CN106027405B - Data stream shunting method and device - Google Patents
Data stream shunting method and device Download PDFInfo
- Publication number
- CN106027405B CN106027405B CN201610289433.2A CN201610289433A CN106027405B CN 106027405 B CN106027405 B CN 106027405B CN 201610289433 A CN201610289433 A CN 201610289433A CN 106027405 B CN106027405 B CN 106027405B
- Authority
- CN
- China
- Prior art keywords
- data stream
- security
- maximum processing
- detection
- processing threshold
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/25—Flow control; Congestion control with rate being modified by the source upon detecting a change of network conditions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/29—Flow control; Congestion control using a combination of thresholds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
- H04L65/60—Network streaming of media packets
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N7/00—Television systems
- H04N7/18—Closed-circuit television [CCTV] systems, i.e. systems in which the video signal is not broadcast
Landscapes
- Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- Multimedia (AREA)
- Computer Networks & Wireless Communication (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to a data stream shunting method and a device, wherein the method comprises the following steps: judging whether the received data stream is the data stream subjected to security detection; forwarding the data stream which is judged to be subjected to security detection; for the data stream which is judged not to be subjected to the security detection, judging whether the flow of the data stream exceeds a maximum processing threshold value supported by equipment or not; when the flow of the data stream which is not subjected to the safety detection exceeds the maximum processing threshold value, performing safety detection on part of the data stream which does not exceed the maximum processing threshold value, and then forwarding the part of the data stream, which does not exceed the maximum processing threshold value, and forwarding a message load which exceeds the maximum processing threshold value in the data stream; and when the flow of the data stream which is not subjected to the safety detection does not exceed the maximum processing threshold value, carrying out safety detection on the data stream which is not subjected to the safety detection and then forwarding the data stream. The invention can solve the problem of low forwarding efficiency of the safety equipment when facing larger data stream in the related technology.
Description
Technical Field
The present invention relates to the field of communications technologies, and in particular, to a method and an apparatus for offloading a data stream.
Background
In the video monitoring system, the network camera may send the acquired data stream to the network storage device for storage to save the video monitoring data. In the process that the network camera sends the data stream to the network storage device, in order to avoid sending the data stream which is illegal, attacked, unauthorized and the like and can damage a storage system on the network storage device to the network storage device, related technologies add a network device which is a security device.
In the related art, the security device may be located between the network camera and the network storage device, and when the network camera sends the acquired data stream to the network storage device, the security device may detect the data stream and send the detected data stream to the network storage device.
As can be seen from the above, in the related art, the security device can detect the data stream sent by the network camera to the network storage device, but due to the limited processing performance of the security device, when a large data stream is faced, the security device needs a long time to detect the data stream, and at this time, the forwarding efficiency of the security device is low.
Disclosure of Invention
In order to overcome the problems in the related art, the invention provides a data stream shunting method and device.
The invention provides a data stream shunting method, which is applied to safety equipment in a video monitoring system comprising a plurality of safety equipment which are mutually cascaded, the video monitoring system also comprises front-end equipment and rear-end equipment, and the plurality of safety equipment which are mutually cascaded are connected between the front-end equipment and the rear-end equipment, and the method is characterized by comprising the following steps:
judging whether the received data stream is the data stream subjected to security detection;
forwarding the data stream which is judged to be subjected to security detection; for the data stream which is judged not to be subjected to the security detection, judging whether the flow of the data stream exceeds a maximum processing threshold value supported by equipment or not;
when the flow of the data stream which is not subjected to the safety detection exceeds the maximum processing threshold value, performing safety detection on part of the data stream which does not exceed the maximum processing threshold value, and then forwarding the part of the data stream, which does not exceed the maximum processing threshold value, and forwarding a message load which exceeds the maximum processing threshold value in the data stream; and when the flow of the data stream which is not subjected to the safety detection does not exceed the maximum processing threshold value, carrying out safety detection on the data stream which is not subjected to the safety detection and then forwarding the data stream.
As an improvement, the cascade interface on the security device includes a first-level connection port and a second-level connection port, where the first-level connection port is connected to the first-level connection port, the second-level connection port is connected to the second-level connection port, and only the first-level connection port learns the MAC address, and when the security device is connected to the front-end device and the back-end device through other security devices in the video monitoring system, the method further includes:
when the data stream is detected safely, the data stream is received and forwarded through a first-level connection interface;
and when the data stream is not subjected to security detection, receiving and forwarding the data stream through a second-stage connection interface.
As an improvement, the method further comprises:
when the flow of the data stream which is not subjected to the safety detection exceeds the maximum processing threshold value, dividing the data stream into a part of data stream which does not exceed the maximum processing threshold value and a message load which exceeds the maximum processing threshold value according to a preset shunting rule.
As an improvement, the splitting rule includes:
dividing the data stream into a plurality of sub-data streams;
performing different processing actions for the number of sub-data streams;
the dividing, according to a preset splitting rule, the data stream into a part of data stream that does not exceed the maximum processing threshold and a part of packet load that exceeds the maximum processing threshold, further includes:
based on the shunting rule, carrying out safety detection on part of the data streams which do not exceed the maximum processing threshold value, and forwarding the part of the data streams after the safety detection through a primary connection port;
and forwarding the message load exceeding the maximum processing threshold value in the data stream through a second-level connection port based on the shunting rule.
As an improvement, the method further comprises:
when the safety equipment is the safety equipment which is closest to the front-end equipment in the hierarchy in the mutually cascaded safety equipment, the safety equipment performs data stream interaction with the front-end equipment through a preset interface;
and when the safety equipment is the safety equipment with the hierarchy closest to the back-end equipment in the mutually cascaded safety equipment, the safety equipment performs data stream interaction with the back-end equipment through a preset interface.
The invention also provides a data stream shunting device, which is applied to safety equipment in a video monitoring system comprising a plurality of safety equipment which are mutually cascaded, the video monitoring system also comprises front-end equipment and rear-end equipment, and the plurality of safety equipment which are mutually cascaded are connected between the front-end equipment and the rear-end equipment, and the device is characterized by comprising:
the judging module is used for judging whether the received data stream is the data stream subjected to the safety detection;
the first processing module is used for forwarding the data stream which is judged to be subjected to the safety detection; for the data stream which is judged not to be subjected to the security detection, judging whether the flow of the data stream exceeds a maximum processing threshold value supported by equipment or not;
the second processing module is configured to, when the traffic of the data stream that is not subjected to security detection exceeds the maximum processing threshold, forward the data stream after performing security detection on a part of the data stream that does not exceed the maximum processing threshold, and forward a packet load that exceeds the maximum processing threshold in the data stream; and when the flow of the data stream which is not subjected to the safety detection does not exceed the maximum processing threshold value, carrying out safety detection on the data stream which is not subjected to the safety detection and then forwarding the data stream.
As an improvement, the cascade interface on the security device includes a first-level connection port and a second-level connection port, wherein the first-level connection port is connected with the first-level connection port, the second-level connection port is connected with the second-level connection port between two security devices of adjacent levels, and only the first-level connection port learns the MAC address, when the security device is connected with the front-end device and the back-end device through other security devices in the video monitoring system, the apparatus further includes:
the third processing module is used for receiving and forwarding the data stream through the first-level connection port when the data stream is subjected to security detection; and when the data stream is not subjected to security detection, receiving and forwarding the data stream through a second-stage connection interface.
As an improvement, the apparatus further comprises:
and the dividing module is used for dividing the data stream into a part of data stream which does not exceed the maximum processing threshold and a message load which exceeds the maximum processing threshold according to a preset shunting rule when the flow of the data stream which is not subjected to the safety detection exceeds the maximum processing threshold.
As an improvement, the splitting rule includes:
dividing the data stream into a plurality of sub-data streams;
performing different processing actions for the number of sub-data streams;
the partitioning module is further configured to:
based on the shunting rule, carrying out safety detection on part of the data streams which do not exceed the maximum processing threshold value, and forwarding the part of the data streams after the safety detection through a primary connection port;
and forwarding the message load exceeding the maximum processing threshold value in the data stream through a second-level connection port based on the shunting rule.
As an improvement, the apparatus further comprises:
the interaction module is used for carrying out data stream interaction on the safety equipment and the front-end equipment through a preset interface when the safety equipment is the safety equipment which is closest to the front-end equipment in the hierarchy in the mutually cascaded safety equipment; and when the safety equipment is the safety equipment with the hierarchy closest to the back-end equipment in the mutually cascaded safety equipment, the safety equipment performs data stream interaction with the back-end equipment through a preset interface.
In the invention, the safety device in the video monitoring system can firstly judge whether the received data stream is the data stream which is subjected to the safety detection, and forwards the data stream which is judged to be subjected to the safety detection; the security device may determine whether the traffic of the data stream that is not subjected to security detection exceeds a maximum processing threshold supported by the device, and when the traffic of the data stream that is not subjected to security detection exceeds the maximum processing threshold, may forward a part of the data stream that does not exceed the maximum processing threshold after performing security detection on the part of the data stream that does not exceed the maximum processing threshold, and forward a part of a packet load that exceeds the maximum processing threshold in the data stream; when the traffic of the data stream that is not subjected to security detection does not exceed the maximum processing threshold, the security device may perform security detection on the data stream that is not subjected to security detection and then forward the data stream.
The invention can use a plurality of safety devices to detect the data stream, thereby solving the problem of low forwarding efficiency of the safety devices when facing larger data stream in the related technology.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention.
Fig. 1 is a network diagram illustrating a related art video surveillance system.
Fig. 2 is a flowchart illustrating a data stream splitting method according to an embodiment of the present invention.
Fig. 3 is a schematic diagram showing one type of security device cascaded to each other.
Fig. 4 is a diagram of an application scenario for implementing data stream splitting by applying the present invention.
Fig. 5 is a block diagram of a hardware structure of a data stream splitting apparatus according to an embodiment of the present invention.
Fig. 6 is a block diagram illustrating a data flow splitting apparatus according to an exemplary embodiment of the present invention.
Detailed Description
Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the invention, as detailed in the appended claims.
Referring to fig. 1, fig. 1 is a network diagram illustrating a video monitoring system in the related art.
In the video monitoring system shown in fig. 1, a front-end device IPC (IP Camera), a back-end device IPSAN (IP Storage Area Network), and a security device disposed between the IPC and the IPSAN are included.
When the IPC obtains the data stream, it may send the data stream to the IPSAN for saving. In order to avoid sending malicious content, which may damage a storage system on the IPSAN, to the IPSAN, such as illegal, attack, unauthorized, and the like in the data stream, security equipment is added in the video monitoring system to perform security detection on the data stream sent by the IPC to the IPSAN.
As shown in fig. 1, the security device may receive the data stream sent by the IPC to the IPSAN, analyze and process the data stream, and thereby determine that the data stream sent to the IPSAN is a secure data stream. However, since the processing capability of the security device is limited, when a large data stream is faced, the security device needs a long time to perform security detection on the data stream, thereby causing a problem of inefficient forwarding of the data stream.
In the invention, the safety device in the video monitoring system can firstly judge whether the received data stream is the data stream which is subjected to the safety detection, and forwards the data stream which is judged to be subjected to the safety detection; and further judging the data stream which is judged not to be subjected to the security detection, wherein the security device can judge whether the flow volume of the data stream which is not subjected to the security detection exceeds a maximum processing threshold value supported by the device, and when the flow volume of the data stream which is not subjected to the security detection exceeds the maximum processing threshold value, the security device can forward the part of the data stream which does not exceed the maximum processing threshold value after performing the security detection, and forward the part of the message load which exceeds the maximum processing threshold value in the data stream; when the traffic of the data stream that is not subjected to security detection does not exceed the maximum processing threshold, the security device may perform security detection on the data stream that is not subjected to security detection and then forward the data stream.
The invention can use a plurality of safety devices to detect the data stream, thereby solving the problem of low forwarding efficiency of the safety devices when facing larger data stream in the related technology.
Referring to fig. 2, a flowchart of a data stream splitting method is shown for an embodiment of the present invention, where the embodiment is applied to a security device in a video surveillance system including a plurality of security devices cascaded to each other, and includes the following steps:
step 201: and judging whether the received data stream is the data stream subjected to security detection.
In the invention, the video monitoring system may include an IPC at a front end of the monitoring, an IPSAN at a back end of the monitoring, and a plurality of security devices connected between the IPC and the IPSAN and cascaded with each other through a cascade interface.
In the present invention, the security device may include an ingress interface for receiving IPC traffic and an egress interface for sending traffic to the IPSAN. In addition, a cascade interface may be included on the security device in addition to the outbound and inbound interfaces shown above.
The cascade interface can comprise a first-level connection port and a second-level connection port, wherein the first-level connection port is connected with the first-level connection port between two safety devices of adjacent levels, and the second-level connection port is connected with the second-level connection port.
The first-stage connection interface may be an interface on the security device for forwarding a data stream that has undergone security detection by the security device, and the second-stage connection interface may be an interface on the security device for forwarding a data stream that has not undergone security detection by the security device.
Because the first-level connection interface is used for forwarding the data stream after the security device security detection to the next cascaded security device in the security device group, the first-level connection interface can only participate in MAC address learning in the first-level connection interface and the second-level connection interface; for example, in practical application, the first-level interface may learn, by monitoring a packet, the MAC address of the IPSAN and the first-level interface interfacing with the first-level interface on the next cascaded security device in the security device group.
Referring to fig. 3, fig. 3 is a schematic diagram illustrating a security device cascade connection.
The interface a of the security device 1 is an ingress interface for receiving IPC traffic, and the interface J of the security device 3 is an egress interface for sending traffic to the IPSAN. Except for the interface A and the interface J, 8 interfaces from the interface B to the interface I in the three safety devices are cascade interfaces. The interface B of the safety device 1, the interface D and the interface F of the safety device 2 and the interface H of the safety box 3 are all primary connecting interfaces; the interface C of the safety device 1, the interface E and the interface G of the safety device 2 and the interface I of the safety device 3 are all second-level connecting interfaces. In fig. 3, the safety device 1 and the safety device 2 can be cascaded by connecting the interface B with the interface D and connecting the interface C with the interface E; the security device 2 and the security device 3 may be cascaded by connecting the interface F to the interface H and connecting the interface G to the interface I.
After the security device in fig. 3 is cascaded by the above method, when the security device 1 receives a data stream sent by IPC through the input interface a, security detection may be performed on all the received data streams or on a part of the received data streams, and then the security box 1 may send the data stream subjected to security detection to the D interface of the security device 2 through the interface B; and sending the message load which is not subjected to the security detection to an interface E of the security device 2 through an interface C. The safety device 2 can send the data stream subjected to the safety detection to an H interface of the safety device 3 through an F interface; and sending the message load which is not subjected to the security detection to an I interface of the security device 3 through an interface G. After receiving the data stream through the H interface, the security box 3 may send the data stream to the IPSAN through the output interface J; after receiving the message load through the I interface, the security device 3 can perform security detection on the message load and send the message load after the security detection to the IPSAN through the interface J.
In the present invention, a splitting rule may be preset, where the splitting rule may be a rule that divides a received data stream into a plurality of sub-data streams and performs different processing actions for the plurality of sub-data streams. When receiving a data stream whose flow size is not detected safely and exceeds the maximum processing threshold, the security device may use the splitting rule and divide the received data stream according to the splitting rule, so that the security device may perform different processing actions on the divided different sub-data streams. For example, the security device may divide the received data stream into two parts, namely a partial data stream and a packet load according to the offloading rule, perform security detection on only the partial data stream, and then forward the partial data stream after the security detection and the packet load that has not undergone the security detection.
In an embodiment, the splitting rule may specify a cascade interface for the divided different data streams, for example, the splitting rule may specify a first-level connection interface for a part of the data streams subjected to security detection, and the part of the data streams may be forwarded through the first-level connection interface; the distribution rule may also assign a second level connection port for a message load that has not undergone security detection, and the message load may be forwarded through the second level connection port.
In the invention, when the security device in the video monitoring system receives the data stream, before selecting to perform security detection on all the received data streams or perform security detection on part of the received data streams, whether the data stream is the data stream subjected to the security detection can be judged.
When the safety equipment for receiving the data stream is the safety equipment connected with the IPC through other safety equipment in the video monitoring system, the safety equipment can receive the data stream through a first-level connection port or a second-level connection port; when the security device receiving the data stream is the security device closest to the IPC in the hierarchy among the security devices cascaded with each other in the video monitoring system, the security device may receive the data stream through the ingress interface.
It should be noted that, the technology of determining whether a certain data stream is a data stream subjected to security detection is the prior art, and therefore, the present invention is not described herein again.
Step 202: forwarding the data stream which is judged to be subjected to security detection; for the data stream which is judged not to be subjected to the security detection, judging whether the flow of the data stream exceeds a maximum processing threshold value supported by equipment or not;
in the invention, the data stream which is judged to be subjected to the security detection can be forwarded. When the security device is a security device connected to the IPSAN through another security device in the video monitoring system, the security device may forward the data stream subjected to security detection to a security device of a next level through the first-level connection interface; when the security device is a security device closest to the IPSAN in the hierarchy among the security devices cascaded with each other in the video monitoring system, the security device may send the data stream to the backend device through the outgoing interface.
For a data stream determined not to have undergone security detection, the security device may further determine whether a traffic size of the data stream exceeds a maximum processing threshold supported by the security device.
It should be noted that the maximum processing threshold of the security device may be set by the performance of the device or by user customization, and the maximum processing thresholds of different security devices may be different, which is not limited in the present invention.
Step 203: when the flow of the data stream which is not subjected to the safety detection exceeds the maximum processing threshold value, performing safety detection on part of the data stream which does not exceed the maximum processing threshold value, and then forwarding the part of the data stream, which does not exceed the maximum processing threshold value, and forwarding a message load which exceeds the maximum processing threshold value in the data stream; and when the flow of the data stream which is not subjected to the safety detection does not exceed the maximum processing threshold value, carrying out safety detection on the data stream which is not subjected to the safety detection and then forwarding the data stream.
In the invention, when the flow size of the received data stream does not exceed the maximum processing threshold of the device, the data stream can be subjected to security detection. The process of security detection on the data stream by the security device is the prior art, and the present invention is not described herein again.
After the data stream is subjected to security detection, if the current security device is not the security device with the hierarchy closest to the IPSAN among the security devices which are cascaded with each other, the security device can send the data stream after security detection to the security device with the hierarchy closest to the IPSAN through the first-level connection port on the security device and the first-level connection ports of a plurality of security devices between the security device and the security device with the hierarchy closest to the IPSAN, and after the security device with the hierarchy closest to the IPSAN receives the data stream, the data stream can be sent to the IPSAN through the outgoing interface.
Of course, if the current security device is the security device closest to the IPSAN in the above hierarchy, the security device may send the security-detected data stream to the IPSAN through the egress interface.
In one embodiment, when one security device in the video monitoring system is connected to the IPSAN through other security devices, the security device may forward the data stream after security detection to the security device closest to the IPSAN in the above-mentioned hierarchy through the first-level connection port, based on the MAC address learned by the first-level connection ports of several security devices.
In the invention, when the flow of the received data stream which is not subjected to security detection exceeds the maximum processing threshold value of the equipment, the part of the data stream which does not exceed the maximum processing threshold value in the data stream can be forwarded after security detection, and the message load which exceeds the maximum processing threshold value in the data stream can be forwarded.
When the security device is not the security device whose hierarchy is closest to the IPSAN, the security device may forward the part of the data stream that does not exceed the maximum processing threshold through the first-level connection port after performing security detection on the part of the data stream, and forward the packet load that exceeds the maximum processing threshold in the data stream to the security device of the next hierarchy through the second-level connection port, so that the security device of the next hierarchy performs security detection on the packet load.
In one embodiment, for a security device whose hierarchy is not closest to the IPSAN, when the traffic size of a received data stream without security detection exceeds a maximum processing threshold supported by the security device, a preset splitting rule may be used to split the data stream into a partial data stream that does not exceed the maximum processing threshold and a packet load that exceeds the maximum processing threshold. Then, the security device may forward the part of the data stream that does not exceed the maximum processing threshold through the first-level connection interface after performing security detection on the part of the data stream based on the offloading rule, and forward the packet load that exceeds the maximum processing threshold through the second-level connection interface.
In one embodiment shown, assuming that the maximum processing threshold of a security device not hierarchically closest to the IPSAN is 300Mb and the traffic size of a data stream received by the security device is 500Mb, the security device may split the data stream into a first partial data stream and a second partial packet load based on a splitting rule. Wherein, the first partial data stream is a partial data stream 300Mb before the data stream; the second partial message load is 200Mb after the data flow. Then, the security device can perform security detection on the first part of data stream, and send the first part of data stream after security detection to the first-level connection port of the security device of the next level through the first-level connection port; the security device may not perform security detection on the second part of the packet load, but forward the second part of the packet load to the second-level connection port of the security device of the next hierarchy through the second-level connection port, so as to perform security detection by the security device of the next hierarchy.
Of course, when the security device allocates the splitting rule to the data stream whose traffic exceeds the maximum processing threshold, the security device may first identify the data stream based on the quintuple information of the data stream, so as to determine which IPC the data stream is sent out by.
In the present invention, when the traffic size of the received data stream that is not subjected to security detection does not exceed the maximum processing threshold of the security device, the security device may not use the splitting rule to split the data stream.
In an embodiment, when the IPC streaming rate in the video monitoring system increases, so that the traffic of the part of the data stream that does not exceed the maximum processing threshold increases to exceed the maximum processing threshold, the security device may partition the part of the data stream that exceeds the maximum processing threshold in the packet load that exceeds the maximum processing threshold, so that the security device may complete security detection on the part of the data stream that does not exceed the maximum processing threshold.
In the invention, the safety device in the video monitoring system can firstly judge whether the received data stream is the data stream which is subjected to the safety detection, and forwards the data stream which is judged to be subjected to the safety detection; and further judging the data stream which is judged not to be subjected to the security detection, wherein the security device can judge whether the flow volume of the data stream which is not subjected to the security detection exceeds a maximum processing threshold value supported by the device, and when the flow volume of the data stream which is not subjected to the security detection exceeds the maximum processing threshold value, the security device can forward the part of the data stream which does not exceed the maximum processing threshold value after performing the security detection, and forward the part of the message load which exceeds the maximum processing threshold value in the data stream; when the traffic of the data stream that is not subjected to security detection does not exceed the maximum processing threshold, the security device may perform security detection on the data stream that is not subjected to security detection and then forward the data stream.
The invention can use a plurality of safety devices to detect the data stream, thereby solving the problem of low forwarding efficiency of the safety devices when facing larger data stream in the related technology.
The above embodiments are described in detail below with reference to application scenarios:
fig. 4 is a diagram of an application scenario for implementing data stream splitting according to the present invention. In fig. 4, the security devices 1, 2, and 3 may be cascaded with each other, and the three security devices may be located between IPC and IPSAN. The three security devices may include, among other things, an ingress interface a for receiving IPC traffic and an egress interface J for sending traffic to the IPSAN. In addition, in addition to the outgoing and incoming interfaces shown above, cascaded interfaces B through I may also be included on the security device.
It should be noted that the video surveillance system may include a plurality of security devices, and the inclusion of 3 security devices shown in fig. 4 is merely an illustrative example.
The cascade interfaces B to I can be divided into a first-stage interface (e.g. B, D, F and H interface in fig. 4) and a second-stage interface (e.g. C, E, G and I interface in fig. 4). The safety devices 1 and 2 and the safety devices 2 and 3 are connected with each other through a first-level connecting port and a second-level connecting port respectively.
The manner of cascading between security devices of adjacent levels in the video surveillance system has been described in detail in the above embodiments, and the present invention is not described in detail in this embodiment.
The first-stage connection interface may be an interface on the security device for forwarding a data stream that has undergone security detection by the security device, and the second-stage connection interface may be an interface on the security device for forwarding a data stream that has not undergone security detection by the security device.
Since the first-level connection interface is used for forwarding the data stream after the security device security detection to the next cascaded security device in the security device group, the MAC address can be learned only by the first-level connection interface in the first-level connection interface and the second-level connection interface.
When the IPC sends the acquired data stream to the IPSAN, the security device in the video monitoring system may perform security detection on the data stream, and send the data stream passing the security detection to the IPSAN.
When the IPC acquires the data stream, the data stream may be sent to the security device 1 connected to the IPC, after the security device 1 receives the data stream through the interface a, it may be determined that the data stream is a data stream that has not undergone security detection, and then the security device 1 may further determine whether the traffic volume of the data stream exceeds the maximum processing threshold value supported by the security device. Since the determination process is prior art, the present invention is not limited thereto.
It should be noted that the maximum processing threshold of the security device may be set by the performance of the device or by user customization, and the maximum processing thresholds of different security devices may be different, so the present invention is not limited to this.
After the above determination process is completed, if the size of the data stream does not exceed the maximum processing threshold of the security device 1, the security device 1 may perform security detection on the data stream, and forward the data stream after security detection.
In an embodiment, the security device 1 may first send the data stream after security detection to the first-level interface D of the security device 2 through the first-level interface B, and then after receiving the data stream through the interface D, the security device 2 may determine that the data stream is the data stream after security detection through analysis of the data stream, so that the security device 2 may not perform security detection on the data stream, but forward the data stream to the first-level interface H of the security device 3 through the first-level interface F based on its own MAC address table, and after receiving the data stream through the interface H, the security device 3 may determine that the data stream is the data stream after security detection through analysis of the data stream, so the security box 3 may not perform security detection on the data stream, and send the data stream to the IPSAN through the interface J.
In the illustrated embodiment, it may be assumed that the maximum processing threshold of the security device 1 is 300Mb and that the traffic size of the data stream received by the security device 1 from the interface a is 100 Mb. The security device 1 may determine that the flow of the data stream that is not subjected to security detection does not exceed the maximum processing threshold value, then the security device 1 may perform security detection on the data stream, and send the data stream that is subjected to security detection to the first-stage interface D of the security device 2 through the first-stage interface B based on the MAC address table of the security device 1, after the security device 2 receives the data stream through the interface D, it may be determined that the data stream is a data stream that is subjected to security detection, then the security device 2 may send the data stream to the first-stage interface H of the security device 3 through the first-stage interface F based on the MAC address table of the security device 2, after the security device 3 receives the data stream through the interface H, it may be determined that the data stream is a data stream that is subjected to security detection, and then the security device 3 sends the data stream to the IPSAN through the interface J.
In the present invention, if the flow of the data stream received by the security device 1 exceeds the maximum processing threshold of the security device 1, the security device 1 may perform security detection on a part of the data stream that does not exceed the maximum processing threshold, and forward the part of the data stream after the security detection through the primary connection port. The specific process may be the same as the above embodiment, and the present invention is not described herein again.
In another embodiment, if the traffic of the data stream received by the security device 1 exceeds the maximum processing threshold of the security device 1, the security device 1 may send, through the preset second-level interface, the packet load exceeding the maximum processing threshold in the data stream to the security device of the next hierarchy, that is, the security device 2, for security detection. Specifically, the security device 1 may send the message load to the second-level connection interface E of the security device 2 through the first-level connection interface C, so that the security device 2 may perform security detection on the message load.
In the present invention, when the security device 1 receives a data stream exceeding the maximum processing threshold, the data stream may be divided into two parts, that is, a part of the data stream not exceeding the maximum processing threshold and a part of the message load exceeding the maximum processing threshold, based on a preset splitting rule. Then, the security device 1 may perform security detection on the partial data stream that does not exceed the maximum processing threshold based on the offloading rule, and forward the partial data stream to the first-level connection port of the security device 2 through the first-level connection port, and forward the packet load that exceeds the maximum processing threshold to the second-level connection port of the security device 2 through the second-level connection port.
In one embodiment shown, assuming that the maximum processing threshold of the security device 1 is 300Mb, when the security device 1 receives a data stream with a traffic size of 500Mb, the security device 1 may divide the data stream into two parts based on a preset splitting rule, wherein the first part is a first 300Mb part of the data stream, and the second part is a second 200Mb message load of the data stream. The safety device 1 can perform safety detection on the first 300Mb partial data stream, and send the first 300Mb partial data stream after the safety detection to the first-level connection port D of the safety device 2 through the first-level connection port B based on the shunting rule, after receiving the partial data stream after the safety detection through the interface D, the safety device 2 can send the partial data stream to the first-level connection port H of the safety device 3 through the first-level connection port F, and after receiving the partial data stream through the first-level connection port H, the safety device 3 can send the partial data stream to the IPSAN through the interface J; the security device 1 may not perform security detection on the message load of the last 200Mb, but send it to the second-level interface E of the security devices 2 cascaded with each other through the second-level interface C to perform security detection. After receiving the message load through the interface E, the security device 2 may determine that the message load has not undergone security detection, and then the security device 2 may perform security detection on the message load. Assuming that the maximum processing threshold of the security device 2 is 100Mb, the security device 2 determines that the traffic of the packet load exceeds the maximum processing threshold, and at this time, the security device 2 may divide the packet load into a partial packet load that does not exceed the maximum processing threshold and a packet that exceeds the maximum processing threshold based on a preset splitting rule, that is, the security device 2 may divide the first 100Mb of the packet load of the last 200Mb into a partial packet load of the first 100Mb and divide the last 100Mb of the packet load of the last 200Mb into a packet of the last 100 Mb. Then, the security device 2 can perform security detection on the first 100Mb of partial message load, and send the partial message load after the security detection to the first-level interface H of the security device 3 through the first-level interface F, and after receiving the partial message load through the interface H, the security device 3 can send the partial message load to the IPSAN through the interface J; the security device 2 may not perform security detection on the message with the next 100Mb, but use the second shunting rule to send the part of the message to the second-level connection port I of the security device 3 through the second-level connection port G, and after receiving the message through the interface I, the device 3 may determine that the message has not undergone security detection, and then the security device 3 may perform security detection on the message, and send the message after security detection to the IPSAN through the interface J.
Of course, when the security device allocates the splitting rule to the data stream whose traffic exceeds the maximum processing threshold, the security device may first identify the data stream based on the quintuple information of the data stream, so as to determine which IPC the data stream is sent out by.
In one embodiment, when the IPC (e.g., IPC1 in fig. 4) sending rate in the video monitoring system increases, so that the traffic size of the part of the data stream that does not exceed the maximum processing threshold increases to exceed the maximum processing threshold, the security device may partition the part of the data stream that exceeds the maximum processing threshold into the packet load that exceeds the maximum processing threshold, so that the security device may complete security detection on the part of the data stream that does not exceed the maximum processing threshold.
In another embodiment, when the traffic size of the received data stream without security detection does not exceed the maximum processing threshold of the security device, the security device may not shunt the data stream using the above-mentioned shunting rule.
In the invention, the safety device in the video monitoring system can firstly judge whether the received data stream is the data stream which is subjected to the safety detection, and forwards the data stream which is judged to be subjected to the safety detection; and further judging the data stream which is judged not to be subjected to the security detection, wherein the security device can judge whether the flow volume of the data stream which is not subjected to the security detection exceeds a maximum processing threshold value supported by the device, and when the flow volume of the data stream which is not subjected to the security detection exceeds the maximum processing threshold value, the security device can forward the part of the data stream which does not exceed the maximum processing threshold value after performing the security detection, and forward the part of the message load which exceeds the maximum processing threshold value in the data stream; when the traffic of the data stream that is not subjected to security detection does not exceed the maximum processing threshold, the security device may perform security detection on the data stream that is not subjected to security detection and then forward the data stream.
The invention can use a plurality of safety devices to detect the data stream, thereby solving the problem of low forwarding efficiency of the safety devices when facing larger data stream in the related technology.
Based on the same inventive concept as the method, the embodiment of the present invention further provides an embodiment of a data stream offloading device, which can be applied to a security device. The data stream shunting device may be implemented by software, or may be implemented by hardware or a combination of hardware and software. The software implementation is taken as an example, and as a logical device, the device is formed by reading corresponding computer program instructions in the nonvolatile memory into the memory through the processor where the device is located and running the computer program instructions. In an application aspect, as shown in fig. 5, the hardware structure block diagram of the shunting device for data flow in the embodiment of the present invention is shown, and besides the processor, the network interface, the memory, and the nonvolatile memory shown in fig. 5, the hardware structure block diagram may further include other hardware, such as a camera device, a forwarding chip responsible for processing a packet, and the like.
As shown in fig. 6, which is a block diagram of a data stream splitting apparatus according to an exemplary embodiment of the present invention, the apparatus includes: a judging module 610, a first processing module 620 and a second processing module 630.
The determining module 610 is configured to determine whether the received data stream is a data stream subjected to security detection;
a first processing module 620, configured to forward, for a data stream determined to be subjected to security detection, the data stream; for the data stream which is judged not to be subjected to the security detection, judging whether the flow of the data stream exceeds a maximum processing threshold value supported by equipment or not;
a second processing module 630, configured to forward, after performing security detection on a portion of the data stream that does not exceed the maximum processing threshold when the traffic of the data stream that does not undergo security detection exceeds the maximum processing threshold, a packet load that exceeds the maximum processing threshold in the data stream; and when the flow of the data stream which is not subjected to the safety detection does not exceed the maximum processing threshold value, carrying out safety detection on the data stream which is not subjected to the safety detection and then forwarding the data stream.
In an optional implementation manner, the cascade interface on the security device includes a first-level connection port and a second-level connection port, where the first-level connection port is connected to the first-level connection port, the second-level connection port is connected to the second-level connection port, and only the first-level connection port learns the MAC address, and when the security device is connected to the front-end device and the back-end device through other security devices in the video surveillance system, the apparatus may further include (not shown in fig. 6):
the third processing module 640 is configured to receive and forward the data stream through the first-stage connection interface when the data stream is a data stream subjected to security detection; and when the data stream is not subjected to security detection, receiving and forwarding the data stream through a second-stage connection interface.
In an alternative implementation, the apparatus may further include (not shown in fig. 6):
the dividing module 650 is configured to, when the traffic of the data stream that is not subjected to the security detection exceeds the maximum processing threshold, divide the data stream into a part of data stream that does not exceed the maximum processing threshold and a message load that exceeds the maximum processing threshold according to a preset splitting rule.
In an optional implementation manner, the splitting rule may include:
dividing the data stream into a plurality of sub-data streams;
performing different processing actions for the number of sub-data streams;
the partitioning module 650 may be further configured to:
based on the shunting rule, carrying out safety detection on part of the data streams which do not exceed the maximum processing threshold value, and forwarding the part of the data streams after the safety detection through a primary connection port;
and forwarding the message load exceeding the maximum processing threshold value in the data stream through a second-level connection port based on the shunting rule.
In an alternative implementation, the apparatus may further include (not shown in fig. 6):
the interaction module is used for carrying out data stream interaction on the safety equipment and the front-end equipment through a preset interface when the safety equipment is the safety equipment which is closest to the front-end equipment in the hierarchy in the mutually cascaded safety equipment; and when the safety equipment is the safety equipment with the hierarchy closest to the back-end equipment in the mutually cascaded safety equipment, the safety equipment performs data stream interaction with the back-end equipment through a preset interface.
In the invention, the safety device in the video monitoring system can firstly judge whether the received data stream is the data stream which is subjected to the safety detection, and forwards the data stream which is judged to be subjected to the safety detection; and further judging the data stream which is judged not to be subjected to the security detection, wherein the security device can judge whether the flow volume of the data stream which is not subjected to the security detection exceeds a maximum processing threshold value supported by the device, and when the flow volume of the data stream which is not subjected to the security detection exceeds the maximum processing threshold value, the security device can forward the part of the data stream which does not exceed the maximum processing threshold value after performing the security detection, and forward the part of the message load which exceeds the maximum processing threshold value in the data stream; when the traffic of the data stream that is not subjected to security detection does not exceed the maximum processing threshold, the security device may perform security detection on the data stream that is not subjected to security detection and then forward the data stream.
The invention can use a plurality of safety devices to detect the data stream, thereby solving the problem of low forwarding efficiency of the safety devices when facing larger data stream in the related technology.
Other embodiments of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the invention and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims.
It will be understood that the invention is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the invention is limited only by the appended claims.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.
Claims (8)
1. A method for shunting data stream is applied to a security device in a video monitoring system comprising a plurality of security devices which are cascaded with each other, the video monitoring system further comprises a front-end device and a back-end device, the plurality of security devices which are cascaded with each other are connected between the front-end device and the back-end device, and the method is characterized by comprising the following steps:
judging whether the received data stream is the data stream subjected to security detection;
forwarding the data stream which is judged to be subjected to security detection; for the data stream which is judged not to be subjected to the security detection, judging whether the flow of the data stream exceeds a maximum processing threshold value supported by equipment or not;
when the flow of the data stream which is not subjected to the safety detection exceeds the maximum processing threshold, dividing the data stream into two parts, namely a part of data stream which does not exceed the maximum processing threshold and a message load which exceeds the maximum processing threshold, according to a preset shunting rule, and forwarding the part of data stream which does not exceed the maximum processing threshold after carrying out the safety detection on the part of data stream which does not exceed the maximum processing threshold, and forwarding the message load which exceeds the maximum processing threshold in the data stream; when the flow of the data stream which is not subjected to the safety detection does not exceed the maximum processing threshold value, the data stream which is not subjected to the safety detection is forwarded after the safety detection;
wherein the splitting rule comprises:
dividing the data stream into a plurality of sub-data streams;
different processing actions are performed for the several sub-data streams.
2. The method of claim 1, wherein the cascade interface on the security device comprises a first-level interface and a second-level interface, wherein the first-level interface is connected with the first-level interface and the second-level interface is connected with the second-level interface between two security devices of adjacent levels, and only the first-level interface learns the MAC address, and when the security device is connected with the front-end device and the back-end device through other security devices in the video surveillance system, the method further comprises:
when the data stream is detected safely, the data stream is received and forwarded through a first-level connection interface;
and when the data stream is not subjected to security detection, receiving and forwarding the data stream through a second-stage connection interface.
3. The method according to claim 2, wherein the dividing the data stream into two parts, namely a part of data stream that does not exceed the maximum processing threshold and a packet load that exceeds the maximum processing threshold according to a preset splitting rule, further comprises:
based on the shunting rule, carrying out safety detection on part of the data streams which do not exceed the maximum processing threshold value, and forwarding the part of the data streams after the safety detection through a primary connection port;
and forwarding the message load exceeding the maximum processing threshold value in the data stream through a second-level connection port based on the shunting rule.
4. The method of claim 2, further comprising:
when the safety equipment is the safety equipment which is closest to the front-end equipment in the hierarchy in the mutually cascaded safety equipment, the safety equipment performs data stream interaction with the front-end equipment through a preset interface;
and when the safety equipment is the safety equipment with the hierarchy closest to the back-end equipment in the mutually cascaded safety equipment, the safety equipment performs data stream interaction with the back-end equipment through a preset interface.
5. The utility model provides a diverging device of data flow, is applied to the security device among the video monitoring system that includes a plurality of security devices that cascade each other, video monitoring system still includes front end equipment and back end equipment, a plurality of security devices that cascade each other are connected the front end equipment with between the back end equipment, its characterized in that, the device includes:
the judging module is used for judging whether the received data stream is the data stream subjected to the safety detection;
the first processing module is used for forwarding the data stream which is judged to be subjected to the safety detection; for the data stream which is judged not to be subjected to the security detection, judging whether the flow of the data stream exceeds a maximum processing threshold value supported by equipment or not;
the dividing module is used for dividing the data stream into a part of data stream which does not exceed the maximum processing threshold value and a message load part which exceeds the maximum processing threshold value according to a preset shunting rule when the flow of the data stream which is not subjected to the safety detection exceeds the maximum processing threshold value;
the second processing module is configured to, when the traffic of the data stream that is not subjected to security detection exceeds the maximum processing threshold, forward the data stream after performing security detection on a part of the data stream that does not exceed the maximum processing threshold, and forward a packet load that exceeds the maximum processing threshold in the data stream; when the flow of the data stream which is not subjected to the safety detection does not exceed the maximum processing threshold value, the data stream which is not subjected to the safety detection is forwarded after the safety detection;
wherein the splitting rule comprises:
dividing the data stream into a plurality of sub-data streams;
different processing actions are performed for the several sub-data streams.
6. The apparatus of claim 5, wherein the cascade interface on the security device comprises a first-level connection port and a second-level connection port, wherein the first-level connection port is connected with the first-level connection port, the second-level connection port is connected with the second-level connection port between two security devices of adjacent levels, and only the first-level connection port learns the MAC address, and when the security device is connected with the front-end device and the back-end device through other security devices in the video monitoring system, the apparatus further comprises:
the third processing module is used for receiving and forwarding the data stream through the first-level connection port when the data stream is subjected to security detection; and when the data stream is not subjected to security detection, receiving and forwarding the data stream through a second-stage connection interface.
7. The apparatus of claim 6, wherein the partitioning module is further configured to:
based on the shunting rule, carrying out safety detection on part of the data streams which do not exceed the maximum processing threshold value, and forwarding the part of the data streams after the safety detection through a primary connection port;
and forwarding the message load exceeding the maximum processing threshold value in the data stream through a second-level connection port based on the shunting rule.
8. The apparatus of claim 6, further comprising:
the interaction module is used for carrying out data stream interaction on the safety equipment and the front-end equipment through a preset interface when the safety equipment is the safety equipment which is closest to the front-end equipment in the hierarchy in the mutually cascaded safety equipment; and when the safety equipment is the safety equipment with the hierarchy closest to the back-end equipment in the mutually cascaded safety equipment, the safety equipment performs data stream interaction with the back-end equipment through a preset interface.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610289433.2A CN106027405B (en) | 2016-05-03 | 2016-05-03 | Data stream shunting method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610289433.2A CN106027405B (en) | 2016-05-03 | 2016-05-03 | Data stream shunting method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106027405A CN106027405A (en) | 2016-10-12 |
| CN106027405B true CN106027405B (en) | 2020-04-10 |
Family
ID=57082049
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610289433.2A Active CN106027405B (en) | 2016-05-03 | 2016-05-03 | Data stream shunting method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106027405B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108322403B (en) * | 2018-01-31 | 2022-03-25 | 杭州迪普科技股份有限公司 | Netflow flow shunting method and device |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103685321A (en) * | 2013-12-31 | 2014-03-26 | 北京神州绿盟信息安全科技股份有限公司 | Data packet forwarding and safety protection detection system, load balancing method and device |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070016938A1 (en) * | 2005-07-07 | 2007-01-18 | Reti Corporation | Apparatus and method for identifying safe data in a data stream |
| CN101729424B (en) * | 2009-12-16 | 2012-09-26 | 杭州华三通信技术有限公司 | Flow forwarding method, devices and system |
| CN103685052B (en) * | 2012-09-21 | 2018-03-02 | 中国电信股份有限公司 | A kind of method and system that flow-dividing control is carried out to network traffic data |
| CN103609070B (en) * | 2012-10-29 | 2016-10-05 | 华为技术有限公司 | Network flow detection method, system, equipment and controller |
| CN103051557B (en) * | 2012-12-27 | 2016-07-06 | 华为技术有限公司 | Data flow processing method and system, controller, switching equipment |
| CN104158761B (en) * | 2014-08-05 | 2018-02-13 | 华为技术有限公司 | A kind of method and apparatus of bypass flow |
| CN104753738A (en) * | 2015-03-26 | 2015-07-01 | 杭州华三通信技术有限公司 | Flow measurement method and device |
-
2016
- 2016-05-03 CN CN201610289433.2A patent/CN106027405B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103685321A (en) * | 2013-12-31 | 2014-03-26 | 北京神州绿盟信息安全科技股份有限公司 | Data packet forwarding and safety protection detection system, load balancing method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106027405A (en) | 2016-10-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10735325B1 (en) | Congestion avoidance in multipath routed flows | |
| CN107968791B (en) | Attack message detection method and device | |
| US11979326B2 (en) | Tool port throttling at a network visibility node | |
| US9356844B2 (en) | Efficient application recognition in network traffic | |
| CN103281257B (en) | A kind of protocol message processing method and equipment | |
| US10523692B2 (en) | Load balancing method and apparatus in intrusion detection system | |
| JP2016525846A (en) | Method, system, and computer program for processing data packets | |
| CN108337699B (en) | Internet surfing method and device, mobile terminal and storage medium | |
| US20060262789A1 (en) | Method and corresponding device for packets classification | |
| CN108092913A (en) | A kind of method and the multi-core CPU network equipment of message shunting | |
| US20190319923A1 (en) | Network data control method, system and security protection device | |
| CN107769992B (en) | Message parsing and shunting method and device | |
| CN114143107B (en) | Low-speed DDoS attack detection method, system and related equipment | |
| CN113489711B (en) | DDoS attack detection method, system, electronic device and storage medium | |
| CN113765846B (en) | Intelligent detection and response method and device for network abnormal behaviors and electronic equipment | |
| US20070253334A1 (en) | Switch routing algorithm for improved congestion control & load balancing | |
| WO2016169121A1 (en) | Link analysis method, device and system | |
| CN112671662B (en) | Data stream acceleration method, electronic device and storage medium | |
| CN110300085B (en) | Evidence obtaining method, device and system for network attack, statistical cluster and computing cluster | |
| CN106027405B (en) | Data stream shunting method and device | |
| CN107896196B (en) | Method and device for distributing messages | |
| CN107210969B (en) | Data processing method based on software defined network and related equipment | |
| CN108156052B (en) | Method and system for testing equipment stability | |
| CN112653708B (en) | Media flow detection method, device, network equipment and readable storage medium | |
| CN116264520A (en) | Artificial intelligence supported network telemetry using data processing units |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |