CN101355585B - System and method for protecting information of distributed architecture data communication equipment - Google Patents

Abstract

The invention discloses a message protection system and method of a data communication device with a distributed architecture, so as to effectively protect the CPU of the data communication device with a distributed architecture. In the method, after receiving the message, the service processing unit analyzes the message to be processed that needs to be processed by the CPU; performs protocol analysis on the message to be processed, and obtains the protocol type of the message to be processed; obtains the system main control unit CPU and cache utilization; according to the utilization of the system main control unit CPU and cache, perform quality of service speed limit processing on the messages that need to be processed by the system main control unit CPU among the messages to be processed; The protocol type of the processing message is used to process the message to be processed. The invention controls the rate at which messages of each service processing unit are sent to the main control CPU, and avoids the influence of busy CPU caused by message processing on other normal services.

Description

A message protection system and method for data communication equipment with distributed architecture

technical field

The present invention relates to a data communication device with a distributed architecture, in particular to a message protection system and method for a data communication device with a distributed architecture.

Background technique

With the development and growth of the Internet, various Internet devices have emerged one after another. In the aggregation layer and core layer of the network, in order to alleviate the requirements of huge traffic on device performance, the application of distributed architecture devices has been popularized.

As shown in Figure 1, the distributed architecture is mainly composed of a system main control unit 110, several business processing units 120, data channels 130 between the system main control unit 110 and business processing units 120 and between business processing units 120, each The service processing unit 120 can independently complete the processing of certain services, and the unified scheduling and management of system resources is completed by the system main control unit 110, wherein:

The system main control unit 110 is responsible for managing and maintaining the entire device, and uniformly scheduling system resources. The final processing and response to various messages of simple network management protocol (simple network management protocol, abbreviated as SNMP) and other protocols are all in the done here;

The service processing unit 120 is responsible for receiving data and performing processing such as forwarding, sending to the service processing unit central processing unit (CPU) or discarding according to the data content;

Data channel 130: mainly responsible for the message and data exchange between the system main control unit 110 and the business processing unit 120, and between each business processing unit 120. It is different according to the distributed system equipment. For example, it can be divided into multiple channels according to the actual situation. Each processing unit, for example, the data exchange between the service processing unit 120 can be handled by a dedicated switching unit and so on.

In order to better manage various devices in the network, various network protocols have been developed, such as using the network time protocol (network time protocol, abbreviated as NTP) to synchronize the time of each device in the network, and using SNMP to implement network device Remote centralized management and more.

However, with the continuous emergence of network devices and network protocols, attacks against network devices using network protocols are also emerging, such as the most common "Denial of Service" (Denial of Service, abbreviated as DOS) attack (a kind of attack by sending a large number of simulated protocol message to occupy the CPU resources of the attacked device, so that other normal services are affected or even interrupted) and so on. In response to these attacks, the network has adopted some protective measures, such as the packet rate limit function, which limits the speed at which various protocol packets are sent to the CPU for processing on the business processing unit, so as to achieve the purpose of protecting the CPU.

For centralized equipment, the technology adopted at this stage can effectively protect the CPU. However, in a distributed environment, although each service processing unit is protected, there is no protection measure from the service processing unit CPU to the system main control unit CPU, but is directly uploaded. There are certain protocols (such as SNMP, NTP, etc.), which need to be sent to the system main control unit for further processing after being processed by the business processing unit. In this process, the following problems exist:

Because the CPU of each service processing unit only needs to judge whether it is a protocol message such as SNMP or NTP, and if it is, it will send it to the CPU of the system main control unit for further processing, so the CPU utilization of each service processing unit may still be very low, but the system main control unit The CPU may have been overwhelmed. Take the SNMP protocol as an example: a read batch request (GetBulkRequest) message that is commonly used at the SNMP manager (manager) side is composed of many read next request (GetNextRequest) messages. When the management object requested in GetBulkRequest If it does not exist in the management information base (MIB) of the agent (agent), the main control unit of the system still needs to completely search the entire MIB library before it can determine that the MIB file to be searched does not exist. Since one data packet carries multiple request messages, this will cause the CPU utilization rate of the main control to remain high, and even stop responding to other normal requests such as telnet and console ports.

Contents of the invention

The technical problem to be solved by the present invention is to provide a message protection system and a corresponding protection method for data communication equipment with a distributed architecture, so as to effectively protect the CPU of the data communication equipment with a distributed architecture.

In order to solve the above technical problems, the present invention firstly provides a message protection system for data communication equipment with a distributed architecture, including a forwarding module, a protocol analysis module, an internal quality of service module, a management module and a protocol processing module, wherein:

The forwarding module is located on the service processing unit of the distributed architecture data communication device, and is used to receive and send the pending messages that need to be processed by the CPU;

The protocol analysis module is connected to the forwarding module, and is used to analyze the protocol of the message to be processed, and obtain the protocol type of the message to be processed;

The management module is configured to acquire the utilization ratios of the system main control unit CPU and cache;

The internal quality of service module is connected to the protocol analysis module and the management module, and is used to forward the message to be processed to the protocol processing module, and according to the utilization rate of the system main control unit CPU and cache, Among the messages to be processed, the messages that need to be processed by the CPU of the system main control unit are subjected to quality of service and speed limit processing; and

The protocol processing module is connected to the internal quality of service module, and is used to process the message to be processed according to the protocol type of the message to be processed.

In the above system, the forwarding module may be further connected to the protocol processing module, for feeding back a response from the protocol processing module after processing the message to be processed.

In the above-mentioned system, the internal quality of service module may, according to the utilization rate of the system main control unit CPU and cache, use the agreed access rate principle of quality of service to process the report that needs to be processed by the system main control unit CPU The document performs quality of service rate limit processing.

Further, the internal quality of service module can set a commitment after comprehensively weighing the CPU occupation of the system main control unit according to the performance of the system main control unit CPU and the burst traffic that the data communication device may face. The value of the access rate and compliance burst, according to the value of the committed access rate and compliance burst, perform quality of service and speed limit processing on the message that needs to be processed by the CPU of the main control unit of the system.

In order to solve the above technical problems, the present invention also provides a message protection method for a data communication device with a distributed architecture, comprising steps:

After receiving the message, the business processing unit of the distributed architecture data communication device analyzes the pending message that needs to be processed by the CPU;

Perform protocol analysis on the message to be processed to obtain the protocol type of the message to be processed;

Obtain the utilization ratios of the system main control unit CPU and cache of the distributed architecture data communication device;

According to the utilization rate of the system main control unit CPU and cache, perform quality of service and speed limit processing on the messages to be processed that need to be processed by the system main control unit CPU; and

Process the message to be processed according to the protocol type of the message to be processed.

In the method described above, the message to be processed may include a broadcast packet, a protocol packet, a destination address of the device itself, or a message that has been identified and needs to be sent.

Further, the message to be processed may include a simple network management protocol message or a network time protocol message.

In the above-mentioned method, according to the utilization rate of the system main control unit CPU and the cache, the agreed access rate principle of the quality of service can be used to perform quality of service speed limit processing on the messages that need to be processed by the system main control unit CPU .

Further, the committed access rate and compliance burst can be set after comprehensively weighing the occupation of the CPU of the system main control unit according to the performance of the system main control unit CPU and the burst traffic flow that the data communication device may face , according to the value of the committed access rate and the compliant burst amount, perform quality of service and speed limit processing on the packets that need to be processed by the CPU of the system main control unit.

In the above method, when processing the message to be processed, correctness checking and version matching may be further performed on the message to be processed.

Compared with the prior art, the present invention provides a message protection mechanism based on quality of service (QOS) in distributed architecture equipment, combined with the speed limit for various protocol messages on each business processing unit, thereby controlling each Rate at which service processing units send messages to the master CPU. After the service processing unit CPU and the main control CPU are protected, the influence of the busy CPU on other normal services due to message processing is avoided.

Description of drawings

Figure 1 is a schematic diagram of the framework of the distributed architecture.

Fig. 2 is a schematic composition diagram of a system embodiment of the present invention.

Fig. 3 is a schematic flow chart of a method embodiment of the present invention.

Detailed ways

The implementation of the present invention will be described in detail below in conjunction with the accompanying drawings and examples, so as to fully understand and implement the process of how to apply technical means to solve technical problems and achieve technical effects in the present invention.

Fig. 2 shows the composition diagram of an embodiment of the message protection system based on internal quality of service (QOS) flow control in the present invention, the system embodiment includes: forwarding module 210, protocol analysis module 220, management module 230, internal QOS module 240 And the protocol processing module 250, wherein:

The forwarding module 210 is located on each service processing unit, and is used for receiving and processing the message received by the service processing unit. If it is a correct message that can be forwarded normally, search the forwarding table and routing table and forward it according to the query results, and discard the wrong message; if the message is a broadcast packet or protocol packet, or the destination address of the message is the device itself, Or other services have identified the pending messages that need to be sent to the CPU for processing, then first send them to the service processing unit CPU for processing; if the service processing unit CPU cannot process them, then further send them to the system main control unit CPU for processing (such as SNMP );

Protocol analysis module 220, is connected with forwarding module 210, is used for analyzing and preprocessing the message to be processed that forwarding module 210 sends, and analyzes the protocol type of this message to be processed; Such as User Datagram Protocol (UDP) port number Be the message of 161 or 162, send to the protocol processing module 250 to carry out the processing of SNMP agreement; Protocol analysis module 220 mainly works on each business processing unit;

The management module 230 is connected with the internal QOS module 240, and is mainly used for monitoring and managing the system main control unit CPU and cache, so that the system can grasp the utilization rate of the system main control unit CPU and cache in real time, according to the utilization rate of the system terminal unit CPU and cache rate, assisting the internal QOS module 240 to complete the QOS speed limit processing of the message;

The internal QOS module 240 works between each business processing unit CPU and the system main control unit CPU, and is connected with the protocol analysis module 220 and the management module 230, and is mainly used for utilizing the system main control unit CPU and cache acquired by the management module 230 rate, and perform QOS rate-limiting processing on messages that need to be sent to the CPU of the main control unit of the system; in a distributed architecture, after the protocol analysis module 220 finishes analyzing the messages, if the protocol , it needs to be further sent to the system main control unit CPU for processing, through the speed limiting effect of the QOS module 230, the speed of sending the system main control unit CPU message from the service processing unit CPU is limited;

The protocol processing module 250 is connected with the internal QOS module 240. At first, the message is checked for correctness and version matching, and the correct message to be processed is processed accordingly. If a response is required, a corresponding response is generated and sent to the sender of the request. For example, for SNMP messages, the device completes the task of SNMP agent. After the correctness check and version matching pass, it processes according to the SNMP request (request) message sent by the SNMP manager, and feeds back the SNMP response (response) according to the processing result. The forwarding module 210 feeds back to the SNMPmanager that sends the SNMP request message, or actively sends the SNMP trap (trap) message to the SNMP manager.

Although the foregoing content takes the SNMP protocol message as an example to illustrate the technical solution of the present invention, the present invention is not limited to the message to be processed of the SNMP protocol, and it should include all protocol messages that need to be similarly processed such as the NTP protocol message etc.

In conjunction with Fig. 1 and Fig. 2, Fig. 3 shows the flowchart of an embodiment of the method of the present invention, and this embodiment comprises the following steps:

Step 310, after the forwarding module 210 on the service processing unit 120 receives the message from the port, it analyzes the message, and if it is a message that needs to be forwarded normally, it searches the forwarding table and the routing table, and according to the forwarding result and route of the search The result is forwarded or discarded. If it is a message that needs further processing, such as a broadcast packet, a protocol packet, or the destination address of the message is the device itself, or other services have identified a pending message that needs to be sent to the CPU for processing, then it will be processed via The protocol analysis module 220 sends it to the business processing unit CPU for processing;

Step 320, after the protocol analysis module 220 receives the message to be processed forwarded by the forwarding module 210, it analyzes the protocol type of the message to be processed, and processes the data according to a pre-defined processing mode (such as in Ethernet, it can be processed according to the destination MAC , IP address, source, destination port number will send different messages to different processing units); For example, the protocol analysis module 220 analyzes that what the forwarding module 210 forwards is a UDP message, and when the port numbers are 161 and 162, then forward What the module 210 forwards is the SNMP protocol message, which needs to be sent to the protocol processing module 250 through the internal QOS module 240 for corresponding processing; for the message that the service processing unit CPU cannot process, it needs to be processed by the system main control unit CPU, and this part The message is forwarded to the internal QOS module 240 via the protocol analysis module 220;

Step 330, internal QOS module 240 utilizes the agreed access rate (CommittedAccess Rate, abbreviated as CAR) principle of QOS to carry out speed limit processing to the message that sends system main control unit CPU, and a kind of speed limit mode that can be selected is for example according to CPU's The performance and the sudden business flow that the device may face are comprehensively weighed against the CPU occupation, and then the Committed Information Rate (CIR for short) and the Conformed burst size (CIR for short) (Conformed burst size, short for CIR) are set. CBS) value, taking the SNMP protocol message as an example, its operation method is:

Step 3a, set a CIR and CBS bucket, and put tokens into the CBS bucket according to the CIR; at the same time, if there are SNMP protocol messages passing through, the tokens in the CBS bucket will be reduced accordingly; specifically how many tokens each message corresponds to It can be set according to the actual situation;

Step 3b, when there is token in the CBS bucket, the internal QOS module 240 directly sends the SNMP protocol message to the system main control unit CPU;

Step 3c, when there is no token in the CBS bucket, the internal QOS module 240 invokes the management module 230 to check the utilization rate of the current system main control unit CPU, and when the utilization rate of the system main control unit CPU is small (less than a certain preset threshold value M), the internal QOS module 240 can pass a certain amount of (T) tokens into the CBS bucket to ensure the normal delivery of SNMP protocol packets, if the utilization rate of the current system main control unit CPU is higher ( greater than or equal to threshold M), then call management module 230 to check the cache of the current system main control unit, if there is enough cache, then the internal QOS module 240 caches the SNMP protocol packet, and waits for it to be sent when there is a token in the CBS bucket Give the system main control unit CPU processing, if the system main control unit cache is insufficient, then the internal QOS module 240 discards the protocol message;

Step 340, after the protocol processing module 250 receives the message to be processed forwarded by the internal QOS module 240, it checks the validity of the message, if the check fails, it directly discards the message, and if the legality check passes, then according to the message to be processed According to the protocol type of the text, the message to be processed is processed, and if necessary, a corresponding response (response) is generated according to the processing result, and is sent to the server corresponding to the request (request) by calling the forwarding module 210.

The invention aims at the distributed framework system, and sets the QOS speed limit between each service processing unit and the main control, which alleviates the influence of some other important services due to the busyness of the main control CPU when multiple service processing units send to the main control at the same time. The present invention takes SNMP as an example, but it is not limited to SNMP protocol messages. The rate-limiting processing of other protocol messages that need to be sent from the service processing unit to the master in all distributed systems is within the scope of the present invention.

Although the embodiments disclosed in the present invention are as above, the described content is only an embodiment adopted for the convenience of understanding the present invention, and is not intended to limit the present invention. Anyone skilled in the technical field to which the present invention belongs can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed by the present invention, but the patent protection scope of the present invention, The scope defined by the appended claims must still prevail.

Claims (10)

1. the message protection systems of a distributed architecture data communication equipment is characterized in that, comprises forwarding module, protocol-analysis model, internal services quality module, administration module and protocol process module, wherein:

Described forwarding module is positioned on the Service Processing Unit of described distributed architecture data communication equipment, be used to receive and on send the clear text that needs CPU to handle;

Described protocol-analysis model links to each other with described forwarding module, is used for described clear text is carried out protocal analysis, obtains the protocol type of described clear text;

Described administration module is used to obtain the utilance of system master unit CPU and buffer memory;

Described internal services quality module, link to each other with described protocol-analysis model and administration module, be used for transmitting described clear text to described protocol process module, and, the message that needs system master unit CPU to handle in the described clear text is carried out the service quality speed limit handle according to the utilance of described system master unit CPU and buffer memory; And

Described protocol process module links to each other with described internal services quality module, is used for the protocol type according to described clear text, and described clear text is handled.

2. the system as claimed in claim 1 is characterized in that:

Described forwarding module further links to each other with described protocol process module, is used to feed back the response after described protocol process module is handled described clear text.

3. the system as claimed in claim 1 is characterized in that:

Described internal services quality module according to the utilance of described system master unit CPU and buffer memory, utilizes the agreement access rate principle of service quality, the message that needs system master unit CPU to handle in the described clear text is carried out the service quality speed limit handle.

4. system as claimed in claim 2 is characterized in that:

Described internal services quality module, after the burst service stream that may face according to performance and the described data communications equipment of described system master unit CPU takies comprehensive balance to described system master unit CPU, committed access rate and the value of being obedient to the burst amount are set, according to described committed access rate and the value of being obedient to the burst amount, the described message that needs system master unit CPU to handle is carried out the service quality speed limit handle.

5. the message protection method of a distributed architecture data communication equipment is characterized in that, comprises step:

The Service Processing Unit of distributed architecture data communication equipment is received after the message, analyzes the clear text that needs CPU to handle;

Described clear text is carried out protocal analysis, obtain the protocol type of described clear text;

Obtain the system master unit CPU of described distributed architecture data communication equipment and the sharp frequency of buffer memory;

According to the utilance of described system master unit CPU and buffer memory, the message that needs system master unit CPU to handle in the described clear text is carried out the service quality speed limit handle; And

According to the protocol type of described clear text, described clear text is handled.

6. method as claimed in claim 5 is characterized in that:

Described clear text comprises that broadcast packet, protocol package, destination address are equipment itself or have identified the message that send on the needs.

7. method as claimed in claim 6 is characterized in that:

Described clear text comprises Simple Network Management Protocol message or NTP (Network Time Protocol) message.

8. method as claimed in claim 5 is characterized in that:

According to the utilance of described system master unit CPU and buffer memory, utilize the agreement access rate principle of service quality, the described message that needs system master unit CPU to handle is carried out the service quality speed limit handle.

9. method as claimed in claim 8 is characterized in that:

After the burst service stream that may face according to performance and the described data communications equipment of described system master unit CPU takies comprehensive balance to described system master unit CPU, committed access rate and the value of being obedient to the burst amount are set, according to described committed access rate and the value of being obedient to the burst amount, the described message that needs system master unit CPU to handle is carried out the service quality speed limit handle.

10. method as claimed in claim 5 is characterized in that, when described clear text is handled, further described clear text is carried out correctness inspection and version match.

Images