Traffic processing method and protection device

Abstract

The present application relates to the technical field of networks, and provides a traffic processing method and a protection device. In the present application, traffic outputted by a dedicated security chip is forwarded on the basis of the resource occupancy of a CPU. When the resource occupancy of the CPU satisfies a first condition, for example, when the utilization of the CPU is relatively low, the traffic outputted by the dedicated security chip is forwarded to the CPU; when the resource occupancy of the CPU satisfies a second condition, for example, when the utilization of the CPU is relatively high, the traffic outputted by the dedicated security chip is forwarded to an egress interface. In the method, when the resource occupancy of the CPU satisfies the second condition, by enabling the traffic outputted by the dedicated security chip to be directly forwarded to the egress interface without passing through the CPU, the risk of performance degradation or even failure of the CPU can be avoided, helping to ensure normal operation of the protection device, thus helping to ensure normal transmission of service traffic.

Description

Traffic processing methods and protection equipment

[0001] This application claims priority to Chinese Patent Application No. 202411762520.6, filed with the State Intellectual Property Office of China on November 30, 2024, entitled "Flow Processing Method and Protection Device", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of network technology, and more specifically, to a traffic processing method and protection device. Background Technology

[0003] Protective devices (such as security gateways or firewalls) detect the traffic flowing through them to identify the presence of attack traffic and promptly block it if such traffic is detected, thereby ensuring network security.

[0004] The protection device includes a dedicated security chip and a central processing unit (CPU). To improve the performance of the protection device, a hardware offloading technology is proposed, which offloads network layer attack defense functions to a dedicated hardware chip. Specifically, the protection device uses a dedicated security chip to block network layer attack traffic, sending application layer attack traffic and normal service traffic to the CPU for processing. After defense processing, the CPU forwards normal service traffic through the protection device's outgoing interface. If the application layer attack traffic is large or the dedicated hardware chip fails to successfully block the network-side attack, it may cause the CPU to malfunction, thus affecting the normal transmission of service traffic. Summary of the Invention

[0005] This application provides a traffic processing method and protection device, which helps ensure the normal operation of the CPU and thus helps ensure the normal transmission of business traffic.

[0006] Firstly, a traffic processing method is provided, which is applied to a protection device. The protection device includes an ingress interface, an egress interface, a dedicated security chip, and a CPU.

[0007] The method includes: receiving first traffic from the ingress interface via the dedicated security chip; performing a first defense process on the first traffic via the dedicated security chip to obtain a second traffic; in response to the CPU's resource occupancy meeting a first condition, sending the second traffic to the CPU via the dedicated security chip, and performing a second defense process on the second traffic via the CPU, and sending the third traffic obtained after the second defense process to the egress interface; in response to the CPU's resource occupancy meeting a second condition, sending the second traffic to the egress interface via the dedicated security chip, wherein the parameter ranges described by the first condition and the second condition do not overlap.

[0008] Optionally, the condition that the CPU resource usage meets the first condition can be replaced with the condition that the CPU resource usage does not meet the second condition.

[0009] Optionally, "CPU resource usage satisfies the second condition" can be replaced with "CPU resource usage does not satisfy the first condition".

[0010] Optionally, the first defense process includes defense against network layer attack traffic.

[0011] Optionally, the second defense process includes defense processing against application layer attack traffic.

[0012] In the method provided in the first aspect, the protection device flexibly adjusts the transmission path of the traffic (e.g., the second traffic) output by the dedicated security chip based on the CPU's resource utilization. Based on this mechanism, when CPU resources are sufficient (e.g., when CPU resource utilization meets the first condition), the CPU can perform defensive processing and forwarding of traffic, improving defense capabilities while ensuring the transmission of service traffic. When CPU resources are insufficient (e.g., when CPU resource utilization meets the second condition), the traffic output by the dedicated security chip can be directly forwarded to the outgoing interface without passing through the CPU, thus avoiding the risk of performance degradation or even paralysis caused by the CPU still needing to process traffic when resources are insufficient. This mechanism can be understood as an escape mechanism, which helps ensure the normal operation of the CPU, and consequently, the normal transmission of service traffic.

[0013] In one possible implementation, the first condition includes one or more of the following: the CPU utilization is less than or equal to a first threshold, the duration for which the CPU utilization is less than or equal to the first threshold is greater than a first duration, the amount of memory occupied by the CPU is less than or equal to a second threshold, the duration for which the amount of memory occupied by the CPU is less than or equal to the second threshold is greater than a second duration, the percentage of memory occupied by the CPU is less than or equal to a third threshold, or the duration for which the percentage of memory occupied by the CPU is less than or equal to the third threshold is greater than a third duration.

[0014] CPU utilization, also known as CPU usage, refers to the percentage of time the CPU is processing tasks. CPU utilization reflects the CPU's workload; higher utilization indicates a busier CPU, while lower utilization indicates a less busy CPU.

[0015] The amount of memory used by the CPU refers to the amount of memory used by tasks associated with the CPU. For example, the CPU may use 32GB of memory.

[0016] The percentage of memory used by the CPU refers to the ratio of the amount of memory used by tasks associated with the CPU to the total amount of memory.

[0017] CPU utilization, CPU memory usage, and the percentage of memory used by the CPU are used to measure CPU resource usage. When CPU resource usage meets the first condition, the CPU is used for traffic defense processing and forwarding, which improves defense capabilities while ensuring the transmission of business traffic.

[0018] In one possible implementation, the second condition includes one or more of the following: the CPU utilization is greater than a third threshold, the duration for which the CPU utilization is greater than the third threshold is greater than a fourth duration, the amount of memory occupied by the CPU is greater than a fourth threshold, the duration for which the amount of memory occupied by the CPU is greater than the fourth threshold is greater than a fifth duration, the percentage of memory occupied by the CPU is greater than a sixth threshold, or the duration for which the percentage of memory occupied by the CPU is greater than the sixth threshold is greater than a sixth duration.

[0019] Based on this implementation, one or more of the following metrics—CPU utilization, CPU memory usage, and the percentage of memory used by the CPU—are used to measure CPU resource usage. When CPU resource usage meets the second condition, the traffic output by the dedicated security chip can be directly forwarded to the outgoing interface without passing through the CPU. This reduces the CPU's processing burden (or CPU load), which helps ensure the normal operation of the CPU and, consequently, the normal transmission of service traffic.

[0020] In one possible implementation, the first traffic is traffic that does not meet the preset conditions.

[0021] Traffic that meets the preset conditions is the traffic that needs to be directly forwarded by the protection device. For traffic that does not meet the preset conditions, the CPU will process and forward it if the CPU resource usage meets the first condition. Since the CPU only needs to process traffic that does not meet the preset conditions, the processing load can be reduced.

[0022] In one possible implementation, the method further includes: receiving a fourth traffic flow from the ingress interface via the dedicated security chip, the fourth traffic flow being traffic that satisfies the preset conditions; performing the first defense processing on the fourth traffic flow via the dedicated security chip; and sending a fifth traffic flow obtained after the first defense processing to the egress interface.

[0023] Based on this implementation method, for traffic that meets the preset conditions, regardless of the CPU resource usage, it is directly forwarded to the outgoing interface by a dedicated security chip, which can reduce the CPU processing burden while achieving fast forwarding of traffic that meets the preset conditions.

[0024] In one possible implementation, the preset conditions include one or more of the following: the destination Internet Protocol (IP) address is the target destination IP address, the source IP address is the target source IP address, the destination port is the target destination port, the source port is the target source port, or the transport protocol is the target transport protocol.

[0025] The above provides a variety of possible designs with preset conditions, improving the flexibility and usability of the solution.

[0026] In one possible implementation, the dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

[0027] The above provides a variety of possible designs for dedicated security chips, improving the usability of the solution.

[0028] Secondly, a traffic processing method is provided, which is applied to a protection device. The protection device includes an ingress interface, an egress interface, a dedicated security chip, and a CPU.

[0029] The method includes: receiving first traffic from the ingress interface via the dedicated security chip; performing a first defense process on the first traffic via the dedicated security chip to obtain a second traffic; in response to a first detection result obtained by the CPU from detecting the sampled traffic, sending a first target traffic to the CPU via the dedicated security chip, and performing a second defense process on the first target traffic via the CPU, and sending a third traffic obtained after the second defense process to the egress interface, wherein the first target traffic is application layer traffic in the second traffic that meets a first preset condition, the sampled traffic is sent by the dedicated security chip to the CPU, and the sampled traffic is obtained by the dedicated security chip from sampling historical traffic at a preset sampling rate; and in response to a second detection result obtained by the CPU from detecting the sampled traffic, sending the second traffic to the egress interface via the dedicated security chip.

[0030] Optionally, the first detection result is contradictory to the second detection result. That is, the detection result obtained by the CPU from detecting the sampled traffic is either the first detection result or the second detection result.

[0031] Optionally, the first defense process includes defense against network layer attack traffic.

[0032] Optionally, the second defense process includes defense processing against application layer attack traffic.

[0033] Alternatively, the first detection result is obtained by a dedicated security chip detecting historical traffic.

[0034] Alternatively, the second detection result is obtained by detecting historical traffic using a dedicated security chip.

[0035] In the second method, the dedicated security chip selects the transmission path for the traffic output by the dedicated security chip (e.g., the second traffic) based on the detection result of the CPU's detection of the sampled traffic. When the detection result is the first detection result, the dedicated security chip sends application layer traffic that meets the first preset condition to the CPU. The CPU then performs defense processing on the application layer traffic that meets the first preset condition, which improves defense performance. When the detection result is the second detection result, the dedicated security chip directly sends the traffic to the outgoing interface without going through the CPU, ensuring normal traffic transmission. In summary, the CPU only needs to process and forward traffic when the detection result is the second detection result, resulting in a lower processing burden, which helps ensure the normal operation of the CPU and, consequently, the transmission of service traffic.

[0036] In one possible implementation, the step of sending the second traffic to the output interface through the dedicated security chip in response to a second detection result obtained by the CPU from detecting the sampled traffic includes: in response to the second detection result and the second traffic not including a second target traffic, sending the second traffic to the output interface through the dedicated security chip, wherein the second target traffic is application layer traffic that meets a second preset condition.

[0037] The second target traffic is the traffic that the protection device is concerned with. For traffic that the protection device is not concerned with, the dedicated security chip forwards the traffic directly to the outgoing interface without going through the CPU. By reducing the CPU's processing load in this way, the CPU can reserve more resources to process the traffic that the protection device is concerned with.

[0038] In one possible implementation, the method further includes: in response to the second detection result and the second traffic including the second target traffic, sending the second target traffic to the CPU through the dedicated security chip; performing the second defense processing on the second target traffic through the CPU, and sending the fourth traffic obtained after the second defense processing to the outgoing interface.

[0039] The second target traffic is the traffic that the protection device is concerned with. For traffic that the protection device is concerned with, the CPU sends, processes, and forwards it, which helps ensure traffic security.

[0040] In one possible implementation, the first detection result includes: the rate of application layer traffic satisfying the first preset condition is greater than a first threshold, or the duration for which the rate of application layer traffic satisfying the first preset condition is greater than the first threshold is greater than a first duration.

[0041] This implementation determines whether application layer traffic meeting the first preset condition is abnormal by detecting the rate of application layer traffic meeting the first preset condition. When an anomaly is found in the application layer traffic meeting the first preset condition (i.e., the CPU obtains a first detection result by detecting the sampled traffic), defensive processing is performed on the application layer traffic meeting the first preset condition to ensure the normal transmission of service traffic within the application layer traffic meeting the first preset condition.

[0042] In one possible implementation, the second detection result includes: the rate of application layer traffic that satisfies the first preset condition is less than or equal to a second threshold, or the duration for which the rate of application layer traffic that satisfies the first preset condition is less than or equal to a first threshold is greater than a second duration.

[0043] This implementation determines whether application layer traffic meeting the first preset condition is abnormal by detecting the rate of application layer traffic meeting the first preset condition. When there is no abnormality in the application layer traffic meeting the first preset condition (i.e., the CPU obtains a second detection result from the sampled traffic), the traffic is directly forwarded to achieve fast transmission.

[0044] In one possible implementation, the method further includes: in response to the first detection result, sending application layer traffic in the second traffic that does not meet the first preset condition to the outgoing interface via the dedicated security chip.

[0045] Application layer traffic that meets the first preset condition is considered traffic that the protection device is concerned with; application layer traffic that does not meet the first preset condition is considered traffic that the protection device is not concerned with. For traffic that the protection device is not concerned with, the dedicated security chip forwards the traffic directly to the outgoing interface without going through the CPU. By reducing the CPU's processing load in this way, the CPU can reserve more resources to process the traffic that the protection device is concerned with.

[0046] In one possible implementation, the first preset condition includes one or more of the following: the destination Internet Protocol IP address is the first target destination IP address, the source IP address is the first target source IP address, the destination port is the first target destination port, the source port is the first target source port, or the transport protocol is the first target transport protocol.

[0047] The above provides a variety of possible designs for the first preset condition, improving the flexibility and usability of the solution.

[0048] In one possible implementation, the second preset condition includes one or more of the following: the destination Internet Protocol IP address is the second target destination IP address, the source IP address is the second target source IP address, the destination port is the second target destination port, the source port is the second target source port, or the transport protocol is the second target transport protocol.

[0049] The above provides a variety of possible designs for the second preset condition, improving the flexibility and usability of the solution.

[0050] In one possible implementation, the method further includes: sending indication information to the dedicated security chip via the CPU, the indication information indicating the first detection result.

[0051] In this implementation, after the CPU detects the sampled traffic and obtains the detection result, it sends an instruction message to the dedicated security chip so that the dedicated security chip can know the detection result and then select an appropriate path to forward the traffic based on the detection result.

[0052] In one possible implementation, the dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

[0053] The above provides a variety of possible designs for dedicated security chips, improving the usability of the solution.

[0054] Thirdly, a traffic processing method is provided, which is applied to a dedicated security chip. The dedicated security chip is located in a protection device, which also includes an ingress interface, an egress interface, and a central processing unit (CPU).

[0055] The method includes: receiving first traffic from the ingress interface; performing a first defense process on the first traffic to obtain second traffic; sending the second traffic to the CPU in response to the CPU's resource occupancy meeting a first condition; and sending the second traffic to the egress interface in response to the CPU's resource occupancy meeting a second condition, wherein the parameter ranges described by the first condition and the second condition do not overlap.

[0056] In the third method, the dedicated security chip flexibly adjusts the transmission path of traffic (e.g., the second type of traffic) based on CPU resource utilization. Based on this mechanism, when CPU resources are sufficient (e.g., CPU resource utilization meets the first condition), the CPU can perform defensive processing and forwarding of traffic, improving defense capabilities while ensuring the transmission of service traffic. When CPU resources are insufficient (e.g., CPU resource utilization meets the second condition), the traffic output by the dedicated security chip can be directly forwarded to the outgoing interface without passing through the CPU, thus avoiding the risk of performance degradation or even shutdown caused by the CPU still needing to process traffic due to insufficient resources. This mechanism can be understood as an escape mechanism, which helps ensure the normal operation of the CPU, thereby ensuring the normal transmission of service traffic.

[0057] In one possible implementation, an indication is received from the CPU, the indication indicating that the CPU's resource usage satisfies the first condition, or the indication indicating that the CPU's resource usage satisfies the second condition.

[0058] In this implementation, the CPU determines whether its resource usage meets the first or second condition and instructs the dedicated security chip accordingly. Based on the CPU's instructions, the dedicated security chip can determine whether the CPU's resource usage meets the first or second condition, and thus determine the traffic forwarding path.

[0059] In one possible implementation, the first condition includes one or more of the following: the CPU utilization is less than or equal to a first threshold, the duration for which the CPU utilization is less than or equal to the first threshold is greater than a first duration, the amount of memory occupied by the CPU is less than or equal to a second threshold, the duration for which the amount of memory occupied by the CPU is less than or equal to the second threshold is greater than a second duration, the percentage of memory occupied by the CPU is less than or equal to a third threshold, or the duration for which the percentage of memory occupied by the CPU is less than or equal to the third threshold is greater than a third duration.

[0060] In one possible implementation, the second condition includes one or more of the following: the CPU utilization is greater than a third threshold, the duration for which the CPU utilization is greater than the third threshold is greater than a fourth duration, the amount of memory occupied by the CPU is greater than a fourth threshold, the duration for which the amount of memory occupied by the CPU is greater than the fourth threshold is greater than a fifth duration, the percentage of memory occupied by the CPU is greater than a sixth threshold, or the duration for which the percentage of memory occupied by the CPU is greater than the sixth threshold is greater than a sixth duration.

[0061] In one possible implementation, the first traffic is traffic that does not meet the preset conditions.

[0062] In one possible implementation, the method further includes: receiving a fourth flow from the ingress interface, the fourth flow being flow that satisfies the preset condition; performing the first defense processing on the fourth flow; and sending a fifth flow obtained after the first defense processing to the egress interface.

[0063] In one possible implementation, the preset conditions include one or more of the following: the destination Internet Protocol IP address is the target destination IP address, the source IP address is the target source IP address, the destination port is the target destination port, the source port is the target source port, or the transport protocol is the target transport protocol.

[0064] In one possible implementation, the dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

[0065] Fourthly, a traffic processing method is provided, which is applied to a dedicated security chip. The dedicated security chip is located in a protective device, which also includes an input interface, an output interface, and a central processing unit (CPU).

[0066] The method includes: receiving first traffic from the ingress interface; performing a first defense process on the first traffic to obtain a second traffic;

[0067] The system receives an indication from the CPU, which instructs the CPU to detect a first detection result obtained by detecting the sampled traffic. The sampled traffic is sent to the CPU by the dedicated security chip and is obtained by the dedicated security chip sampling historical traffic at a preset sampling rate. In response to the indication, the system sends a first target traffic to the CPU, which is the application layer traffic in the second traffic that meets a first preset condition. If the indication is not received, the system sends the second traffic to the output interface.

[0068] In the method provided in the fourth aspect, the dedicated security chip selects the transmission path for the traffic output by the dedicated security chip (e.g., the second traffic) based on the detection result of the CPU's detection of the sampled traffic. When the detection result is the first detection result, the dedicated security chip sends application layer traffic that meets the first preset condition to the CPU. The CPU then performs defense processing on the application layer traffic that meets the first preset condition, which improves defense performance. When the detection result is not the first detection result, the dedicated security chip directly sends the traffic to the outgoing interface without going through the CPU, ensuring normal traffic transmission. In summary, the CPU only needs to process and forward traffic when the detection result is the second detection result, resulting in a smaller processing burden, which helps ensure the normal operation of the CPU and, consequently, the transmission of service traffic.

[0069] In one possible implementation, the method further includes: if the second traffic includes a second target traffic, sending the second target traffic to the CPU, wherein the second target traffic is application layer traffic that satisfies a second preset condition.

[0070] In one possible implementation, the first detection result includes: the rate of application layer traffic satisfying the first preset condition is greater than a first threshold, or the duration for which the rate of application layer traffic satisfying the first preset condition is greater than the first threshold is greater than a first duration.

[0071] In one possible implementation, the method further includes: in response to the indication information, sending application layer traffic in the second traffic that does not meet the first preset condition to the outgoing interface.

[0072] In one possible implementation, the first preset condition includes one or more of the following: the destination Internet Protocol IP address is the first target destination IP address, the source IP address is the first target source IP address, the destination port is the first target destination port, the source port is the first target source port, or the transport protocol is the first target transport protocol.

[0073] In one possible implementation, the second preset condition includes one or more of the following: the destination Internet Protocol IP address is the second target destination IP address, the source IP address is the second target source IP address, the destination port is the second target destination port, the source port is the second target source port, or the transport protocol is the second target transport protocol.

[0074] In one possible implementation, the dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

[0075] Fifthly, a traffic processing method is provided, which is applied to a central processing unit (CPU). The CPU is located within a protection device, which further includes an output interface and a dedicated security chip.

[0076] The method includes: sending indication information to the dedicated security chip, the indication information indicating that the CPU's resource occupancy meets a first condition; receiving second traffic from the dedicated security chip; performing a second defense process on the second traffic; and sending a third traffic obtained after the second defense process to the output interface.

[0077] In the method provided in the fifth aspect, the CPU indicates the CPU's resource usage to the dedicated security chip. When the CPU's resources are sufficient (for example, when the CPU's resource usage meets the first condition), the dedicated security chip forwards traffic to the CPU, enabling the CPU to perform traffic defense processing and forwarding, thereby improving defense capabilities while ensuring the transmission of business traffic.

[0078] In one possible implementation, the first condition includes one or more of the following: the CPU utilization is less than or equal to a first threshold, the duration for which the CPU utilization is less than or equal to the first threshold is greater than a first duration, the amount of memory occupied by the CPU is less than or equal to a second threshold, the duration for which the amount of memory occupied by the CPU is less than or equal to the second threshold is greater than a second duration, the percentage of memory occupied by the CPU is less than or equal to a third threshold, or the duration for which the percentage of memory occupied by the CPU is less than or equal to the third threshold is greater than a third duration.

[0079] In a sixth aspect, a traffic processing method is provided. The method is applied to a central processing unit (CPU), which is located in a protection device. The protection device further includes an input interface, an output interface, and a dedicated security chip.

[0080] The method includes: receiving sampled traffic from a dedicated security chip, the sampled traffic being obtained by the dedicated security chip sampling traffic received from the ingress interface at a preset sampling rate; sending indication information to the dedicated security chip, the indication information instructing the CPU to detect a first detection result obtained by detecting the sampled traffic; receiving a first target traffic from the dedicated security chip in response to the indication information, the first target traffic being application layer traffic that meets a first preset condition; performing a second defense processing on the first target traffic; and sending a third traffic obtained after the second defense processing to the egress interface.

[0081] In the second method, the CPU instructs a dedicated security chip on the detection results of the sampled traffic. The dedicated security chip then forwards the traffic according to the CPU's instructions. When the detection result is a first detection result, the dedicated security chip sends application-layer traffic that meets a first preset condition to the CPU. The CPU then performs defensive processing on this application-layer traffic, improving defense performance. Since the CPU only needs to process and forward traffic when the detection result is a second detection result, its processing burden is reduced, which helps ensure the normal operation of the CPU and, consequently, the transmission of service traffic.

[0082] In one possible implementation, the method further includes: receiving a second target traffic from the dedicated security chip, wherein the second target traffic is application layer traffic that satisfies a second preset condition.

[0083] In one possible implementation, the first detection result includes: the rate of application layer traffic satisfying the first preset condition is greater than a first threshold, or the duration for which the rate of application layer traffic satisfying the first preset condition is greater than the first threshold is greater than a first duration.

[0084] In one possible implementation, the first preset condition includes one or more of the following: the destination Internet Protocol IP address is the first target destination IP address, the source IP address is the first target source IP address, the destination port is the first target destination port, the source port is the first target source port, or the transport protocol is the first target transport protocol.

[0085] In one possible implementation, the second preset condition includes one or more of the following: the destination Internet Protocol IP address is the second target destination IP address, the source IP address is the second target source IP address, the destination port is the second target destination port, the source port is the second target source port, or the transport protocol is the second target transport protocol.

[0086] In a seventh aspect, a protection device is provided, including an ingress interface, an egress interface, a dedicated security chip, and a central processing unit (CPU): the dedicated security chip is configured to receive first traffic from the ingress interface and perform a first defense process on the first traffic to obtain second traffic; in response to the CPU's resource occupancy satisfying a first condition, the dedicated security chip is further configured to send the second traffic to the CPU, the CPU is configured to perform a second defense process on the second traffic, and send a third traffic obtained after the second defense process to the egress interface; in response to the CPU's resource occupancy satisfying a second condition, the dedicated security chip is further configured to send the second traffic to the egress interface, wherein the parameter ranges described by the first condition and the second condition do not overlap.

[0087] The seventh aspect provides a protective device that flexibly adjusts the transmission path of traffic (e.g., the second type of traffic) output by the dedicated security chip based on CPU resource utilization. When CPU resources are sufficient (e.g., CPU resource utilization meets the first condition), the CPU can perform defensive processing and forwarding of traffic, improving defense capabilities while ensuring the transmission of service traffic. When CPU resources are insufficient (e.g., CPU resource utilization meets the second condition), the traffic output by the dedicated security chip can be directly forwarded to the outgoing interface without passing through the CPU. This avoids the risk of performance degradation or even paralysis caused by the CPU having to process traffic despite insufficient resources, thus ensuring the normal operation of the CPU and consequently ensuring the normal transmission of service traffic.

[0088] In one possible implementation, the first condition includes one or more of the following: the CPU utilization is less than or equal to a first threshold, the duration for which the CPU utilization is less than or equal to the first threshold is greater than a first duration, the amount of memory occupied by the CPU is less than or equal to a second threshold, the duration for which the amount of memory occupied by the CPU is less than or equal to the second threshold is greater than a second duration, the percentage of memory occupied by the CPU is less than or equal to a third threshold, or the duration for which the percentage of memory occupied by the CPU is less than or equal to the third threshold is greater than a third duration.

[0089] In one possible implementation, the second condition includes one or more of the following: the CPU utilization is greater than a third threshold, the duration for which the CPU utilization is greater than the third threshold is greater than a fourth duration, the amount of memory occupied by the CPU is greater than a fourth threshold, the duration for which the amount of memory occupied by the CPU is greater than the fourth threshold is greater than a fifth duration, the percentage of memory occupied by the CPU is greater than a sixth threshold, or the duration for which the percentage of memory occupied by the CPU is greater than the sixth threshold is greater than a sixth duration.

[0090] In one possible implementation, the first traffic is traffic that does not meet the preset conditions.

[0091] In one possible implementation, the dedicated security chip is further configured to: receive a fourth flow from the ingress interface, the fourth flow being flow that satisfies the preset conditions; perform the first defense processing on the fourth flow, and send a fifth flow obtained after the first defense processing to the egress interface.

[0092] In one possible implementation, the preset conditions include one or more of the following: the destination Internet Protocol IP address is the target destination IP address, the source IP address is the target source IP address, the destination port is the target destination port, the source port is the target source port, or the transport protocol is the target transport protocol.

[0093] In one possible implementation, the dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

[0094] Eighthly, a protection device is provided, including an ingress interface, an egress interface, a dedicated security chip, and a central processing unit (CPU): the dedicated security chip is used to receive first traffic from the ingress interface and perform a first defense processing on the first traffic to obtain a second traffic; in response to a first detection result obtained by the CPU from detecting the sampled traffic, the dedicated security chip is further used to send a first target traffic to the CPU, the CPU is used to perform a second defense processing on the first target traffic, and send a third traffic obtained after the second defense processing to the egress interface, wherein the first target traffic is application layer traffic in the second traffic that meets a first preset condition, the sampled traffic is sent by the dedicated security chip to the CPU, and the sampled traffic is obtained by the dedicated security chip from sampling historical traffic at a preset sampling rate; in response to a second detection result obtained by the CPU from detecting the sampled traffic, the dedicated security chip is further used to send the second traffic to the egress interface.

[0095] The eighth aspect provides a protection device that selects the transmission path for the traffic output by the dedicated security chip (e.g., the second traffic) based on the detection results of the sampled traffic detected by the CPU. When the detection result is the first detection result, the dedicated security chip sends application layer traffic that meets the first preset condition to the CPU. The CPU then performs defense processing on the application layer traffic that meets the first preset condition, thereby improving defense performance. When the detection result is the second detection result, the dedicated security chip directly sends the traffic to the outgoing interface without going through the CPU, ensuring normal traffic transmission. In summary, the CPU only needs to process and forward traffic when the detection result is the second detection result, resulting in a lower processing burden, which helps ensure the normal operation of the CPU and, consequently, the transmission of service traffic.

[0096] In one possible implementation, in response to a second detection result obtained by the CPU from detecting the sampled traffic, the dedicated security chip is further configured to send the second traffic to the output interface, specifically including: in response to the second detection result and the second traffic not including a second target traffic, the dedicated security chip is further configured to send the second traffic to the output interface, wherein the second target traffic is application layer traffic that meets a second preset condition.

[0097] In one possible implementation, in response to the second detection result and the second traffic including the second target traffic, the dedicated security chip is further configured to send the second target traffic to the CPU; the CPU is further configured to perform the second defense processing on the second target traffic and send the fourth traffic obtained after the second defense processing to the output interface.

[0098] In one possible implementation, the first detection result includes: the rate of application layer traffic satisfying the first preset condition is greater than a first threshold, or the duration for which the rate of application layer traffic satisfying the first preset condition is greater than the first threshold is greater than a first duration.

[0099] In one possible implementation, the second detection result includes: the rate of application layer traffic that satisfies the first preset condition is less than or equal to a second threshold, or the duration for which the rate of application layer traffic that satisfies the first preset condition is less than or equal to a first threshold is greater than a second duration.

[0100] In one possible implementation, the dedicated security chip is further configured to: in response to the first detection result, send application layer traffic in the second traffic that does not meet the first preset condition to the outgoing interface.

[0101] In one possible implementation, the first preset condition includes one or more of the following: the destination Internet Protocol IP address is the first target destination IP address, the source IP address is the first target source IP address, the destination port is the first target destination port, the source port is the first target source port, or the transport protocol is the first target transport protocol.

[0102] In one possible implementation, the second preset condition includes one or more of the following: the destination Internet Protocol IP address is the second target destination IP address, the source IP address is the second target source IP address, the destination port is the second target destination port, the source port is the second target source port, or the transport protocol is the second target transport protocol.

[0103] In one possible implementation, the CPU is further configured to send indication information to the dedicated security chip, the indication information indicating the first detection result.

[0104] In one possible implementation, the dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

[0105] Ninthly, a chip is provided for performing the methods of the third aspect or any possible implementation thereof, as detailed in the above description, which will not be repeated here.

[0106] In a tenth aspect, a chip is provided for performing the methods in the fourth aspect or any possible implementation thereof, as detailed in the above description, which will not be repeated here.

[0107] Eleventhly, a CPU is provided for executing the methods in the fifth aspect or any possible implementation of the fifth aspect, as detailed in the above description, which will not be repeated here.

[0108] In the twelfth aspect, a CPU is provided for executing the methods in the sixth aspect or any possible implementation thereof, as detailed in the above description, which will not be repeated here.

[0109] In a thirteenth aspect, a protective device is provided, which includes the chip described in the ninth aspect, the CPU described in the eleventh aspect, and at least one network interface.

[0110] In a fourteenth aspect, a protective device is provided, comprising the chip described in the tenth aspect, the CPU described in the twelfth aspect, and at least one network interface.

[0111] In a fifteenth aspect, a protection system is provided, comprising the chip described in the ninth aspect, the CPU described in the eleventh aspect, and at least one network interface. Optionally, at least two of the chip, CPU, and at least one network interface in the protection system provided in the fifteenth aspect are distributed across different physical computers.

[0112] In a sixteenth aspect, a protection system is provided, comprising the chip described in the tenth aspect, the CPU described in the twelfth aspect, and at least one network interface. Optionally, at least two of the chip, CPU, and at least one network interface in the protection system provided in the sixteenth aspect are distributed on different physical computers.

[0113] In a seventeenth aspect, a computer program product is provided, the computer program product comprising one or more computer program instructions, which, when loaded and run by a dedicated security chip, cause the dedicated security chip to perform the method of the third aspect or any possible implementation thereof.

[0114] In an eighteenth aspect, a computer program product is provided, the computer program product comprising one or more computer program instructions, which, when loaded and run by a dedicated security chip, cause the dedicated security chip to perform the method in the fourth aspect or any possible implementation thereof.

[0115] In a nineteenth aspect, a computer program product is provided, the computer program product comprising one or more computer program instructions, which, when loaded and executed by a CPU, cause the CPU to perform the method of the fifth aspect or any possible implementation thereof.

[0116] In a twentieth aspect, a computer program product is provided, the computer program product comprising one or more computer program instructions, which, when loaded and executed by a CPU, cause the CPU to perform the method of the sixth aspect or any possible implementation thereof.

[0117] In a twentieth aspect, a computer-readable storage medium is provided, the storage medium storing at least one instruction that, when executed on a dedicated security chip, causes the dedicated security chip to perform the method of the third aspect or any possible implementation thereof.

[0118] In a twenty-second aspect, a computer-readable storage medium is provided, which stores at least one instruction that, when executed on a dedicated security chip, causes the dedicated security chip to perform the method of the fourth aspect or any possible implementation thereof.

[0119] In a twentieth aspect, a computer-readable storage medium is provided, which stores at least one instruction that, when executed on a CPU, causes the CPU to perform the method described in the fifth aspect or any possible implementation thereof.

[0120] In a twentieth aspect, a computer-readable storage medium is provided, which stores at least one instruction that, when executed on a CPU, causes the CPU to perform the method described in the sixth aspect or any possible implementation thereof. Attached Figure Description

[0121] Figure 1 is a schematic diagram of how the protection device processes and forwards traffic;

[0122] Figure 2 is another schematic diagram of the protection equipment processing and forwarding traffic;

[0123] Figure 3 is a schematic diagram of an application scenario provided by an embodiment of this application;

[0124] Figure 4 is a structural schematic diagram of a protective device provided in an embodiment of this application;

[0125] Figure 5 is a flowchart of a traffic processing method provided in an embodiment of this application;

[0126] Figure 6 is a flowchart of a traffic processing method provided in an embodiment of this application;

[0127] Figure 7 is a schematic diagram of the traffic processing and forwarding path provided in an embodiment of this application;

[0128] Figure 8 is a flowchart of a traffic processing method provided in an embodiment of this application;

[0129] Figure 9 is a flowchart of a traffic processing method provided in an embodiment of this application;

[0130] Figure 10 is a flowchart of a traffic processing method provided in an embodiment of this application;

[0131] Figure 11 is a flowchart of a traffic processing method provided in an embodiment of this application;

[0132] Figure 12 is a flowchart of a traffic processing method provided in an embodiment of this application;

[0133] Figure 13 is a flowchart of a traffic processing method provided in an embodiment of this application. Detailed Implementation

[0134] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the figures.

[0135] Distributed Denial of Service (DDoS) attacks refer to attacks where attackers control a large number of botnet hosts to send a large number of data packets or requests to the target, exhausting the target's resources (such as CPU, memory, and bandwidth), preventing the target from processing legitimate requests or services. DDoS attacks include application layer attacks and network layer attacks. Network layer attacks mainly consist of two parts: (1) attackers consume the target's resources by forging IP addresses or sending a large number of Internet Control Message Protocol (ICMP) packets; (2) attackers send a large number of fake requests, preventing the target from processing legitimate requests. Common network layer attacks include ICMP flood attacks, Address Resolution Protocol (ARP) flood attacks, IP fragmentation attacks, Synchronize (SYN) flood attacks, Acknowledgement (ACK) flood attacks, and User Datagram Protocol (UDP) flood attacks. Application layer attacks refer to attacks where attackers send a large number of fake requests, preventing the target from processing legitimate requests. Common application-layer attacks include Domain Name System (DNS) flood attacks, Hypertext Transfer Protocol (HTTP) flood attacks, and Challenge Collapsar (CC) attacks.

[0136] DDoS protection equipment (hereinafter referred to as protection equipment) is used to defend against DDoS attacks. Protection equipment deploys a dedicated security chip and a CPU. The dedicated security chip is mainly used to defend against network layer attacks, while the CPU is mainly used to defend against application layer attacks. Figure 1 shows a schematic diagram of the protection equipment processing and forwarding traffic. Referring to Figure 1, the security chip blocks network layer attack traffic at the dedicated security chip, while sending application layer attack traffic and service traffic (also known as normal traffic) to the CPU. The CPU processes this traffic and finally forwards the service traffic. Figure 2 shows another schematic diagram of the protection equipment processing and forwarding traffic. Referring to Figure 2, if the dedicated security chip is improperly configured or has limited capabilities, network layer attack traffic will be sent to the CPU by the dedicated security chip. Because it needs to process both network layer attack traffic and application layer attack traffic simultaneously, the CPU will face the risk of performance degradation or even paralysis, affecting service traffic transmission.

[0137] As an alternative approach to handling and forwarding traffic, once a session is established on the CPU, the CPU synchronizes the session information to a dedicated hardware chip. Subsequent traffic is then forwarded directly from the dedicated hardware chip, bypassing the CPU and reducing its load. However, attack traffic still requires processing by a dedicated security chip and the CPU. If the dedicated security chip is improperly configured or has limited capabilities, the CPU also faces the risk of performance degradation or even failure, impacting traffic transmission.

[0138] In view of this, embodiments of this application provide an improved hardware offloading scheme for protection devices. The basic design idea is to reduce the CPU load, or control the CPU load within an acceptable range, so as to avoid the performance degradation of protection devices and the impact on business traffic transmission caused by CPU overload paralysis.

[0139] Specifically, embodiments of this application provide two traffic processing methods that can reduce CPU load, or control CPU load within an acceptable range.

[0140] In the first traffic processing method, the protection device flexibly adjusts the transmission path (also known as the forwarding path) of the traffic output by the dedicated security chip based on the CPU resource usage. Based on this mechanism, when CPU resources are insufficient, the traffic output by the dedicated security chip can be directly forwarded without passing through the CPU, thus avoiding the risk of performance degradation or even shutdown caused by the CPU still needing to process traffic despite insufficient resources. This mechanism can be understood as an escape mechanism, which helps ensure the normal operation of the CPU, and consequently, the normal transmission of business traffic.

[0141] In the second traffic processing method, the dedicated security chip selects the transmission path for the traffic output by the dedicated security chip (e.g., the second traffic) based on the detection result obtained by the CPU from detecting the sampled traffic. If the CPU's detection result for the sampled traffic is the second detection result, the dedicated security chip directly sends the traffic to the outgoing interface without going through the CPU, which helps ensure normal traffic transmission. If the CPU's detection result for the sampled traffic is the first detection result, the dedicated security chip directly sends application layer traffic that meets the first preset condition to the CPU, and the CPU performs defense processing on the application layer traffic that meets the first preset condition, improving defense performance. In summary, this method can reduce the CPU load, which is beneficial to ensuring the normal operation of the CPU, and thus helps to ensure the normal transmission of business traffic.

[0142] The following are examples illustrating the application scenarios of embodiments of this application.

[0143] Figure 3 is a schematic diagram of an application scenario provided by an embodiment of this application. The application scenario shown in Figure 3 is a typical DDoS protection scenario. As shown in Figure 3, the network deployment of this protection scenario mainly involves four components: normal client, attacker, protection device, and server.

[0144] Examples of each of the four components are given below.

[0145] (1) Normal client

[0146] A normal client initiates business traffic. Normal clients generate and send business traffic to the server to access the services provided on the server. Examples of normal clients include browser software or business client software.

[0147] As shown in Figure 3, the deployment locations of normal clients in the network include, but are not limited to, the following two situations.

[0148] In one possible scenario, the legitimate client is located on the internet. For example, in the scenario shown in Figure 3, after a legitimate client on the internet initiates business traffic, the protection device intercepts the business traffic and performs security checks on it. If no threat is detected in the business traffic, the protection device forwards the business traffic to a protected server on the local area network.

[0149] In another possible scenario, the normal client is located on a local area network (LAN). For example, in the scenario shown in Figure 3, after a normal client on the LAN initiates business traffic, the protection device intercepts the business traffic and performs security checks on it. If the business traffic is deemed harmless, the protection device forwards it to an external server on the Internet.

[0150] (2) Attacker

[0151] Attackers generate and send attack traffic to the protected server using tools, botnets, or proxies. Optionally, the attacker is located on the internet, meaning they launch the attack from the internet to a protected server or a legitimate client on a local area network (LAN). Alternatively, the attacker is located on a LAN, meaning they launch the attack from the LAN to a server on the internet.

[0152] (3) Protective equipment

[0153] Security devices are used to protect local area networks (LANs), such as protecting protected servers and legitimate clients within the LAN from attacks, or preventing hosts within the LAN from being used by attackers to spread threats. Security devices are deployed between the LAN and the internet; in other words, they are deployed at the LAN's boundary. These devices perform security checks on traffic entering and leaving the LAN to determine whether the traffic is business traffic or attack traffic. Furthermore, they block attack traffic to ensure the security of protected servers, while forwarding business traffic to ensure that protected servers can provide services. Protective devices can be hardware-based, such as integrating any or some or all of the following: firewalls, security gateways (e.g., routers or switches), intrusion detection systems (IDS), intrusion prevention systems (IPS), unified threat management (UTM), antivirus (AV), anti-distributed denial-of-service (DDoS) devices, or next-generation firewalls (NGFW). Protective devices can also be software-based, such as virtual machines or host software functionalities.

[0154] (4) Server

[0155] As shown in Figure 3, the deployment locations of servers in the network include, but are not limited to, the following two situations.

[0156] In one possible scenario, the server is deployed on a local area network (LAN). The server located on the LAN is the protected server that the security equipment aims to protect.

[0157] In another possible scenario, the server is located on the internet. From the perspective of a normal client on the local area network, a server located on the internet is an external network server.

[0158] In a local area network (LAN) or the internet, a server responds to business traffic from legitimate clients, thereby providing services to those clients. Servers include, but are not limited to, application servers or web servers. Application servers include, but are not limited to, game servers, video application servers, file servers, search engine servers, instant messaging servers, etc. Web servers are also called World Wide Web (WWW) servers or website servers.

[0159] The following example illustrates the basic hardware structure of protective equipment.

[0160] Figure 4 is a schematic diagram of a protective device 400 provided in an embodiment of this application. The protective device 400 includes a CPU 401, a dedicated security chip 402, and at least one network interface 403.

[0161] Optionally, the protective device 400 in Figure 4 is the protective device shown in Figure 3.

[0162] Optionally, CPU 401 in Figure 4 is the CPU shown in Figures 5 through 13 below.

[0163] Optionally, the dedicated security chip 402 in Figure 4 is the dedicated security chip shown in Figures 5 to 13 below.

[0164] Optionally, network interface 403 in Figure 4 is the network interface (such as an ingress or egress interface) shown in Figures 5 to 13 below.

[0165] CPU 401 refers to a general-purpose central processing unit with high scalability and flexibility. A CPU 401 can be a single-core processor or a multi-core processor.

[0166] The dedicated security chip 402 is a high-performance processing hardware module. For example, the dedicated security chip 402 includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

[0167] At least one network interface 403 includes, for example, network interface 1, network interface 2, network interface 3... network interface n in FIG. 4. Network interface 403 is implemented using any transceiver-like device for communicating with other devices or communication networks. For example, network interface 1 in FIG. 4 communicates with a first network device, and network interface 2 in FIG. 4 communicates with a second network device. Network interface 403 may optionally include at least one of a wired network interface or a wireless network interface. The wired network interface is, for example, an Ethernet interface. An Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. A wireless network interface is, for example, a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

[0168] At least one network interface 403 is connected to a dedicated security chip 402, and the dedicated security chip 402 is connected to a CPU 401 via an internal connection 404. The internal connection 404 includes a pathway for data transmission between the network interface 403, the dedicated security chip 402, and the CPU 401. Optionally, the internal connection 404 is a single board or a bus. For example, the internal connection 404 may be Ethernet, Fibre Channel, PCI-E (Peripheral Component Interconnect Express, PCI Express, a high-speed serial computer bus), RapidIO (a high-performance, low-pin-count, packet-switched interconnect architecture), InfiniBand, or an XAUI bus (an interface extender that connects the Ethernet media access control (MAC) layer to the physical layer).

[0169] Optionally, the protection device also includes a content addressable memory (CAM) 405. CAM 405 may be, for example, a ternary content addressable memory (TCAM). CAM 405 stores an IP address table. This IP address table can be accessed by the dedicated security chip 402. CAM 405 stores a mapping between network interfaces, indicating the egress interface corresponding to the ingress interface of traffic. In some embodiments, the dedicated security chip 402 uses the mapping between network interfaces stored in CAM 405. Optionally, CAM 405 exists independently and is connected to the dedicated security chip 402 via the aforementioned internal connection 404. Alternatively, CAM 405 and the dedicated security chip 402 may be integrated, i.e., CAM 405 serves as the internal memory of the dedicated security chip 402.

[0170] Optionally, the protective device also includes memory 406. Memory 406 may be, for example, read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; electrically erasable programmable read-only memory (EEPROM); compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.); magnetic disk storage media or other magnetic storage devices; or any other medium capable of carrying or storing desired program code 408 in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 406 may exist independently and be connected to CPU 401 via internal connection 404. Alternatively, memory 406 and CPU 401 may be integrated together.

[0171] The memory 406 stores an operating system 407 and program code 408. Optionally, the at least one processor reads the operating system 407 from the memory 406 and runs the operating system 407, while the dedicated security chip 402 reads the program code 408 from the memory 406 and implements the method provided in this application embodiment by running the program code 408 on the operating system 407. For example, during the execution of the program code 408, the dedicated security chip 402 performs the operations performed by the dedicated security chip in the method provided in this application embodiment. For example, during the execution of the program code 408, the CPU 401 performs the operations performed by the CPU in the method provided in this application embodiment.

[0172] The methods of the embodiments of this application are illustrated below.

[0173] Optionally, the network deployment scenario on which any method provided in the embodiments of this application (such as method 500, method 600, method 800, method 1100, or method 1200, etc.) is based is shown in Figure 3. For example, referring to Figure 3, the protection device in the method provided in the embodiments of this application is the protection device in Figure 3. The traffic received by the protection device comes from normal clients and / or attackers in Figure 3, and the destination of the traffic is the protected server in Figure 3.

[0174] The protection devices applicable to the methods provided in this application include, but are not limited to, a single physical device or a distributed system (sometimes also referred to as a protection system) containing multiple physical devices. When the protection device in the methods provided in this application is implemented through a single physical device, the interaction between the dedicated security chip and the CPU involved in the steps of the method is the interaction between the dedicated security chip and the CPU within the same physical device. When the protection device in the methods provided in this application is implemented through multiple physical devices (e.g., a cluster of computers), the interaction between the dedicated security chip and the CPU involved in the steps of the method is the interaction between the dedicated security chip in one physical device and the CPU in another physical device.

[0175] Optionally, the protection device in the method provided in this application embodiment has the hardware structure shown in FIG4. For example, the CPU in the method provided in this application embodiment is CPU 401 in FIG4, the dedicated security chip is dedicated security chip 402 in FIG4, the input interface is used to receive traffic input to the protection device, and the output interface is used to output traffic from the protection device. The input interface is at least one network interface 403 in FIG4, and the output interface is at least one network interface 403 in FIG4, and the output interface and the output interface are different network interfaces.

[0176] In this application embodiment, the term "traffic" is also referred to as network traffic or data traffic. Traffic refers to data transmitted through a network at a given point in time or within a given period of time. For example, the traffic received by a device at time T refers to all packets received by the device at time T. Similarly, the traffic received within a period of time refers to all packets received by the device within that period. Optionally, the duration of this period is related to the device's buffering capacity. Alternatively, the duration of this period can be set as needed, for example, it could be 1 second, 5 seconds, or 1 minute.

[0177] Figure 5 is a flowchart of a traffic processing method 500 provided in an embodiment of this application. Method 500 includes one or more of the following steps S501 to S505.

[0178] S501, the ingress interface sends the first traffic to the dedicated security chip. Correspondingly, the dedicated security chip receives the first traffic from the ingress interface.

[0179] The first traffic could be normal traffic generated by a normal client, or it could be attack traffic generated by an attacker. It could also include both normal traffic generated by a normal client and attack traffic generated by an attacker.

[0180] The S502, a dedicated security chip, performs first-level defense processing on the first traffic to obtain the second traffic.

[0181] Specifically, after receiving the first traffic, the dedicated security chip performs a first defense process on the first traffic, and the traffic after the first defense process becomes the second traffic.

[0182] The first defense process specifically refers to one or more defense strategies. In one possible implementation, a dedicated security chip is pre-configured with one or more defense strategies.

[0183] The embodiments of this application do not limit the specific defense strategy of the first defense process. Optionally, the first defense process includes defense processing against network layer attack traffic.

[0184] For example, the initial traffic includes SYN packet traffic. In the event of a flood attack targeting SYN packet traffic, protection devices perform initial packet loss and use source detection technology to clean up network layer attack traffic included in the initial traffic. Flood attacks are a type of DDoS attack.

[0185] In response to the CPU resource usage meeting the second condition, the dedicated security chip (S503) sends the second traffic to the outgoing interface. Correspondingly, the outgoing interface receives the second traffic.

[0186] In response to the CPU resource usage meeting the first condition, the dedicated security chip sends a second data packet to the CPU. The CPU then receives the second data packet.

[0187] Steps S503 and S504 are then executed. Furthermore, if S504 is executed, then steps S505 through S506 are executed.

[0188] Specifically, the dedicated security chip determines the forwarding path of the second traffic based on the CPU's resource usage. If the CPU's resource usage meets the first condition, the dedicated security chip sends the second traffic to the CPU. If the CPU's resource usage meets the second condition, the dedicated security chip sends the second traffic to the outgoing interface.

[0189] The parameter ranges described by the first and second conditions do not overlap. That is, if the CPU resource usage meets the first condition, then the CPU resource usage definitely does not meet the second condition. Conversely, if the CPU resource usage meets the second condition, then the CPU resource usage definitely does not meet the first condition.

[0190] In one implementation, the first and second conditions are mutually exclusive but not contradictory. That is, the CPU resource usage may satisfy the first condition, the second condition, or neither. For the case where the CPU resource usage does not satisfy either the first or the second condition, this application embodiment does not limit the forwarding path of the second traffic. For example, the second traffic may be sent from a dedicated security chip to the CPU, or from a dedicated security chip to the outgoing interface.

[0191] In another implementation, the first and second conditions are contradictory. That is, the CPU resource usage either satisfies the first condition or the second condition; there are no other possibilities.

[0192] Optionally, the first condition includes one or more of the following: CPU utilization is less than or equal to a first threshold, CPU utilization is less than or equal to the first threshold for a duration greater than a first duration, CPU memory usage is less than or equal to a second threshold, CPU memory usage is less than or equal to the second threshold for a duration greater than a second duration, the percentage of CPU memory usage is less than or equal to a third threshold, or the percentage of CPU memory usage is less than or equal to the third threshold for a duration greater than a third duration.

[0193] For example, the first condition is that the CPU utilization is less than or equal to a first threshold. Or, the first condition is that the amount of memory used by the CPU is less than or equal to a second threshold. Or, the first condition is that the percentage of memory used by the CPU is less than or equal to a third threshold.

[0194] For example, the first condition is that the CPU utilization is less than or equal to a first threshold and the amount of memory used by the CPU is less than or equal to a second threshold. Alternatively, the first condition is that the CPU utilization is less than or equal to a first threshold and the percentage of memory used by the CPU is less than or equal to a third threshold.

[0195] CPU utilization, also known as CPU usage, refers to the percentage of time the CPU is processing tasks. CPU utilization reflects the CPU's workload; higher utilization indicates a busier CPU, while lower utilization indicates a less busy CPU. For example, a CPU utilization of 90% means that the CPU is working for an average of 0.9 seconds within one second. Similarly, a CPU utilization of 100% means that the CPU is working for the entire second.

[0196] The amount of memory used by the CPU refers to the amount of memory used by tasks associated with the CPU. For example, the CPU may use 32GB of memory. The more memory the CPU uses, the more tasks it is handling, and the higher its workload.

[0197] The percentage of memory used by the CPU refers to the ratio of the amount of memory used by tasks associated with the CPU to the total amount of memory. For example, if the CPU uses 20GB of memory and the total memory is 32GB, then the percentage of memory used by the CPU is 62.5%.

[0198] Optionally, the second condition includes one or more of the following: CPU utilization is greater than the fourth threshold, the duration of CPU utilization being greater than the fourth threshold is greater than the fourth duration, the amount of memory occupied by the CPU is greater than the fifth threshold, the duration of CPU memory occupation being greater than the fifth threshold is greater than the fifth duration, the percentage of memory occupied by the CPU is less than or equal to the sixth threshold, or the duration of CPU memory occupation being less than or equal to the sixth threshold is greater than the sixth duration.

[0199] For example, the second condition is that CPU utilization is greater than the fourth threshold. Or, the second condition is that the amount of memory used by the CPU is greater than the fifth threshold. Or, the second condition is that the percentage of memory used by the CPU is greater than the sixth threshold.

[0200] For example, the second condition is that CPU utilization is greater than the fourth threshold and the amount of memory used by the CPU is greater than the fifth threshold. Or, the second condition is that CPU utilization is greater than the fourth threshold and the percentage of memory used by the CPU is greater than the sixth threshold.

[0201] For example, the first threshold and the fourth threshold can be the same, such as both being 80%. The first threshold and the third threshold can also be different, such as the first threshold being 80% and the fourth threshold being 85%.

[0202] Similarly, the second and fifth thresholds can be the same or different. The third and sixth thresholds can be the same or different. The first and fourth durations can be the same or different. The second and fifth durations can be the same or different. The third and sixth durations can be the same or different.

[0203] In some embodiments, only the first condition or only the second condition may be set.

[0204] If only the first condition is set, then it is only necessary to determine whether the CPU resource usage meets the first condition. If the CPU resource usage meets the first condition, the dedicated security chip sends the second traffic to the CPU. If the CPU resource usage does not meet the first condition, the dedicated security chip sends the second traffic to the outgoing interface.

[0205] In this scheme, S503 is replaced by: in response to the CPU resource usage not meeting the first condition, the dedicated security chip sends a second flow to the outgoing interface.

[0206] If only the second condition is set, then it is only necessary to determine whether the CPU resource usage meets the second condition. If the CPU resource usage meets the second condition, the dedicated security chip sends the second traffic to the outgoing interface. If the CPU resource usage does not meet the second condition, the dedicated security chip sends the second traffic to the CPU.

[0207] In this scheme, S504 is replaced by: in response to the CPU's resource usage not meeting the second condition, the dedicated security chip sends a second traffic to the CPU.

[0208] In other embodiments, both a first condition and a second condition are set simultaneously.

[0209] In this example, it's necessary to determine whether the CPU resource usage meets both the first and second conditions. These checks can be performed simultaneously, or one can be executed first. For instance, first check if the CPU resource usage meets the first condition. If it does, the dedicated security chip sends the second traffic to the CPU. If it doesn't, then check if the second condition is met. If the second condition is met, the dedicated security chip sends the second traffic to the outgoing interface. If the second condition is not met, the second traffic is sent to the CPU or the outgoing interface based on other rules or randomly. Alternatively, the process could be repeated: first check if the CPU resource usage meets the second condition. If it does, the dedicated security chip sends the second traffic to the outgoing interface. If it doesn't, then check if the first condition is met. If the first condition is met, the dedicated security chip sends the second traffic to the CPU. If the CPU resource usage does not meet the first condition, a second flow is sent to the CPU or the outgoing interface according to other rules or randomly.

[0210] In one implementation, a dedicated security chip determines whether the CPU's resource usage meets the first condition and / or the second condition.

[0211] For example, the CPU periodically sends its resource usage information (e.g., CPU utilization) to the dedicated security chip, or the CPU sends its resource usage information to the dedicated security chip based on a request from the dedicated security chip. The dedicated security chip then determines whether the CPU's resource usage meets the first and / or second conditions based on the information sent by the CPU.

[0212] In another implementation, the CPU indicates to a dedicated security chip whether its resource usage meets the first and / or second conditions. The dedicated security chip then sends traffic (e.g., the second traffic) to the CPU or to the output interface based on the CPU's instructions.

[0213] For example, when the CPU's resource usage meets the second condition, it sends an indication to the dedicated security chip, indicating that the CPU's resource usage meets the second condition. If the CPU's resource usage does not meet the second condition, it does not send an indication to the dedicated security chip. Before receiving the indication that the CPU's resource usage meets the second condition, the dedicated security chip assumes that the CPU's resource usage either does not meet the second condition or meets the first condition.

[0214] In the S505, the CPU performs a second defense process on the second traffic to obtain the third traffic.

[0215] Specifically, after the CPU receives the second traffic, it performs a second defense process on the second traffic to obtain the traffic after the second defense process, which is the third traffic.

[0216] The second defense process specifically refers to one or more defense strategies. In one possible implementation, the CPU pre-configures one or more defense strategies.

[0217] This application does not limit the specific defense strategy of the second defense process. Optionally, the second defense process includes defense processing against application layer attack traffic.

[0218] For example, the second type of traffic includes HTTP message traffic. In the event of a flooding attack targeting HTTP message traffic, protection devices use CAPTCHA technology to clean up the attack traffic. For example, the second type of defense includes defending against encrypted traffic attacks and slow-moving attacks.

[0219] In the S506, the CPU sends third traffic to the output interface. Correspondingly, the output interface receives the third traffic.

[0220] After receiving traffic, the outgoing interface outputs the traffic from the protection device to forward the traffic to its destination.

[0221] It is understandable that if S504 is executed, the outgoing interface will receive a third type of traffic. If S503 is executed, the outgoing interface will receive a second type of traffic.

[0222] Optionally, the dedicated security chip itself can store the mapping between destination IP addresses and outgoing interfaces. Based on the mapping between destination IP addresses and outgoing interfaces, the dedicated security chip can determine the corresponding outgoing interface for each packet in the second or third traffic flow.

[0223] For example, if the mapping between destination IP address and outgoing interface indicates that the outgoing interface of a packet with destination IP address 128.1.1.2 is network interface 3 of the protection device, then the packet with destination IP address 128.1.1.2 in the second or third traffic will be sent to network interface 3 of the protection device by the dedicated security chip.

[0224] For example, the above correspondence between destination IP address and outgoing interface can be replaced with the correspondence between source IP address / incoming interface and outgoing interface.

[0225] For example, the correspondence between inbound and outbound interfaces indicates that interface A1 corresponds to interface A4. Therefore, any traffic entering through interface A1 will exit through interface A4.

[0226] By specifying the mapping between inbound and outbound interfaces, traffic can be forwarded without looking up the routing table, resulting in higher processing performance.

[0227] The method described in this embodiment allows the protection device to flexibly adjust the transmission path of the traffic (e.g., the second traffic) output by the dedicated security chip based on the CPU's resource usage. Based on this mechanism, when CPU resources are sufficient, the CPU can perform traffic defense processing and forwarding, improving defense capabilities while ensuring the transmission of service traffic. When CPU resources are insufficient, the traffic output by the dedicated security chip can be directly forwarded to the outgoing interface without passing through the CPU, thus avoiding the risk of performance degradation or even shutdown caused by the CPU still needing to process traffic when resources are insufficient. This mechanism can be understood as an escape mechanism, which helps ensure the normal operation of the CPU, thereby ensuring the normal transmission of service traffic.

[0228] Figure 5 illustrates the flow of traffic processing by setting both a first condition and a second condition. As mentioned earlier, only the first condition or only the second condition can be set. The following, with reference to Figure 6, describes a specific example of traffic processing by setting only the second condition, as provided in this application embodiment.

[0229] Figure 6 is a flow diagram of a flow processing method 600 provided in an embodiment of this application. Method 600 includes one or more steps from S601 to S607. Method 600 is an equivalent variation of method 500.

[0230] S601, the ingress interface sends the first traffic to the dedicated security chip. Correspondingly, the dedicated security chip receives the first traffic from the ingress interface.

[0231] Step S601 is the same as S501, and you can refer to S501.

[0232] The S602, a dedicated security chip, performs a first defense process on the first traffic flow to obtain the second traffic flow.

[0233] Step S602 is the same as S502, and you can refer to S502.

[0234] The S603 is a dedicated security chip that determines whether the CPU's resource usage meets the second condition.

[0235] If the CPU resource usage does not meet the second condition, then execute steps S604 to S606. If the CPU resource usage meets the second condition, then execute step S607.

[0236] S604, a dedicated security chip, sends a second flow of data to the CPU.

[0237] Accordingly, the CPU receives the second data stream. After receiving the second data stream, the CPU executes S605.

[0238] In S605, the CPU performs a second defense process on the second traffic to obtain the third traffic.

[0239] Step S605 is the same as S505, so you can refer to S505. After the CPU receives the third flow, it executes S606.

[0240] S606, the CPU sends third traffic to the output interface.

[0241] Accordingly, the outgoing interface receives the third traffic. After receiving the third traffic, the outgoing interface outputs the third traffic from the protection device to forward the traffic to its destination.

[0242] S607, a dedicated security chip, sends a second flow to the outgoing interface.

[0243] Accordingly, the outgoing interface receives the second traffic. After receiving the second traffic, the outgoing interface outputs the second traffic from the protection device to forward the traffic to its destination.

[0244] The method provided in this embodiment selects the transmission path of the traffic output by the dedicated security chip based on whether the CPU resource usage meets the second condition. On the one hand, when the CPU resources are sufficient, it can improve the defense capability while ensuring the transmission of business traffic. On the other hand, when the CPU resources are insufficient, it can avoid the risk of performance degradation or even paralysis caused by the CPU processing traffic.

[0245] For example, Figure 7 shows a schematic diagram of traffic processing via method 500 or method 600.

[0246] Referring to Figure 7, the protection device includes two traffic processing paths: the first path is A1→A2→B1→B2→C1→C2→A3→A4, which can be called the CPU forwarding path; the second path is A1→A2→B1→B2→A3→A4, which can be called the dedicated security chip direct forwarding path. Here, A1 is the ingress interface described above, A4 is the egress interface described above, and A2, B1, B2, C1, C2, and A3 represent the data transmission or communication interfaces between the various chips.

[0247] In this embodiment, if the CPU resource usage meets the first condition or does not meet the second condition, traffic is processed and forwarded through the CPU forwarding path. If the CPU resource usage meets the second condition or does not meet the first condition, traffic is processed and forwarded through the dedicated security chip direct forwarding path.

[0248] For example, assuming that at time t1, the CPU resource utilization meets the second condition, then traffic received by the protection device before time t1 is processed and forwarded through the CPU forwarding path, while traffic received by the protection device after time t1 is processed and forwarded through the dedicated security chip direct forwarding path. Furthermore, if at time t2, which is after time t1, the CPU resource utilization does not meet the second condition, then traffic received by the protection device after time t2 is processed and forwarded through the CPU forwarding path.

[0249] In some embodiments, the first traffic is or includes traffic that does not meet the preset conditions, or the second traffic is or includes traffic that does not meet the preset conditions.

[0250] It should be understood that if the first flow is or includes flow that does not meet the preset conditions, the second flow is also or also includes flow that does not meet the preset conditions.

[0251] Traffic that meets the preset conditions is the traffic that needs to be directly forwarded by the protected device. For traffic that does not meet the preset conditions, a forwarding path is selected based on CPU resource usage. If CPU resource usage meets the first condition but not the second condition, the dedicated security chip sends the traffic that does not meet the preset conditions to the CPU. If CPU resource usage meets the second condition but not the first condition, the dedicated security chip sends the traffic that does not meet the preset conditions to the outgoing interface.

[0252] By employing the above method, when the CPU resource usage meets the first condition or does not meet the second condition, the CPU only needs to process traffic that does not meet the preset conditions, thus reducing the processing burden. When the CPU resource usage meets the second condition or does not meet the first condition, normal traffic transmission can be guaranteed.

[0253] In some embodiments, a dedicated security chip sends traffic that meets preset conditions to the output interface.

[0254] For example, a dedicated security chip receives a fourth traffic flow that meets preset conditions from the ingress interface, performs a first defense process on the fourth traffic flow to obtain a fifth traffic flow. Then, the dedicated security chip sends the fifth traffic flow to the egress interface.

[0255] In the above method, regardless of whether the CPU resource usage meets the first condition or the second condition, the dedicated security chip sends traffic that meets the preset conditions to the outgoing interface. Based on this method, the dedicated security chip sends traffic that meets the preset conditions directly to the outgoing interface without going through the CPU, which on the one hand achieves fast transmission of traffic that meets the preset conditions, and on the other hand reduces the processing burden on the CPU.

[0256] In one possible implementation, the preset conditions include one or more of the following: the destination IP address is the target destination IP address, the source IP address is the target source IP address, the destination port is the target destination port, the source port is the target source port, or the transport protocol is the target transport protocol.

[0257] Taking the preset condition of the destination IP address being the target IP address as an example, and assuming that the destination IP address of a packet received by the dedicated security chip from the ingress interface is not the target IP address, then, if the CPU resource usage meets the first condition or does not meet the second condition, the dedicated security chip sends the packet to the CPU; if the CPU resource usage meets the second condition or does not meet the first condition, the dedicated security chip sends the packet to the egress interface.

[0258] Optionally, the target destination IP address is one or more IP addresses. Similarly, the target source IP address is one or more source IP addresses. The target destination port is one or more destination ports. The target transport protocol is one or more transport protocols.

[0259] For example, the target IP is the target IP corresponding to a specific customer.

[0260] The following examples, in conjunction with Figures 8 and 9, illustrate the overall processing flow for traffic that meets and does not meet the preset conditions.

[0261] Please refer to Figures 8 and 9. The specific interaction process between the input interface, output interface, dedicated security chip and CPU shown in Figures 8 and 9 includes, for example, one or more steps in S801 to S808 of method 800.

[0262] S801: The first flow of traffic enters the dedicated security chip through the inlet interface.

[0263] The S802, a dedicated security chip, performs a first defense process on the first traffic flow to obtain the second traffic flow.

[0264] Steps S801 to S802 are the same as steps S601 to S602, and can be referred to steps S601 to S602.

[0265] The S803 is a dedicated security chip that determines whether the CPU's resource usage meets the second condition (or whether it meets the first condition).

[0266] If the CPU resource usage does not meet the second condition or meets the first condition, then execute S804 and S805; if the CPU resource usage meets the second condition or does not meet the first condition, then execute S808.

[0267] In one implementation, if the dedicated security chip does not receive any indication from the CPU that the CPU's resource usage meets the second condition before receiving the first traffic, it assumes that the CPU's resource usage does not meet the second condition or meets the first condition.

[0268] S804, a dedicated security chip, sends traffic that meets preset conditions from the second traffic stream to the outgoing interface.

[0269] The S805, a dedicated security chip, sends traffic from the second traffic stream that does not meet preset conditions to the CPU.

[0270] It should be noted that if the second flow does not include flow that meets the preset conditions, then S804 is executed, but S805 is not. If the second flow consists entirely of flow that meets the preset conditions, then only S805 is executed, and S804 is not. Furthermore, if S804 is executed, then S806 is executed.

[0271] Furthermore, the execution order between S804 and S805 is not limited in the embodiments of this application.

[0272] S806, the CPU performs a second defense process on traffic in the second traffic that does not meet the preset conditions, so as to obtain traffic after the second defense process.

[0273] Regarding the second defense measures, please refer to the description above, and we will not repeat them here.

[0274] S807, the CPU sends traffic to the outgoing interface after it has been processed by the second defense.

[0275] S808, a dedicated security chip, sends a second stream to the output interface.

[0276] After receiving the traffic involved in S807 or S808, the outgoing interface outputs the traffic from the protection device to forward the traffic to the destination.

[0277] In the examples shown in Figures 8 and 9, the dedicated security chip performs traffic distribution control based on whether the CPU resource utilization meets a first condition or a second condition. If the CPU resource utilization meets the first condition but not the second condition, the dedicated security chip further performs traffic distribution control based on whether the traffic meets preset conditions. Specifically, after receiving traffic from the ingress interface, the dedicated security chip first performs a first defense process on the received traffic, such as network layer defense processing, to obtain traffic that has undergone the first defense process. The dedicated security chip determines whether the CPU resource utilization meets the first or second condition. If the CPU resource utilization meets the first condition but not the second condition, the dedicated security chip sends the traffic that meets the preset conditions from the traffic that has undergone the first defense process to the egress interface, and sends the traffic that does not meet the preset conditions from the traffic that has undergone the first defense process to the CPU. If the CPU resource utilization does not meet the first condition or meets the second condition, the dedicated security chip sends the traffic that has undergone the first defense process to the egress interface.

[0278] Figure 10 illustrates another flow for the overall processing of traffic that meets and does not meet preset conditions. The flow shown in Figure 10 is an equivalent variation of the flows shown in Figures 8 and 9. Unlike the flows shown in Figures 8 and 9, the flow shown in Figure 10 first determines whether there is traffic in the first flow that meets the preset conditions. If there is no traffic in the first flow that meets the preset conditions, then it determines whether the CPU resource usage meets the second condition.

[0279] In the process shown in Figure 10, after the dedicated security chip receives traffic from the ingress interface, it first performs a first defense process on the received traffic, such as network layer defense processing, to obtain traffic that has undergone the first defense process. The dedicated security chip determines whether there is traffic in the first traffic that meets preset conditions. If there is traffic in the first traffic that meets the preset conditions, the dedicated security chip sends the traffic that does not meet the preset conditions from the traffic that has undergone the first defense process to the CPU, and sends the traffic that meets the preset conditions from the traffic that has undergone the first defense process to the egress interface. If there is no traffic that meets the preset conditions in the first traffic, the dedicated security chip determines whether the CPU's resource usage meets a second condition or a first condition. If the CPU's resource usage does not meet the first condition or meets the second condition, the dedicated security chip sends the traffic that has undergone the first defense process to the egress interface. If the CPU's resource usage meets the first condition or does not meet the second condition, the dedicated security chip sends the traffic that has undergone the first defense process to the CPU.

[0280] The above describes a method for load balancing based on CPU resource usage. This application also provides a method that helps ensure the normal operation of protection equipment, which will be explained below with reference to Figure 11.

[0281] Figure 11 is a flowchart of a traffic processing method 1100 provided in an embodiment of this application. Method 1100 includes one or more of the following steps S1101 to S1106.

[0282] S1101, the ingress interface of the protection device sends the first traffic to the dedicated security chip. Correspondingly, the dedicated security chip receives the first traffic from the ingress interface.

[0283] The first traffic is the traffic received by the protection device from the first network device via its ingress interface. This first traffic could be normal traffic generated by a legitimate client, or attack traffic generated by an attacker; it could also include both normal traffic generated by a legitimate client and attack traffic generated by an attacker.

[0284] S1102, a dedicated security chip performs first-level defense processing on the first traffic to obtain the second traffic.

[0285] Specifically, after receiving the first traffic, the dedicated security chip performs a first defense process on the first traffic, and the traffic after the first defense process becomes the second traffic.

[0286] The first defense process specifically refers to one or more defense strategies. In one possible implementation, a dedicated security chip is pre-configured with one or more defense strategies.

[0287] The embodiments of this application do not limit the specific defense strategy of the first defense process. Optionally, the first defense process includes defense processing against network layer attack traffic.

[0288] For example, the initial traffic includes SYN packet traffic. In the event of a flood attack targeting SYN packet traffic, protection devices perform initial packet loss and use source detection technology to clean up network layer attack traffic included in the initial traffic. Flood attacks are a type of DDoS attack.

[0289] S1103, in response to the second detection result obtained by the CPU from detecting the sampled traffic, the dedicated security chip sends the second traffic to the output interface.

[0290] Accordingly, the outgoing interface receives the second traffic and outputs the second traffic to the protection device to forward the second traffic to its destination.

[0291] S1104, in response to the first detection result obtained by the CPU from detecting the sampled traffic, the dedicated security chip sends the first target traffic to the CPU.

[0292] Accordingly, the CPU receives the first target traffic and executes S1105.

[0293] The first target traffic is the application layer traffic in the second traffic that meets the first preset condition. The sampled traffic is sent to the CPU by the dedicated security chip. The sampled traffic is obtained by the dedicated security chip sampling historical traffic at a preset sampling rate.

[0294] Specifically, the CPU detects the sampling traffic sent by the dedicated security chip to obtain the detection results.

[0295] In the first possible implementation, after the CPU obtains the detection result, regardless of whether the detection result is the first detection result or the second detection result, the CPU indicates the detection result to the dedicated security chip.

[0296] For example, the CPU sends a second indication message to the dedicated security chip based on a preset period, and the second indication message indicates that the detection result is a second detection result. For instance, the CPU performs statistics on the sampled traffic based on a first preset period to obtain a detection result, and the CPU indicates the detection result to the dedicated security chip based on a second preset period, wherein the second preset period is longer than the first preset period.

[0297] For example, if the detection result is the first detection result, the CPU sends a first indication message to the dedicated security chip in real time, and the first indication message indicates that the detection result is the first detection result.

[0298] In the second possible implementation, the dedicated security chip requests the detection results obtained by the CPU from detecting the sampled traffic. The CPU responds to the dedicated security chip's request by sending either a first indication message or a second indication message to the dedicated security chip.

[0299] Based on either the first or second possible implementation, if the dedicated security chip has received the first indication information before receiving the second traffic, then the dedicated security chip sends the application layer traffic in the second traffic that meets the first preset condition to the CPU. If the dedicated security chip only receives the second indication information (without receiving the first indication information) before receiving the second traffic, then the dedicated security chip sends the second traffic to the outgoing interface.

[0300] In the third possible implementation, if the detection result is the first detection result, the CPU sends the first indication information to the dedicated security chip. If the detection result is the second detection result, the CPU does not indicate the detection result to the dedicated security chip. Correspondingly, if the dedicated security chip does not receive the first indication information, the dedicated security chip considers the detection result obtained by the CPU from detecting the sampled traffic to be the second detection result.

[0301] Based on the third possible implementation, if the dedicated security chip has received the first indication information before receiving the second traffic, then the dedicated security chip sends the application layer traffic in the second traffic that meets the first preset condition to the CPU. If the dedicated security chip has not received the first indication information before receiving the second traffic, then the dedicated security chip sends the second traffic to the outgoing interface.

[0302] S1105, the CPU performs a second defense process on the first target traffic to obtain the third traffic.

[0303] Specifically, after the CPU receives the first target traffic, it performs a second defense process on the first target traffic to obtain the traffic after the second defense process, which is the third traffic.

[0304] The second defense process specifically refers to one or more defense strategies. In one possible implementation, the CPU pre-configures one or more defense strategies.

[0305] This application does not limit the specific defense strategy of the second defense process. Optionally, the second defense process includes defense processing against application layer attack traffic.

[0306] For example, the first target traffic includes HTTP message traffic. In the event of a flooding attack targeting HTTP message traffic, protection devices use CAPTCHA technology to clean up the attack traffic. For example, the second defense measures include defending against encrypted traffic attacks and slow-moving attacks.

[0307] S1106, the CPU sends third traffic to the output interface. Correspondingly, the output interface receives the third traffic.

[0308] After receiving the third traffic, the outgoing interface sends the third traffic to the second network device, which then forwards the third traffic to its destination.

[0309] Optionally, the dedicated security chip itself can store the mapping between destination IP addresses and outgoing interfaces. Based on the mapping between destination IP addresses and outgoing interfaces, the dedicated security chip can determine the corresponding outgoing interface for each packet in the second or third traffic flow.

[0310] For example, if the mapping between destination IP address and outgoing interface indicates that the outgoing interface of a packet with destination IP address 128.1.1.2 is network interface 3 of the protection device, then the packet with destination IP address 128.1.1.2 in the second or third traffic will be sent to network interface 3 of the protection device by the dedicated security chip.

[0311] For example, the above correspondence between destination IP address and outgoing interface can be replaced with the correspondence between source IP address / incoming interface and outgoing interface.

[0312] For example, the correspondence between inbound and outbound interfaces indicates that interface A1 corresponds to interface A4. Therefore, any traffic entering through interface A1 will exit through interface A4.

[0313] By specifying the mapping between inbound and outbound interfaces, traffic can be forwarded without looking up the routing table, resulting in higher processing performance.

[0314] The method provided in this embodiment involves a dedicated security chip selecting the transmission path for the traffic (e.g., the second traffic) output by the dedicated security chip based on the detection result obtained by the CPU from detecting the sampled traffic. If the CPU's detection result for the sampled traffic is the second detection result, the dedicated security chip directly sends the traffic to the outgoing interface without going through the CPU, thus ensuring normal traffic transmission. If the CPU's detection result for the sampled traffic is the first detection result, the dedicated security chip directly sends application layer traffic that meets a first preset condition to the CPU, which then performs defense processing on the application layer traffic that meets the first preset condition, improving defense performance. In summary, the method provided in this embodiment can reduce the CPU load, which is beneficial for ensuring the normal operation of the CPU and thus for ensuring the normal transmission of service traffic.

[0315] In the above method, the dedicated security chip continuously samples the received traffic at a preset sampling rate and sends the sampled traffic to the CPU. The CPU restores the traffic and detects the application layer traffic that meets the first preset condition to obtain the detection result obtained by detecting the sampled traffic.

[0316] The aforementioned sampling can also be called data extraction. Sampling refers to the dedicated security chip copying or extracting packets from the traffic according to a preset sampling rate and sending them to the CPU for processing. The aforementioned reconstruction refers to the CPU converting the number of sampled packets into the number of packets in the traffic according to the preset sampling rate. For example, if the preset sampling rate is 200:1, when the dedicated security chip sends out 200 packets, it selects one packet and sends it to the CPU for processing. When the CPU receives this packet, it will consider that it has received 200 packets according to the preset sampling rate.

[0317] Optionally, the first detection result includes: the rate of application layer traffic that meets the first preset condition is greater than the first threshold, or the duration for which the rate of application layer traffic that meets the first preset condition is greater than the first threshold is greater than the first duration.

[0318] If the rate of application layer traffic meeting the first preset condition exceeds a first threshold, or if the rate of application layer traffic meeting the first preset condition exceeds the first threshold for a duration greater than a first duration, it indicates that the application layer traffic meeting the first preset condition is abnormal. A dedicated security chip sends the application layer traffic meeting the first preset condition to the CPU for defense processing, which helps ensure network security.

[0319] For example, the rate of application layer traffic that meets the first preset condition includes, but is not limited to, packet rate or bandwidth rate.

[0320] Message rate describes the number of data packets transmitted per unit of time. For example, the unit of message rate is packets per second (PPS). PPS refers to the number of data packets transmitted per second.

[0321] Bandwidth rate describes the number of bits transmitted per unit of time. For example, the unit of bandwidth rate is bits per second (bps), kilo bits per second (Kbps), or million bits per second (Mbps).

[0322] For example, assuming a preset sampling rate of 200:1, if two packets from the dedicated security chip that are sent to the CPU within one second meet the first preset condition, then the packet rate of the application layer traffic that meets the first preset condition is 2*200 packets / second.

[0323] Optionally, the second detection result includes: the rate of application layer traffic that meets the first preset condition is less than or equal to the second threshold, or the duration for which the rate of application layer traffic that meets the first preset condition is less than or equal to the second threshold is greater than the second duration.

[0324] If the rate of application layer traffic that meets the first preset condition is less than or equal to the second threshold, or if the rate of application layer traffic that meets the first preset condition is less than or equal to the second threshold but greater than the second duration, it indicates that the application layer traffic that meets the first preset condition is basically normal. Therefore, the dedicated security chip directly forwards the traffic to the outgoing interface.

[0325] For example, the second threshold and the first threshold can be the same or different. The first duration and the second duration can be the same or different. That is, the first detection result and the second detection result can be mutually exclusive and contradictory, or they can be mutually exclusive but not contradictory.

[0326] Optionally, the first preset condition includes one or more of the following: the destination IP address is the first target destination IP address, the source IP address is the first target source IP address, the destination port is the first target destination port, the source port is the first target source port, or the transmission protocol is the first target transmission protocol.

[0327] By limiting the traffic sent to the CPU using a first preset condition, the CPU's processing load can be reduced. Furthermore, by setting the first preset condition appropriately, customized services can be achieved. For example, the first preset condition can be the destination IP address corresponding to a specific customer. By setting this first preset condition, a two-layer defense service can be provided to that specific customer, meaning both the CPU and a dedicated security chip perform defense processing.

[0328] For example, the first destination IP address is one or more IP addresses. Similarly, the first source IP address is one or more source IP addresses. The first destination port is one or more destination ports. The first transport protocol is one or more transport protocols.

[0329] In one possible implementation, the detection result obtained by the CPU from detecting the sampled traffic may not satisfy either the first detection result or the second detection result. In this scenario, the embodiments of this application do not limit the forwarding path of the traffic output by the dedicated security chip.

[0330] In some embodiments, the dedicated security chip continuously sends sampled traffic to the CPU before the CPU obtains the first detection result. Once the CPU obtains the first detection result, the dedicated security chip stops sampling the received traffic.

[0331] For example, in method 1100, the protection device performs traffic processing based on the two paths shown in Figure 7.

[0332] Specifically, if the CPU detects the sampled traffic and the result is the second detection result or not the first detection result, the traffic is processed and forwarded directly through the dedicated security chip forwarding path. If the CPU detects the sampled traffic and the result is the first detection result or not the second detection result, the application layer traffic that meets the first preset condition in the traffic output by the dedicated security chip is processed and forwarded through the CPU forwarding path.

[0333] For example, assuming that at time t1, the CPU detects the sampled traffic and the result is either the first detection result or not the second detection result, then the traffic received by the protection device before time t1 is processed and forwarded through the dedicated security chip direct forwarding path, and the application layer traffic that meets the first preset condition among the traffic received by the protection device after time t1 is processed and forwarded through the CPU forwarding path.

[0334] In some embodiments, in response to the first detection result, the method 1100 further includes:

[0335] S1107, a dedicated security chip sends traffic other than the first target traffic in the second traffic to the outgoing interface.

[0336] That is, in response to the first detection result, the dedicated security chip not only sends the first target traffic from the second traffic to the CPU, but also sends the traffic from the second traffic other than the first target traffic to the output interface. The traffic from the second traffic other than the first target traffic is the traffic from the second traffic that does not meet the first preset condition.

[0337] For example, referring to Figure 7, if the detection result of the CPU on the sampled traffic is the first detection result or not the second detection result, the application layer traffic that meets the first preset condition in the traffic output by the dedicated security chip is processed and forwarded through the CPU forwarding path, and the traffic other than the application layer traffic that meets the first preset condition in the traffic output by the dedicated security chip is processed and forwarded through the dedicated security chip direct forwarding path.

[0338] Application layer traffic that meets the first preset condition is considered traffic of interest to the protection device, while application layer traffic that does not meet the first preset condition is considered traffic of interest to the protection device. Based on this embodiment, for traffic of interest to the protection device, processing and forwarding it through the CPU can improve defense capabilities. For traffic of interest to the protection device, the dedicated security chip forwards the traffic directly to the outgoing interface without going through the CPU. By reducing the CPU's processing load in this way, the CPU can reserve more resources to process the traffic of interest to the protection device.

[0339] In some embodiments, S1104 specifically includes: in response to a second detection result obtained by the CPU from detecting the sampled traffic and the fact that the second traffic does not include the second target traffic, the dedicated security chip sends the second traffic to the output interface. The second target traffic is application layer traffic that meets a second preset condition.

[0340] That is, if the CPU detects the sampled traffic and obtains a second detection result, and the second traffic does not include the second target traffic, then the dedicated security chip sends the second traffic to the output interface.

[0341] The second target traffic is the traffic that the protection device is concerned with. Based on this embodiment, for traffic that the protection device is not concerned with, the dedicated security chip forwards the traffic directly to the outgoing interface without going through the CPU. By reducing the CPU's processing load in this way, the CPU can reserve more resources to process the traffic that the protection device is concerned with.

[0342] Optionally, the second preset condition includes one or more of the following: the destination IP address is the second target destination IP address, the source IP address is the second target source IP address, the destination port is the second target destination port, the source port is the second target source port, or the transmission protocol is the second target transmission protocol.

[0343] For example, the second destination IP address is one or more IP addresses. Similarly, the second destination source IP address is one or more source IP addresses. The second destination port is one or more destination ports. The second destination transport protocol is one or more transport protocols.

[0344] In some embodiments, if the second traffic includes the second target traffic, the dedicated security chip sends the second target traffic to the CPU. After receiving the second target traffic, the CPU performs a second defense process on the second target traffic and sends the fourth traffic obtained after the second defense process to the outgoing interface.

[0345] For traffic other than the second target traffic in the second traffic, i.e., non-second target traffic in the second traffic, it is sent to the outgoing interface by a dedicated security chip.

[0346] For example, referring to Figure 7, if the detection result of the CPU on the sampled traffic is the second detection result or not the first detection result, the second target traffic in the traffic output by the dedicated security chip is processed and forwarded through the CPU forwarding path, and the non-second target traffic in the traffic output by the dedicated security chip is processed and forwarded through the dedicated security chip direct forwarding path.

[0347] Based on this embodiment, the second target traffic is the traffic that the protection device is concerned with. For traffic that the protection device is concerned with, the CPU sends, processes, and forwards it, which helps ensure traffic security. For traffic that the protection device is not concerned with, it is forwarded through the outgoing interface, enabling fast traffic forwarding while reducing the CPU's processing load.

[0348] In some embodiments, after the CPU obtains the first detection result, the CPU detects the application layer traffic that meets the first preset condition sent by the dedicated security chip to obtain a detection result. If the detection result is the second detection result, the CPU instructs the dedicated security chip to no longer send application layer traffic that meets the first preset condition to the CPU. The dedicated security chip, according to the CPU's instruction, performs the sampling operation described above and sends the sampled traffic to the CPU. Subsequent operations are performed according to the method described above, and will not be repeated here.

[0349] Based on this embodiment, the detection result indicates that the application layer traffic rate that meets the first preset condition is relatively small, the possibility of application layer attacks is relatively small, the CPU does not perform application layer defense, and the traffic is forwarded quickly.

[0350] The following examples, with reference to Figures 12 and 13, illustrate the overall traffic processing flow of the dedicated security chip. Specifically, the dedicated security chip performs traffic splitting based on whether the traffic is the second target traffic, splitting the traffic based on the detection result obtained by the CPU from detecting the sampled traffic, and splitting the traffic based on whether the traffic meets the first preset condition when the detection result is the first detection result.

[0351] Please refer to Figures 12 and 13. The interaction process between the network interface, the dedicated security chip, and the CPU in Figures 12 and 13 includes, for example, one or more steps in S1201 to S1211 shown in method 1200.

[0352] S1201, the first flow of traffic enters the dedicated security chip through the inlet interface.

[0353] S1202, a dedicated security chip performs first-level defense processing on the first traffic to obtain the second traffic.

[0354] S1203, a dedicated security chip, determines whether the detection result of the CPU's detection of the sampled traffic is the first detection result (or the second detection result).

[0355] If the test result is the first test result or not the second test result, then execute S1204 and S1205; if the test result is not the first test result or is not the second test result, then execute S1208 and S1211.

[0356] In one implementation, if the dedicated security chip does not receive a first indication from the CPU indicating that the detection result is the first detection result before receiving the first traffic, it considers the detection result to be either not the first detection result or the second detection result.

[0357] S1204, the dedicated security chip sends the traffic in the second traffic that does not meet the second preset condition to the outgoing interface.

[0358] S1205, the dedicated security chip sends the traffic in the second traffic that meets the second preset condition to the CPU.

[0359] It should be noted that if the second traffic does not include traffic that meets the second preset condition, then S1204 is executed, but S1205 is not executed. If the second traffic consists entirely of traffic that meets the second preset condition, then S1205 is executed, but S1204 is not executed.

[0360] S1206, the CPU performs second defense processing on the traffic in the second traffic that meets the second preset conditions, so as to obtain the traffic after the second defense processing.

[0361] S1207, the CPU sends traffic that has undergone the second defense process to the outgoing interface.

[0362] S1208, the dedicated security chip sends the traffic in the second traffic that does not meet the first preset condition to the outgoing interface.

[0363] S1209, the dedicated security chip sends the application layer traffic that meets the first preset condition from the second traffic to the CPU.

[0364] Accordingly, the CPU receives application layer traffic from the second traffic that meets the first preset condition and executes S1210.

[0365] S1210, the CPU performs a second defense process on the application layer traffic in the second traffic that meets the first preset condition, so as to obtain the traffic after the second defense process.

[0366] S1211, the CPU sends traffic that has undergone the second defense process to the outgoing interface.

[0367] In the processes shown in Figures 12 and 13, after the dedicated security chip receives traffic from the ingress interface, it first performs a first defense process on the received traffic, such as network layer defense processing, to obtain traffic that has undergone the first defense process. The dedicated security chip determines whether the detection result of the CPU's detection of the sampled traffic is the first detection result or the second detection result. If the detection result is not the second detection result or is the first detection result, the dedicated security chip sends the traffic that meets the second preset condition from the traffic that has undergone the first defense process to the CPU, and sends the traffic that does not meet the second preset condition from the traffic that has undergone the first defense process to the egress interface. If the detection result is not the first detection result or is the second detection result, the dedicated security chip sends the traffic that meets the first preset condition from the traffic that has undergone the first defense process to the CPU, and sends the traffic that does not meet the first preset condition from the traffic that has undergone the first defense process to the egress interface.

[0368] In the method embodiments described above, the CPU detects the traffic sent by the dedicated security chip. As an alternative, the dedicated security chip does not sample the traffic; instead, it detects the traffic to obtain detection results and then routes the traffic based on those results. The specific traffic routing method is consistent with the method described above; please refer to the methods described above, such as method 1100 or method 1200.

[0369] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0370] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be construed as indicating or implying relative importance. For example, "first flow" and "second flow" are used to distinguish different flows, not to describe a specific order of flows, and should not be construed as the first flow being more important than the second flow.

[0371] In the description of the embodiments in this application, unless otherwise stated, "at least one" means one or more. "More than one" means two or more. In addition, A refers to B, meaning that A is the same as B or A is a simple variation of B.

[0372] In the various method embodiments of this application, the order of the sequence numbers does not imply the order of execution. The execution order should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0373] It is understood that in this application, descriptions such as "under the circumstances," "if," "when," and "if..." can be used interchangeably. Furthermore, these descriptions all refer to the corresponding actions that will be taken under certain objective circumstances, and are not time-limited, nor do they require any judgment action during implementation, nor do they imply any other limitations.

[0374] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0375] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A flow processing method, characterized in that, Applied to protective equipment, the protective equipment including an input interface, an output interface, a dedicated security chip, and a central processing unit (CPU), the method includes: The first traffic is received from the ingress interface via the dedicated security chip; The first traffic is subjected to a first defense process through the dedicated security chip to obtain the second traffic; In response to the CPU's resource usage meeting the first condition, the second traffic is sent to the CPU through the dedicated security chip, and the CPU performs a second defense process on the second traffic, and sends the third traffic obtained after the second defense process to the output interface; In response to the CPU resource usage meeting the second condition, the second traffic is sent to the output interface through the dedicated security chip, wherein the parameter ranges described by the first condition and the second condition do not overlap.

2. The method as described in claim 1, characterized in that, The first condition includes one or more of the following: the CPU utilization is less than or equal to a first threshold, the duration for which the CPU utilization is less than or equal to the first threshold is greater than a first duration, the amount of memory occupied by the CPU is less than or equal to a second threshold, the duration for which the amount of memory occupied by the CPU is less than or equal to the second threshold is greater than a second duration, the percentage of memory occupied by the CPU is less than or equal to a third threshold, or the duration for which the percentage of memory occupied by the CPU is less than or equal to the third threshold is greater than a third duration.

3. The method as described in claim 1 or 2, characterized in that, The second condition includes one or more of the following: the CPU utilization is greater than a third threshold, the duration for which the CPU utilization is greater than the third threshold is greater than a fourth duration, the amount of memory occupied by the CPU is greater than a fourth threshold, the duration for which the amount of memory occupied by the CPU is greater than the fourth threshold is greater than a fifth duration, the percentage of memory occupied by the CPU is greater than a sixth threshold, or the duration for which the percentage of memory occupied by the CPU is greater than the sixth threshold is greater than a sixth duration.

4. The method according to any one of claims 1-3, characterized in that, The first flow rate is the flow rate that does not meet the preset conditions.

5. The method as described in claim 4, characterized in that, The method further includes: The fourth traffic is received from the input interface through the dedicated security chip, and the fourth traffic is traffic that meets the preset conditions; The dedicated security chip performs the first defense processing on the fourth traffic and sends the fifth traffic, which has undergone the first defense processing, to the outgoing interface.

6. The method as described in claim 4 or 5, characterized in that, The preset conditions include one or more of the following: the destination Internet Protocol IP address is the target destination IP address, the source IP address is the target source IP address, the destination port is the target destination port, the source port is the target source port, or the transport protocol is the target transport protocol.

7. The method according to any one of claims 1-6, characterized in that, The dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

8. A flow processing method, characterized in that, Applied to protective equipment, the protective equipment including an input interface, an output interface, a dedicated security chip, and a central processing unit (CPU), the method includes: The first traffic is received from the ingress interface via the dedicated security chip; The first traffic is subjected to a first defense process through the dedicated security chip to obtain the second traffic; In response to the first detection result obtained by the CPU from detecting the sampled traffic, the dedicated security chip sends a first target traffic to the CPU, and the CPU performs a second defense processing on the first target traffic. The third traffic obtained after the second defense processing is then sent to the output interface. The first target traffic is the application layer traffic in the second traffic that meets the first preset condition. The sampled traffic is sent by the dedicated security chip to the CPU. The sampled traffic is obtained by the dedicated security chip from sampling historical traffic at a preset sampling rate. In response to the second detection result obtained by the CPU from detecting the sampled traffic, the second traffic is sent to the output interface through the dedicated security chip.

9. The method as described in claim 8, characterized in that, The step of sending the second traffic to the output interface via the dedicated security chip in response to the second detection result obtained by the CPU detecting the sampled traffic includes: In response to the second detection result and the fact that the second traffic does not include the second target traffic, the second traffic is sent to the output interface through the dedicated security chip. The second target traffic is application layer traffic that meets the second preset condition.

10. The method as described in claim 9, characterized in that, The method further includes: In response to the second detection result and the fact that the second traffic includes the second target traffic, the second target traffic is sent to the CPU through the dedicated security chip; The CPU performs the second defense processing on the second target traffic and sends the fourth traffic obtained after the second defense processing to the outgoing interface.

11. The method according to any one of claims 8-10, characterized in that, The first detection result includes: the rate of application layer traffic that meets the first preset condition is greater than a first threshold, or the duration for which the rate of application layer traffic that meets the first preset condition is greater than the first threshold is greater than a first duration.

12. The method according to any one of claims 8-11, characterized in that, The second detection result includes: the rate of application layer traffic that meets the first preset condition is less than or equal to the second threshold, or the duration for which the rate of application layer traffic that meets the first preset condition is less than or equal to the first threshold is greater than the second duration.

13. The method according to any one of claims 8-12, characterized in that, The method further includes: In response to the first detection result, the application layer traffic that does not meet the first preset condition in the second traffic is sent to the outgoing interface through the dedicated security chip.

14. The method according to any one of claims 8-13, characterized in that, The first preset condition includes one or more of the following: the destination Internet Protocol IP address is the first target destination IP address, the source IP address is the first target source IP address, the destination port is the first target destination port, the source port is the first target source port, or the transport protocol is the first target transport protocol.

15. The method as described in claim 9 or 10, characterized in that, The second preset condition includes one or more of the following: the destination Internet Protocol IP address is the second target destination IP address, the source IP address is the second target source IP address, the destination port is the second target destination port, the source port is the second target source port, or the transport protocol is the second target transport protocol.

16. The method according to any one of claims 8-15, characterized in that, The method further includes: The CPU sends an indication message to the dedicated security chip, and the indication message indicates the first detection result.

17. The method according to any one of claims 8-16, characterized in that, The dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

18. A flow processing method, characterized in that, The method is applied to a dedicated security chip located in a protective device, which also includes an input interface, an output interface, and a central processing unit (CPU). The method includes: Receive the first traffic from the ingress interface; The first traffic is subjected to a first defense process to obtain the second traffic; In response to the CPU's resource usage meeting the first condition, the second traffic is sent to the CPU; In response to the CPU resource usage satisfying the second condition, the second traffic is sent to the output interface, wherein the parameter ranges described by the first condition and the second condition do not overlap.

19. The method as described in claim 18, characterized in that, The method further includes: The system receives an indication from the CPU, which indicates that the CPU's resource usage satisfies the first condition, or the indication indicates that the CPU's resource usage satisfies the second condition.

20. The method as described in claim 18 or 19, characterized in that, The first condition includes one or more of the following: the CPU utilization is less than or equal to a first threshold, the duration for which the CPU utilization is less than or equal to the first threshold is greater than a first duration, the amount of memory occupied by the CPU is less than or equal to a second threshold, the duration for which the amount of memory occupied by the CPU is less than or equal to the second threshold is greater than a second duration, the percentage of memory occupied by the CPU is less than or equal to a third threshold, or the duration for which the percentage of memory occupied by the CPU is less than or equal to the third threshold is greater than a third duration.

21. The method according to any one of claims 18-20, characterized in that, The second condition includes one or more of the following: the CPU utilization is greater than a third threshold, the duration for which the CPU utilization is greater than the third threshold is greater than a fourth duration, the amount of memory occupied by the CPU is greater than a fourth threshold, the duration for which the amount of memory occupied by the CPU is greater than the fourth threshold is greater than a fifth duration, the percentage of memory occupied by the CPU is greater than a sixth threshold, or the duration for which the percentage of memory occupied by the CPU is greater than the sixth threshold is greater than a sixth duration.

22. The method according to any one of claims 18-21, characterized in that, The first flow rate is the flow rate that does not meet the preset conditions.

23. The method as described in claim 22, characterized in that, The method further includes: A fourth flow is received from the ingress interface, wherein the fourth flow is flow that satisfies the preset condition; The first defense process is applied to the fourth traffic, and the fifth traffic obtained after the first defense process is sent to the outgoing interface.

24. The method as described in claim 22 or 23, characterized in that, The preset conditions include one or more of the following: the destination Internet Protocol IP address is the target destination IP address, the source IP address is the target source IP address, the destination port is the target destination port, the source port is the target source port, or the transport protocol is the target transport protocol.

25. The method according to any one of claims 18-24, characterized in that, The dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

26. A flow processing method, characterized in that, The method is applied to a dedicated security chip located in a protective device, which further includes an input interface, an output interface, and a central processing unit (CPU). The method includes: Receive the first traffic from the ingress interface; The first traffic is subjected to a first defense process to obtain the second traffic; The system receives an instruction from the CPU, which instructs the CPU to detect the first detection result obtained by detecting the sampled traffic. The sampled traffic is sent to the CPU by the dedicated security chip and is obtained by the dedicated security chip from sampling historical traffic at a preset sampling rate. In response to the indication information, a first target traffic is sent to the CPU. The first target traffic is the application layer traffic in the second traffic that meets the first preset condition. If the indication information is not received, the second traffic is sent to the outgoing interface.

27. The method as described in claim 26, characterized in that, The method further includes: If the second traffic includes the second target traffic, the second target traffic is sent to the CPU. The second target traffic is application layer traffic that meets the second preset condition.

28. The method as described in claim 26 or 27, characterized in that, The first detection result includes: the rate of application layer traffic that meets the first preset condition is greater than a first threshold, or the duration for which the rate of application layer traffic that meets the first preset condition is greater than the first threshold is greater than a first duration.

29. The method according to any one of claims 26-28, characterized in that, The method further includes: In response to the indication information, the application layer traffic in the second traffic that does not meet the first preset condition is sent to the outgoing interface.

30. The method according to any one of claims 26-29, characterized in that, The first preset condition includes one or more of the following: the destination Internet Protocol IP address is the first target destination IP address, the source IP address is the first target source IP address, the destination port is the first target destination port, the source port is the first target source port, or the transport protocol is the first target transport protocol.

31. The method as described in claim 27, characterized in that, The second preset condition includes one or more of the following: the destination Internet Protocol IP address is the second target destination IP address, the source IP address is the second target source IP address, the destination port is the second target destination port, the source port is the second target source port, or the transport protocol is the second target transport protocol.

32. The method according to any one of claims 26-31, characterized in that, The dedicated security chip includes one or more of the following: application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), network processor (NP), or data processing unit (DPU).

33. A flow processing method, characterized in that, The method is applied to a central processing unit (CPU), the CPU being located within a protective device, the protective device further including an output interface and a dedicated security chip, and the method comprising: Send indication information to the dedicated security chip, the indication information indicating that the CPU's resource usage meets a first condition; Receive a second data stream from the dedicated security chip; The second traffic is subjected to a second defense process, and the third traffic obtained after the second defense process is sent to the outgoing interface.

34. The method as described in claim 33, characterized in that, The first condition includes one or more of the following: the CPU utilization is less than or equal to a first threshold, the duration for which the CPU utilization is less than or equal to the first threshold is greater than a first duration, the amount of memory occupied by the CPU is less than or equal to a second threshold, the duration for which the amount of memory occupied by the CPU is less than or equal to the second threshold is greater than a second duration, the percentage of memory occupied by the CPU is less than or equal to a third threshold, or the duration for which the percentage of memory occupied by the CPU is less than or equal to the third threshold is greater than a third duration.

35. A flow processing method, characterized in that, The method is applied to a central processing unit (CPU), the CPU being located within a protective device. The protective device further includes an input interface, an output interface, and a dedicated security chip. The method includes: The system receives sampled traffic from a dedicated security chip, which is obtained by the dedicated security chip sampling the traffic received from the ingress interface at a preset sampling rate. Send indication information to the dedicated security chip, the indication information instructing the CPU to detect the first detection result obtained by detecting the sampled traffic; Receive a first target traffic from the dedicated security chip in response to the indication information, wherein the first target traffic is application layer traffic that meets a first preset condition; The first target traffic is subjected to a second defense process, and the third traffic obtained after the second defense process is sent to the outgoing interface.

36. The method as described in claim 35, characterized in that, The method further includes: Receive a second target traffic from the dedicated security chip, wherein the second target traffic is application layer traffic that meets a second preset condition.

37. The method as described in claim 35 or 36, characterized in that, The first detection result includes: the rate of application layer traffic that meets the first preset condition is greater than a first threshold, or the duration for which the rate of application layer traffic that meets the first preset condition is greater than the first threshold is greater than a first duration.

38. The method according to any one of claims 35-37, characterized in that, The first preset condition includes one or more of the following: the destination Internet Protocol IP address is the first target destination IP address, the source IP address is the first target source IP address, the destination port is the first target destination port, the source port is the first target source port, or the transport protocol is the first target transport protocol.

39. The method as described in claim 36, characterized in that, The second preset condition includes one or more of the following: the destination Internet Protocol IP address is the second target destination IP address, the source IP address is the second target source IP address, the destination port is the second target destination port, the source port is the second target source port, or the transport protocol is the second target transport protocol.

40. A protective device, characterized in that, Includes input / output interfaces, a dedicated security chip, and a central processing unit (CPU): The dedicated security chip is used to receive first traffic from the ingress interface and perform first defense processing on the first traffic to obtain second traffic; In response to the CPU's resource usage satisfying the first condition, the dedicated security chip is further configured to send the second traffic to the CPU, and the CPU is configured to perform a second defense process on the second traffic and send the third traffic obtained after the second defense process to the output interface. In response to the CPU resource usage satisfying the second condition, the dedicated security chip is further configured to send the second traffic to the output interface, wherein the parameter ranges described by the first condition and the second condition do not overlap.

41. A protective device, characterized in that, Includes input / output interfaces, a dedicated security chip, and a central processing unit (CPU): The dedicated security chip is used to receive first traffic from the ingress interface and perform first defense processing on the first traffic to obtain second traffic; In response to the first detection result obtained by the CPU from detecting the sampled traffic, the dedicated security chip is further configured to send a first target traffic to the CPU. The CPU is configured to perform a second defense processing on the first target traffic and send the third traffic obtained after the second defense processing to the output interface. The first target traffic is the application layer traffic in the second traffic that meets the first preset condition. The sampled traffic is sent by the dedicated security chip to the CPU. The sampled traffic is obtained by the dedicated security chip from sampling historical traffic at a preset sampling rate. In response to the second detection result obtained by the CPU from detecting the sampled traffic, the dedicated security chip is further configured to send the second traffic to the output interface.

Images