Back to results
US 12,695,722 B2Granted
Network traffic control method and related system
AssigneeHuawei Cloud Computing Technolgoies Co., Ltd.
InventorsZhaoyu Luo, Mian Guo, Jianbiao Li, Wei Deng
Life of this patent
Estimating the term…
Abstract
A firewall receives bypass traffic obtained by performing a copy operation on the network traffic, and detects a packet in the bypass traffic, to obtain a packet control message. The firewall control module receives the packet control message sent by the firewall, and performs a target operation such as forwarding, discarding, or buffering on a target packet in the plurality of packets. In this method, the firewall deployed in a bypass manner parses data in parallel, and the firewall control module does not need to parse any data.
Claims18
A method comprising:
- receiving, by a firewall controller of a control system, network traffic;
- buffering, by the firewall controller, a plurality of packets in the network traffic, wherein the plurality of packets comprises a first packet and a second packet that are associated with each other;
- receiving, by a firewall of the control system, bypass traffic based on a copy operation on the network traffic;
- detecting a packet in the bypass traffic in order to obtain a detected packet;
- generating a packet control message based on the detected packet, wherein the packet control message comprises:
- a first packet control message comprising both first packet identification information and first packet control information of the first packet;
- and
- a second packet control message comprising the first packet identification information, the first packet control information, second packet identification information, and second packet control information of the second packet;
- receiving, by the firewall controller, the packet control message from the firewall;
- and
- performing, based on the packet control message, a target operation on a target packet in the plurality of packets,
- wherein the target operation comprises forwarding, discarding, or buffering,
- wherein when the second packet control information indicates to discard the second packet, performing the target operation on the target packet in the plurality of packets comprises discarding, by the firewall controller, the first packet and the second packet,
- wherein the first packet control information indicates to buffer the first packet, wherein the first packet control information and the second packet control information indicate to discard the first packet and the second packet, and wherein receiving the packet control message from the firewall, and performing the target operation on the target packet comprises:
- receiving, by the firewall controller, the first packet control message;
- prolonging a buffer time of the first packet;
- receiving, by the firewall controller, the second packet control message;
- and
- discarding the first packet and the second packet.
16 more elements
A control system, comprising:
- a firewall controller configured to:
- receive network traffic;
- and
- buffer a plurality of packets in the network traffic, wherein the plurality of packets comprises a first packet and a second packet that are associated with each other;
- and
- a firewall configured to:
- receive bypass traffic based on a copy operation on the network traffic;
- detect a packet in the bypass traffic in order to obtain a detected packet;
- generate a packet control message based on the detected packet, wherein the packet control message comprises:
- a first packet control message comprising both first packet identification information and first packet control information of the first packet;
- and
- a second packet control message comprising the first packet identification information, the first packet control information, second packet identification information, and second packet control information of the second packet;
- receive the packet control message from the firewall;
- and
- perform, based on the packet control message, a target operation on a target packet in the plurality of packets, wherein the target operation comprises forwarding, discarding, or buffering,
- wherein the first packet control information indicates to buffer the first packet, wherein the first packet control information and the second packet control information indicate to discard the first packet and the second packet, and wherein the firewall controller is further configured to:
- receive the first packet control message and prolong buffer time of the first packet;
- and
- receive the second packet control message and discard the first packet and the second packet.
16 more elements
A computer program product comprising instructions that are stored on a non-transitory computer-readable medium and that, when executed by one or more processors, cause a control system to:
- receive network traffic;
- buffer a plurality of packets in the network traffic, wherein the plurality of packets comprises a first packet and a second packet that are associated with each other;
- perform a copy operation on the network traffic to obtain bypass traffic;
- detect a packet in the bypass traffic in order to obtain a detected packet;
- generate a packet control message based on the detected packet, wherein the packet control message comprises:
- a first packet control message comprising both first packet identification information and first packet control information of the first packet;
- and
- a second packet control message comprising the first packet identification information, the first packet control information, second packet identification information, and second packet control information of the second packet;
- and
- perform, based on the packet control message, a target operation on a target packet in the plurality of packets, wherein the target operation comprises forwarding, discarding, or buffering,
- wherein when the second packet control information indicates to discard the second packet, performing the target operation on the target packet in the plurality of packets comprises discarding the first packet and the second packet,
- wherein the first packet control information indicates to buffer the first packet, wherein the first packet control information and the second packet control information indicate to discard the first packet and the second packet, and wherein the instructions, when executed by the one or more processors, further cause the control system to perform the target operation on the target packet by:
- receiving the first packet control message and prolonging buffer time of the first packet;
- and
- receiving the second packet control message and discarding the first packet and the second packet.
12 more elements
Dependencies are inferred from the claim text.