attribute values, and the set of lookup keys includes a first lookup key corresponding to the first attribute value and a second lookup key corresponding to the second attribute value. Based on the first lookup key, a strategy matching the first lookup key is searched in the first storage unit, and based on the second lookup key, a strategy matching the second lookup key is searched in the second storage unit to obtain a strategy set corresponding to the attribute value set. The strategy set includes a first strategy and a second strategy. The first strategy corresponds to the first attribute value and matches the first lookup key, and the second strategy corresponds to the second attribute value and matches the second lookup key. The search step based on the first lookup key and the search step based on the second lookup key are executed in parallel. The data packets are processed based on the set of policies.

2. The method according to claim 1, characterized in that, Before the strategy of searching for a match between the first lookup key and the first lookup key in the first storage unit, the method further includes: In response to the existence of a network object in the communication network where the forwarding device is located that simultaneously possesses the first attribute value and the second attribute value, the first strategy corresponding to the first attribute value is stored in the first storage unit, and the second strategy corresponding to the second attribute value is stored in the second storage unit; or... In response to the absence of a network object in the communication network where the forwarding device resides that simultaneously possesses both a first attribute value and a third attribute value, the first strategy corresponding to the first attribute value and the third strategy corresponding to the third attribute value are stored in the first storage unit; or... In response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, and the first policy corresponding to the first attribute value and the second policy corresponding to the second attribute value are both stored in the first storage unit, the second policy is migrated from the first storage unit to the second storage unit.

3. The method according to claim 2, characterized in that, After storing the first strategy corresponding to the first attribute value in the first storage unit and the second strategy corresponding to the second attribute value in the second storage unit, the method further includes: Record a first correspondence and a second correspondence. The first correspondence includes the first attribute value and the identifier of the first storage unit. The second correspondence includes the second attribute value and the identifier of the second storage unit.

4. The method according to claim 2, characterized in that, The first storage unit includes one or more slices, and the first policy corresponding to the first attribute value includes multiple policy entries. Storing the first policy corresponding to the first attribute value in the first storage unit includes: If the total storage capacity required by the multiple policy entries does not exceed the storage capacity of one slice, then the multiple policy entries are stored in one slice; or, If the total storage capacity required by the multiple policy entries exceeds the storage capacity of one slice, the different policy entries among the multiple policy entries are stored in different slices of the multiple slices.

5. The method according to claim 1, characterized in that, Before the strategy of searching for a match between the first lookup key and the first lookup key in the first storage unit, the method further includes: The identifier of the first storage unit is obtained based on the first attribute value and the first correspondence, and the first storage unit is determined based on the identifier of the first storage unit. The first correspondence includes the first attribute value and the identifier of the first storage unit. Before the second strategy for searching the second attribute value from the second storage unit corresponding to the second attribute value based on the second lookup key, the method further includes: The identifier of the second storage unit is obtained based on the second attribute value and the second correspondence, and the second storage unit is determined based on the identifier of the second storage unit. The second correspondence includes the second attribute value and the identifier of the second storage unit.

6. The method according to any one of claims 1-5, characterized in that, The search step based on the first search key and the search step based on the second search key are executed in parallel within the same clock cycle.

7. The method according to any one of claims 1 to 6, characterized in that, The set of attribute values ​​for the first attribute of the endpoint that obtains the data packet includes: Obtain the set of attribute values ​​for the first attribute of the endpoint carried in the data packet; or, Based on the field content carried in the data packet and the third correspondence, the attribute value set of the first attribute of the endpoint is obtained, and the third correspondence includes the field content and the attribute value set of the first attribute.

8. The method according to any one of claims 1-7, characterized in that, The network object includes a user, the first attribute includes a security group, and the attribute value set includes multiple security groups to which the user belongs; or, The first attribute includes a user, the first attribute value includes a job position, and the set of attribute values ​​includes multiple job positions to which the user belongs; or, The first attribute includes the terminal location, the first attribute value includes a security zone, and the set of attribute values ​​includes multiple security zones to which the terminal location belongs.

9. A strategy search method, characterized in that, Applied to a forwarding device, the forwarding device including a memory, the method includes: Receive a data packet from another device, obtain a set of attribute values ​​for a first attribute of the endpoint of the data packet, wherein the endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet, and the set of attribute values ​​for the first attribute includes a first attribute value and a second attribute value of the first attribute. The lookup key is determined based on the set of attribute values ​​of the first attribute. The lookup key includes a first group code and a first attribute value sequence code. The first group code is used to identify a first group. The first group includes the first attribute value and the second attribute value. In the first attribute value sequence code, the first bit corresponding to the first attribute value is set to the first bit value, and the second bit corresponding to the second attribute value is set to the second bit value. Based on the lookup key, a strategy matching the lookup key is searched in the memory to obtain a strategy set corresponding to the attribute value set. The strategy set includes a first strategy and a second strategy. The first strategy corresponds to the first attribute value and matches the lookup key, and the second strategy corresponds to the second attribute value and matches the lookup key. The first strategy includes a first block code and a first mask sequence. In the first mask sequence, the first bit corresponding to the first attribute value is set to the first bit value, and the other bits in the first mask sequence other than the first bit include the mask. The second strategy includes the first block code and a second mask sequence. In the second mask sequence, the second bit corresponding to the second attribute value is set to the second bit value, and the other bits in the second mask sequence other than the second bit include the mask. The data packets are processed based on the set of policies.

10. The method according to claim 9, characterized in that, Before the strategy of searching for a match between the lookup key and the memory based on the lookup key, the method further includes: In response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, the first attribute value and the second attribute value are assigned to the first group based on constraints. The constraints include that each set of attribute values ​​of the same attribute is at least a subset of the set of attribute values ​​in a group, and that an attribute value is assigned to at least one group, and that a group belongs to only one attribute.

11. The method according to claim 10, characterized in that, After classifying the first attribute value and the second attribute value into the first group based on constraints, the method further includes: The first group is encoded to obtain the first group code; The first attribute value is encoded to obtain the first mask sequence, and the second attribute value is encoded to obtain the second mask sequence; The first block code and the first mask sequence are stored in the first strategy, and the first block code and the second mask sequence are stored in the second strategy.

12. The method according to claim 9, characterized in that, The set of attribute values ​​for the first attribute of the endpoint that obtains the data packet includes: Obtain the attribute value set of the first attribute and the attribute value set of the second attribute of the endpoint of the data packet. The endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet. The attribute value set of the second attribute includes the third attribute value and the fourth attribute value of the second attribute. Determining the lookup key based on the set of attribute values ​​of the first attribute includes: Based on the attribute value set of the first attribute and the attribute value set of the second attribute, a lookup key is determined. The lookup key further includes a second group code and a second attribute value sequence code. The second group code is used to identify a second group, which includes a third attribute value and a fourth attribute value. In the second attribute value sequence code, the third bit corresponding to the third attribute value includes a third bit value, and in the fourth attribute value sequence code, the fourth bit corresponding to the fourth attribute value includes a fourth bit value. Accordingly, The first strategy further includes the second block code and the third mask sequence. In the third mask sequence, the third bit corresponding to the third attribute value includes the third bit value, and the other bits in the third mask sequence besides the third bit include the mask. The second strategy further includes the second block code and the third mask sequence. The strategy set further includes the third strategy and the fourth strategy. The third strategy includes the first block code, the first mask sequence, the second block code, and the fourth mask sequence. In the fourth mask sequence, the fourth bit corresponding to the fourth attribute value includes the fourth bit value, and the other bits in the fourth mask sequence besides the fourth bit include the mask. The fourth strategy includes the first block code, the second mask sequence, the second block code, and the fourth mask sequence.

13. The method according to claim 9, characterized in that, The set of strategies is obtained within the same clock cycle.

14. The method according to any one of claims 9 to 13, characterized in that, The set of attribute values ​​for the first attribute of the endpoint that obtains the data packet includes: Obtain the set of attribute values ​​for the first attribute of the endpoint carried in the data packet; or, Based on the field content and corresponding relationship carried in the data message, the attribute value set of the first attribute of the endpoint is obtained, and the corresponding relationship includes the field content and the attribute value set of the first attribute.

15. A relay device, characterized in that, The forwarding device includes a processor, a memory, and a network interface, wherein the memory includes a first storage unit and a second storage unit; The network interface is used to receive data packets from another device; The processor is configured to obtain a set of attribute values ​​for a first attribute of the endpoint of the data packet, wherein the endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet, and the set of attribute values ​​includes a first attribute value and a second attribute value of the first attribute. The processor is further configured to determine a lookup key set based on the attribute value set, the lookup key set including a first lookup key corresponding to the first attribute value and a second lookup key corresponding to the second attribute value; search for a strategy matching the first lookup key from the first storage unit based on the first lookup key, and search for a strategy matching the second lookup key from the second storage unit based on the second lookup key, to obtain a strategy set corresponding to the attribute value set, the strategy set including a first strategy and a second strategy, the first strategy corresponding to the first attribute value and matching the first lookup key, the second strategy corresponding to the second attribute value and matching the second lookup key, the lookup step based on the first lookup key and the lookup step based on the second lookup key are executed in parallel; The data packets are processed based on the set of policies.

16. The device according to claim 15, characterized in that, The processor is further configured to, in response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, store a first strategy corresponding to the first attribute value in the first storage unit and store a second strategy corresponding to the second attribute value in the second storage unit; or, In response to the absence of a network object in the communication network where the forwarding device is located that simultaneously has a first attribute value and a third attribute value, the first strategy corresponding to the first attribute value and the third strategy corresponding to the third attribute value are stored in the first storage unit. or, In response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, and the first policy corresponding to the first attribute value and the second policy corresponding to the second attribute value are both stored in the first storage unit, the second policy is migrated from the first storage unit to the second storage unit.

17. The device according to claim 16, characterized in that, The processor is further configured to record a first correspondence and a second correspondence, wherein the first correspondence includes the first attribute value and the identifier of the first storage unit, and the second correspondence includes the second attribute value and the identifier of the second storage unit.

18. The device according to claim 16, characterized in that, The first storage unit includes one or more slices, and the first policy corresponding to the first attribute value includes multiple policy entries. The processor is configured to store the multiple policy entries in one slice if the total storage capacity required by the multiple policy entries does not exceed the storage capacity of one slice; or, if the total storage capacity required by the multiple policy entries exceeds the storage capacity of one slice, store different policy entries among the multiple policy entries in different slices among the multiple slices.

19. The device according to claim 15, characterized in that, The processor is configured to obtain the identifier of the first storage unit based on the first attribute value and the first correspondence, and to determine the first storage unit based on the identifier of the first storage unit, wherein the first correspondence includes the first attribute value and the identifier of the first storage unit. The identifier of the second storage unit is obtained based on the second attribute value and the second correspondence, and the second storage unit is determined based on the identifier of the second storage unit. The second correspondence includes the second attribute value and the identifier of the second storage unit.

20. The device according to any one of claims 15 to 19, characterized in that, The processor is configured to obtain a set of attribute values ​​for the first attribute of the endpoint carried in the data packet; or, based on the field content carried in the data packet and a third correspondence, obtain a set of attribute values ​​for the first attribute of the endpoint, wherein the third correspondence includes the field content and the set of attribute values ​​for the first attribute.

21. A relay device, characterized in that, It is applied to a forwarding device, which includes a processor, a memory, and a network interface; The network interface is used to receive data packets from another device; The processor is configured to obtain a set of attribute values ​​for a first attribute of the endpoint of the data packet, wherein the endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet, and the set of attribute values ​​for the first attribute includes a first attribute value and a second attribute value of the first attribute. The processor is further configured to determine a lookup key based on the attribute value set of the first attribute, the lookup key including a first block code and a first attribute value sequence code, the first block code being used to identify a first block, the first block including the first attribute value and the second attribute value, the first bit corresponding to the first attribute value in the first attribute value sequence code being set to a first bit value, and the second bit corresponding to the second attribute value in the first attribute value sequence code being set to a second bit value; and to search for a strategy matching the lookup key from the memory based on the lookup key to obtain a strategy set corresponding to the attribute value set, the strategy set including a first strategy and a second strategy. The strategies are as follows: the first strategy corresponds to the first attribute value and matches the lookup key; the second strategy corresponds to the second attribute value and matches the lookup key; the first strategy includes the first block code and the first mask sequence; the first bit in the first mask sequence corresponding to the first attribute value is set to the first bit value; and the other bits in the first mask sequence other than the first bit include the mask; the second strategy includes the first block code and the second mask sequence; the second bit in the second mask sequence corresponding to the second attribute value is set to the second bit value; and the other bits in the second mask sequence other than the second bit include the mask. The processor is further configured to process the data packets based on the policy set.

22. The device according to claim 21, characterized in that, The processor is further configured to, in response to the existence of a network object in the communication network where the forwarding device is located that simultaneously has the first attribute value and the second attribute value, classify the first attribute value and the second attribute value into the first group based on constraints, wherein the constraints include that each set of attribute values ​​of the same attribute is at least a subset of the set of attribute values ​​in a group, and that an attribute value is assigned to at least one group, and that a group belongs to only one attribute.

23. The device according to claim 22, characterized in that, The processor is further configured to encode the first group to obtain the first group code; encode the first attribute value to obtain the first mask sequence; and encode the second attribute value to obtain the second mask sequence; store the first group code and the first mask sequence in the first strategy, and store the first group code and the second mask sequence in the second strategy.

24. The device according to claim 21, characterized in that, The processor is configured to acquire a set of attribute values ​​for a first attribute and a set of attribute values ​​for a second attribute of the endpoint of the data packet. The endpoint of the data packet includes either the initiating network object of the data packet or the destination network object of the data packet. The set of attribute values ​​for the second attribute includes a third attribute value and a fourth attribute value of the second attribute. Based on the set of attribute values ​​for the first attribute and the set of attribute values ​​for the second attribute, a lookup key is determined. The lookup key further includes a second block code and a second attribute value sequence code. The second block code is used to identify a second block. The second block includes a third attribute value and a fourth attribute value. In the second attribute value sequence code, the third bit corresponding to the third attribute value includes a third bit value, and in the fourth attribute value sequence code, the fourth bit corresponding to the fourth attribute value includes a fourth bit value. Accordingly, The first strategy further includes the second block code and the third mask sequence. In the third mask sequence, the third bit corresponding to the third attribute value includes the third bit value, and the other bits in the third mask sequence besides the third bit include the mask. The second strategy further includes the second block code and the third mask sequence. The strategy set further includes the third strategy and the fourth strategy. The third strategy includes the first block code, the first mask sequence, the second block code, and the fourth mask sequence. In the fourth mask sequence, the fourth bit corresponding to the fourth attribute value includes the fourth bit value, and the other bits in the fourth mask sequence besides the fourth bit include the mask. The fourth strategy includes the first block code, the second mask sequence, the second block code, and the fourth mask sequence.

25. A strategy lookup device, characterized in that, The device is provided in a forwarding device, the forwarding device including a memory, the memory including a first storage unit and a second storage unit, the device including: A receiving unit is configured to receive a data packet from another device and obtain a set of attribute values ​​of a first attribute of the endpoint of the data packet. The endpoint of the data packet includes the initiating network object of the data packet or the destination network object of the data packet. The set of attribute values ​​includes a first attribute value of the first attribute and a second attribute value of the first attribute. The processing unit is configured to determine a set of lookup keys based on the set of attribute values, wherein the set of lookup keys includes a first lookup key corresponding to the first attribute value and a second lookup key corresponding to the second attribute value; A lookup unit is configured to search for a strategy matching the first lookup key in the first storage unit based on the first lookup key, and to search for a strategy matching the second lookup key in the second storage unit based on the second lookup key, so as to obtain a strategy set corresponding to the attribute value set. The strategy set includes a first strategy and a second strategy. The first strategy corresponds to the first attribute value and matches the first lookup key, and the second strategy corresponds to the second attribute value and matches the second lookup key. The lookup step based on the first lookup key and the lookup step based on the second lookup key are executed in parallel. The processing unit is further configured to process the data packets based on the policy set.

26. A strategy lookup device, characterized in that, The device is provided in a forwarding device, the forwarding device including a memory, the means including: A receiving unit is configured to receive a data packet from another device and obtain a set of attribute values ​​for a first attribute of the endpoint of the data packet. The endpoint of the data packet includes either the initiating network object of the data packet or the destination network object of the data packet. The set of attribute values ​​for the first attribute includes a first attribute value and a second attribute value of the first attribute. The processing unit is configured to determine a lookup key based on the set of attribute values ​​of the first attribute. The lookup key includes a first group code and a first attribute value sequence code. The first group code is used to identify a first group. The first group includes the first attribute value and the second attribute value. In the first attribute value sequence code, the first bit corresponding to the first attribute value is set to the first bit value, and the second bit corresponding to the second attribute value is set to the second bit value. A lookup unit is configured to search for a strategy matching the lookup key in the memory based on the lookup key, so as to obtain a strategy set corresponding to the attribute value set. The strategy set includes a first strategy and a second strategy. The first strategy corresponds to the first attribute value and matches the lookup key, and the second strategy corresponds to the second attribute value and matches the lookup key. The first strategy includes a first block code and a first mask sequence. In the first mask sequence, the first bit corresponding to the first attribute value is set to the first bit value, and the other bits in the first mask sequence other than the first bit bit include the mask. The second strategy includes the first block code and a second mask sequence. In the second mask sequence, the second bit corresponding to the second attribute value is set to the second bit value, and the other bits in the second mask sequence other than the second bit bit include the mask. The processing unit is further configured to process the data packets based on the policy set.

Images