Message processing method and related apparatus

Abstract

A message processing method, which is applied to implementing network access control and preventing the number of policies stored in a network device from expanding. In the message processing method, firstly, a plurality of user identities corresponding to a message are determined on the basis of a sending source identifier in the message; then, a corresponding policy action is searched for each user identity, thereby obtaining a plurality of policy actions; and finally, on the basis of the plurality of policy actions, one target policy action is determined for execution, thereby implementing network access control of the message. In the present solution, after a plurality of user identities corresponding to a message are acquired, the plurality of user identities are respectively used to execute policy matching a plurality of times, and then a policy action that needs to be executed is determined on the basis of a plurality of matched policy actions. Therefore, when a user identity corresponding to a user changes, a controller only adjusts the user identity corresponding to the user without the need for issuing a new policy action to a network device, thereby effectively preventing the number of policies stored in the network device from expanding, and ensuring the normal operation of the network device.

Description

A message processing method and related apparatus

[0001] The present application claims priority from the Chinese patent application No. 202411134187.4 filed on August 16, 2024, and entitled "A message processing method and related apparatus", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the field of network communication technology, and in particular to a message processing method and related apparatus. BACKGROUND

[0003] In order to ensure network security, in the internal network of an enterprise or a school, etc., a network access control technology is usually used to manage user access to the network. The main function of the network access control technology is to authorize user access to network resources, to ensure that only users who have been authenticated and meet the security policy can access the resources in the network, such as servers in the network.

[0004] At present, in most network access control scenarios, a single-user single-identity access control scheme is usually used. Specifically, an account administrator first creates an account for a user and specifies the identity of the user. A network administrator then creates a security group based on the identity of the user and creates a corresponding security group policy to define the access rights of the security group.

[0005] However, in some business scenarios, a user may change from corresponding to a single identity to corresponding to multiple identities. In this case, a new security group is created based on the multiple identities corresponding to the user in the related technology, and a new security group policy is created to define the access rights of the new security group. Generally, the network administrator needs to issue the newly created security group policy to the network device every time a new security group policy is created, which can easily cause the number of policies stored in the network device to expand beyond the storage specifications of the network device, affecting the normal operation of the network device. SUMMARY

[0006] The present application provides a message processing method and related apparatus to avoid the problem of the number of policies stored in the network device expanding, and to ensure the normal operation of the network device.

[0007] The first aspect of the present application provides a packet processing method applied to a network device in a communication network. The packet processing method comprises: receiving, by the network device, a first packet. Then, the network device finds a plurality of user identities corresponding to the first packet according to a first identifier in the first packet, the first identifier being used to represent a sending source of the first packet. For example, the first identifier is a source Internet Protocol (IP) address in the first packet or a Media Access Control (MAC) address in the first packet.

[0008] Secondly, based on the plurality of user identities and a destination address of the first packet, the network device finds a plurality of policy actions corresponding to the plurality of user identities respectively in a policy rule table, and obtains the plurality of policy actions. The policy rule table stores a corresponding relationship between user identities and policy actions. That is, for the plurality of user identities corresponding to the first packet, each user identity can find a corresponding policy action in the policy rule table.

[0009] Finally, based on the plurality of policy actions found, the network device performs a target policy action on the first packet, the target policy action being a policy action determined based on the plurality of policy actions. That is, the network device determines one policy action (i.e., the target policy action) to be finally performed on the first packet based on the plurality of policy actions found.

[0010] In the present scheme, in the process of performing network access control by the network device, for a packet sent by a user corresponding to a plurality of identities, the plurality of user identities corresponding to the packet are first determined based on a sending source identifier in the packet. Then, a corresponding policy action is found for each user identity, thereby obtaining a plurality of policy actions. Finally, a target policy action is determined based on the plurality of policy actions to be executed, thereby implementing network access control of the packet. In the present scheme, the network device located at the forwarding plane actually acquires the plurality of user identities corresponding to the packet, and then performs multiple policy matching respectively using the plurality of user identities, and then determines the policy action to be performed on the packet based on the plurality of policy actions matched. Therefore, when the user identities corresponding to the user change, the controller located at the control plane does not need to issue a new policy action to the network device, but only needs to adjust the user identities corresponding to the user, which can effectively avoid the problem of expansion of the number of policies stored by the network device, and ensure the normal operation of the network device.

[0011] In a possible implementation, the network device for performing the method described above stores a hash table and a policy cache table, the hash table includes a plurality of table entries, each of the plurality of table entries includes a plurality of storage locations, and at least two of the plurality of storage locations are respectively mapped to different table entries of the policy cache table. For example, a first storage location of the plurality of storage locations is mapped to a first table entry in the policy cache table, a second storage location of the plurality of storage locations is mapped to a second table entry of the policy cache table, and the first table entry and the second table entry are different. In addition, the policy cache table is used to cache a policy action matched by a received packet of the network device.

[0012] After the network device determines the target policy action corresponding to the first packet, the network device determines a target table entry from the plurality of table entries of the hash table according to first target information carried by the first packet, where an index value of the target table entry is the same as a first hash value calculated based on a first hash algorithm from the first target information, and the first target information at least includes a source address and a destination address of the first packet.

[0013] In addition, the network device records the second hash value and the target index value in the first storage location of the target table entry, where the second hash value is calculated based on a second hash algorithm from the first target information.

[0014] In addition, the network device also records the first target information and the target policy action in the first table entry of the policy cache table, where an index value of the first table entry is the same as the target index value.

[0015] In this scheme, the hash table and the policy cache table are set to cooperate with caching the policy action corresponding to the received packet, so that the policy action corresponding to the packet can be quickly determined by searching the hash table and the policy cache table in the subsequent process, and the policy action corresponding to the packet is determined by searching the user identity, thereby improving the working efficiency of the network device.

[0016] In a possible implementation, before searching for a plurality of user identities corresponding to the first packet, the network device first searches, according to first target information carried by the first packet, a storage location in the hash table, where the storage content of the storage location matches the first target information. In response to that the storage location with the storage content matching the first target information is not found in the hash table, the network device triggers searching for the user identity corresponding to the first packet according to the first identifier in the first packet.

[0017] In this scheme, the network device first searches the policy action corresponding to the first packet based on the hash table and the policy cache table, and in the case that the policy action corresponding to the first packet cannot be found, the policy action corresponding to the first packet is determined by searching the user identity corresponding to the first packet, thereby avoiding the need to determine the policy action by searching the corresponding user identity every time a packet is received, and improving the efficiency of the network device in determining the policy action corresponding to the packet.

[0018] In a possible implementation, after the network device records the policy action corresponding to the first packet in the hash table and the policy cache table, the network device receives a second packet, the second packet carrying second target information, the content of the second target information being the same as the content of the first target information. Based on the second target information, the network device finds, in the hash table, a storage location storing content matching the second target information. And, in response to finding the first storage location storing content matching the second target information, the network device performs, based on the content recorded in the first table item mapped by the first storage location, a target policy action on the second packet.

[0019] In this scheme, after finding the policy action corresponding to the second packet based on the hash table and the policy cache table, the network device can directly perform the found policy action on the second packet, thereby avoiding determining the policy action to be performed by finding the user identity corresponding to the second packet, and improving the efficiency of the network device in determining the policy action corresponding to the packet.

[0020] In a possible implementation, when the storage content at the first storage location in the target table item is empty, the network device records the second hash value at the first storage location.

[0021] In this scheme, after the network device determines the policy action corresponding to the packet, if there is still a storage location without recorded content in the hash table, the network device can directly record the related information of the packet at the storage location, without performing competition of the storage location on the packet, thereby ensuring that the hash table and the policy cache table can cache as many policy actions as possible as soon as possible, and facilitating to improve the efficiency of subsequent determination of the policy action corresponding to the packet.

[0022] In a possible implementation, each storage location in the plurality of table items further contains a count value, the count value being used to indicate the number of times of matching between the policy action mapped by the storage location and the packet.

[0023] When the target table item does not have a storage location with empty storage content, the network device first determines, in the target table item, a first storage location with a count value less than or equal to a first threshold value; and then, the network device replaces the content in the first storage location with the second hash value and the target index value.

[0024] In this scheme, the count value is set at the storage location of the hash table to indicate the number of times of matching between the policy action mapped by the storage location and the packet, which can effectively reflect the number of times of actual application of the content recorded at each storage location, and is beneficial to replacing the content at some storage locations with less number of times of application with new content, thereby facilitating to improve the probability of finding the policy action corresponding to the packet based on the hash table and the policy cache table.

[0025] In a possible implementation, after the second hash value and the target index value are recorded in the first storage position, the network device receives a third packet; in response to the third packet being processed by using the policy action mapped by the first storage position, the network device increases a preset increment value on the basis of the count value in the first storage position.

[0026] That is, the network device finds the policy action corresponding to the third packet based on the content recorded in the first storage position, and the policy action mapped by the first storage position is matched with the third packet, and therefore the network device needs to increase the count value recorded in the first storage position, so as to update the count value.

[0027] In a possible implementation, in response to the third packet not being processed by using the policy action mapped by the second storage position, the network device decreases a preset decrement value on the basis of the count value in the second storage position.

[0028] In this scheme, based on whether the packet is processed by using the policy action mapped by the storage position in the hash table, the count value in the storage position in the hash table can be updated, so that the count value can reflect the number of times of matching between the content recorded in the storage position and the packet in real time, so as to enable the network device to replace the content recorded in some storage positions with less effect times in time, thereby improving the probability of finding the policy action corresponding to the packet based on the hash table and the policy cache table.

[0029] In a possible implementation, before the network device receives the first packet, the network device obtains configuration information, and the configuration information is used to indicate the correspondence between the first user identity and the first identifier, and the first user identity is one of a plurality of user identities. According to the configuration information, the network device adds the correspondence between the first user identity and the first identifier in the identity information table, and the identity information table is used to record the correspondence between the user identity and the sending source identifier of the packet.

[0030] In a possible implementation, the target policy action is a policy action with the highest priority in the plurality of policy actions.

[0031] The second aspect of the application provides a message processing method, comprising: receiving a second message, the second message carrying second target information; based on the second target information, searching a storage location in a hash table, where the storage content matches the second target information, the hash table including a plurality of table entries, each of the plurality of table entries including a plurality of storage locations, at least two of the plurality of storage locations being respectively mapped to different table entries of a policy cache table, a first storage location of the plurality of storage locations being mapped to a first table entry in the policy cache table; in response to finding the first storage location where the storage content matches the second target information, performing a target policy action on the second message based on the content recorded in the first table entry to which the first storage location is mapped, the first table entry recording the first target information and the target policy action, the first target information being the same as the second target information.

[0032] The third aspect of the application provides a message processing device, comprising: a transceiver module configured to receive a first message; a processing module configured to find a plurality of user identities corresponding to the first message according to a first identifier in the first message, the first identifier being used to represent a sending source of the first message; the processing module is further configured to find a plurality of policy actions corresponding to the plurality of user identities respectively in a policy rule table based on the plurality of user identities and a destination address of the first message, to obtain the plurality of policy actions, the policy rule table storing a corresponding relationship between the user identities and the policy actions; the processing module is further configured to perform a target policy action on the first message based on the plurality of policy actions, the target policy action being a policy action determined based on the plurality of policy actions.

[0033] In a possible implementation, the device stores a hash table and a policy cache table, the hash table including a plurality of table entries, each of the plurality of table entries including a plurality of storage locations, at least two of the plurality of storage locations being respectively mapped to different table entries of the policy cache table, a first storage location of the plurality of storage locations being mapped to a first table entry in the policy cache table, a second storage location of the plurality of storage locations being mapped to a second table entry of the policy cache table, the first table entry and the second table entry being different, the policy cache table being used to cache a policy action matched by a message received by a network device; the processing module is further configured to: determine a target table entry in the plurality of table entries according to first target information carried by the first message, wherein an index value of the target table entry is the same as a first hash value calculated based on a first hash algorithm from the first target information, the first target information including at least a source address and a destination address of the first message; record a second hash value and a target index value in the first storage location of the target table entry, the second hash value being calculated based on a second hash algorithm from the first target information; record the first target information and a target policy action in the first table entry of the policy cache table, the index value of the first table entry being the same as the target index value.

[0034] In a possible implementation, before the multiple user identities corresponding to the first message are found, the processing module is further configured to: find, according to the first target information carried in the first message, a storage location in the hash table in which the storage content matches the first target information; and in response to that the storage location in which the storage content matches the first target information is not found in the hash table, trigger the finding of the user identity corresponding to the first message according to the first identifier in the first message.

[0035] In a possible implementation, the transceiving module is further configured to receive a second message, the second message carrying second target information, the content of the second target information being the same as that of the first target information; and the processing module is further configured to find, based on the second target information, a storage location in the hash table in which the storage content matches the second target information; and the processing module is further configured to, in response to that the first storage location in which the storage content matches the second target information is found, perform a target policy action on the second message based on the content recorded in the first table item mapped by the first storage location.

[0036] In a possible implementation, the processing module is further configured to: when the storage content at the first storage location in the target table item is empty, record the second hash value at the first storage location.

[0037] In a possible implementation, each storage location in the multiple table items further contains a count value, the count value being used to indicate the number of times that the policy action mapped by the storage location matches the message; and the processing module is further configured to: when the target table item does not have a storage location in which the storage content is empty, determine, in the target table item, a first storage location in which the count value is less than or equal to a first threshold value; and replace the content in the first storage location with the second hash value and the target index value.

[0038] In a possible implementation, after the second hash value and the target index value are recorded in the first storage location, the transceiving module is further configured to receive a third message;

[0039] The processing module is further configured to, in response to that the third message is processed by using the policy action mapped by the first storage location, increase a preset increment value on the basis of the count value in the first storage location.

[0040] In a possible implementation, the processing module is further configured to: in response to that the third message is not processed by using the policy action mapped by the second storage location, decrease a preset decrement value on the basis of the count value in the second storage location.

[0041] In a possible implementation, the transceiving module is further configured to acquire configuration information, the configuration information being used to indicate a correspondence between the first user identity and the first identifier, the first user identity being one of the multiple user identities; and the processing module is further configured to add the correspondence between the first user identity and the first identifier in the identity information table according to the configuration information, the identity information table being used to record the correspondence between the user identity and the sending source identifier of the packet.

[0042] In a possible implementation, the target policy action is a policy action with the highest priority among the multiple policy actions.

[0043] The fourth aspect of the present application provides a packet processing apparatus, comprising: a transceiving module configured to receive a second packet, the second packet carrying second target information; and a processing module configured to search, based on the second target information, a storage location in a hash table, in which the storage content matches the second target information, the hash table comprising multiple table entries, each of the multiple table entries comprising multiple storage locations, at least two of the multiple storage locations being respectively mapped to different table entries of a policy cache table, and a first storage location of the multiple storage locations being mapped to a first table entry in the policy cache table; and the processing module is further configured to, in response to finding the first storage location in which the storage content matches the second target information, perform a target policy action on the second packet based on content recorded in the first table entry to which the first storage location is mapped, the first table entry recording the first target information and the target policy action, and the first target information being the same as the second target information.

[0044] The fifth aspect of the present application provides a network device, comprising a processor and a memory; the memory is configured to store program code, and the processor is configured to execute the method according to any one of the embodiments of the first aspect or the second aspect.

[0045] The sixth aspect of the present application provides a computer-readable storage medium, which stores instructions, when the instructions are executed on a computer, the computer is caused to execute the method according to any one of the embodiments of the first aspect or the second aspect.

[0046] The seventh aspect of the present application provides a computer program product, when the computer program product is executed on a computer, the computer is caused to execute the method according to any one of the embodiments of the first aspect or the second aspect.

[0047] The eighth aspect of the present application provides a chip comprising one or more processors. Part or all of the processors are configured to read and execute computer instructions stored in a memory to perform the method in any possible implementation of any of the above aspects. Optionally, the chip further comprises the memory. Optionally, the chip further comprises a communication interface, and the processors are connected with the communication interface. The communication interface is configured to receive data and / or information to be processed, and the processors obtain the data and / or information from the communication interface, process the data and / or information, and output the processing result through the communication interface. Optionally, the communication interface is an input / output interface or a bus interface. The method provided by the present application is implemented by one chip or by multiple chips cooperatively.

[0048] The solutions provided by the second aspect to the eighth aspect above are used to implement or assist in implementing the method provided by the first aspect, and thus can achieve the same or corresponding beneficial effects as the first aspect. Therefore, no further description is provided here. BRIEF DESCRIPTION OF DRAWINGS

[0049] FIG. 1 is a schematic diagram of a user identity change according to the present application;

[0050] FIG. 2 is a schematic diagram of creating a new security group policy in the related art;

[0051] FIG. 3 is a schematic diagram of a system architecture to which a packet processing method according to the present application is applied;

[0052] FIG. 4 is a flowchart of a packet processing method according to the present application;

[0053] FIG. 5 is a flowchart of a process in which a network device determines a policy action to be performed by a packet according to the present application;

[0054] FIG. 6 is a schematic diagram of a hash table and a policy cache table according to the present application;

[0055] FIG. 7 is a flowchart of a process in which a hash table and a policy cache table are used to find a policy action corresponding to a packet according to the present application;

[0056] FIG. 8 is a flowchart of a process in which a packet competes for a storage location in a hash table according to the present application;

[0057] FIG. 9 is a flowchart of a process in which a multi-identity policy execution unit determines a policy action corresponding to a packet according to the present application;

[0058] FIG. 10 is a flowchart of a process in which another multi-identity policy execution unit determines a policy action corresponding to a packet according to the present application;

[0059] FIG. 11 is a schematic diagram of configuring a security policy for a user identity based on an enterprise organization architecture according to the present application;

[0060] FIG. 12 is a schematic diagram of adjusting a user identity of a user without adjusting a security policy according to the present application;

[0061] FIG. 13 is a schematic diagram of a structure of a packet processing device according to the present application;

[0062] FIG. 14 is a schematic diagram of a structure of a network device according to the present application. DETAILED DESCRIPTION

[0063] For the purpose of making the object, technical scheme and advantages of the present application more clear, the embodiments of the present application are described below with reference to the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Those skilled in the art can know that the technical scheme provided by the embodiments of the present application is also applicable to similar technical problems with the emergence of new application scenarios.

[0064] The terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0065] At present, in the existing network access control technology, after the identity of a user changes, a new security group policy often needs to be created. Moreover, the newly created security group policy is issued to a network device, which is easy to cause the number of policies stored in the network device to expand and exceed the storage specification of the network device, thereby affecting the normal operation of the network device.

[0066] Exemplarily, refer to FIG. 1, which is a schematic diagram of a user identity change according to the present application. As shown in FIG. 1, at a first time node, the identity of user A is a research and development group, and user A needs to have access permission of a research and development server; the identity of user B is a test group, and user B needs to have access permission of a test server. At a second time node after the first time node, user A is transferred from the research and development group to the test group, so the identity of user A changes to the research and development group + the test group, and user A needs to have access permission of the research and development server and the test server at this time.

[0067] As the identity of user A and the access right that user A needs to have change, the related art often adjusts the network access control for user A by creating a new security group policy. Specifically, referring to FIG. 2, which is a schematic diagram of creating a new security group policy in the related art. As shown in FIG. 2, at a first time node, two security group policies have been created, which are: a device with an identity of a research and development group can access a research and development server and cannot access a test server; and a device with an identity of a test group can access the test server and cannot access the research and development server. At a second time node, as a new identity of a research and development group + test group is added, the existing security group policies can no longer cover all identities, so a new security group policy is created in the related art. The new security group policy is: a device with an identity of a research and development group + test group can access the research and development server and the test server.

[0068] Therefore, the present application provides a packet processing method. In the process of performing network access control by a network device, for a packet sent by a user corresponding to multiple identities, the multiple user identities corresponding to the packet are determined based on a sending source identifier in the packet. Then, a corresponding policy action is found for each user identity, thereby obtaining multiple policy actions. Finally, a target policy action is determined based on the multiple policy actions to be executed, thereby implementing network access control of the packet. In the present solution, after the multiple user identities corresponding to the packet are obtained at the forwarding plane, multiple policy matching operations are performed using the multiple user identities respectively, and then a policy action to be executed for the packet is determined based on the multiple policy actions matched. Therefore, when the user identities corresponding to a user change, a new policy action does not need to be issued to the network device, but only the user identities corresponding to the user need to be adjusted, which can effectively avoid the problem of expansion of the number of policies stored by the network device and ensure normal operation of the network device.

[0069] Referring to FIG. 3, which is a schematic diagram of a system architecture to which the packet processing method provided by the present application is applied. As shown in FIG. 3, the system architecture includes a communication network 10, one or more terminal devices (for example, terminal devices 201-205 in FIG. 3) connected to the communication network 10, and one or more servers (for example, servers 301-305 in FIG. 3) connected to the communication network 10. The communication network 10 includes one or more network devices (for example, network devices 101-103 in FIG. 3) for transmitting data interacted between the terminal devices and the servers. Optionally, the system architecture can further include a controller 40 for controlling and managing the network devices in the communication network 10, so that the network devices in the communication network 10 can successfully complete data transmission.

[0070] The message processing method provided in the application can be applied to a network device in the communication network 10. When the network device in the communication network 10 receives a message exchanged between a terminal device and a server, the message processing method provided in the application can be used to determine and perform a policy action corresponding to the message, thereby realizing network access control for the terminal device.

[0071] Please refer to FIG. 4, which is a flowchart of a message processing method provided in the application. As shown in FIG. 4, the message processing method includes the following steps 401-404.

[0072] Step 401, the network device receives a first message.

[0073] In the application, the network device is a physical device such as a router, a gateway, a switch or a firewall. Alternatively, the network device is a virtualized device deployed on a hardware device, such as a virtual gateway or a virtual switch.

[0074] The network device is a device responsible for forwarding messages in the communication network, and the network device is responsible for performing corresponding policy actions on the messages to realize network access control. During the operation of the network device, the network device receives a first message sent by a terminal device, a server or another network device. After the network device receives the first message, the policy action performed on the first message needs to be determined, so as to perform the corresponding policy action on the first message, thereby realizing network access control.

[0075] Step 402, the network device finds a plurality of user identities corresponding to the first message according to a first identifier in the first message, the first identifier being used to represent a sending source of the first message.

[0076] After receiving the first message, the network device obtains a first identifier carried in the first message. The first identifier is used to represent the sending source of the first message, for example, the first identifier is a source Internet Protocol (IP) address in the first message or a Media Access Control (MAC) address in the first message.

[0077] The network device is pre-provided with an identity information table, which is used to record the correspondence between the sending source identifier of the message and the user identity. Therefore, based on the first identifier in the first message, the network device can find the user identity corresponding to the first message in the identity information table.

[0078] In the present application, the identity information table records a plurality of user identities corresponding to the first identifier in the first packet. Exemplarily, the identity information table includes a plurality of table entries, and the plurality of table entries are respectively used to indicate different user identities corresponding to the first identifier. For example, table entry 1 in the identity information table indicates that the first identifier corresponds to user identity 1, table entry 2 in the identity information table indicates that the first identifier corresponds to user identity 2, and table entry 3 in the identity information table indicates that the first identifier corresponds to user identity 3. In this way, according to the first identifier in the first packet, the network device can find a plurality of user identities corresponding to the first packet.

[0079] Optionally, the identity information table pre-set in the network device can be continuously updated according to actual conditions to ensure that different packets can find corresponding user identities.

[0080] Exemplarily, before the network device receives the first packet, the network device obtains configuration information, which is used to indicate the correspondence between the first user identity and the first identifier, and the first user identity is one of the plurality of user identities. The configuration information obtained by the network device is, for example, issued by a controller to the network device, or issued by an operation and maintenance personnel to the network device by inputting a command line, and the present application does not limit the way in which the network device obtains the configuration information.

[0081] In this way, according to the configuration information, the network device can add the correspondence between the first user identity and the first identifier in the pre-set identity information table, thereby realizing the update of the identity information table.

[0082] In step 403, the network device finds a plurality of policy actions corresponding to a plurality of user identities respectively in a policy rule table based on the plurality of user identities and the destination address of the first packet, and obtains the plurality of policy actions, and the policy rule table stores the correspondence between the user identity and the policy action.

[0083] After obtaining the plurality of user identities corresponding to the first packet, the network device combines each user identity in the plurality of user identities with the destination address of the first packet, and finds the policy action corresponding to each user identity in the policy rule table, thereby obtaining the plurality of policy actions. That is, for the plurality of user identities corresponding to the first packet, each user identity can find a corresponding policy action in the policy rule table. Moreover, the policy actions corresponding to different user identities can be the same or different. For example, assuming that the user identities corresponding to the first packet include user identity 1, user identity 2 and user identity 3, the policy action corresponding to user identity 1 is, for example, to allow the packet to pass, the policy action corresponding to user identity 2 is, for example, to allow the packet to pass, and the policy action corresponding to user identity 3 is, for example, to reject the packet to pass.

[0084] The policy rule table stores the correspondence between the user identity and the policy action. For example, the policy rule table includes a plurality of table entries, and each of the plurality of table entries is used to indicate the correspondence among the user identity, the destination address, and the policy action. When the user identity corresponding to the first packet and the destination address of the first packet match the user identity and the destination address on a table entry in the policy rule table, the network device can determine the policy action on the table entry as the policy action corresponding to the current user identity.

[0085] For another example, the policy rule table includes a plurality of table entries, and each of the plurality of table entries is used to indicate the correspondence among the user identity, the address belonging group, and the policy action. Based on the destination address of the first packet, the address belonging group of the destination address can be determined first. When the user identity corresponding to the first packet and the address belonging group of the destination address match the user identity and the address belonging group on a table entry in the policy rule table, the network device can determine the policy action on the table entry as the policy action corresponding to the current user identity.

[0086] In general, the application does not limit the content storage form of the policy rule table.

[0087] At step 404, the network device performs a target policy action on the first packet based on the plurality of policy actions, the target policy action being the policy action determined based on the plurality of policy actions.

[0088] After the plurality of policy actions corresponding to the first packet are found, the network device determines a target policy action based on the plurality of policy actions, and then performs the target policy action on the first packet. That is, the network device determines a policy action (i.e., the target policy action) to be finally executed on the first packet based on the plurality of policy actions found.

[0089] For example, the network device is pre-configured with a policy selection rule, and the network device can determine the target policy action based on the pre-configured policy selection rule and the plurality of policy actions found. The policy selection rule configured in the network device can be uniformly issued by a controller, or can be issued by an operation and maintenance personnel on the network device through a command line. The application does not limit the way of configuring the policy selection rule in the network device.

[0090] In the case where the plurality of policy actions corresponding to the first packet are fixed, the policy selection rule will affect the target policy action finally determined. The following will introduce the possible cases when the target policy action is determined.

[0091] Case 1: The target policy action is one of the plurality of policy actions.

[0092] In case 1, the network device actually selects one of the multiple policy actions corresponding to the first packet as the target policy action.

[0093] For example, the network device selects one of the multiple policy actions corresponding to the first packet as the target policy action. For example, assume that the multiple policy actions corresponding to the first packet include allowing the packet to pass, transmitting the packet at a committed access rate, and rejecting the packet, and the policy action of allowing the packet to pass has the highest priority among the multiple policy actions, and thus the network device determines that the target policy action is the policy action of allowing the packet to pass.

[0094] It should be noted that the priority of the policy action may be set in different manners in different scenarios. For example, in some scenarios, the policy action of allowing the packet to pass has the highest priority, and in some other scenarios, the policy action of rejecting the packet may have the highest priority. In actual application, the network device can be preconfigured with the priority of each policy action, so that the network device can quickly determine the priority of each policy action among the multiple policy actions corresponding to the first packet.

[0095] In case 2, the target policy action is not one of the multiple policy actions.

[0096] In case 2, the network device actually determines a new policy action as the target policy action according to the multiple policy actions corresponding to the first packet. At this time, the target policy action determined by the network device does not belong to any of the multiple policy actions.

[0097] For example, assume that the multiple policy actions determined by the network device include allowing the packet to pass and rejecting the packet, and at this time, the target policy action determined by the network device is specifically the policy action of transmitting the packet at a committed access rate and reporting information of the packet to a controller.

[0098] In general, in actual application, an operation and maintenance personnel can set a policy selection rule on the network device according to the actual scenario, and the present application does not limit the policy selection rule used by the network device.

[0099] The above describes the process of determining a policy action by the network device by searching for a user identity corresponding to a packet and based on the searched user identity. Since the network device receives a large number of packets during operation, and each packet needs to determine a corresponding policy action, how to improve the efficiency of the network device in determining the policy action corresponding to the packet will be described below to improve the working efficiency of the network device.

[0100] Referring to FIG. 5, FIG. 5 is a flowchart illustrating a method for determining a policy action to be performed by a network device according to an embodiment of the present application. As shown in FIG. 5, the network device can include a policy cache unit and a multi-identity policy execution unit, which can be implemented by software modules. After receiving a packet, the policy cache unit of the network device first searches for a cached policy action based on target information of the packet. The target information of the packet includes at least a source address and a destination address of the packet, for example, the target information of the packet is a five-tuple, i.e., a source IP address, a destination IP address, a source port, a destination port, and a transmission protocol. If the policy cache unit finds a corresponding policy action for the packet, the network device performs the policy action found by the policy cache unit. If the policy cache unit does not find a corresponding policy action for the packet, the multi-identity policy execution unit of the network device determines a policy action to be performed by the packet by searching for multiple user identities corresponding to the packet. That is, the multi-identity policy execution unit is actually used to perform steps 402-404 described above to determine the policy action corresponding to the packet.

[0101] In addition, after determining the policy action corresponding to the packet by the multi-identity policy execution unit, it can be determined whether the number of user identities corresponding to the packet exceeds N, where N is a positive integer greater than or equal to 0, for example, N is 1 or 2. In the case where the number of user identities corresponding to the packet exceeds N, the policy cache unit can cache the policy action corresponding to the packet, so that subsequent network devices receiving other packets with the same target information can quickly find the corresponding policy action.

[0102] For ease of understanding, the following first introduces how the policy cache unit in the network device implements caching and searching for the policy action corresponding to the packet in combination with FIG. 6 and FIG. 7.

[0103] Exemplarily, referring to FIG. 6, FIG. 6 is a schematic diagram of a hash table and a policy cache table according to an embodiment of the present application. As shown in FIG. 6, in order to cache the policy action corresponding to the packet, the network device stores a hash table and a policy cache table. The hash table includes multiple entries, and each entry includes an index value and multiple storage locations. For example, the hash table shown in FIG. 6 includes M entries, the first entry includes index value 1 and storage locations 1-N, the second entry includes index value 2 and storage locations 1-N, and the Mth entry includes index value M and storage locations 1-N.

[0104] At least two of the plurality of storage locations of each table entry in the hash table are respectively mapped to different table entries of the policy cache table. For example, a first storage location of the plurality of storage locations of a table entry of the hash table is mapped to a first table entry in the policy cache table, a second storage location of the plurality of storage locations is mapped to a second table entry of the policy cache table, and the first table entry and the second table entry are different. As shown in FIG. 6, the content that can be stored in each storage location of the hash table at least includes a flow hash value and a policy cache table index value, where the flow hash value is used to represent a hash value calculated based on the target information of the packet, and the policy cache table index value is used to represent an index value of the table entry to which the current storage location is mapped in the policy cache table.

[0105] In addition, the policy cache table is used to cache the policy actions matched by the packets received by the network device. As shown in FIG. 6, the policy cache table includes a plurality of table entries, and each table entry includes an index value, target information of a packet, and a policy action corresponding to the packet. For the packet for which the policy action is found by the multi-identity policy execution unit, the target information of the packet and the policy action corresponding to the packet can be recorded in a table entry of the policy cache table.

[0106] Optionally, on the basis of the embodiment shown in FIG. 4, after the network device performs the step 404, the network device continues to perform the following steps 405-407. It should be noted that the steps 405-407 are optional execution steps, and are not necessarily executed.

[0107] In step 405, the network device determines a target table entry from the plurality of table entries of the hash table according to the first target information carried by the first packet.

[0108] The index value of the target table entry is the same as a first hash value calculated based on the first hash algorithm from the first target information, and the first target information at least includes a source address and a destination address of the first packet.

[0109] That is, the network device first performs hash calculation on the first target information in the first packet based on the first hash algorithm to obtain the first hash value. Then, the network device compares the first hash value with the index value in each table entry of the hash table, so as to determine the target table entry from the plurality of table entries of the hash table, whose index value is the same as the first hash value.

[0110] In order to ensure accurate searching of the policy action, the first target information used to determine the table entry at least includes the source address and the destination address of the first packet. In some possible examples, the first target information includes, for example, a source IP address, a destination IP address, a source port, a destination port, and a transmission protocol of the first packet, that is, the first target information is the five-tuple of the first packet.

[0111] At step 406, the network device records the second hash value and the target index value in the first storage location of the target entry, the second hash value being calculated based on the second hash algorithm from the first target information.

[0112] After determining the target entry in the hash table, the network device determines the first storage location for recording the related content of the first packet in the multiple storage locations of the target entry. Then, the network device performs hash calculation on the first target information in the first packet based on the second hash algorithm, to obtain a second hash value, wherein the first hash algorithm and the second hash algorithm are different hash algorithms. In this way, the network device records the calculated second hash value and the target index value that can be mapped to the policy cache table in the first storage location.

[0113] At step 407, the network device records the first target information and the target policy action in the first entry of the policy cache table.

[0114] After the network device completes the recording of the second hash value and the target index value in the first storage location of the hash table, the network device determines the first entry in the policy cache table based on the target index value, wherein the index value of the first entry is the same as the target index value. And the network device records the first target information of the first packet and the target policy action corresponding to the first packet in the first entry.

[0115] By performing the above steps 405-407, the network device can cache the policy action found for the first packet through the hash table and the policy cache table, so as to determine the policy action corresponding to the subsequent packet by searching the hash table and the policy cache table after receiving the subsequent packet, avoiding determining the policy action corresponding to the packet by searching the user identity. Wherein, the index value in the hash table is used to locate the entry in the hash table, and the flow hash value in the storage location is used to locate the storage location in the entry. Therefore, when searching for the policy action for other packets based on the hash table and the policy cache table, the entry in the hash table can be located first, and then the storage location in the entry can be located, and then the entry in the policy cache table can be located based on the policy cache table index value in the storage location.

[0116] Exemplarily, please refer to FIG. 7, which is a flowchart of searching for the policy action corresponding to the packet based on the hash table and the policy cache table provided by the present application. As shown in FIG. 7, for any one packet, taking the target information of the packet as the quintuple as an example, the process of searching for the policy action corresponding to the packet based on the hash table and the policy cache table can include the following steps 701-707.

[0117] At step 701, a first hash value of the quintuple in the packet is calculated based on a first hash algorithm.

[0118] When the network device needs to find a policy action corresponding to a packet based on the hash table and the policy cache table, the network device extracts the quintuple in the packet as target information of the packet, and calculates a first hash value of the quintuple in the packet based on a first hash algorithm.

[0119] Step 702, determining a target entry in the hash table with an index value same as the first hash value.

[0120] After the first hash value of the quintuple in the packet is calculated, the first hash value is compared with the index value of each entry in the hash table, so as to determine the target entry with the index value same as the first hash value.

[0121] Step 703, calculating a second hash value of the quintuple in the packet based on a second hash algorithm.

[0122] Step 704, comparing the second hash value with the flow hash value in each storage location in the target entry.

[0123] Step 705, judging whether there is a target storage location with the flow hash value same as the second hash value in the target entry.

[0124] If there is the target storage location with the flow hash value same as the second hash value in the target entry, step 706 is executed. If there is not the target storage location with the flow hash value same as the second hash value in the target entry, it is determined that the policy action corresponding to the packet is not found, i.e., the policy action corresponding to the packet is not cached in the hash table and the policy cache table.

[0125] Step 706, finding a corresponding entry in the policy cache table based on the policy cache table index value in the target storage location.

[0126] After the target storage location is found, the entry with the index value same as the policy cache table index value in the target storage location is found in the policy cache table, so as to realize locating the entry corresponding to the current packet in the policy cache table.

[0127] Step 707, judging whether the quintuple in the entry found in the policy cache table is same as the quintuple of the packet.

[0128] If the quintuple in the entry found in the policy cache table is same as the quintuple of the packet, it is determined that the policy action recorded in the entry is the policy action corresponding to the current packet, so as to realize finding the policy action corresponding to the packet. If the quintuple in the entry found in the policy cache table is not same as the quintuple of the packet, it is determined that the policy action corresponding to the packet is not found.

[0129] In general, for any packet received by the network device, the policy cache unit in the network device can find the corresponding policy action for the packet by performing the above steps 701-707.

[0130] It should be noted that the hash algorithm is a secure hash algorithm, which can convert input data of any length into a shorter fixed-length string. Therefore, in the above steps, based on the first hash algorithm and the second hash algorithm, the first target information of the first packet can be converted into a hash value with a shorter length, which is beneficial to subsequent fast implementation of packet target information matching when finding policy actions for other packets, and improves the efficiency of finding policy actions. For example, in the case where the target information of the packet is a five-tuple, the length of the five-tuple can be more than 400 bits, and the length of the first hash value and the second hash value calculated based on the first hash algorithm and the second hash algorithm is 10 bits or 20 bits. In this way, compared with directly matching the five-tuple of the packet with the cached five-tuple, by matching the hash value corresponding to the five-tuple of the packet, the matching range of the packet can be effectively reduced, the matching efficiency of the five-tuple of the packet is improved, and thus it is beneficial to quickly locate the policy action corresponding to the packet.

[0131] The above introduces that the network device caches and finds the policy action corresponding to the packet based on the hash table and the policy cache table. In general, compared with determining the policy action corresponding to the packet by finding the user identity corresponding to the packet, finding the policy action corresponding to the packet based on the hash table and the policy cache table often consumes less time. Therefore, in some embodiments, when the network device receives any packet, the network device first finds the policy action corresponding to the packet based on the hash table and the policy cache table. And when the network device cannot find the policy action corresponding to the packet based on the hash table and the policy cache table, the network device determines the policy action corresponding to the packet by finding the user identity corresponding to the packet.

[0132] Exemplarily, in the above step 402, before the network device finds the multiple user identities corresponding to the first packet, the network device first finds, according to the first target information carried by the first packet, a storage location in the hash table whose storage content matches the first target information. Wherein, the storage content of the storage location in the hash table matching the first target information means that the index value of the table entry where the storage location is located is the same as the hash value calculated based on the first hash algorithm on the first target information, the flow hash value of the table entry where the storage location is located is the same as the hash value calculated based on the second hash algorithm on the first target information, and the target information in the table entry in the policy cache table where the storage location is mapped is the same as the first target information. That is, if there is a storage location in the hash table whose storage content matches the first target information, the policy action corresponding to the first packet can be found based on the hash table and the policy cache table.

[0133] In response to not finding the storage location matching the storage content and the first target information in the hash table, it is considered that the policy action corresponding to the first packet cannot be found based on the hash table and the policy cache table, so that the user identity corresponding to the first packet is found according to the first identifier in the first packet.

[0134] That is, in the present scheme, the policy action corresponding to the first packet is first found based on the hash table and the policy cache table, and in the case where the policy action corresponding to the first packet cannot be found, the policy action corresponding to the first packet is determined by finding the user identity corresponding to the first packet, so that the policy action is determined by finding the user identity corresponding to the packet each time the packet is received, and the efficiency of the network device in determining the policy action corresponding to the packet is improved.

[0135] Optionally, after the network device records the policy action corresponding to the first packet in the hash table and the policy cache table by performing steps 401-407, the network device receives a second packet, and the second packet carries second target information, and the content of the second target information is the same as that of the first target information in the first packet. For example, in the case where the first target information is a five-tuple, the five-tuple of the second packet is the same as that of the first packet.

[0136] Based on the second target information in the second packet, the network device finds the storage location matching the storage content and the second target information in the hash table. And in response to finding the first storage location matching the storage content and the second target information, the target policy action is performed on the second packet based on the content recorded in the first entry mapped by the first storage location in the policy cache table.

[0137] Specifically, since the second target information in the second packet is the same as the first target information in the first packet, the first storage location matching the second target information can be found in the hash table, and the target information recorded in the entry mapped by the first storage location in the policy cache table is also the same as the second target information. In this case, the network device can consider that the target policy action recorded in the first entry of the policy cache table is the policy action corresponding to the second packet, so that the target policy action is performed on the second packet.

[0138] In the present scheme, the policy action corresponding to the second packet is first found based on the hash table and the policy cache table, and the found policy action can be directly performed on the second packet, so that the policy action to be performed is determined by finding the user identity corresponding to the second packet, and the efficiency of the network device in determining the policy action corresponding to the packet is improved.

[0139] The above introduces that in the case that the hash table and the policy cache table cache the policy action corresponding to the message, the network device can quickly find the policy action corresponding to the message based on the hash table and the policy cache table. However, due to the limitation of storage space, the storage location in the hash table is often limited, so based on the limited storage location in the hash table, it is often difficult to record the policy action corresponding to all the messages received on the network device. In this case, the message received by the network device often needs to compete for the storage location in the hash table, so as to cache as much as possible the policy action corresponding to the message in the data stream frequently received by the network device in the hash table and the policy cache table, and ensure that as much as possible messages can find the corresponding policy action based on the hash table and the policy cache table.

[0140] Specifically, after the network device receives the message and determines the corresponding policy action for the message, if there is a storage location with empty storage content in the hash table, the network device can directly record the related information of the current message in the storage location with empty storage content.

[0141] Exemplarily, in the step 406 described above, in the case that the network device determines that the first hash value of the first message is the same as the index value of the target entry in the hash table, and the storage content in the first storage location in the target entry is empty, the network device records the second hash value of the second message in the first storage location. And the network device also records the target policy action corresponding to the first message in the first entry mapped by the first storage location on the policy cache table, so as to cache the target policy action corresponding to the first message.

[0142] That is, after the network device determines the policy action corresponding to the message, if there is still a storage location without recorded content in the hash table, the related information of the message can be directly recorded in the storage location without the need to perform storage location competition on the message, ensuring that as much as possible policy actions can be cached based on the hash table and the policy cache table, so as to improve the efficiency of subsequent determination of the policy action corresponding to the message.

[0143] However, if there is no storage location with empty storage content in the entry of the hash table, the network device needs to determine whether the recorded content in the storage location can be replaced by new content.

[0144] Exemplarily, the count value is also contained in each storage location in the multiple entries of the hash table. The count value is used to indicate the number of times of matching between the policy action mapped by the storage location and the message. That is, if the network device finds the corresponding policy action for a message based on the hash table and the policy cache table, the network device can increase the value of the count value in the storage location hit by the message.

[0145] Then, when the network device determines that the target table item does not have a storage location with empty storage content after determining the target policy action corresponding to the first packet by searching the user identity, the network device determines a first storage location with a count value less than or equal to the first threshold value in the target table item. Then, the network device replaces the content in the first storage location with the second hash value of the first packet and the target index value. In addition, the network device records the first target information of the first packet and the target policy action corresponding to the first packet in the table item with the index value and the target index value in the policy cache table. In this way, the network device can implement caching the target policy action corresponding to the first packet based on the hash table and the policy cache table.

[0146] The first threshold value is an integer value, for example, 0 or 1, which can be determined or adjusted according to actual application, and the application does not make any limitation in this regard.

[0147] In general, in the present scheme, the count value in the storage location of the hash table is used to indicate the number of times that the policy action mapped by the storage location matches the packet, which can effectively reflect the number of times that the content recorded in each storage location can play a role in actual application, and is conducive to replacing the content in some storage locations with less role with new content, thereby facilitating improving the probability of finding the policy action corresponding to the packet based on the hash table and the policy cache table.

[0148] In addition, in the process of receiving the packet by the network device each time and searching the policy action corresponding to the packet in the hash table and the policy cache table, the network device updates the count value in the storage location in the hash table according to the search result of the policy action.

[0149] For example, after the network device records the second hash value and the target index value in the first storage location, the network device further receives a third packet, wherein the third target information in the third packet is the same as the first target information in the first packet. Therefore, when searching the hash table and the policy cache table based on the third target information in the third packet, the network device can find that the policy action corresponding to the third packet is the policy action mapped by the first storage location in the target table item (i.e., the target policy action described above).

[0150] In this way, in response to the third packet being processed by the policy action mapped by the first storage location, the network device increases the count value in the first storage location by a preset increment value. The preset increment value is a fixed value, for example, the preset increment value is 1. That is, the network device finds the policy action corresponding to the third packet based on the content recorded in the first storage location, which means that the policy action mapped by the first storage location matches the third packet, and therefore the network device needs to increase the count value recorded in the first storage location, thereby updating the count value.

[0151] Further, in response to the third packet not being processed by using the policy action mapped by the second storage location in the target entry, the network device decreases the count value in the second storage location by a preset decrement value. The second storage location is, for example, any one of the storage locations in the target entry except the first storage location. The preset decrement value is also a fixed value, for example, the preset decrement value is 1.

[0152] Specifically, since the hash value calculated based on the first hash algorithm for the third target information of the third packet is the same as the index value of the target entry (i.e., the third packet hits the target entry), but the third packet only matches the content recorded in the first storage location in the target entry, which means that the content recorded in other storage locations in the target entry does not match the third packet. Therefore, for other storage locations in the target entry except the first storage location, the network device can decrease the count values in these other storage locations by a preset decrement value, or the network device randomly selects one of these other storage locations and decreases the count value in the selected storage location by a preset decrement value.

[0153] In this scheme, based on whether the packet is processed by using the policy action mapped by the storage location in the hash table, the count value in the storage location in the hash table can be updated, so that the count value can reflect the number of times of matching between the content recorded in the storage location and the packet in real time, so that the network device can replace the content recorded in some storage locations with less effect in time, thereby improving the probability of finding the policy action corresponding to the packet based on the hash table and the policy cache table.

[0154] For the sake of understanding, the following will take the target information in the packet for finding the policy action as an example, and the process of the packet competing for the storage location in the hash table will be introduced in detail.

[0155] Exemplarily, please refer to FIG. 8, which is a flowchart of the packet competing for the storage location in the hash table provided by the present application. As shown in FIG. 8, the process of the packet competing for the storage location in the hash table includes the following steps 801-807.

[0156] Step 801, it is judged whether the five-tuple of the packet hits the index value of the hash table.

[0157] Specifically, first, the hash value corresponding to the five-tuple of the packet is calculated based on the first hash algorithm, and then the calculated hash value is compared with the index value in the hash table. If the hash value calculated based on the first hash algorithm is the same as a certain index value in the hash table, it means that the five-tuple of the packet hits the index value in the hash table.

[0158] Step 802, if the five-tuple of the packet hits the index value of the hash table, continue to determine whether the five-tuple of the packet hits the flow hash value in the storage position of the table entry of the hash table.

[0159] After determining that the five-tuple of the packet hits the index value in the hash table, the hash value corresponding to the five-tuple of the packet is calculated based on the second hash algorithm, and the calculated hash value is compared with the flow hash value in each storage position of the table entry. If the hash value calculated based on the second hash algorithm is the same as the flow hash value in a certain storage position, it means that the five-tuple of the packet hits the flow hash value in the storage position of the table entry of the hash table.

[0160] Step 803, if the five-tuple of the packet hits the flow hash value in a storage position, determine whether the five-tuple of the packet is the same as the five-tuple in the table entry of the policy cache table mapped by the hit storage position.

[0161] Since each storage position can be mapped to a table entry of the policy cache table through the recorded policy cache table index value, when the five-tuple of the packet hits the flow hash value in a storage position, it can be continued to compare whether the five-tuple of the packet is the same as the five-tuple in the table entry of the policy cache table mapped by the hit storage position.

[0162] Step 804, if the five-tuple of the packet is the same as the five-tuple in the table entry of the policy cache table mapped by the hit storage position, increase the count value in the hit storage position of the packet by a preset increment value.

[0163] If the five-tuple of the packet is the same as the five-tuple in the table entry of the policy cache table mapped by the hit storage position, it means that the packet can find the corresponding policy action based on the content recorded in the hit storage position, so the count value in the hit storage position of the packet is increased by a preset increment value.

[0164] Step 805, decrease the count value in the storage position not mapped to the corresponding policy action of the packet by a preset decrement value.

[0165] After executing step 803 or 804, for the storage positions not mapped to the corresponding policy action of the packet in the same table entry, the count values in these storage positions can be decreased by a preset decrement value. That is, if the five-tuple of the packet hits a table entry, and the storage positions in the table entry are not mapped to the corresponding policy action of the packet, the count values in these storage positions not mapped to the corresponding policy action of the packet are decreased by a preset decrement value.

[0166] Step 806, if the five-tuple of the packet does not hit the flow hash value in all storage positions, determine whether there is a storage position with a count value not greater than the first threshold in the table entry hit by the packet.

[0167] If the count value of the storage location is not greater than the first threshold value, the network device replaces the content in the storage location with the content corresponding to the current packet.

[0168] Specifically, the network device replaces the content in the storage location with the content corresponding to the current packet based on the hash value calculated by the second hash algorithm on the five-tuple of the current packet and the index value of the table entry to which the current storage location is mapped in the policy cache table.

[0169] The above describes the process of caching and searching for the policy action corresponding to the packet through the hash table and the policy cache table, and how the packet competes for the storage location in the hash table. The following describes how the multi-identity policy execution unit in the network device determines the policy action corresponding to the packet by searching for the user identity when the policy action corresponding to the packet cannot be found based on the hash table and the policy cache table.

[0170] In actual applications, the multi-identity policy execution unit determines the policy action corresponding to the packet based on the identity information table and the policy rule table. The identity information table is used to record the mapping relationship between the sending source identifier of the packet and the user identity. The policy rule table is used to record the mapping relationship between the user identity and the policy action.

[0171] For example, referring to FIG. 9, FIG. 9 is a flowchart of a process in which a multi-identity policy execution unit determines a policy action corresponding to a packet. As shown in FIG. 9, the multi-identity policy execution unit first acquires the sending source identifier of the packet (for example, the source IP address or MAC address of the packet), and searches for all user identities corresponding to the sending source identifier (for example, user identity 1-user identity n shown in FIG. 9) in the identity information table based on the sending source identifier of the packet.

[0172] Then, based on the multiple user identities found, the multi-identity policy execution unit combines each user identity with the destination address of the packet, and searches for the policy action corresponding to each user identity in the policy rule table. For example, in FIG. 9, user identity 1-user identity n are combined with the destination address of the packet respectively, and policy action 1-policy action n corresponding to user identity 1-user identity n are found in the policy rule table.

[0173] Finally, based on the multiple policy actions found, the multi-identity policy execution unit determines the policy action corresponding to the packet through a pre-set policy selection rule.

[0174] Exemplarily, refer to FIG. 10, which is a flowchart of another process of determining a policy action corresponding to a packet by a multi-identity policy execution unit provided in the present application. As shown in FIG. 10, in another possible example, the multi-identity policy execution unit first acquires a sending source identity and a destination address of the packet, and finds all user identities corresponding to the sending source identity and a destination identity corresponding to the destination address in the identity information table based on the sending source identity and the destination address of the packet.

[0175] Then, based on the found multiple user identities, the multi-identity policy execution unit combines each user identity with the destination identity corresponding to the destination address, and finds a policy action corresponding to each user identity in the policy rule table. For example, in FIG. 10, the user identity 1-user identity n are combined with the destination identity corresponding to the packet respectively, and the policy action 1-policy action n corresponding to the user identity 1-user identity n is found in the policy rule table.

[0176] Finally, based on the found multiple policy actions, the multi-identity policy execution unit determines a policy action corresponding to the packet by using a pre-set policy selection rule.

[0177] For the convenience of understanding, the packet processing method provided in the present application will be described in detail below in combination with specific examples in actual application scenarios.

[0178] Refer to FIG. 11, which is a schematic diagram of configuring a security policy for a user identity based on an enterprise organization architecture provided in the present application. As shown in FIG. 11, the organization architecture of an enterprise is specifically divided into: a company level, a transaction department, a securities transaction group, an information department, and a network management group. The transaction department and the information department belong to the company level, the securities transaction group belongs to the transaction department, and the network management group belongs to the information department. Based on the organization architecture of the enterprise, the security policy needs to be constructed according to the following principles: the employees belonging to the company level can access an office automation (OA) system; the employees belonging to the transaction department can access a transaction public server; the employees belonging to the securities transaction group can access a securities transaction server 1 and a securities transaction server 2; the employees belonging to the information department can access a back-end operation and maintenance server; and the employees belonging to the network management group can access a network management system.

[0179] Based on the above principles, five user identities can be constructed, which are respectively: company employee, transaction department employee, securities transaction group employee, information department employee and network management group employee. And the security policy configured for the five user identities specifically includes: the destination address that the company employee is allowed to access is OA; the security group that the transaction department employee is allowed to access is OA, transaction public server; the security group that the securities transaction group employee is allowed to access is OA, transaction public server, securities transaction server 1 and securities transaction server 2; the security group that the information department employee is allowed to access is OA and background operation and maintenance server; the security group that the network management group employee is allowed to access is OA, background operation and maintenance server and network management system. Based on the above security policy, for each user identity, the corresponding relationship between the user identity, the destination address and the policy action can be established, so that the corresponding policy action can be found based on any one user identity and destination address in the subsequent.

[0180] Please refer to FIG. 12, which is a schematic diagram provided by the present application for adjusting the user corresponding user identity without adjusting the security policy. As shown in FIG. 12, it is assumed that a certain user is an employee A in the enterprise, and the user identity corresponding to the user is specifically the network management group employee. And in the configured security policy, the destination address that the network management group employee is allowed to access is OA, background operation and maintenance server and network management system.

[0181] After employee A is transferred from the network management group to the securities transaction group, employee A corresponds to two user identities at the same time, which are respectively the network management group employee and the securities transaction group employee. At this time, only the user identity corresponding to employee A needs to be changed, and the security policy configured for the network management group employee and the securities transaction group employee does not need to be changed, that is, no new security policy needs to be added.

[0182] After employee A is transferred to the securities transaction group, taking employee A accessing the securities server 1 as an example, the following will introduce how the policy cache unit and the multi-identity policy execution unit in the network device cooperate to realize the processing of the message.

[0183] In the communication network of the enterprise, when the network device responsible for forwarding data receives the message sent by employee A through the local device, the policy cache unit in the network device uses the five-tuple of the message to find the policy action corresponding to the message in the hash table and the policy cache table.

[0184] When the five-tuple based on the packet cannot find the policy action corresponding to the packet in the hash table and the policy cache table, the multi-identity policy execution unit in the network device uses the source IP address of the packet to find the user identity corresponding to the packet in the identity information table, so as to obtain two user identities corresponding to the packet, which are the network management group employee and the securities transaction group employee. Based on the first user identity (i.e., the network management group employee) and the destination IP address of the packet, the policy rule table is searched to obtain the first policy action as rejecting the packet. Based on the second user identity (i.e., the securities transaction group employee) and the destination IP address of the packet, the policy rule table is searched to obtain the second policy action as allowing the packet. Finally, in combination with the two policy actions found for the packet, it can be determined that the policy action to be executed for the packet is to allow the packet to pass.

[0185] After finding the policy action corresponding to the packet, the policy cache unit uses the five-tuple of the packet and the policy action corresponding to the packet to update the hash table and the policy cache table, so as to realize caching the policy action corresponding to the five-tuple of the current packet in the hash table and the policy cache table. In this way, when the network device subsequently receives other packets with the same five-tuple as the current packet, the policy cache unit of the network device can directly determine the policy action corresponding to the packet by searching the hash table and the policy cache table, without the need to determine the policy action corresponding to the packet by searching the user identity again.

[0186] The above introduces the packet processing method provided by the present application, and the following will introduce the device for executing the above packet processing method.

[0187] Please refer to FIG. 13, which is a structural schematic diagram of a packet processing device provided by the present application. As shown in FIG. 13, the packet processing device comprises: a transceiver module 1301, configured to receive a first packet; a processing module 1302, configured to find a plurality of user identities corresponding to the first packet according to a first identifier in the first packet, the first identifier being used to represent a sending source of the first packet; the processing module 1302 is further configured to find policy actions corresponding to the plurality of user identities respectively in a policy rule table based on the plurality of user identities and a destination address of the first packet, to obtain a plurality of policy actions, the policy rule table storing a corresponding relationship between user identities and policy actions; and the processing module 1302 is further configured to execute a target policy action on the first packet based on the plurality of policy actions, the target policy action being a policy action determined based on the plurality of policy actions.

[0188] In a possible implementation, the apparatus stores a hash table and a policy cache table, the hash table includes a plurality of table entries, each of the plurality of table entries includes a plurality of storage locations, at least two of the plurality of storage locations are respectively mapped to different table entries of the policy cache table, a first storage location of the plurality of storage locations is mapped to a first table entry of the policy cache table, a second storage location of the plurality of storage locations is mapped to a second table entry of the policy cache table, the first table entry and the second table entry are different, and the policy cache table is used to cache a policy action matched by a received packet of a network device; the processing module 1302 is further configured to: determine a target table entry from the plurality of table entries according to first target information carried in the first packet, where an index value of the target table entry is the same as a first hash value calculated based on a first hash algorithm from the first target information, and the first target information at least includes a source address and a destination address of the first packet; record a second hash value and a target index value in the first storage location of the target table entry, where the second hash value is calculated based on a second hash algorithm from the first target information; and record the first target information and a target policy action in the first table entry of the policy cache table, where an index value of the first table entry is the same as the target index value.

[0189] In a possible implementation, before the plurality of user identities corresponding to the first packet are found, the processing module 1302 is further configured to: find, according to the first target information carried in the first packet, a storage location in the hash table, where a storage content of the storage location matches the first target information; and in response to that the storage location with the storage content matching the first target information is not found in the hash table, trigger finding the user identity corresponding to the first packet according to the first identifier in the first packet.

[0190] In a possible implementation, the transceiver module 1301 is further configured to receive a second packet, where the second packet carries second target information, and a content of the second target information is the same as a content of the first target information; and the processing module 1302 is further configured to find, based on the second target information, a storage location in the hash table, where a storage content of the storage location matches the second target information; and the processing module 1302 is further configured to, in response to that the first storage location with the storage content matching the second target information is found, execute a target policy action on the second packet based on the content recorded in the first table entry mapped by the first storage location.

[0191] In a possible implementation, the processing module 1302 is further configured to: when the storage content in the first storage location of the target table entry is empty, record the second hash value in the first storage location.

[0192] In a possible implementation, the count value is further included in each of the plurality of storage locations, and the count value is used to indicate a number of times that the policy action mapped by the storage location matches the packet; the processing module 1302 is further configured to: when the target entry does not have a storage location with empty storage content, determine a first storage location with a count value less than or equal to a first threshold value in the target entry; and replace content in the first storage location with the second hash value and the target index value.

[0193] In a possible implementation, after the second hash value and the target index value are recorded in the first storage location, the transceiver 1301 is further configured to receive a third packet.

[0194] The processing module 1302 is further configured to, in response to the third packet being processed by using the policy action mapped by the first storage location, increase a preset increment value on the basis of the count value in the first storage location.

[0195] In a possible implementation, the processing module 1302 is further configured to, in response to the third packet not being processed by using the policy action mapped by the second storage location, decrease a preset decrement value on the basis of the count value in the second storage location.

[0196] In a possible implementation, the transceiver 1301 is further configured to obtain configuration information, and the configuration information is used to indicate a correspondence between a first user identity and a first identifier, the first user identity being one of a plurality of user identities; and the processing module 1302 is further configured to, according to the configuration information, add the correspondence between the first user identity and the first identifier in an identity information table, and the identity information table is used to record a correspondence between a user identity and a sending source identifier of a packet.

[0197] In a possible implementation, the target policy action is a policy action with the highest priority in the plurality of policy actions.

[0198] In another possible embodiment, the transceiver 1301 is configured to receive a second packet, and the second packet carries second target information; the processing module 1302 is configured to, based on the second target information, find, in a hash table, a storage location with storage content matching the second target information, the hash table including a plurality of entries, each of the plurality of entries including a plurality of storage locations, at least two of the plurality of storage locations being mapped to different entries of a policy cache table respectively, and a first storage location of the plurality of storage locations being mapped to a first entry in the policy cache table; and the processing module 1302 is further configured to, in response to finding the first storage location with the storage content matching the second target information, perform a target policy action on the second packet based on content recorded in the first entry mapped by the first storage location, the first entry recording the first target information and the target policy action, and the first target information being the same as the second target information.

[0199] The apparatus embodiment described in FIG. 13 is merely illustrative, for example, the division of the modules is merely a logical function division, and in actual implementation, there can be another division manner, for example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. The function modules in each embodiment of the present application can be integrated in one processing module, or each module can be physically present separately, or two or more modules can be integrated in one module. Each module in FIG. 13 can be implemented in the form of hardware or in the form of a software function unit. For example, when implemented in software, the processing module 1302 can be implemented by a software function module generated by at least one processor 1401 in FIG. 14 reading a program code stored in a memory. Each module in FIG. 13 can also be implemented by different hardware in a network device, for example, the processing module 1302 is implemented by a part of processing resources (for example, one core of a multi-core processor) of at least one processor 1401 in FIG. 14, and the transceiver module 1301 is implemented by the rest of the processing resources (for example, other cores of a multi-core processor) of the communication interface 1404 and at least one processor 1401 in FIG. 14, or by using a programmable device such as FPGA or coprocessor. Obviously, the above function modules can also be implemented in a combination of software and hardware, for example, the transceiver module 1301 is implemented by a hardware programmable device, and the processing module 1302 is a software function module generated by a central processing unit (CPU) reading a program code stored in a memory.

[0200] FIG. 14 is a structural schematic diagram of a network device provided by the present application. The network device is equipped with the packet processing apparatus in FIG. 13, and the network device is implemented by a general bus architecture.

[0201] The network device includes at least one processor 1401, a communication bus 1402, a memory 1403, and at least one communication interface 1404.

[0202] Optionally, the processor 1401 is a general purpose CPU, NP, microprocessor, or one or more integrated circuits utilized to implement one or more embodiments of the application such as an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination of such a device and a processor. The PLD is a complex programmable logic device (CPLD), a field programmable logic gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0203] The communication bus 1402 serves to communicate information between above-mentioned components over a communication bus. The communication bus 1402 is divided into an address bus, a data bus, a control bus, and the like. For the convenience of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or only one type of bus.

[0204] Optionally, the memory 1403 is a read-only memory (ROM) or other type of static storage device that can store static information and instructions. Alternatively, the memory 1403 is a random access memory (RAM) or other type of dynamic storage device that can store information and instructions. Alternatively, the memory 1403 is an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage or other magnetic storage devices, or any other medium capable of storing desired program code in the form of instructions or data structures and that can be accessed by a computer, but not limited to. Optionally, the memory 1403 is independent and connected to the processor 1401 through the communication bus 1402. Alternatively, the memory 1403 and the processor 1401 are integrated together.

[0205] The communication interface 1404 is configured to communicate with other devices or communication networks using any transceiver-like mechanism. The communication interface 1404 includes a wired communication interface. Optionally, the communication interface 1404 also includes a wireless communication interface. The wired communication interface is, for example, an Ethernet interface. The Ethernet interface is an optical interface, an electrical interface, or a combination thereof. The wireless communication interface is, for example, a wireless local area networks (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0206] In some embodiments, the processor 1401 includes one or more CPUs, such as CPU0 and CPU1 as shown in FIG. 14.

[0207] In some embodiments, the network device includes a plurality of processors, such as the processor 1401 and the processor 1405 as shown in FIG. 14. Each of the processors is a single-CPU or a multi-CPU. The processor herein refers to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0208] In some embodiments, the memory 1403 is configured to store the program code 1406 for implementing the solutions of the present application, and the processor 1401 is configured to execute the program code 1406 stored in the memory 1403. That is, the network device implements the above-described method embodiments by means of the processor 1401 and the program code 1406 in the memory 1403.

[0209] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts of each of the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, the device embodiments are described more simply because they are basically similar to the method embodiments, and the relevant parts are referred to the part of the method embodiments. Wherein, A refers to B means that A is the same as B or a simple modification of B.

[0210] The terms “first” and “second” and the like in the specification and claims of the embodiments of the present application are used to distinguish different objects, and are not used to describe a specific order of the objects, nor can they be understood as indicating or implying relative importance. For example, the first speed limiting channel and the second speed limiting channel are used to distinguish different speed limiting channels, and are not used to describe the specific order of the speed limiting channels, nor can they be understood as the first speed limiting channel being more important than the second speed limiting channel.

[0211] In the embodiments of the present application, unless otherwise specified, “at least one” means one or more, and “a plurality of” means two or more.

[0212] The above embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, the embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media (such as DVD), or semiconductor media (such as solid state disk (SSD)), etc.

[0213] The above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of processing a packet, the method comprising: The method comprises: receiving a first packet; finding a plurality of user identities corresponding to the first packet according to a first identifier in the first packet, the first identifier being used to represent a sending source of the first packet; finding a plurality of policy actions corresponding to the plurality of user identities respectively in a policy rule table based on the plurality of user identities and a destination address of the first packet, to obtain a plurality of policy actions, the policy rule table storing a correspondence between user identities and policy actions; performing a target policy action on the first packet based on the plurality of policy actions, the target policy action being a policy action determined based on the plurality of policy actions.

2. The method of claim 1, wherein, The network device for performing the method has a hash table and a policy cache table stored thereon, the hash table comprising a plurality of table entries, each of the plurality of table entries comprising a plurality of storage locations, at least two of the plurality of storage locations being mapped to different table entries of the policy cache table, a first storage location of the plurality of storage locations being mapped to a first table entry of the policy cache table, a second storage location of the plurality of storage locations being mapped to a second table entry of the policy cache table, the first table entry and the second table entry being different, the policy cache table being used to cache policy actions matched by packets received by the network device, the method further comprising: determining a target table entry from the plurality of table entries according to first target information carried by the first packet, wherein an index value of the target table entry is the same as a first hash value calculated based on a first hash algorithm from the first target information, the first target information at least comprising a source address and a destination address of the first packet; recording a second hash value and a target index value in the first storage location of the target table entry, the second hash value being calculated based on a second hash algorithm from the first target information; recording the first target information and the target policy action in the first table entry of the policy cache table, the index value of the first table entry being the same as the target index value.

3. The method of claim 2, wherein, Before finding the plurality of user identities corresponding to the first packet, the method further comprises: finding a storage location in the hash table having a storage content matching the first target information carried by the first packet according to the first target information; in response to not finding the storage location having the storage content matching the first target information in the hash table, triggering finding the user identity corresponding to the first packet according to the first identifier in the first packet.

4. The method according to claim 2 or 3, characterized in that, The method further comprises: receiving a second packet, the second packet carrying second target information, the content of the second target information being the same as the content of the first target information; finding a storage location in the hash table having a storage content matching the second target information based on the second target information; in response to finding the first storage location having the storage content matching the second target information, performing the target policy action on the second packet based on the content recorded in the first table entry mapped by the first storage location.

5. The method according to any one of claims 2 to 4, characterized in that, The recording of the second hash value in the first storage location of the target entry includes: When the storage content on the first storage location in the target entry is empty, recording the second hash value on the first storage location.

6. The method according to any one of claims 2-4, characterized in that, Each storage location in the plurality of entries further contains a count value, which is used to indicate the number of times of matching the policy action mapped by the storage location with the packet; The recording of the second hash value and a target index value in the first storage location of the target entry includes: When the target entry does not have a storage location with empty storage content, determining the first storage location with a count value less than or equal to a first threshold value in the target entry; Replacing the content in the first storage location with the second hash value and the target index value.

7. The method of claim 6, wherein, After recording the second hash value and the target index value in the first storage location, the method further includes: Receiving a third packet; In response to that the third packet is processed by using the policy action mapped by the first storage location, increasing a preset increment value on the basis of the count value of the first storage location.

8. The method of claim 7, wherein, The method further includes: In response to that the third packet is not processed by using the policy action mapped by the second storage location, decreasing a preset decrement value on the basis of the count value of the second storage location.

9. The method according to any one of claims 1 to 8, characterized in that, The method further includes: Obtaining configuration information, the configuration information being used to indicate the correspondence between a first user identity and the first identity, the first user identity being one of the plurality of user identities; According to the configuration information, adding the correspondence between the first user identity and the first identity in an identity information table, the identity information table being used to record the correspondence between a user identity and a sending source identity of a packet.

10. The method according to any one of claims 1 to 9, characterized in that, The target policy action is the policy action with the highest priority among the plurality of policy actions.

11. A method of processing a packet, the method comprising: The method includes: Receiving a second packet, the second packet carrying second target information; Based on the second target information, searching for a storage location with storage content matching the second target information in a hash table, the hash table including a plurality of entries, each entry of the plurality of entries including a plurality of storage locations, at least two storage locations of the plurality of storage locations being mapped to different entries of the policy cache table respectively, a first storage location of the plurality of storage locations being mapped to a first entry in the policy cache table; In response to finding the first storage location with storage content matching the second target information, performing the target policy action on the second packet based on the content recorded in the first entry mapped by the first storage location, the first entry recording first target information and the target policy action, the first target information being the same as the second target information.

12. A packet processing device, characterized by, The method includes: A transceiver module, configured to receive a first packet; A processing module, configured to find a plurality of user identities corresponding to the first packet according to a first identity in the first packet, the first identity being used to represent a sending source of the first packet. The processing module is further configured to find, based on the multiple user identities and a destination address of the first packet, policy actions corresponding to the multiple user identities respectively in a policy rule table, to obtain multiple policy actions, and the policy rule table stores a correspondence between user identities and policy actions. The processing module is further configured to perform a target policy action on the first packet based on the multiple policy actions, and the target policy action is a policy action determined based on the multiple policy actions.

13. The apparatus of claim 12, wherein, The device stores a hash table and a policy cache table, the hash table includes multiple entries, each of the multiple entries includes multiple storage locations, at least two of the multiple storage locations are respectively mapped to different entries of the policy cache table, a first storage location of the multiple storage locations is mapped to a first entry of the policy cache table, a second storage location of the multiple storage locations is mapped to a second entry of the policy cache table, the first entry and the second entry are different, and the policy cache table is used to cache policy actions matched by packets received by the network device. The processing module is further configured to: determine a target entry from the multiple entries according to first target information carried by the first packet, wherein an index value of the target entry is the same as a first hash value calculated based on a first hash algorithm from the first target information, and the first target information at least includes a source address and a destination address of the first packet; record a second hash value and a target index value in the first storage location of the target entry, wherein the second hash value is calculated based on a second hash algorithm from the first target information; record the first target information and the target policy action in the first entry of the policy cache table, and an index value of the first entry is the same as the target index value.

14. The apparatus of claim 13, wherein, Before finding the multiple user identities corresponding to the first packet, the processing module is further configured to: find, according to the first target information carried by the first packet, a storage location in the hash table, wherein a storage content of the storage location matches the first target information; in response to that no storage location with a storage content matching the first target information is found in the hash table, trigger finding user identities corresponding to the first packet according to a first identifier in the first packet.

15. The apparatus of claim 13 or 14, wherein the transceiver module is further configured to receive a second packet, and the second packet carries second target information, and a content of the second target information is the same as a content of the first target information; the processing module is further configured to find, based on the second target information, a storage location in the hash table, wherein a storage content of the storage location matches the second target information; the processing module is further configured to, in response to that the first storage location with the storage content matching the second target information is found, perform the target policy action on the second packet based on the content recorded in the first entry mapped by the first storage location.

16. The apparatus of any one of claims 13-15, wherein, the processing module is further configured to: when the storage content at the first storage location in the target entry is empty, recording the second hash value at the first storage location.

17. The apparatus of any one of claims 13-15, wherein, Each storage location in the plurality of entries further comprises a count value, the count value being used to indicate a number of times of matching a policy action and a packet; The processing module is further configured to: when the target entry does not have a storage location with empty storage content, determining the first storage location with a count value less than or equal to a first threshold value in the target entry; replacing content in the first storage location with the second hash value and the target index value.

18. The apparatus of claim 17, wherein, after recording the second hash value and the target index value in the first storage location, The transceiving module is further configured to receive a third packet. The processing module is further configured to, in response to the third packet being processed using the policy action mapped by the first storage location, increase a preset increment value on the basis of the count value of the first storage location.

19. The apparatus of claim 18, wherein, The processing module is further configured to: in response to the third packet not being processed using the policy action mapped by the second storage location, decrease a preset decrement value on the basis of the count value of the second storage location.

20. The apparatus of any of claims 12-19, wherein The transceiving module is further configured to obtain configuration information, the configuration information being used to indicate a correspondence relationship between a first user identity and the first identifier, the first user identity being one of the plurality of user identities. The processing module is further configured to, according to the configuration information, add the correspondence relationship between the first user identity and the first identifier in an identity information table, the identity information table being used to record a correspondence relationship between a user identity and a sending source identifier of a packet.

21. The apparatus of any of claims 12-20, wherein, The target policy action is a policy action with the highest priority among the plurality of policy actions.

22. A packet processing device, comprising: comprising: a transceiving module configured to receive a second packet, the second packet carrying second target information; a processing module configured to, based on the second target information, find, in a hash table, a storage location with storage content matching the second target information, the hash table comprising a plurality of entries, each entry in the plurality of entries comprising a plurality of storage locations, at least two storage locations in the plurality of storage locations being mapped to different entries in the policy cache table respectively, a first storage location in the plurality of storage locations being mapped to a first entry in the policy cache table; The processing module is further configured to, in response to finding the first storage location with storage content matching the second target information, perform the target policy action on the second packet based on content recorded in the first entry mapped by the first storage location, the first entry recording first target information and the target policy action, the first target information being the same as the second target information.

23. A network device, comprising: comprising a processor and a memory, the memory being used to store program code, the processor being used to invoke the program code in the memory to cause the network device to perform the method of any of claims 1-11.

Images