Session processing method and computer-readable storage medium

Abstract

The present application discloses a session processing method and a computer-readable storage medium. Relating to the technical field of networks, the method comprises: when a first data packet has been received, determining whether a first session exists in a session table, wherein the first session is a session matching a data flow to which the first data packet belongs; if the first session does not exist in the session table, determining whether a second session exists in the session table, wherein the second session is a session matching a target data flow, and the target data flow has the same target data characteristics as the data flow to which the first data packet belongs; and if the second session exists in the session table, generating the first session on the basis of the second session. The present application solves the technical problem in the related art that each time a network device receives a new data flow, a complete session is directly created for the new data flow, affecting the working performance of the device.

Description

Session processing method and computer readable storage medium

[0001] The present application claims priority from the Chinese patent application No. 202410903307.6 filed on July 5, 2024, and entitled "Session processing method, device, computer readable storage medium and electronic device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the technical field of network, in particular to a session processing method and a computer readable storage medium. BACKGROUND

[0003] With the continuous development of network technology, the demand for the working performance of network devices is also increasing. At present, the industry widely adopts a data processing architecture and process based on flow for network devices, that is, data packets belonging to the same flow will follow the same processing path and service, for example, the processing methods of NAT (Network Address Translation), routing, policy, application service and statistics are the same. The data structure composed of the foregoing information describing network and service characteristics is also called session.

[0004] The network device adopts a session table-based method to process network traffic, that is, a corresponding session is established in the session table for the first packet in the traffic, and the subsequent data packets in the traffic can be quickly processed through the information in the established session. The network device directly creates a complete session for each new data flow when receiving a new data flow, and since the newly created session usually consumes a large number of CPU cycles, for example, in a typical firewall gateway, several ten thousand CPU cycles are required to create a new TCP (Transmission Control Protocol) session, thus affecting the working performance of the device.

[0005] SUMMARY

[0006] The present application provides a session processing method and a computer readable storage medium.

[0007] According to an aspect of the embodiments of the present application, a session processing method is provided, comprising: in the case of receiving a first data packet, judging whether a first session exists in a session table, wherein the first session refers to a session matching a data flow to which the first data packet belongs; if the first session does not exist in the session table, judging whether a second session exists in the session table, wherein the second session refers to a session matching a target data flow, and the target data flow has a same target data characteristic as the data flow to which the first data packet belongs; and in the case of the second session existing in the session table, generating the first session according to the second session.

[0008] According to another aspect of the embodiments of the present application, a session processing method is also provided, which is applied to a network device, comprising: in the case of a first data packet received being a first packet of a data flow, judging whether a second session exists in a session table, wherein the second session refers to a session matching a target data flow, and the target data flow has a same target data characteristic as the data flow to which the first data packet belongs; and in the case of the second session existing in the session table, generating the first session according to the second session, wherein the first session matches the data flow to which the first data packet belongs.

[0009] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which stores a computer program, wherein the computer program is set to execute the session processing method as described above when running.

[0010] In the embodiments of the present application, a session corresponding to a data packet is generated based on a data flow having an association relationship with the data packet, by judging whether a first session exists in a session table in the case of receiving a first data packet, and then judging whether a second session exists in the session table if the first session does not exist in the session table, so as to generate the first session according to the second session in the case of the second session existing in the session table. The first session refers to a session matching a data flow to which the first data packet belongs, and the second session refers to a session matching a target data flow, and the target data flow has a same target data characteristic as the data flow to which the first data packet belongs.

[0011] In the above process, by judging whether the second session exists in the session table in the case that the first session does not exist in the session table, the session corresponding to the data flow having the association relationship with the data flow to which the first data packet belongs is found in the case that the first data packet does not correspond to the session existing in the session table. Since the sessions corresponding to the two data flows have part of the same information when the two data flows have part of the same data characteristics, that is, have a certain association relationship, the first session is generated according to the second session in the case that the second session exists in the session table, so that the first session is generated on the basis of the existing associated session, thereby the determination process of the information that does not need to be modified can be saved in the generation process of the first session, and then the resource occupation of the network device can be reduced and the influence on the performance of the network device can be reduced.

[0012] Therefore, the scheme provided in the present application achieves the purpose of generating the session corresponding to the data packet based on the session of the data flow having the association relationship with the data packet, thereby achieving the technical effect of reducing the influence on the performance of the network device, and further solving the technical problem that the related art network device directly creates a complete session for a new data flow each time the new data flow is received, thereby affecting the working performance of the device. BRIEF DESCRIPTION OF DRAWINGS

[0013] The accompanying drawings, which are included to provide a further understanding of the present application and are incorporated in and constitute a part of this application, illustrate embodiments of the present application and serve to explain the present application. In the drawings:

[0014] FIG. 1 is a flowchart of a traffic processing method;

[0015] FIG. 2 is a flowchart of a session processing method according to an embodiment of the present application;

[0016] FIG. 3 is a schematic diagram of a session index table and a session table according to an embodiment of the present application;

[0017] FIG. 4 is a flowchart of a session processing method according to an embodiment of the present application;

[0018] FIG. 5 is a schematic diagram of a session processing apparatus according to an embodiment of the present application;

[0019] FIG. 6 is a flowchart of a session processing method according to an embodiment of the present application;

[0020] FIG. 7 is a schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the technical personnel in the art better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor should be within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0023] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards in relevant regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0024] Embodiment 1

[0025] FIG. 1 is a flowchart of a traffic processing method. As shown in FIG. 1, when the network device receives a data packet, it first performs session lookup in the session table. If a session is found, the data packet is directly processed based on the information in the session. If no session is found, a corresponding session is created, and the session is loaded into the session table, and then the data packet is processed. In the foregoing manner, the network device directly creates a complete session for each new data flow received. Since the newly created session usually consumes a large number of CPU cycles, for example, in a typical firewall gateway, several ten thousand CPU cycles are required to create a new TCP (Transmission Control Protocol) session, thus there is a problem of affecting the working performance of the device.

[0026] According to some embodiments of the present application, a session processing method is provided. It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] FIG. 2 is a flowchart of a session processing method according to an embodiment of the present application. As shown in FIG. 2, the method comprises the following steps:

[0028] In step S201, when a first data packet is received, it is determined whether the first session exists in the session table, wherein the first session refers to a session matching a data flow to which the first data packet belongs.

[0029] In this embodiment, a network device is taken as an execution subject to execute the session processing method. The network device can be a network security device such as a FW (Firewall), an IDS (Intrusion Detection System), an IPS (Intrusion Prevention System), a WAF (Web Application Firewall), or the like, or can be another device supporting processing of traffic in the process of traffic transmission. The specific network device is not limited in the embodiments of the present application.

[0030] In this embodiment, the network device is configured to process a data packet matching a session in the session table according to the session, for example, to forward the data packet.

[0031] In some embodiments, the first data packet can be sent by an external terminal to the network device, and the external terminal includes but is not limited to a client, a server, or the like. The network device follows the same processing path and service for data packets belonging to the same data flow, for example, the same processing mode in the dimensions of NAT (Network Address Translation), routing, policy, application service, and statistics.

[0032] In some embodiments, one data flow refers to data packets with the same characteristics and matching the same predefined conditions so as to have consistent processing logic or services, for example, data structures with the same source IP address, source port number, destination IP address, destination port number, transmission layer protocol, interface and other service characteristics. In this embodiment, data packets with the same source IP address, source port number, destination IP address, destination port number and transmission layer protocol can be determined as belonging to the same data flow, or data packets with the same source IP address, source port number, destination IP address, destination port number, transmission layer protocol and interface receiving the data packets can be determined as data packets belonging to the same data flow.

[0033] In some examples, one session in the session table can be represented by one session table entry. One session table entry can include source IP address, destination IP address, source port number, destination port number, protocol and the like. The protocol can be, for example, TCP protocol or UDP protocol (User Datagram Protocol).

[0034] In some examples, when there is no session table entry in the session table that does not match the first data packet, it is determined that there is no first session in the session table that matches the first data packet.

[0035] In some embodiments, the network device needs to create a session for the first packet of each data flow, that is, create a session for a new data flow when a new data flow is received, so that the network device can quickly process subsequent data packets in the data flow based on the information in the session corresponding to the first packet. Therefore, in this embodiment, when the network device receives the first data packet, the network device can first determine whether the first session exists in the session table.

[0036] In some embodiments, in step S201, when the received first data packet is not the first packet of a data flow, it can be determined whether the first session that matches the data flow to which the first data packet belongs exists in the session table, and when the first session does not exist in the session table and the second session exists, the first session is generated according to the second session; the target data characteristics between the target data flow matched by the second session and the data flow to which the first data packet belongs are the same.

[0037] Considering that the session table can have an aging time, for an already established session table entry, it is only necessary to exist when it is continuously matched by data packets. If there is no data packet matching for a long time, it means that the communication parties may have disconnected and no longer need the session table entry, which will be destroyed. Therefore, in this embodiment, when the subsequent packet of the data flow cannot be matched by the first session in the session table, the first session can be generated according to the second session matched by other data flows in the session table, so as to reduce the CPU resources consumed due to the need to newly create a session in the related art.

[0038] In some embodiments, the session described above is a data structure created by the network device for managing and tracking data flows passing through it, and the network device loads the session in a session table. The session includes, but is not limited to, a session identifier, session state information, a processing manner of the data packet in at least one dimension, a timestamp, a quality of service (QoS) parameter, and the like. The session state information can be active, closed, and the like; the at least one dimension includes at least one of the following: a network address translation dimension, a routing dimension, a policy dimension, a service dimension, a statistics dimension, wherein the network address translation refers to rewriting the source IP address or the destination IP address of the data packet when the data packet passes through the network device, the routing refers to the routing path or the next hop information of the data packet, the policy can refer to a series of rules for controlling the processing and transmission of the data packet, the service can refer to a specific application or service related to the transmission of the data packet, and the statistics refers to counting the number of data packets, counting the number of bytes, and the like; the timestamp can include the creation time and the last active time of the session, and is used for timeout management; the quality of service parameter is used for recording the service level agreement or the bandwidth allocation information, and the like.

[0039] For example, when creating a session, the network device creates a session corresponding to the data packet according to the data characteristics (or referred to as "attribute information") in the data packet, wherein the data characteristics can include the five-tuple information in the data packet. For example, the data characteristics can include: the source IP address, the source port number, the destination IP address, the destination port number, and the transport layer protocol. In the process of searching for the first session in the session table, the network device can extract the data characteristics of the first data packet from the first data packet, and then determine whether there is a session matching the data characteristics in the session table, if there is, the session matching the data characteristics is determined as the first session, and if there is not, it is determined that there is no first session.

[0040] For another example, when creating a session, the network device creates a session corresponding to the data packet according to other characteristics (i.e. characteristics other than data characteristics) of the data packet, and there is a corresponding relationship between the session and the other characteristics, wherein the other characteristics can be a special identifier set for the data flow. In the process of searching for the first session in the session table, the network device can extract the other characteristics of the first data packet from the first data packet, and then determine whether there is a session matching the characteristics in the session table, if there is, the session matching the characteristics is determined as the first session, and if there is not, it is determined that there is no first session.

[0041] In step S202, if the first session does not exist in the session table, it is determined whether a second session exists in the session table, wherein the second session refers to a session matching a target data flow, and the target data characteristics between the target data flow and the data flow to which the first data packet belongs are the same.

[0042] In some embodiments, in the case that the first session does not exist in the session table, a session needs to be established for the data flow to which the first data packet belongs (i.e., the first session is established) so as to quickly process the data packets belonging to the data flow subsequently received. In this embodiment, in this case, the network device can determine whether the second session exists in the session table, and determine the manner of establishing the first session based on the determination result.

[0043] In some embodiments, the first session is used for processing the data packets in the data flow to which the first data packet belongs, and the second session is used for processing the data packets in the target data flow.

[0044] In some embodiments, the target data characteristic between the target data flow and the data flow to which the first data packet belongs is the same.

[0045] In some embodiments, the target data characteristic between the target data flow and the data flow to which the first data packet belongs is the same, and is the same as the interface information of the ingress interface used by the network device to receive the first data packet, and is the same as the security policy corresponding to the first data packet. The security policy can be determined according to the source port number of the first data packet.

[0046] In some embodiments, the target data characteristic described above is a part of the data characteristic of the data flow, which can also be understood as a part of the data characteristic of the data packet. For example, the target data characteristic can refer to at least one of the destination IP address, the source IP address, the destination port number, and the transmission layer protocol.

[0047] For example, in a typical Web (World Wide Web, global wide area network) application, such as accessing a Web page and interacting with a Web service, the network device transmits traffic between a client and a server, and between the same client and the same server, a plurality of links, even more, are often generated within a certain time period. The data flows in these links have the same elements except for some elements, such as the source port number. The relationship between the aforementioned data flows can be understood as the relationship between the data flow to which the first data packet belongs and the target data flow in this embodiment, and the processing logic for the data flows in these links has common points.

[0048] In some embodiments, the network device can establish a correspondence between the session and the target data characteristic when generating the session for the data packet. Thus, in the process of searching for the second session by the network device, the target data characteristic of the first data packet is extracted from the first data packet first, and then it is determined whether there is a session in the session table that matches the target data characteristic. If there is, the session that matches the target data characteristic is determined as the second session. If there is no session that matches the target data characteristic, it is determined that there is no second session.

[0049] In some embodiments, the network device can also establish a correspondence between the session and the target data feature, the interface information and the security policy when generating the session for the first data packet. Thus, in the process of searching for the second session by the network device, the network device can first extract the target data feature of the first data packet from the first data packet, and determine the security policy and the interface information corresponding to the first data packet, and then determine whether there is a session in the session table that matches the target data feature, the security policy and the interface information. If there is, the session that matches the target data feature, the security policy and the interface information is determined as the second session. If there is no session that matches the target data feature, the security policy and the interface information, it is determined that there is no second session.

[0050] In some embodiments, in step S202, the target index value can be generated according to at least one of the policy pointer, the interface information of the ingress interface used by the network device to receive the first data packet, and the target data feature in the first data packet, and it is determined whether there is a target record corresponding to the target index value in the pre-constructed session index table to obtain a determination result, and it is determined whether there is a second session according to the determination result, wherein each record in the session index table includes an index value and a session pointer for pointing to a session in the session table.

[0051] In some embodiments, the policy pointer is determined according to the source port number of the first data packet; and the policy pointer is used to point to a security policy. The ingress interface of the network device is an interface used by the network device to receive the first data packet, and the interface information can be an interface identifier of the ingress interface or an indication of a security area to which the ingress interface belongs.

[0052] Exemplarily, the target index value can be calculated according to the policy pointer determined based on the source port in the first data packet, the interface information of the ingress interface, and the target data feature in the plurality of data features of the first data packet, wherein the target data feature includes at least one of the following: destination IP address, source IP address, destination port number, and transport layer protocol.

[0053] In step S203, the first session is generated according to the second session in the case where the second session exists in the session table.

[0054] In the embodiments of the present application, there are partially same data features between the target data flow and the data flow to which the first data packet belongs, and therefore, there are also partially same information between the session corresponding to the target data flow and the session corresponding to the data flow. Therefore, in the case where the second session exists in the session table, the network device can generate the first session according to the second session. In some embodiments, the second session and the first session are brother sessions or associated sessions.

[0055] In some embodiments, for any two data flows, if one or more target data features between the two data flows are the same, and a session matched by one of the two data flows is a first session, a second session matched by the other of the two data flows can be determined as an associated session (or a sibling session) of the first session, or the first session is determined to be associated with the second session.

[0056] In some examples, when the second session exists in the session table, the second session can be a session directly created based on a data packet (e.g., a first packet) of a target data flow in the session table, or can be a session generated based on another session in the session table.

[0057] In the step S203, when the second session exists in the session table, the second session can be cloned, and the cloned session can be modified based on at least the data features of the first data packet to obtain the first session.

[0058] For example, the network device can clone the second session completely to obtain a cloned second session, and then modify part of information in the cloned second session to determine the modified session as the first session. For example, the part of information can be difference information of the multiple data features of the first data packet compared with the session table entry of the second session, or can be mode information of a processing mode of the data packet in at least one dimension.

[0059] For another example, the network device can clone information in the second session that does not need to be modified, and then determine difference information of the first session relative to the second session based on the multiple data features of the first data packet, so as to combine the difference information and the cloned information to obtain the first session.

[0060] In some embodiments, the network device is preset with a configuration file, and the configuration file records a dimension to which information needed to be updated when the first session is generated based on the second session belongs, so that the network device can determine information in the second session that needs to be modified or information that does not need to be modified based on the configuration file when the first session is generated based on the second session.

[0061] In some embodiments, after the first session is generated, the network device can load the first session into the session table, and process the first data packet based on information in the first session. For example, the network device can perform network address translation, routing, processing based on a specific policy, processing based on a specific service, and counting a number of bytes of the first data packet, etc.

[0062] In some examples, for the associated two sessions (e.g., the second session and the first session generated based on the second session), the two sessions satisfy at least one of the following conditions:

[0063] The first condition indicates that the two sessions have the same incoming interface or have the same security zone;

[0064] The second condition indicates that the two sessions have at least one of the same source IP address, destination IP address, destination port, and protocol type;

[0065] The third condition indicates that the two sessions have the same policy pointer (also referred to as a policy index).

[0066] Based on the scheme defined in steps S201 to S203, it can be learned that, in the embodiments of the present application, the session corresponding to the data packet is generated based on the data flow associated with the data packet, by determining whether the first session exists in the session table when the first data packet is received, and then determining whether the second session exists in the session table if the first session does not exist in the session table, so that the first session is generated based on the second session if the second session exists in the session table. The first session refers to the session matched with the data flow to which the first data packet belongs, and the network device is used to process the data packet matched with the session based on the information in the session. The second session refers to the session matched with the target data flow, and the target data flow has the same target data characteristics as the data flow to which the first data packet belongs.

[0067] It is easy to note that, in the above process, by determining whether the second session exists in the session table if the first session does not exist in the session table, the session corresponding to the data flow associated with the data flow to which the first data packet belongs is found if the session corresponding to the first data packet does not exist in the session table. Since the sessions corresponding to the two data flows have partially same information when the two data flows have partially same data characteristics, i.e., have certain association, the first session is generated based on the second session if the second session exists in the session table, which realizes generating the first session based on the existing associated session, so that the determination process of the information that does not need to be modified can be saved in the generation process of the first session, and the resource occupation of the network device can be reduced and the influence on the performance of the network device can be reduced.

[0068] Therefore, the scheme provided in the application achieves the purpose of generating a session corresponding to a data packet based on a data flow having an association relationship with the data packet, thereby achieving the technical effect of reducing the impact on the performance of a network device, and further solving the technical problem of a related art network device directly creating a complete session for a new data flow each time a new data flow is received, thereby affecting the working performance of the device.

[0069] In some embodiments, a session processing method is provided, which can include: when a first data packet received is a first packet of a data flow, determining whether a second session exists in a session table, wherein the second session refers to a session matching a target data flow, the target data flow having the same target data characteristic as a data flow to which the first data packet belongs, and in the case that the second session exists in the session table, generating a first session according to the second session, the first session matching the data flow to which the first data packet belongs. In the case that the first data packet received is not the first packet of the data flow, determining whether a first session matching the data flow to which the first data packet belongs exists in the session table, and in the case that the first session does not exist in the session table and a second session exists, generating the first session according to the second session, the target data flow matched by the second session having the same target data characteristic as the data flow to which the first data packet belongs.

[0070] In some embodiments, in the process of determining whether the second session exists in the session table, the network device can determine a policy pointer corresponding to a source port number according to the source port number in the first data packet, determine interface information of an incoming interface used by the network device to receive the first data packet, and then calculate a target index value according to the policy pointer, the interface information, and a target data characteristic of the first data packet, and then determine whether a target record corresponding to the target index value exists in a session index table, to obtain a determination result, so as to determine whether the second session exists in the session table according to the determination result. The policy pointer is used to point to a security policy, the target data characteristic includes at least one of a destination IP address, a source IP address, a destination port number, and a transport layer protocol, and each record in the session index table includes an index value and a session pointer used to point to a session in the session table.

[0071] In some embodiments, in the range of 16-bit source port numbers, the port numbers are usually divided into several parts, including a temporary port segment and some fixed ports or port segments. Each segment area has a matching security policy, that is, there is a matching relationship between the source port number and the security policy. The security policy can be used for access control, traffic filtering, security checking, and the like on the first data packet.

[0072] The network device stores a matching relationship between source port numbers and policy pointers in a memory. The policy pointer can be an index value for pointing to a security policy. In a case where the first session does not exist in the session table, the network device can determine, according to the source port number in the first packet, a policy pointer corresponding to the source port number from the matching relationship.

[0073] In some embodiments, the network device can further determine interface information of a network interface of the network device used for receiving the first packet. The interface information can be an interface identifier or a security zone to which the network interface belongs. For example, the network device can record the interface identifier of the network interface used for receiving the first packet when the first packet enters the network device, and determine the interface information according to the interface identifier. The network device stores a correspondence between network interfaces and security zones in a memory. The multiple interfaces in the network device can be divided into multiple security zones. The security zones can include a trusted zone, an untrusted zone, a demilitarized zone (DMZ), a local zone, and the like. A security zone can be understood as a collection of interfaces. The interfaces in a security zone have the same security attribute.

[0074] In some embodiments, the network device can further determine target data characteristics of the first packet. The target data characteristics can include at least one of a destination IP address, a source IP address, a destination port number, and a transport layer protocol. For example, the network device can extract the destination IP address, the source IP address, the destination port number, and the transport layer protocol from the first packet.

[0075] For example, in this embodiment, for the data flow to which the first packet belongs, data flows having the same interface information, and / or having the same destination IP address, source IP address, destination port number, and transport layer protocol, and / or having the same source port number and policy pointer can be determined as target data flows.

[0076] After determining the policy pointer, the interface information, and the target data characteristics, the network device can calculate a target index value according to the policy pointer, the interface information, and the target data characteristics of the first packet. For example, the network device can combine the policy pointer, the interface information, and the target data characteristics of the first packet, and perform a hash operation to obtain a hash value, and determine the hash value as the target index value. For another example, the network device can set a correspondence between different policy pointers, different interface information, and different target data characteristics and numbers, determine a number sequence composed of a number corresponding to the policy pointer, the interface information, and the target data characteristics of the first packet corresponding to the first packet, and determine the number sequence as the target index value. For another example, the network device can calculate the policy pointer, the interface information, and the target data characteristics of the first packet based on other calculation manners, and obtain the target index value.

[0077] In some embodiments, in the network device, the relationship between the policy pointer, the interface information, the target data feature and the session can be established by a session index table. FIG. 3 is a schematic diagram of a session index table and a session table according to an embodiment of the present application. As shown in FIG. 3, the session index table includes a plurality of records, each of which includes an index value and a session pointer for pointing to a session in the session table. Different records correspond to different sessions, and the index value in the record is calculated according to the policy pointer, the interface information and the target data feature of the data packet corresponding to the session, and the calculation method of the index value is the same as that of the target index value. The session pointer in the record is used to point to the session, so that when a new data packet has the same policy pointer, interface information and target data feature as the aforementioned data packet, the index value calculated for the new data packet can find the aforementioned session, i.e., the session corresponding to the data flow having an association relationship with the data flow of the new data packet can be determined, for example, the target index value in FIG. 3 finds the session in the session table through the session index table.

[0078] In some embodiments, the session pointer can be an index value for pointing to a session, for example, the session pointer can be a session identifier in the session.

[0079] Therefore, after obtaining the target index value, the network device can determine whether there is a target record corresponding to the target index value in the session index table, and obtain a determination result. Then, it is determined whether there is a second session in the session table according to the determination result.

[0080] It should be noted that when data is transmitted between two terminals (e.g., a client and a server), the two terminals often generate dozens or even more links, and the data streams in these links have the same elements except for some elements, such as the source port number. Therefore, by determining the target data feature of the first data packet, the fixed and unchanged data content in the associated data stream is counted, and by determining the policy pointer and the interface information, the common characteristics of the associated data stream other than the data content are obtained, so that when the target index value is calculated based on these information, the session of the data stream having an association relationship with the first data packet can be effectively indexed, and the index accuracy is improved. In addition, by setting the session index table, the corresponding relationship between the data packet and the associated session is effectively recorded, so that the index efficiency is improved.

[0081] In some embodiments, after determining whether the second session exists in the session table according to the judgment result, the network device can create the first session and load the first session into the session table in the case that the second session does not exist in the session table, and then generate a session pointer pointing to the first session in the session table to obtain a target session pointer, so as to generate a record in the session index table based on the target index value and the target session pointer.

[0082] In some embodiments, if the second session does not exist in the session table, it means that the network device has not processed the data flow associated with the first data packet before, in which case the network device needs to create the complete first session directly. For example, the network device stores a correspondence between a five tuple (i.e. destination IP address, source IP address, destination port number, source port number, transport layer protocol) and a processing manner corresponding to the data packet in at least one dimension, and the network device can determine the processing manner corresponding to the first data packet in at least one dimension according to the five tuple in the first data packet, so as to create the first session according to the processing manner corresponding to the first data packet in at least one dimension, the session identifier, the preset initial session state information, the preset timestamp, the quality of service (QoS) parameter and other information.

[0083] In some embodiments, the aforementioned session identifier can be obtained by hashing the five tuple (i.e. data characteristics) of the data packet, so as to facilitate the construction of the correspondence between the session and the data flow to which the data packet belongs.

[0084] In some embodiments, after generating the first session, the network device loads the first session into the session table for subsequent session lookup.

[0085] In some embodiments, in order to facilitate the generation of the session of the new data flow associated with the first data packet according to the first data packet when the new data flow associated with the first data packet appears subsequently, the network device can generate a session pointer pointing to the first session in the session table to obtain a target session pointer after loading the first session into the session table. For example, the session identifier of the first session is used as the target session pointer. Then a record including the target index value and the target session pointer is generated in the session index table.

[0086] In some embodiments, after generating a record in the session index table based on the target index value and the target session pointer, the network device can process the first data packet based on the information in the first session.

[0087] In some embodiments, when a new data flow occurs subsequently and is associated with the data flow of the first data packet, the policy pointer, the interface information and the target data feature of the data packet of the new data flow are the same as the policy pointer, the interface information and the target data feature of the first data packet. Since there is no session corresponding to the new data flow in the network device at this time, the network device calculates an index value based on the policy pointer, the interface information and the target data feature of the data packet of the new data flow, and the calculated index value is the same as the target index value. Then, the network device searches the session index table according to the calculated index value, so that the above-mentioned record including the target index value and the target session pointer can be found, and the first session can be found. The first session is determined as the session corresponding to the new data flow, and then the session corresponding to the new data flow is determined based on the first session.

[0088] It should be noted that by generating the record corresponding to the first session in the session index table after the first session is created, the real-time updating of the session index table is realized, so that when the network device receives a data flow associated with the data flow to which the first data packet belongs subsequently, the session of the new data flow can be quickly established, thereby reducing the resource occupation when the session is created and reducing the influence on the performance of the network device in some embodiments.

[0089] In some embodiments, in the process of determining whether the second session exists in the session table according to the determination result, the network device can determine the session pointed to by the session pointer in the target record as the second session when the determination result represents that the target record exists in the session index table, and determine that the second session does not exist in the session table when the determination result represents that the target record does not exist in the session index table.

[0090] In some embodiments, the index value in the record is calculated according to the policy pointer, the interface information and the target data feature of the data packet corresponding to the session. Therefore, when the determination result represents that the target record exists in the session index table, it is determined that the data packet corresponding to the session pointed to by the session pointer in the target record is the same as the policy pointer, the interface information and the target data feature of the first data packet, that is, the data flow corresponding to the session pointed to by the session pointer in the target record is associated with the data flow to which the first data packet belongs, so that the session pointed to by the session pointer in the target record can be determined as the second session. Conversely, when the determination result represents that the target record does not exist in the session index table, it is determined that the network device has not processed the data flow associated with the data flow to which the first data packet belongs, and in this case, it is determined that the second session does not exist in the session table.

[0091] It should be noted that through the above process, accurate judgment is achieved on whether the second session exists in the session table, thereby improving the stability of the session processing in the present application, and further improving the stability of data processing.

[0092] In some embodiments, considering that the session in the session table can be invalidated due to timeout management, and the network device can receive other data streams in addition to the target data stream, which have the same target feature data as the data stream to which the first data packet belongs, in order to facilitate the network device to quickly create such data streams after the second session is invalidated, in the present embodiment, a corresponding relationship between the target record and the first session can be established after the first session is generated according to the second session, so that the session for the data stream (for example, the target data stream in the foregoing embodiment) associated with the second session can be quickly generated based on the first session after the second session is invalidated.

[0093] For example, a pointer for pointing to the first session in the session table is directly added in the target record after the first session is generated according to the second session, in which case, the session matched by the newly received data stream can be generated according to any one of the first session and the second session, and for another example, the corresponding relationship between the target record and the first session is recorded first, and then the session pointer in the target record is updated to a pointer for pointing to the first session in the session table in the case that the second session is invalidated.

[0094] In some embodiments, at least one index value can be included in each record in the session index table, and the at least one index value can correspond to the same session pointer, that is, the index value in each record can be one or more, and the multiple index values correspond to the same session pointer to point to the same session. In the case of multiple index values, different index values can be obtained according to different calculation methods, and the information used in different calculation methods is different. For example, a record can include three index values, the first index value can be calculated according to the target data feature, the second index value can be calculated according to the target data feature and the policy pointer, and the third index value can be calculated according to the policy pointer, the interface information and the target data feature.

[0095] In some embodiments, the index values calculated according to different calculation methods have different priorities, and the correspondence between the calculation method used for calculating the index value and the priority is preset in the network device. For example, the index value calculated according to the calculation method using more information has a higher priority, and for the above three index values, the priorities of the third index value, the second index value and the first index value are from high to low.

[0096] In some embodiments, in a case where there are multiple records with the same index value in the session index table, in the process of determining whether the second session exists in the session table according to the determination result, the network device can determine a target calculation manner from the preset multiple calculation manners in a case where the determination result indicates that the target record does not exist in the session index table, then calculate a first index value according to the target calculation manner, and determine whether a first record corresponding to the first index value exists in the session index table, in a case where the first record exists in the session index table, determine the session pointed to by the session pointer in the first record as the second session, in a case where the first record does not exist in the session index table, repeat the step of determining a new target calculation manner from the preset multiple calculation manners, until the preset multiple calculation manners are all used by the first data packet, in a case where the second session does not exist in the session table, or until the first record corresponding to the index value calculated by the new target calculation manner exists in the session index table, and the session pointed to by the session pointer in the first record is determined as the second session.

[0097] In some embodiments, the target network device can determine the target calculation manner from the preset multiple calculation manners according to the order of the priority of the calculation manner from high to low. For example, the calculation manner not used by the first data packet is determined from the preset multiple calculation manners first, and then the calculation manner with the highest priority among the calculation manners not used by the first data packet is determined as the target calculation manner.

[0098] In some embodiments, the preset multiple calculation manners include a calculation manner for calculating the index value according to the policy pointer, the interface information, and the target data feature.

[0099] In this embodiment, multiple index values with different priorities can be set for the same session pointer and recorded in the session index table, so that the session that can be used to generate the first session can be determined from the session table as much as possible, thereby reducing unnecessary resource occupation caused by directly creating the first session and reducing the impact on the performance of the network device.

[0100] In some embodiments, in the process of generating the first session according to the second session, the network device can perform cloning processing on the second session, then determine a target processing manner corresponding to the first data packet in at least one target dimension according to multiple data features of the first data packet, and update the session obtained by the cloning processing according to the manner information of the target processing manner to obtain the first session.

[0101] In some embodiments, the network device is preset with a plurality of data features and a corresponding processing manner of a data packet in at least one dimension, the plurality of data features can be a quintuple, i.e., a destination IP address, a source IP address, a destination port number, a source port number, and a transport layer protocol. The target dimension belongs to the at least one dimension. The network device can determine a target processing manner of the first data packet in at least one target dimension based on the plurality of data features of the first data packet according to the corresponding relationship. The plurality of data features include the target data feature.

[0102] In some embodiments, the at least one target dimension can be all dimensions in the at least one dimension, or can be part of the at least one dimension. The at least one target dimension is preset in the network device, or is determined by the network device based on a preset matching rule. For example, in a certain scenario, for any data flow and the data flow having an associated relationship, the specific session difference information between the two data flows cannot be known, but it is known that the session information between the two data flows will only differ in at least one dimension. Therefore, all dimensions in the at least one dimension can be set as the target dimension. For another example, in a certain scenario, for any data flow and the data flow having an associated relationship, the session information between the two data flows will only differ in a fixed dimension, or the matching relationship between the difference data features of the data flow and the dimension can be determined based on a matching rule. Therefore, a specific dimension in the at least one dimension can be set as the target dimension.

[0103] After determining the processing manner of the first data packet in the at least one target dimension, the network device can replace the manner information of the processing manner in the at least one target dimension in the cloned session with the manner information of the target processing manner, while keeping other information in the cloned session unchanged, thereby obtaining the first session.

[0104] It should be noted that, by the above method, the first session is obtained by modifying the existing session information to a relatively small extent, thereby effectively reducing the occupation of network device resources and reducing the impact on the performance of the network device.

[0105] In some embodiments, the at least one target dimension includes at least one of a network address translation dimension, a routing dimension, a policy dimension, a service dimension, and a statistics dimension. The network device can determine the at least one target dimension by the following method: obtaining a preset configuration file, wherein the configuration file records the dimension to which the information required to generate the first session based on the second session belongs; and determining the at least one target dimension according to the dimension recorded in the configuration file.

[0106] In some examples, the above-mentioned dimension can be replaced by "state".

[0107] In some embodiments, the network device can be preset with a configuration file, and the configuration file records a dimension to which information required to be updated when generating the first session based on the second session belongs. For example, in this embodiment, it is assumed that for any one data flow and the data flow having an association relationship with the data flow, the session information between the two data flows only differs in a fixed dimension, and then the configuration file can directly record the fixed dimension, so that the network device directly determines the dimension recorded in the configuration file as the at least one target dimension, and the dimension recorded in the configuration file can be a network address translation dimension.

[0108] For another example, it is assumed that in this embodiment, for any one data flow and the data flow having an association relationship with the data flow, the session information between the two data flows differs in which dimension depends on the difference data characteristics and other information between the two data flows, and then the configuration file can record a matching relationship between the difference data characteristics of the data flow and the dimension, and then the network device determines the difference information between the data flow to which the first data packet belongs and the target data flow first, for example, the source port number corresponding to the data flow to which the first data packet belongs is "102", and the source port number corresponding to the target data flow is "105", so that the difference data characteristics are "source port number-102; source port number-105;", and then the dimension corresponding to the difference characteristic data in the configuration file can be determined as the at least one target dimension.

[0109] It should be noted that, by the above-mentioned manner, the dimension to which the difference session information between the second session and the first session belongs is effectively determined, so that the network device only needs to determine the information of the related dimension and update the second session when generating the first session based on the second session, thereby further improving the efficiency of generating the first session, reducing the occupation of the network device resources, and reducing the performance impact on the network device.

[0110] In some embodiments, after it is judged whether the first session exists in the session table, if the first session exists in the session table, the network device can process the first data packet according to the information in the first session.

[0111] In some embodiments, if the first session exists in the session table, it can be determined that the first data packet is not a first packet in a data flow to which the first data packet belongs, and the network device has processed a data packet belonging to the same data flow as the first data packet before receiving the first data packet. Therefore, in this case, the network device can directly process the first data packet based on the information in the first session. For example, the network device can perform network address translation, routing, processing based on a specific policy, processing based on a specific service, and counting the number of bytes of the first data packet.

[0112] It should be noted that through the above process, the fast processing of the first data packet is realized, and the resource occupation of the network device is reduced.

[0113] In some embodiments, in the case where the first session exists in the session table, the network device can determine whether a third session exists in the session table when receiving a second data packet, so as to generate the third session based on the first session if the third session does not exist in the session table. The second data packet belongs to a different data flow from the first data packet, and the target data characteristics between the data flow to which the second data packet belongs and the data flow to which the first data packet belongs are the same. The third session refers to a session matched with the data flow to which the second data packet belongs.

[0114] In some examples, when the first session exists in the session table, the first session can be a session directly created in the session table based on a data packet (e.g., a first packet), or can be a session generated based on other sessions in the session table, for example, a session generated based on the second session described above.

[0115] In some examples, in the case where the first session exists in the session table, if the network device receives a second data packet, and the target data characteristics between the data flow to which the second data packet belongs and the data flow to which the first data packet belongs are the same, the network device determines whether a third session exists in the session table. The second data packet belongs to a different data flow from the first data packet.

[0116] If the third session does not exist in the session table, it is determined that the data flow to which the second data packet belongs is a new data flow. In this case, the network device can calculate an index value corresponding to the second data packet based on the policy pointer corresponding to the second data packet, the interface information, and the target data characteristics. Since the target data characteristics between the data flow to which the second data packet belongs and the data flow to which the first data packet belongs are the same, and the second data packet belongs to a different data flow from the first data packet, the index value corresponding to the second data packet is the same as the target index value. In the case where the first session exists in the session table, the network device can find a record including the target index value and a target session pointer from the session index table based on the index value corresponding to the second data packet, so as to find the first session based on the target session pointer, and generate the third session based on the first session.

[0117] In some embodiments, the network device finds the first session in the same way as finding the third session, and the network device generates the third session according to the first session in the same way as generating the first session according to the second session in the foregoing embodiments, and thus is not described here.

[0118] It should be noted that in this way, when the network device subsequently receives a data stream associated with the data stream to which the first data packet belongs, the first session can be used as a sibling session of the session corresponding to the newly received data packet, so that the session of the new data stream is quickly established according to the sibling session, thereby reducing the resource occupation when creating the session and reducing the impact on the performance of the network device in some embodiments.

[0119] In some embodiments, FIG. 4 is a flowchart of another session processing method provided by the embodiments of the present application, and FIG. 4 illustrates an application process of the session processing method in the embodiments. As shown in FIG. 4, when the network device receives a first data packet, the network device first performs session lookup to determine whether the first session exists in the session table. If the first session exists, the network device directly processes the data packet according to the information in the first session.

[0120] As shown in FIG. 4, if the first session does not exist, the network device performs session lookup to determine whether the second session exists in the session table. If the second session exists in the session table, the network device clones the second session, updates the cloned session, obtains the first session, and then loads the first session into the session table. If the second session does not exist in the session table, the network device directly creates a complete first session, and then loads the first session into the session table. After loading the first session into the session table, the network device processes the data packet according to the information in the first session.

[0121] Therefore, the scheme provided by the present application achieves the purpose of generating the session corresponding to the data packet based on the data stream associated with the data packet, thereby achieving the technical effect of reducing the impact on the performance of the network device, and further solving the technical problem that the related art network device directly creates a complete session for a new data stream each time the new data stream is received, thereby affecting the working performance of the device.

[0122] It should be noted that the embodiments or examples of the present disclosure are not exhaustive, but only a part of the embodiments or examples, and are not specific limitations on the protection scope of the present disclosure. In the case of no contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily, for example, the scheme after removing part of the steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be exchanged arbitrarily, in addition, the optional mode or optional example in a certain embodiment or example can be combined arbitrarily; in addition, the embodiments or examples can be combined arbitrarily, for example, part or all steps of different embodiments or examples can be combined arbitrarily, a certain embodiment or example can be combined with optional mode or optional example of other embodiments or examples.

[0123] Embodiment 2

[0124] According to some embodiments of the present application, a session processing apparatus is provided, wherein Fig. 5 is a structural schematic diagram of a session processing apparatus provided by an embodiment of the present application, as shown in Fig. 5, the apparatus is applied to a network device, and includes:

[0125] A first judging module 501 is configured to judge whether a first session exists in a session table in the case of receiving a first data packet, wherein the first session refers to a session matched with a data flow to which the first data packet belongs;

[0126] A second judging module 502 is configured to judge whether a second session exists in the session table if the first session does not exist in the session table, wherein the second session refers to a session matched with a target data flow, and the target data flow is the same as a target data feature between the data flow to which the first data packet belongs;

[0127] A first generating module 503 is configured to generate the first session according to the second session in the case of the second session existing in the session table.

[0128] It should be noted that the first judging module 501, the second judging module 502 and the first generating module 503 correspond to steps S201 to S203 in the above-mentioned embodiments, and the three modules have the same examples and application scenarios as the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiments.

[0129] In some embodiments, the second judging module further comprises: a first determining submodule, configured to determine a policy pointer corresponding to the source port number according to the source port number in the first data packet, wherein the policy pointer is used to point to a security policy; a second determining submodule, configured to determine interface information of an ingress interface used by the network device to receive the first data packet; a calculating submodule, configured to calculate a target index value according to the policy pointer, the interface information, and a target data feature of the first data packet, wherein the target data feature comprises at least one of the following: a destination IP address, a source IP address, a destination port number, and a transport layer protocol; a first judging submodule, configured to judge whether a target record corresponding to the target index value exists in a session index table, to obtain a judgment result, wherein each record in the session index table comprises an index value and a session pointer used to point to a session in a session table; and a second judging submodule, configured to determine whether the second session exists in the session table according to the judgment result.

[0130] In some embodiments, the session processing apparatus further comprises: a creating module, configured to, after determining whether the second session exists in the session table according to the judgment result, create the first session and load the first session into the session table in a case where the second session does not exist in the session table; a second generating module, configured to generate a session pointer used to point to the first session in the session table, to obtain a target session pointer; and a third generating module, configured to generate a record in the session index table based on the target index value and the target session pointer.

[0131] In some embodiments, the second judging submodule further comprises: a first determining unit, configured to, in a case where the judgment result indicates that the target record exists in the session index table, determine the session pointed to by the session pointer in the target record as the second session; and a second determining unit, configured to, in a case where the judgment result indicates that the target record does not exist in the session index table, determine that the second session does not exist in the session table.

[0132] In some embodiments, the first generating module further comprises: a processing submodule, configured to perform a cloning process on the second session; a third determining submodule, configured to determine a target processing manner corresponding to the first data packet in at least one target dimension according to a plurality of data features of the first data packet, wherein the plurality of data features comprise the target data feature; and an updating submodule, configured to update the session obtained through the cloning process according to manner information of the target processing manner, to obtain the first session.

[0133] In some embodiments, the at least one target dimension comprises at least one of the following: a network address translation dimension, a routing dimension, a policy dimension, a service dimension, and a statistics dimension.

[0134] In some embodiments, the session processing apparatus further comprises an obtaining module configured to obtain a preset configuration file, wherein the configuration file records dimensions to which information required to generate the first session based on the second session belongs; and a determining module configured to determine at least one target dimension according to the dimensions recorded in the configuration file.

[0135] In some embodiments, the session processing apparatus further comprises a third determining module configured to, in a case where the second data packet is received, determine whether a third session exists in the session table, wherein the second data packet belongs to a different data flow from the first data packet, and a target data feature between a data flow to which the second data packet belongs and a data flow to which the first data packet belongs is the same, and the third session refers to a session matching the data flow to which the second data packet belongs; and a fourth generating module configured to, in a case where the third session does not exist in the session table, generate the third session based on the first session in a case where the first session exists in the session table.

[0136] It should be noted that the embodiments of the present disclosure are not exhaustive, but only illustrate some embodiments, and are not specific limitations on the protection scope of the present disclosure. In the case of no contradiction, the modules in some embodiments can be combined arbitrarily, which is not limited in the present application. Embodiment 3 Figure 6 is a flowchart of a session processing method provided by the embodiments of the present application. As shown in Figure 6, the method comprises the following steps:

[0137] Step S601 determines whether a second session exists in the session table when the received first data packet is the first packet of a data flow, wherein the second session refers to a session matching a target data flow, and a target data feature between the target data flow and a data flow to which the first data packet belongs is the same;

[0138] The optional implementation of step S601 can refer to the optional implementation of step S202 in embodiment 1 and other related parts in the embodiments involved in Figure 2, which will not be repeated here.

[0139] Step S602 generates the first session based on the second session in a case where the second session exists in the session table, and the first session matches the data flow to which the first data packet belongs.

[0140] The optional implementation of step S602 can refer to the optional implementation of step S203 in embodiment 1 and other related parts in the embodiments involved in Figure 2, which will not be repeated here.

[0141] In a case that the received first data packet is not a first packet of a data flow, it is determined whether a first session matching the data flow to which the first data packet belongs exists in the session table, and in a case that the first session exists and a second session exists in the session table, the first session is generated according to the second session; a target data feature between a target data flow matched by the second session and the data flow to which the first data packet belongs is same.

[0142] In an optional embodiment, the determining whether the second session exists in the session table comprises: determining a policy pointer corresponding to a source port number in the first data packet, wherein the policy pointer is used to point to a security policy; determining interface information of an incoming interface used by the network device to receive the first data packet; generating the target index value according to at least one of the policy pointer and the interface information and a target data feature in the first data packet, wherein the target data feature comprises at least one of a destination IP address, a source IP address, a destination port number and a transport layer protocol; determining whether a target record corresponding to the target index value exists in a session index table to obtain a determination result, wherein each record in the session index table comprises an index value and a session pointer used to point to a session in the session table; and determining whether the second session exists in the session table according to the determination result.

[0143] The optional implementation manner described above can refer to the association part in Embodiment 1, and will not be described herein again.

[0144] According to some embodiments of the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, wherein the computer program is configured to execute the session processing method provided in any one of the above embodiments when running.

[0145] According to some embodiments of the present application, an electronic device is provided, and Fig. 7 is a structural schematic diagram of the electronic device provided in an embodiment of the present application, as shown in Fig. 7, the electronic device comprises one or more processors; a memory configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement a program running method, wherein the program is configured to execute the session processing method provided in any one of the above embodiments when running.

[0146] The serial numbers of the above embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0147] In the above embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0148] In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other ways. Among them, the above-described device embodiments are only schematic, for example, the division of units can be a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, units or modules, which can be electrical or other forms.

[0149] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e. they can be located in one place or distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0150] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0151] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part of the prior art that contributes to the technical solutions or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0152] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A session processing method applied to a network device, comprising: in a case where a first data packet is received, determining whether a first session exists in a session table, wherein the first session refers to a session matching a data flow to which the first data packet belongs; in a case where the first session does not exist in the session table, determining whether a second session exists in the session table, wherein the second session refers to a session matching a target data flow, and a target data feature between the target data flow and the data flow to which the first data packet belongs is the same; in a case where the second session exists in the session table, generating the first session according to the second session.

2. The method of claim 1, wherein, The determining whether the second session exists in the session table comprises: determining a policy pointer corresponding to a source port number in the first data packet, wherein the policy pointer is used to point to a security policy; determining interface information of an incoming interface used by the network device to receive the first data packet; calculating a target index value according to the policy pointer, the interface information, and a target data feature of the first data packet, wherein the target data feature comprises at least one of a destination IP address, a source IP address, a destination port number, and a transport layer protocol; determining whether a target record corresponding to the target index value exists in a session index table, to obtain a determination result, wherein each record in the session index table comprises an index value and a session pointer used to point to a session in the session table; determining whether the second session exists in the session table according to the determination result.

3. The method of claim 2, wherein, After determining whether the second session exists in the session table according to the determination result, the method further comprises: in a case where the second session does not exist in the session table, creating the first session and loading the first session to the session table; generating a session pointer used to point to the first session in the session table, to obtain a target session pointer; generating a record in the session index table based on the target index value and the target session pointer.

4. The method of claim 2, wherein, The determining whether the second session exists in the session table according to the determination result comprises: in a case where the determination result indicates that the target record exists in the session index table, determining the session pointed to by the session pointer in the target record as the second session; in a case where the determination result indicates that the target record does not exist in the session index table, determining that the second session does not exist in the session table.

5. The method according to any one of claims 1 to 4, wherein, The generating the first session according to the second session comprises: performing a cloning process on the second session; determining a target processing mode corresponding to the first data packet in at least one target dimension according to a plurality of data features of the first data packet, wherein the plurality of data features comprise the target data feature; updating the session obtained by the cloning process according to mode information of the target processing mode, to obtain the first session.

6. The method of claim 5, wherein, The at least one target dimension comprises at least one of a network address translation dimension, a routing dimension, a policy dimension, a service dimension, and a statistics dimension, and the at least one target dimension is determined by: obtaining a preset configuration file, wherein the configuration file records dimensions of information required to be updated when the first session is generated based on the second session; determining the at least one target dimension according to the dimensions recorded in the configuration file.

7. The method of any one of claims 1 to 4, wherein, The method further comprises: in a case where a second data packet is received, judging whether a third session exists in the session table, wherein the second data packet belongs to a different data flow from the first data packet, and a target data feature between a data flow to which the second data packet belongs and a data flow to which the first data packet belongs is the same, and the third session refers to a session matched with the data flow to which the second data packet belongs; in a case where the first session exists in the session table, generating the third session according to the first session, if the third session does not exist in the session table.

8. The method of claim 1, wherein, in a case where a first data packet is received, judging whether a first session exists in a session table, comprising: in a case where the received first data packet is not a first packet of a data flow, performing the step of judging whether the first session exists in the session table.

9. The method of claim 2, wherein, comprising: hashing the policy pointer, the interface information and the target data feature of the first data packet to obtain a hash value, and determining the hash value as the target index value, or determining a digital sequence composed of numbers corresponding to the policy pointer, the interface information and the target data feature, and determining the digital sequence as the target index value, wherein the policy pointer, the interface information and the target data feature have a corresponding relationship with the numbers.

10. The method of claim 2, wherein, after the first session is generated according to the second session, the method further comprises: adding the first session to the session table, and establishing a corresponding relationship between the target record and the first session in the session table.

11. The method of claim 10, wherein, establishing the corresponding relationship between the target record and the first session, comprising: adding a session pointer for pointing to the first session in the session table in the target record; or in a case where the second session is invalid, updating the session pointer in the target record to a session pointer for pointing to the first session in the session table. Each record in the session index table comprises at least one index value, and different index values are obtained according to different calculation manners, wherein in a case where a target record corresponding to the target index value does not exist in the session index table, the method further comprises:

12. The method of claim 2, wherein, in a case where a record with multiple index values exists in the session index table, determining a target calculation manner from a plurality of preset calculation manners; calculating a first index value of the first data packet according to the target calculation manner, and judging whether a first record corresponding to the first index value exists in the session index table; in a case where the first record exists in the session index table, determining a session pointed to by a session pointer in the first record as the second session; ​ In the case that the first record does not exist in the session index table, the step of determining a new target calculation mode from the preset multiple calculation modes is repeatedly performed until the preset multiple calculation modes are all used by the first data packet, the second session does not exist in the session table, or the first record corresponding to the index value calculated by the new target calculation mode exists in the session index table, and the session pointer in the first record is pointed to the session determined as the second session. In the case that the first record does not exist in the session index table, the step of determining a new target calculation mode from the preset multiple calculation modes is repeatedly performed until the preset multiple calculation modes are all used by the first data packet, the second session does not exist in the session table, or the first record corresponding to the index value calculated by the new target calculation mode exists in the session index table, and the session pointer in the first record is pointed to the session determined as the second session.

13. The method of claim 12, wherein, The index values calculated according to different calculation modes have different priorities, and the target calculation mode is determined from the preset multiple calculation modes, including: The target calculation mode is determined from the preset multiple calculation modes according to the order from high to low of the priorities corresponding to the calculation modes.

14. The method of claim 13, wherein, The target calculation mode is determined from the preset multiple calculation modes according to the order from high to low of the priorities corresponding to the calculation modes, including: A calculation mode not used by the first data packet is determined from the preset multiple calculation modes. The calculation mode with the highest priority among the calculation modes not used by the first data packet is determined as the target calculation mode.

15. The method of claim 4, wherein, In the case that the judgment result represents that the target record does not exist in the session index table, the second session does not exist in the session table, including: In the case that the judgment result represents that the target record does not exist in the session index table, the network device has not processed the target data flow, and the second session does not exist in the session table.

16. The method of claim 1, wherein, The target data features include at least one of the following: destination IP address, source IP address, destination port number, and transport layer protocol, and the first session and the second session satisfy at least one of the following conditions: The first condition is that they have the same ingress interface or the same security area. The third condition is that they have the same policy pointer.

17. The method of claim 1, wherein, The judgment on whether the second session exists in the session table includes: The target data features of the first data packet are extracted from the first data packet. The security policy and interface information corresponding to the first data packet are determined. If a session matching the target data features, security policy and interface information exists in the session table, the session is determined as the second session. If a session matching the target data features, security policy and interface information does not exist in the session table, it is determined that the second session does not exist.

18. A session processing method, wherein, Applied to a network device, including: In the case that the received first data packet is the first packet of a data flow, it is judged whether a second session exists in a session table, wherein the second session refers to a session matching a target data flow, and the target data flow has the same target data features as the data flow to which the first data packet belongs. In the case that the second session exists in the session table, a first session is generated according to the second session, wherein the first session matches the data flow to which the first data packet belongs.

19. The method of claim 18, wherein, The judgment on whether the second session exists in the session table includes: determining a policy pointer corresponding to the source port number according to the source port number in the first data packet, wherein the policy pointer is used to point to a security policy; determining interface information of an ingress interface used by the network device to receive the first data packet; generating the target index value according to at least one of the policy pointer and the interface information and a target data feature in the first data packet, wherein the target data feature comprises at least one of a destination IP address, a source IP address, a destination port number, and a transport layer protocol; judging whether a target record corresponding to the target index value exists in a session index table, to obtain a judgment result, wherein each record in the session index table comprises an index value and a session pointer used to point to a session in the session table; determining whether the second session exists in the session table according to the judgment result.

20. A computer readable storage medium, wherein, The computer readable storage medium stores a computer program, wherein the computer program is configured to execute the session processing method in any one of claims 1 to 19 when running.

Images