CN102158362B - Network information monitoring realization method, system and device - Google Patents

Abstract

The invention discloses a method, system and device for realizing network information supervision, wherein the method includes: establishing a supervision label switching path LSP channel between an operator's edge router PE and a supervision router Monitor, and configuring policy routing on the incoming interface of the PE; According to the configured policy routing, the PE forwards the suspicious packet to the Monitor through the supervisory LSP channel for detection, and takes corresponding actions according to the detection result fed back by the Monitor: if the detection passes, switch to the normal LSP channel to forward the message, otherwise, according to the scheduled forwarding The strategy processes the message accordingly; the present invention uses policy routing technology to switch between different channels by adding supervision channels, so as to realize the control of message forwarding, and fully realizes the control and control of harmful information in the propagation process. deal with.

Description

Method, system and device for realizing network information supervision

technical field

The present invention relates to the field of communication technology, in particular to a method, system and device for realizing network information supervision.

Background technique

With the rapid development of Internet business, all kinds of harmful information on the network are increasingly flooding, and each operator is also required to shoulder the responsibility of network information supervision. For example, through the Internet anti-pornography campaign some time ago, various domestic websites are now required to register and manage real names. This kind of supervision method belongs to post-event supervision, which cannot intervene in the process of information dissemination, and cannot effectively supervise the way of leasing overseas servers to engage in harmful information, so the overall effect is very limited. How to use network technology to detect and filter harmful information in the process of dissemination has become an urgent problem to be solved.

Contents of the invention

In view of the above analysis, the present invention aims to provide a method, system and device for realizing network information supervision, so as to solve the problem in the prior art that harmful information is not effectively detected and filtered during the propagation process.

The purpose of the present invention is mainly achieved through the following technical solutions:

The invention provides a method for realizing network information supervision, including:

Establish a supervisory label switching path LSP channel between the carrier edge router PE and the supervisory router Monitor, and configure policy routing on the incoming interface of the PE;

According to the configured policy routing, the PE forwards the suspicious packet to the Monitor through the supervisory LSP channel for detection, and takes corresponding actions according to the detection result fed back by the Monitor: if the detection passes, switch to the normal LSP channel to forward the message, otherwise, according to the predetermined forwarding The policy processes the packet accordingly.

Further, after the establishment of the supervision channel, it also includes:

The PE sends a supervision instance registration request to the Monitor through the supervision LSP channel, and after receiving the instance registration response fed back by the Monitor, a supervision path is established between the PE and the Monitor.

Further, the process of forwarding suspicious packets to Monitor for detection specifically includes:

Assign a supervision label to the supervision path established between the PE and the Monitor. After the PE adds a supervision label to the outer forwarding label of the received suspicious packet, it forwards it to the Monitor through the supervision path for detection.

Further, it also includes: when the policy route configured on the inbound interface of the PE is deleted, the PE sends a supervision instance withdrawal request, and after receiving the instance withdrawal response fed back by the Monitor, cancels the supervision path established between the PE and the Monitor.

Wherein, the routing policy includes at least: matching item rules and setting item forwarding entries.

The present invention also provides a system for realizing network information supervision, including: an operator's edge router PE and a supervisory router Monitor, wherein,

PE, which is used to establish a supervisory label switching path LSP channel with the Monitor and configure policy routing on the inbound interface of the PE; and forward suspicious packets to the Monitor through the supervisory LSP channel for detection according to the configured policy route, and according to the feedback from the Monitor The detection result takes corresponding actions: if the detection is passed, switch to the normal LSP channel to forward the message, otherwise the message will be processed accordingly according to the predetermined forwarding strategy;

Monitor, used to detect suspicious packets sent by PEs, and feed back the detection results to the corresponding PEs.

The present invention further provides a device for realizing network information supervision, including:

The channel establishment and management module is used to establish a supervisory LSP channel between the operator's edge router PE and the supervisory router Monitor;

A policy configuration module, configured to configure policy routing on the incoming interface of the PE;

The forwarding processing module is used to forward the suspicious message to the Monitor through the supervision LSP channel according to the configured policy routing, and perform corresponding actions according to the detection result fed back by the Monitor: if the detection passes, switch to the normal LSP channel to forward the message, Otherwise, the packet is processed accordingly according to a predetermined forwarding strategy.

Further, it also includes:

The instance management module is used to send a supervision instance registration request to the Monitor through the supervision LSP channel, and establish a supervision path between the PE and the Monitor after receiving the instance registration response fed back by the Monitor.

Further, it also includes:

The label processing module is used to assign a supervision label to the supervision path established between the PE and the Monitor, and put a supervision label on the outer forwarding label of the suspicious message received by the PE, and the forwarding processing module forwards it to the Monitor through the supervision path for further processing. detection.

Further, the instance management module is further configured to, after the policy routing configured on the inbound interface of the PE is deleted, send a supervision instance revocation request to the Monitor through the supervision LSP channel, and revoke the PE after receiving the instance revocation response fed back by the Monitor. The supervisory path established between Monitor and Monitor.

The beneficial effects of the present invention are as follows:

The present invention realizes the control of message forwarding by adding supervisory channels and switching between different channels with strategy routing technology, and completely realizes the control and processing of harmful information in the propagation process.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

FIG. 1 is a schematic structural diagram of a networking example of an embodiment of the present invention;

Fig. 2 is a schematic flow chart of the method described in the embodiment of the present invention;

Fig. 3 is a schematic structural diagram of the system described in the embodiment of the present invention;

Fig. 4 is a schematic structural diagram of the device described in the embodiment of the present invention.

Detailed ways

Preferred embodiments of the present invention will be specifically described below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of the application and are used together with the embodiments of the present invention to explain the principles of the present invention.

Firstly, the method described in the embodiment of the present invention will be described in detail with reference to accompanying drawings 1 and 2 .

For ease of description, the method described in the embodiment of the present invention will be described in detail below by taking the networking shown in FIG. 1 as an example.

As shown in Figure 1, CE1 (customer edge device) and CE2 are located in the same private network, and there is a normal LSP forwarding channel between PE1 (operator edge router) and PE2; a Monitor (monitoring router) is set in this network ), if it is necessary to supervise the packets passing through PE1, a supervision LSP channel needs to be established between Monitor and PE1; similarly, if it is necessary to supervise the packets passing through PE2, then a Supervise LSP channels.

As shown in Figure 2, Figure 2 is a schematic flow chart of the method described in the embodiment of the present invention. It is set that the message passing through PE1 needs to be supervised, then the method may specifically include the following steps:

Step 201: Establish a supervisory LSP channel between PE1 and Monitor by running a supervisory enable command;

Step 202: Configure policy-based routing on the incoming interface of PE1, the policy-based routing at least includes a Match (matching) item rule and a Set (setting) item forwarding entry, wherein the Match item rule is used to filter the packets passing through PE1, and determine the required Detected suspicious packets; the forwarding entry of the Set item is used to configure the monitoring path;

Step 203: the PE sends a supervision instance registration request to the Monitor through the supervision LSP channel, and after receiving the instance registration response fed back by the Monitor, establishes a supervision path between the PE and the Monitor, and assigns a supervision label to the supervision path;

Step 204: When a packet from CE1 passes through PE1, if it is determined to be a suspicious packet according to the policy routing, PE1 switches the forwarding path of the suspicious packet from the normal forwarding LSP channel to the supervisory LSP channel, and uses the policy label The forwarding technology marks the outer forwarding label of the suspicious message with a supervisory label and sends it to the Monitor for detection through the supervisory path;

Step 205: When the Monitor receives the suspicious message, it detects it, and sends a response message to PE1, and notifies PE1 of the detection result (pass or fail);

Step 206: PE1 takes corresponding actions according to the received detection result: if the detection passes, PE1 switches the forwarding path of the suspicious packet to the normal forwarding LSP channel again, otherwise, chooses to discard the packet according to the forwarding strategy configured in advance by the user or other methods, the specific processing method depends on the requirements of the operator.

Next, the system described in the embodiment of the present invention will be described in detail.

As shown in FIG. 3, FIG. 3 is a schematic structural diagram of the system according to the embodiment of the present invention, which may specifically include: Monitor and PE, wherein,

When a packet passing through a PE needs to be supervised, a supervisory label switching path LSP channel is established between the PE and the Monitor, and policy routing is configured on the incoming interface of the PE; suspicious packets are forwarded through the supervision LSP channel according to the configured policy route Detect to the Monitor, and take corresponding actions according to the detection result fed back by the Monitor: if the detection is passed, switch to the normal LSP channel to forward the message, otherwise process the message according to the predetermined forwarding strategy. The Monitor detects suspicious packets sent by PEs and feeds back the detection results to the corresponding PEs.

Finally, the device described in the embodiment of the present invention is described in detail.

As shown in Figure 4, Figure 4 is a schematic structural diagram of the device described in the embodiment of the present invention. The device described in the embodiment of the present invention can be set in a PE, and specifically can include: a channel establishment and management module, a policy configuration module, and a forwarding processing module , the instance management module and the label processing module, wherein,

A channel management module, which establishes a supervisory LSP channel between the edge router PE and the supervisory router Monitor;

The policy configuration module configures policy routing on the incoming interface of the PE, and the policy routing includes at least a Match (matching) item rule and a Set (setting) item forwarding entry, wherein the Match item rule is used to filter the packets passing through PE1, and determine Suspicious packets that need to be detected; the forwarding entry of the Set item is used to configure the monitoring path;

The forwarding processing module, according to the configured policy routing, forwards the suspicious message to the Monitor through the supervisory LSP channel for detection, and takes corresponding actions according to the detection result fed back by the Monitor: if the detection passes, switch to the normal LSP channel to forward the message, otherwise The message is processed accordingly according to a predetermined forwarding strategy.

The instance management module sends a supervision instance registration request to the Monitor through the supervision LSP channel, and establishes a supervision path between the PE and the Monitor after receiving the instance registration response fed back by the Monitor.

The label processing module assigns a supervision label to the supervision path established between the PE and the Monitor, and puts a supervision label on the outer forwarding label of the suspicious message received by the PE, and the forwarding processing module forwards it to the Monitor through the supervision path for detection.

When the policy route configured on the incoming interface of the PE is deleted, the instance management module sends a supervision instance revocation request to the Monitor through the supervision LSP channel, and after receiving the instance revocation response fed back by the Monitor, revokes the supervision path established between the PE and the Monitor .

It should be noted that, for the specific implementation process of the system and the device, since the above method has been described in detail, it will not be repeated here.

To sum up, the embodiment of the present invention provides a method, system and device for realizing network information supervision. The present invention adds supervisory LSP channels and uses policy routing technology to switch between supervisory LSP channels and normal LSP channels to realize The control of message forwarding fully realizes the control and processing of harmful information during the propagation process; it is more effective than existing post-event supervision methods and technologies, and the implementation method is simpler, which can meet the needs of large-scale deployment in the current network. need.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (10)

1. realize a method for network information monitoring, it is characterized in that, comprising:

Supervision label switching path LSP passage and the incoming interface collocation strategy route at PE is set up between provider edge router PE and supervision router Monitor;

Suspicious message is transmitted to Monitor by supervision LSP passage according to the policybased routing of configuration and detects by PE, and carry out corresponding actions according to the testing result of Monitor feedback: pass through if detected, be switched to normal LSP passage and forward this message, otherwise according to predetermined forwarding strategy, respective handling is carried out to this message.

2. method according to claim 1, is characterized in that, also comprises after setting up supervision passage:

PE sends supervision example registration request to Monitor by supervision LSP passage, and after the example registration response receiving Monitor feedback, sets up supervision path between PE and Monitor.

3. method according to claim 2, is characterized in that, the process that suspicious message repeating carries out detecting to Monitor is specifically comprised:

To the supervision path allocation set up between PE and Monitor one supervision label, after the outer forwarding label of PE to the suspicious message received stamps supervision label, be transmitted to Monitor by supervision path and detect.

4. according to the method in claim 2 or 3, it is characterized in that, also comprise: after the policybased routing configured at PE incoming interface is deleted, PE sends the request of supervision example revocation, and after the example revocation response receiving Monitor feedback, cancel the supervision path set up between PE and Monitor.

5. method according to claim 1, is characterized in that, described policybased routing at least comprises: occurrence rule and setting option forwarding entry.

6. realize a system for network information monitoring, it is characterized in that, comprising: provider edge router PE and supervision router Monitor, wherein,

PE, for and Monitor between set up supervision label switching path LSP passage and the incoming interface collocation strategy route at PE; And according to the policybased routing of configuration, suspicious message is transmitted to Monitor detects by supervising LSP passage, and carry out corresponding actions according to the testing result of Monitor feedback: pass through if detected, be switched to normal LSP passage and forward this message, otherwise according to predetermined forwarding strategy, respective handling is carried out to this message;

Monitor, detects for the suspicious message sent PE, and testing result is fed back to corresponding PE.

7. realize a device for network information monitoring, it is characterized in that, comprising:

Path Setup and administration module, for setting up supervision LSP passage between provider edge router PE and supervision router Monitor;

Strategy configuration module, for the incoming interface collocation strategy route at PE;

Forward process module, detect for suspicious message being transmitted to Monitor by supervision LSP passage according to the policybased routing of configuration, and carry out corresponding actions according to the testing result of Monitor feedback: pass through if detected, be switched to normal LSP passage and forward this message, otherwise according to predetermined forwarding strategy, respective handling is carried out to this message.

8. device according to claim 7, is characterized in that, also comprises:

Instance management module, for sending supervision example registration request to Monitor by supervision LSP passage, and after the example registration response receiving Monitor feedback, sets up supervision path between PE and Monitor.

9. device according to claim 8, is characterized in that, also comprises:

Label processing module, for giving supervision path allocation one supervision of setting up between PE and Monitor label, and supervision label is stamped to the outer forwarding label of the suspicious message that PE receives, be transmitted to Monitor by forward process module by supervision path and detect.

10. device according to claim 9, it is characterized in that, described instance management module also for, after the policybased routing of PE incoming interface configuration is deleted, the request of supervision example revocation is sent to Monitor by supervision LSP passage, and after the example revocation response receiving Monitor feedback, cancel the supervision path set up between PE and Monitor.