WO2016127582A1 - 一种防御消息攻击的方法及装置 - Google Patents

一种防御消息攻击的方法及装置 Download PDF

Info

Publication number
WO2016127582A1
WO2016127582A1 PCT/CN2015/084694 CN2015084694W WO2016127582A1 WO 2016127582 A1 WO2016127582 A1 WO 2016127582A1 CN 2015084694 W CN2015084694 W CN 2015084694W WO 2016127582 A1 WO2016127582 A1 WO 2016127582A1
Authority
WO
WIPO (PCT)
Prior art keywords
queue
switch
host
report message
threshold
Prior art date
Application number
PCT/CN2015/084694
Other languages
English (en)
French (fr)
Inventor
***
胡成臣
王换招
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP15881742.9A priority Critical patent/EP3249874A4/en
Publication of WO2016127582A1 publication Critical patent/WO2016127582A1/zh
Priority to US15/674,969 priority patent/US10536321B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system
    • G06F9/4881—Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/54—Store-and-forward switching systems 
    • H04L12/56—Packet switching systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/10—Scheduling measurement reports ; Arrangements for measurement reports
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/54—Store-and-forward switching systems 
    • H04L12/56—Packet switching systems
    • H04L12/5601—Transfer mode dependent, e.g. ATM
    • H04L2012/5678—Traffic aspects, e.g. arbitration, load balancing, smoothing, buffer management
    • H04L2012/5681—Buffer or queue management
    • H04L2012/5682—Threshold; Watermark

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method and apparatus for defending against message attacks.
  • a Software Defined Network is a network architecture in which control functions and forwarding functions are separated from each other. SDN is divided into control plane and data plane, in which the control plane is responsible for the control and management of the whole network, and the data plane forwards the data according to the rules specified by the control plane.
  • the control device at the control level is called the central controller (referred to as the controller), and the forwarding device at the data level is the network switch (referred to as the switch).
  • the controller is the core device of the entire SDN, and the traffic is correctly forwarded at the decision data level.
  • the switch implements processing of data packets according to the flow table sent by the controller, such as forwarding and discarding data packets.
  • the object that is attacked in traditional network security is usually the host or server.
  • the controller As the core device of the entire SDN network, also faces the possibility of being attacked.
  • the attack form of the controller is usually a Packet_in message flooding attack, where Packet_in is a message type.
  • the switch when the switch receives the data packet, it first matches each flow entry in the internal flow table of the switch. If the match succeeds, the operation indicated by the successfully matched flow entry is executed; if the internal flow table is If there is no flow entry matching the packet, the switch constructs a Packet_in message and sends the Packet_in message to the controller, requesting the controller to issue a rule for processing the packet.
  • the controller After receiving the Packet_in message, the controller sends a flow entry to the switch after the decision, and the flow entry includes a rule for processing the data packet. Therefore, an important function of the controller is to effectively process the Packet_in message.
  • the embodiment of the invention provides a method and a device for defending against a message attack, which can guarantee a normal response to a service request of a normal user while defending against a message attack.
  • an embodiment of the present invention provides a method for defending a message attack, including:
  • the controller receives the report message sent by the at least one switch
  • the controller saves the received report messages sent by the respective switches to the switch queues corresponding to the switches respectively.
  • the controller performs polling scheduling on the switch queues corresponding to the respective switches.
  • the controller where the controller saves the received report message sent by each switch to the switch queue corresponding to each switch, specifically includes:
  • the controller confirms a switch queue to which the reported message belongs
  • the controller determines whether there is a host queue corresponding to the switch queue to which the report message belongs; the host queue is a host queue corresponding to each host connected to the switch corresponding to the switch queue to which the report message belongs;
  • the controller establishes the report message when it is determined that the host queue corresponding to the switch queue to which the report message belongs does not exist and the number of the report messages stored in the switch queue to which the report message belongs is determined to be greater than the first threshold. a host queue corresponding to the switch queue, and the report message is inserted into a host queue corresponding to the switch queue to which the report message belongs;
  • the controller When the controller performs the polling scheduling on the switch queues corresponding to the switches, if the current scheduled switch queue is empty, the controller further includes:
  • the controller performs polling scheduling on each host queue according to the priority of each host queue corresponding to the currently scheduled switch queue.
  • the controller according to a priority of each host queue corresponding to the currently scheduled switch queue, is configured for each host When the queue performs polling scheduling, it also includes:
  • the controller receives the report message sent by the switch corresponding to the currently scheduled switch queue, when the number of the reported messages in the host queue corresponding to the currently scheduled switch queue is less than the third threshold.
  • the received message sent by the switch corresponding to the currently scheduled switch queue is inserted into the currently scheduled switch queue, and the third threshold is less than the second threshold.
  • the controller that the controller sends the received report that is sent by the switch corresponding to the currently scheduled switch queue After the message is inserted into the currently scheduled switch queue, the message further includes:
  • each host queue corresponding to the currently scheduled switch queue is deleted.
  • the controller determines whether the presence and the reporting message belong to After the host queue corresponding to the switch queue, it also includes:
  • the controller inserts the report message when determining that there is no host queue corresponding to the switch queue to which the report message belongs and determining that the number of reported messages stored in the switch queue to which the report message belongs is less than a first threshold. Go to the switch queue to which the reported message belongs.
  • the controller determines whether a When the host queues, it also includes:
  • the controller inserts the report message into a host queue corresponding to the switch queue to which the report message belongs, where the fourth threshold is smaller than the second threshold.
  • the controller determines whether the presence and the reporting message belong to When the switch queue corresponds to the host queue, it also includes:
  • the controller When it is determined that there is a host queue corresponding to the switch queue to which the report message belongs, and the number of reported messages stored in each host queue is less than a fifth threshold, and the number of reported messages stored in the switch queue to which the report message belongs is stored.
  • the controller inserts the report message into the switch queue to which the report message belongs, where the fifth threshold is smaller than the second threshold.
  • the controller The polling scheduling of the corresponding switch queue specifically includes:
  • the controller performs polling scheduling on the switch queues corresponding to the switches according to the weights of the report messages allocated to the switches in advance.
  • an embodiment of the present invention provides an apparatus for defending a message attack, where the apparatus includes:
  • a receiving module configured to receive a report message sent by at least one switch
  • a saving module configured to save the report message sent by each switch received by the receiving module to a switch queue corresponding to each switch
  • the scheduling module is configured to perform polling scheduling on the switch queues corresponding to the switches that are saved by the saving module.
  • the method further includes:
  • a confirmation module configured to confirm a switch queue to which the reported message belongs
  • a determining module configured to determine whether there is a corresponding switch queue corresponding to the reported message a host queue; the host queue is a host queue corresponding to each host connected to the switch corresponding to the switch queue to which the reported message belongs;
  • a first determining module configured to determine that the number of reported messages stored in the switch queue to which the reported message belongs is greater than a first threshold
  • Establishing a module configured to determine, by the determining module, that there is no host queue corresponding to the switch queue to which the report message belongs, and the first determining module determines the number of reported messages stored in the switch queue to which the reported message belongs When the threshold is greater than the first threshold, a host queue corresponding to the switch queue to which the reported message belongs is established;
  • the saving module is configured to insert the report message into a host queue that is established by the establishing module and corresponding to a switch queue to which the report message belongs;
  • a second determining module configured to: when the scheduling module performs polling scheduling on the switch queue corresponding to each switch, if it is determined that the currently scheduled switch queue is empty, according to the currently scheduled switch queue corresponding to each host queue The number of stored report messages and the second threshold determine the priority of each host queue;
  • the scheduling module is specifically configured to perform polling scheduling on each host queue according to the priority of each host queue determined by the currently scheduled switch queue determined by the second determining module.
  • the third determining module is further included;
  • a third determining module configured to: when the scheduling module performs polling scheduling on each host queue according to the priority of each host queue corresponding to the currently scheduled switch queue, determine each host corresponding to the currently scheduled switch queue Whether the number of reported messages stored in the queue is less than the third threshold;
  • the saving unit is configured to: when the third determining module determines whether the number of reported messages in each host queue corresponding to the currently scheduled switch queue is less than a third threshold, if the receiving module receives the The report message sent by the switch corresponding to the currently scheduled switch queue is inserted into the currently scheduled switch queue by the report message sent by the switch corresponding to the currently scheduled switch queue received by the receiving module.
  • the third threshold is less than the second Threshold.
  • the method further includes:
  • a fourth determining module configured to determine, after the saving module inserts the report message sent by the switch corresponding to the currently scheduled switch queue received by the receiving module into the currently scheduled switch queue, Whether there is a host queue with zero reported messages in each host queue corresponding to the currently scheduled switch queue;
  • a deleting module configured to: when the fourth determining module determines that there is a host queue with a number of reported messages in each host queue corresponding to the currently scheduled switch queue, delete the host queue with the number of reported messages being zero;
  • a fourth determining module configured to determine, after the saving module sends the report message sent by the switch corresponding to the currently scheduled switch queue received by the receiving module to the currently scheduled switch queue, to determine the current scheduling Whether the number of reported messages stored in each host queue corresponding to the switch queue is zero;
  • a deleting module configured to: when the fourth determining module determines that the number of reported messages stored in each host queue corresponding to the currently scheduled switch queue is zero, delete each host queue corresponding to the currently scheduled switch queue.
  • the first determining module is further configured to determine the The number of reported messages stored in the switch queue to which the report message belongs is less than the first threshold;
  • the saving unit is further configured to: determine, by the determining module, that there is no host queue corresponding to the switch queue to which the report message belongs, and the first determining module determines that the switch queue belongs to the switch queue to which the report message belongs When the number of reported messages is less than the first threshold, the report message is inserted into the switch queue to which the report message belongs.
  • the method further includes:
  • a fifth determining module configured to: when the determining module determines that there is a host queue corresponding to the switch queue to which the report message belongs, determine that the number of reported messages stored in any host queue is greater than a fourth threshold, and the reporting is The number of reported messages stored in the switch queue to which the message belongs is less than the first threshold;
  • the saving unit is further configured to: determine, by the determining module, that there is a host queue corresponding to the switch queue to which the report message belongs, and the fifth determining module determines that the number of reported messages stored in any host queue is greater than a fourth threshold. And when the number of the reported messages that are stored in the switch queue to which the report message belongs is less than the first threshold, the report message is inserted into the host queue corresponding to the switch queue to which the report message belongs, where the fourth threshold is smaller than Second threshold.
  • the method further includes:
  • a sixth determining module configured to: when the determining module determines that there is a host queue corresponding to the switch queue to which the report message belongs, determine that the number of reported messages in each host queue is less than a fifth threshold, and the reporting is The number of reported messages stored in the switch queue to which the message belongs is less than the first threshold;
  • the saving unit in the determining module, determining that there is a host queue corresponding to the switch queue to which the report message belongs, and the sixth determining module determines that the number of reported messages stored in each host queue is less than a fifth threshold, And when the number of reported messages that are stored in the switch queue to which the report message belongs is less than the first threshold, the report message is inserted into the switch queue to which the report message belongs, where the fifth threshold is smaller than the second threshold.
  • the scheduling module is specifically configured to The reporting message weights assigned to the respective switches are polled and scheduled for the switch queues corresponding to the respective switches.
  • the controller sends the reported messages sent by the switches to the switch queues corresponding to the switches respectively; the controller does not separately process the reported messages sent by the switches, but The polling message in the queue of each switch is polled degree. Therefore, the controller does not directly process the report message sent by the switch after receiving the attack, and then processes the report message sent by the other switch, and then polls the report message sent by each switch after the report message is saved for a certain length of time. Scheduling. Therefore, while defending against the message attack, the processing time of the non-attack traffic caused by the attack is prevented from being extended, and the service request of the normal user is normally responded.
  • FIG. 1 is a flowchart of a method for defending a message attack according to an embodiment of the present invention
  • FIG. 2 is a flowchart of another method for defending a message attack according to an embodiment of the present invention
  • FIG. 3 is a flowchart of still another method for defending a message attack according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of processing of a report message according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of an apparatus for defending a message attack according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of another apparatus for defending against message attacks according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of another apparatus for defending against message attacks according to an embodiment of the present invention.
  • the present invention provides a method and device for defending against a message attack, which can protect a normal user's service request while defending against a message attack.
  • the method and the device are based on the same inventive concept. Since the principles of the method and the device for solving the problem are similar, the implementation of the device and the method can be referred to each other, and the repeated description is not repeated.
  • the embodiment of the invention provides a method and device for defending a message attack.
  • the controller maintains a shared multi-queue structure according to the number of connected switches, that is, establishes a handover for each switch. Switching queues, all switch queues form a shared multi-queue structure.
  • the controller After receiving the report message sent by any switch, the controller inserts the received report message into the switch queue corresponding to the switch.
  • the controller does not separately process the reported messages sent by the switches, but polls the reported messages in the queues of each switch. Therefore, the controller no longer directly processes the report message sent by the switch after receiving the attack, and then processes the report message sent by the other switch, and polls the report message sent by each switch. Therefore, while defending against the message attack, the processing time of the non-attack traffic caused by the attack is prevented from being extended, and the service request of the normal user is normally responded.
  • the embodiment of the invention provides a method for defending against a message attack. As shown in FIG. 1 , the method includes:
  • Step 101 The controller receives the report message sent by the at least one switch.
  • Step 102 The controller saves the received report messages sent by the respective switches to the switch queues corresponding to the switches.
  • Step 103 The controller performs polling scheduling on a switch queue corresponding to each switch.
  • the controller when the controller performs the polling scheduling on the switch queues corresponding to the switches, the controller may also receive the report message sent by the at least one switch, and the controller is in the switch queue corresponding to the switches.
  • the polling schedule is performed, and the received report messages sent by the respective switches are also saved to the switch queue corresponding to the at least one switch. Therefore, it is possible to save the reported message at the same time as the polling scheduling process.
  • the report message includes an asynchronous message sent by the switch or a message sent by the switch to the controller, for example, a Packet-in message.
  • a Packet-in message After receiving the data packet sent by the host, if the switch cannot find a matching flow table rule, the switch encapsulates the data packet into a packet_in message and reports it to the controller; or the switch finds a matching flow table rule, if the rule Indicates that the data packet is reported to the controller, and the switch also encapsulates the data packet into a packet_in message and reports it to the controller.
  • the controller sends the reported messages sent by the switches to the switch queues corresponding to the switches respectively; the controller does not separately process the reported messages sent by the switches, but The reported message in each switch queue is polled and scheduled. Therefore, the controller does not directly process the report message sent by the switch after receiving the attack, and then processes the report message sent by the other switch, and then polls the report message sent by each switch after the report message is saved for a certain length of time. Scheduling. Therefore, while defending against the message attack, the processing time of the non-attack traffic caused by the attack is prevented from being extended, and the service request of the normal user is normally responded.
  • the controller performs polling scheduling on the switch queues corresponding to the switches according to the preset number of reported messages required for scheduling the switch queues.
  • the preset number of reported messages that need to be scheduled when the switch queue is scheduled may be determined according to the weight of the reported message allocated for each switch in advance. Specifically, the administrator allocates a report message weight to each switch through the human machine interface.
  • the controller When the controller performs the polling scheduling on the switch queues corresponding to the switches, the controller may be specifically configured as follows:
  • the controller determines a report message weight of each switch
  • the controller determines, according to the reported message weight of each switch queue, the number of Packet-in messages scheduled by the currently scheduled switch queue in one scheduling period.
  • the controller schedules Packet-in message dequeue processing in the switch queue according to the determined number of Packet-in messages of the currently scheduled switch queue.
  • the controller polls the i-th switch queue (ie, switch queue Si), it extracts from the queue Packet-in messages are processed. Therefore, it is ensured that the Packet-in message in the switch queue corresponding to the attacking switch does not block the packet-in message processing of other normal switches, and provides a certain isolation and defense capability.
  • each host is connected to the switch, and the message sent by the host is forwarded through the switch. If it cannot be matched, it is sent to the controller through the Packet-in message.
  • a Host sends a packet attack to the controller
  • the controller schedules the Packet-in message in the switch queue connected to the Host
  • each polling will first process the message sent by the attacking host, thus causing the Host.
  • the packet-in messages sent by other normal hosts cannot be received in time. Therefore, it is implemented by the following implementation.
  • the controller saves the received report message sent by each switch to the switch queue corresponding to each switch, which may be as follows:
  • the controller confirms the switch queue to which the reported message belongs.
  • the switch queue may be determined according to the identifier information of the switch carried in the report message.
  • the identifier information of the switch can be the port number of the switch, address information, and so on.
  • the controller determines whether there is a host queue corresponding to the switch queue to which the report message belongs, and the host queue is each host queue corresponding to each host connected to the switch corresponding to the switch queue to which the report message belongs.
  • the host queue of each host connected to the switch corresponds to the switch queue of the switch.
  • the controller establishes and reports the number of reported messages that are stored in the switch queue to which the reported message belongs, and the number of reported messages in the switch queue to which the reported message belongs is greater than the first threshold.
  • the host queue corresponding to the switch queue to which the message belongs, and the report message is inserted into the host queue corresponding to the switch queue to which the report message belongs.
  • the host queue may be established according to the identifier information of the host according to the report message.
  • the identifier of the host may be the port number of the host, or may be Address information and more.
  • the report message may also carry the identifier information of the host, and the host queue corresponding to the switch queue to which the report message belongs is determined according to the identifier information of the host, so that the report message is inserted into the host queue.
  • the controller determines the priority of each host queue according to the number of reported messages and the second threshold that are stored in each host queue, and may be: the initial priority of each host queue is the same, and may be the first priority. Level.
  • the controller determines the priority of each host queue according to the number of reported messages and the second threshold that are stored in each host queue, and may be: the initial priority of each host queue is the same, and may be the first priority. Level.
  • the controller determines the priority of each host queue according to the number of reported messages and the second threshold that are stored in each host queue, and may be: the initial priority of each host queue is the same, and may be the first priority. Level.
  • the controller determines the priority of each host queue according to the number of reported messages and the second threshold that are stored in each host queue, and may be: the initial priority of each host queue is the same, and may be the first priority. Level.
  • the controller performs polling scheduling on each host queue according to the priority of each host queue corresponding to the currently scheduled switch queue.
  • the controller performs polling scheduling on each host queue according to the priority of each host queue corresponding to the currently scheduled switch queue, and determines that the currently scheduled switch queue corresponds to each host queue corresponding to the switch queue.
  • the number of the reported report messages is less than the third threshold. If the controller receives the report message sent by the switch corresponding to the currently scheduled switch queue, the controller sends the received switch queue to the switch. The escalation message is inserted into the currently scheduled switch queue.
  • the controller determines whether to send the received report message to the received according to the number of reported messages stored in the switch queue and the third threshold. The switch queue to which the reported message belongs.
  • the controller pre-establishes a switch queue for each switch connected thereto. And the switch is connected to each host.
  • the host is attacked, that is, the number of Packet-in messages of the switch queue corresponding to the switch connected to the host is greater than the first threshold
  • the switch connected to the Host that is attacking establishes the Host queue according to the port number of the host.
  • a Host queue can also be established for each Host connected to the switch.
  • the priority of the established Host queue can be set, and each of the initially established Host queues has the same priority and is the first priority level.
  • the host When the number of Packet-in messages in a host queue reaches the second threshold, the host is determined to be the source of the attack.
  • the priority of the host queue can be set to the second priority level. The level is less than the first priority level.
  • the number of Packet-in messages in each Host queue is less than the third threshold.
  • the third threshold is less than the second threshold.
  • the Host connected to the attacked switch establishes its own Host queue, which can save the Packet-in message of the attacked Host and other normal Host Packet-in messages separately, and poll processing to ensure other The Packet-in message in the normal Host is processed in time.
  • the controller may determine that the switch queue has been established after inserting the received report message sent by the switch into the switch queue corresponding to the switch.
  • the number of the reported messages of the corresponding host queue When it is determined that there is a host queue with a reported message storage quantity of zero in the host queue, the host queue whose storage amount of the reported message is zero is deleted; or when the switch queue is determined to be corresponding When the number of reported messages stored in each host queue is zero, each host queue corresponding to the switch queue is deleted.
  • the controller inserts the received report message sent by the switch corresponding to the currently scheduled switch queue into the currently scheduled After determining the host queue of the number of reported messages in each host queue corresponding to the currently scheduled switch queue, deleting the host queue with the number of reported messages is zero; or determining the current schedule When the number of reported messages stored in each host queue corresponding to the switch queue is zero, the host queues corresponding to the currently scheduled switch queue are deleted.
  • the controller when it is determined that the host queue exists, performs polling scheduling on the switch queues corresponding to the switches, and monitors the host queues of the switches, and determines each switch queue corresponding to each switch. If there is a host queue with a number of reported messages in the host queue, delete the host queue with the number of reported messages, or delete the current schedule when the number of reported messages stored in each host queue corresponding to any switch queue is zero. Each host queue corresponding to the switch queue.
  • the controller determines whether there is a host queue corresponding to the switch queue to which the report message belongs, when it is determined that the switch queue does not exist, The controller inserts the report message into the switch queue to which the report message belongs when the host queue is determined to determine that the number of reported messages in the switch queue to which the report message belongs is less than the first threshold.
  • the controller determines whether there is a host queue corresponding to the switch queue to which the report message belongs, when it is determined that there is a host queue corresponding to the switch queue to which the report message belongs, and The controller inserts the reported message into the device when the number of the reported messages in the queue of the host is greater than the fourth threshold, and the number of reported messages stored in the switch queue to which the reported message belongs is less than the first threshold.
  • the fourth threshold may be equal to the third threshold or may not be equal to the third threshold.
  • the controller determines whether there is a host queue corresponding to the switch queue to which the report message belongs, when it is determined that there is a host queue corresponding to the switch queue to which the report message belongs, and When the number of reported messages stored in each host queue is less than the fifth threshold, and the number of reported messages stored in the switch queue to which the report message belongs is less than the first threshold, the controller inserts the report message into the The switch queue to which the message belongs is reported, wherein the fifth threshold is smaller than the second threshold.
  • the fifth threshold may be equal to the third threshold or the fourth threshold, or may not be equal to the third threshold and the fourth threshold.
  • the process of receiving and enqueuing the Packet-in message by the controller is as shown in FIG. 2 .
  • the controller pre-establishes a switch queue for each switch connected to it.
  • the following describes a Packet-in message for a switch as an example.
  • Step 201 Receive a Packet-in message sent by the switch.
  • Step 202 is performed.
  • the Packet-in message carries the identifier information of the Host connected to the switch.
  • step 202 it is determined whether a Host queue is established. If not, step 203 is performed, and if yes, step 206 is performed.
  • the Host queue is the Host queue corresponding to all hosts connected to the switch.
  • Step 203 Determine whether the number of Packet-in messages in the switch queue corresponding to the switch is greater than the first threshold. If yes, go to step 204. If no, go to step 205.
  • Step 204 Establish a Host queue for the Host corresponding to the identification information of the Host, and save the Packet-in message to the established Host queue.
  • Step 205 Save the received Packet-in message to the switch queue corresponding to the switch.
  • Step 206 Determine whether the number of Packet-in messages in each of the established Host queues is less than a second threshold. If yes, go to step 207. If no, go to step 208.
  • Step 207 Determine whether the number of Packet-in messages in the switch queue corresponding to the switch is greater than a first threshold; if yes, go to step 205; if no, go to step 208.
  • Step 208 Save the received Packet-in message to the Host queue corresponding to the identifier information of the Host.
  • the controller when scheduling the packet-in message dequeue processing in each switch queue according to the determined number of Packet-in messages of each switch queue, determining that the currently scheduled switch queue is empty, and determining that the When any of the established Host queues corresponding to the currently scheduled switch queue is not empty, the number of Packet-in messages scheduled from the currently scheduled switch queue is determined according to the Packet-in message weight of each switch, from the currently scheduled A corresponding number of reported messages are sent in the respective Host queues that are not empty corresponding to the switch queue. The corresponding number is the determined number of Packet-in messages.
  • the corresponding number of report messages are sent, which can be as follows:
  • the sum of the first quantity and the second quantity is less than or equal to the number of the Packet-in messages, And when the first quantity is greater than or equal to the number of Packet-in messages, the second quantity is 0.
  • the number of corresponding queues of a switch is 10, and if the sum of the number of reported messages in the Host queue that is not greater than the second threshold is greater than or equal to 10, In the polling, the number of reported messages is not processed by the number of the reported queues in the Host queue that is not larger than the second threshold.
  • the sum of the number of reported messages in the Host queue of the threshold is less than 10, for example, eight, and eight report messages are scheduled from the Host queue whose number of reported messages is not greater than the second threshold, and then the corresponding switch queue in the current schedule is not
  • the number of reported messages in the empty Host queue is greater than the second threshold.
  • the other Host queues are scheduled to process 2 reported messages.
  • the host queue corresponding to any switch queue is empty, the host queue corresponding to the switch queue is deleted.
  • the scheduling and dequeuing process of the controller for the packet queue and the Packet-in message in the Host queue is as shown in FIG. 3 .
  • the controller polls the i-th switch queue (ie, switch queue Si), it extracts from the queue Packet-in messages are processed.
  • step 301 it is determined whether the switch queue Si is empty. If not, step 302 is performed, and if yes, step 304 is performed.
  • Step 302 Perform scheduling processing on the Packet-in message in the switch queue Si.
  • Step 303 is performed. Specifically, it can be extracted from the switch queue. Packet-in messages are processed.
  • Step 304 determining whether the switch queue Si has a corresponding Host queue, and if not, executing the step At step 303, if yes, step 305 is performed.
  • Step 305 Determine whether all the Host queues corresponding to the switch queue Si are empty. If yes, go to step 306. If no, go to step 307.
  • Step 306 Delete all Host queues corresponding to the switch queue Si. Go to step 303.
  • Step 307 processing the Packet-in message in each Host queue corresponding to the switch queue Si. Go to step 303.
  • the Packet-in message in each Host queue corresponding to the processing switch queue Si is in a Round Bobin manner. details as follows:
  • Priority is given to polling the unquenched Host queues to ensure that Packet-in messages in the unseen Host queue can be processed in a timely manner. If the priority of the Host queue is established before the Host queue is established, the Host queue can be scheduled according to the priority level. The attacked Host queue has the lowest priority and is scheduled last. For example, when scheduling to switch queue 2, if queue 2 of the switch is empty, M packets-in messages are fetched from all host queues in turn in a polling schedule. If the number of all the messages that have not received the attack is less than M, the Packet-in message in the Host queue that received the attack is scheduled.
  • Host queue 4 is the Host queue corresponding to the attacked Host.
  • the Packet-in messages of 1, 2, 3, and 4 are taken out in sequence, and the number of messages in the non-attack Host queue is less than 5. Then, the Packet-in message No. 5 is taken out from the Host queue 4 for scheduling.
  • the embodiment of the invention further provides a device for defending against a message attack. As shown in FIG. 5, the device is applied to a controller, and the device includes:
  • the receiving module 501 is configured to receive a report message sent by at least one switch.
  • the saving module 502 is configured to save the report messages sent by the switches received by the receiving module 501 to the switch queues corresponding to the switches respectively.
  • the scheduling module 503 is configured to perform polling scheduling on the switch queues corresponding to the switches that are saved by the saving module 502.
  • the controller sends the reported messages sent by the switches to the switch queues corresponding to the switches respectively; the controller does not separately process the reported messages sent by the switches, but The reported message in each switch queue is polled and scheduled. Therefore, the controller does not directly process the report message sent by the switch after receiving the attack, and then processes the report message sent by the other switch, and then polls the report message sent by each switch after the report message is saved for a certain length of time. Scheduling. Therefore, the processing time of the non-attack traffic caused by the attack is prevented from being extended, and even the service request of the normal user cannot be responded to. And by improving at the controller level, the burden on the switch is reduced, and the forwarding efficiency of the switch is no longer affected.
  • the apparatus may further include:
  • the confirmation module 504 is configured to confirm the switch queue to which the reported message belongs.
  • the determining module 505 is configured to determine whether there is a host queue corresponding to the switch queue to which the report message belongs, and the host queue is each host queue corresponding to each host connected to the switch corresponding to the switch queue to which the report message belongs.
  • the first determining module 506 is configured to: when the determining module 505 determines that there is no host queue corresponding to the switch queue to which the report message belongs, determine that the number of reported messages stored in the switch queue to which the reported message belongs is greater than A threshold.
  • the module 507 is configured to determine, in the determining module 505, that there is no host queue corresponding to the switch queue to which the report message belongs, and the first determining module 506 determines the number of reported messages stored in the switch queue to which the report message belongs. When the threshold is greater than the first threshold, a host queue corresponding to the switch queue to which the reported message belongs is established;
  • the saving module 502 is specifically configured to insert the report message into the host queue that is established by the establishing module 507 and corresponding to the switch queue to which the report message belongs.
  • the second determining module 508 is configured to: when the scheduling module 503 performs polling scheduling on the switch queue corresponding to each switch, if it is determined that the currently scheduled switch queue is empty, according to each of the currently scheduled switch queues The number of reported messages stored in the host queue and the second threshold determine the priority of each host queue;
  • the scheduling module 503 is specifically configured to perform polling scheduling on each host queue according to the priority of each host queue corresponding to the currently scheduled switch queue determined by the second determining module 508.
  • the device may further include a third determining module
  • the third determining module is configured to: when the scheduling module 503 performs polling scheduling on each host queue according to the priority of each host queue corresponding to the currently scheduled switch queue, determine each of the currently scheduled switch queues. Whether the number of reported messages stored in the host queue is less than the third threshold;
  • the saving unit 502 is configured to: when the third determining module determines whether the number of reported messages in each host queue corresponding to the currently scheduled switch queue is less than a third threshold, if the receiving module 501 receives Inserting, by the switch corresponding to the currently scheduled switch queue, the report message sent by the switch corresponding to the currently scheduled switch queue received by the receiving module 501 into the currently scheduled switch queue, where the The three thresholds are less than the second threshold.
  • the device further includes:
  • a fourth determining module configured to determine, after the saving module 502 inserts the report message sent by the switch corresponding to the currently scheduled switch queue received by the receiving module 501 into the currently scheduled switch queue, Whether there is a host queue with a reported message storage amount of zero in each host queue corresponding to the currently scheduled switch queue;
  • a deleting module configured to: when the fourth determining module determines that there is a host queue with a number of reported messages in each host queue corresponding to the currently scheduled switch queue, delete the host queue with the number of reported messages being zero;
  • a fourth determining module configured to: after the saving module 502 inserts the report message sent by the switch corresponding to the current scheduled switch queue received by the receiving module 501 into the currently scheduled switch queue, determine Whether the number of reported messages stored in each host queue corresponding to the currently scheduled switch queue is zero;
  • a deleting module configured to: when the fourth determining module determines that the number of reported messages stored in each host queue corresponding to the currently scheduled switch queue is zero, delete each host queue corresponding to the currently scheduled switch queue.
  • the first determining module 506 is further configured to: determine that the number of reported messages stored in the switch queue to which the reported message belongs is less than a first threshold;
  • the saving module 502 is further configured to determine, in the determining module 505, that there is no host queue corresponding to the switch queue to which the report message belongs, and the first determining module 506 determines that the report queue belongs to the switch queue to which the report message belongs. When the number of the reported report messages is less than the first threshold, the report message is inserted into the switch queue to which the report message belongs.
  • the device further includes:
  • a fifth determining module configured to: when the determining module 505 determines that there is a host queue corresponding to the switch queue to which the report message belongs, determine that the number of reported messages stored in any host queue is greater than a fourth threshold, and The number of reported messages stored in the switch queue to which the report message belongs is less than the first threshold;
  • the saving module 502 is further configured to: at the determining module 505, determine that there is a host queue corresponding to the switch queue to which the report message belongs, and the fifth determining module determines that the number of reported messages stored in any host queue is greater than the number And the fourth queue is configured to insert the report message into a host queue corresponding to the switch queue to which the report message belongs, where the fourth queue is the number of the report messages that are stored in the switch queue to which the report message belongs is less than the first threshold. The threshold is less than the second threshold.
  • the device may further include:
  • a sixth determining module configured to: when the determining module 505 determines that there is a host queue corresponding to the switch queue to which the report message belongs, determine that the number of reported messages stored in each host queue is less than a fifth threshold, and The number of reported messages stored in the switch queue to which the report message belongs is less than the first threshold;
  • the saving module 502 in the determining module 505, determines that there is a host queue corresponding to the switch queue to which the report message belongs, and the sixth determining module determines that the number of reported messages stored in each host queue is less than the fifth. Threshold, and the switch queue to which the reported message belongs has been saved. When the number of the reported message is less than the first threshold, the report message is inserted into the switch queue to which the report message belongs, where the fifth threshold is smaller than the second threshold.
  • the scheduling module 503 is specifically configured to perform polling scheduling on the switch queues corresponding to the switches according to the weights of the report messages allocated to the switches in advance.
  • the present invention also provides an apparatus for defending against message attacks, as shown in FIG. 7, wherein the apparatus may be disposed in a controller for performing the method shown in FIG. 1 or FIG. 2 or FIG. 3, specifically including processing.
  • the processor 701 is connected to the memory 702 and the transceiver 703, respectively.
  • the embodiment of the present invention does not limit the specific connection medium between the above components.
  • the memory 702, the processor 701, and the transceiver 703 are connected by a bus in FIG. 7, and the bus is indicated by a thick line in FIG.
  • the manner of connection between other components is merely illustrative and not limited.
  • the memory 702 is used to store the program code executed by the processor 701, and may be a read-only memory (ROM) or a random-access memory (RAM). It can be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a magnetic disk storage medium or other magnetic storage device, or can be used to carry or store a desired program code in the form of an instruction or data structure. And any other medium that can be accessed by a computer, but is not limited thereto, for example, the memory 702 can be a combination of the above memories.
  • ROM read-only memory
  • RAM random-access memory
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • magnetic disk storage medium or other magnetic storage device or can be used to carry or store a desired program code in the form of an instruction or data structure.
  • any other medium that can be accessed by a computer but is not limited thereto, for example, the memory 702 can be a combination of the above memories.
  • the processor 701 executes the program stored in the memory 702 to implement the method for defending the message as shown in FIG. 1 or FIG. 2 or FIG. 3 of the present invention.
  • the transceiver 703 receives the report message sent by the at least one switch.
  • the processor 701 saves the report messages sent by the switches received by the transceiver 703 to the switch queues corresponding to the switches respectively.
  • the processor 701 performs polling scheduling on the switch queues corresponding to the respective switches.
  • the switch queue corresponding to each switch is stored in the memory 702.
  • the processor 701 saves the report message sent by the switch received by the transceiver 703 to the switch queue corresponding to each switch, which may be as follows:
  • the processor 701 confirms the switch queue to which the report message is received by the transceiver 703, and determines whether there is a host queue corresponding to the switch queue to which the report message belongs; the host queue is the switch to which the report message belongs Each host queue corresponding to each host connected to the switch corresponding to the queue;
  • the controller establishes the report message when it is determined that the host queue corresponding to the switch queue to which the report message belongs does not exist and the number of the report messages stored in the switch queue to which the report message belongs is determined to be greater than the first threshold. a host queue corresponding to the switch queue, and the report message is inserted into a host queue corresponding to the switch queue to which the report message belongs;
  • the processor 701 When the processor 701 performs the polling scheduling on the switch queues corresponding to the respective switches, if it is determined that the currently scheduled switch queue is empty, the number of reported messages and the second threshold stored in each host queue corresponding to the currently scheduled switch queue are determined. Determine the priority of each host queue corresponding to the currently scheduled switch queue; then perform polling scheduling for each host queue according to the priority of each host queue corresponding to the currently scheduled switch queue.
  • the host queue corresponding to each host is stored in the memory 702.
  • the host queue of each host connected to the switch corresponds to the switch queue of the switch.
  • the processor 701 performs polling scheduling on each host queue according to the priority of each host queue corresponding to the currently scheduled switch queue, and determines that the number of reported messages stored in each host queue corresponding to the currently scheduled switch queue is smaller than the third.
  • the processor 701 inserts the report message sent by the switch corresponding to the currently scheduled switch queue received by the transceiver 703 into the current The scheduled switch queue, the third threshold is less than the second threshold.
  • the processor 701 inserts the report message sent by the switch corresponding to the currently scheduled switch queue received by the transceiver 703 into the currently scheduled switch queue, and determines the number of reported messages in each host queue corresponding to the currently scheduled switch queue. If the host queue is zero, the host queue whose number of reported messages is zero is deleted; or when the number of reported messages stored in each host queue corresponding to the currently scheduled switch queue is zero, the current scheduled switch queue is deleted. Each host queue.
  • the processor 701 determines whether there is a host queue corresponding to the switch queue to which the report message belongs, and determines that there is no host queue corresponding to the switch queue to which the report message belongs and determines that the switch queue to which the report message belongs has been When the number of stored report messages is less than the first threshold, the report message received by the transceiver 703 is inserted into the switch queue to which the report message belongs.
  • the processor 701 determines whether there is a host queue corresponding to the switch queue to which the report message belongs, and if it is determined that there is a host queue corresponding to the switch queue to which the report message belongs, and determines a report message stored in any host queue. When the number is greater than the fourth threshold, and the number of reported messages stored in the switch queue to which the report message belongs is less than the first threshold, the report message received by the transceiver 703 is inserted into the switch queue to which the report message belongs. Host queue, wherein the fourth threshold is less than a second threshold.
  • the fourth threshold may be equal to the third threshold or may not be equal to the third threshold.
  • the processor 701 determines whether there is a host queue corresponding to the switch queue to which the report message belongs, and determines that there is a host queue corresponding to the switch queue to which the report message belongs, and determines the number of reported messages stored in each host queue. When the number of reported messages that are smaller than the fifth threshold and the switch queue to which the report message belongs is smaller than the first threshold, the report message received by the transceiver 703 is inserted into the switch queue to which the report message belongs. The fifth threshold is less than the second threshold.
  • the fifth threshold may be equal to the third threshold or the fourth threshold, or may not be equal to the third threshold and the fourth threshold.
  • the processor 701 performs polling scheduling on the switch queues corresponding to the switches, which may be as follows:
  • the polling queues of the switch queues corresponding to the respective switches are scheduled according to the weights of the report messages allocated to the switches in advance.
  • the processor 701 in the controller saves the report message sent by each switch received by the transceiver 703 to the switch queue corresponding to the switch stored in the memory 702; the controller no longer applies to each switch.
  • the sent report message is processed separately, but for all The reported message in the switch queue is polled and scheduled. Therefore, the controller does not directly process the report message sent by the switch after receiving the attack, and then processes the report message sent by the other switch, and then polls the report message sent by each switch after the report message is saved for a certain length of time. Scheduling. Therefore, while defending against the message attack, the processing time of the non-attack traffic caused by the attack is prevented from being extended, and the service request of the normal user is normally responded.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种防御消息攻击的方法及装置，可以在抵御消息攻击的同时，保证正常响应正常用户的服务请求。该方法包括：控制器接收至少一个交换机发送的上报消息；所述控制器将接收到的各个交换机发送的所述上报消息分别保存到所述各个交换机对应的交换机队列；所述控制器对所述各个交换机对应的交换机队列进行轮询调度。

Description

一种防御消息攻击的方法及装置 技术领域
本发明涉及通信技术领域，尤其涉及一种防御消息攻击的方法及装置。
背景技术
软件定义网络(Software Defined Network，简称SDN)是一种控制功能和转发功能相互分离的网络架构。SDN分为控制层面和数据层面，其中控制层面负责全网的控制管理，数据层面则按照控制层面指定的规则转发数据。控制层面的控制设备称为中央控制器(简称控制器)，数据层面的转发设备为网络交换机(简称交换机)。控制器是整个SDN的核心设备，决策数据层面上流量的正确转发。交换机依据控制器发送的流表实现对数据包的处理，例如数据包的转发、丢弃等操作。
传统的网络安全中被攻击的对象通常是主机或者服务器。而在SDN网络中，控制器作为整个SDN网络的核心设备，同样面临被攻击的可能。控制器面临攻击形式通常是Packet_in消息洪泛攻击，其中Packet_in是一种消息类型。
在SDN网络中，当交换机接收到数据包时，首先与交换机内部流表中各个流表项进行匹配，若匹配成功，则执行所匹配成功的流表项所指示的操作；若内部流表中不存在与该数据包匹配的流表项，则交换机构造一条Packet_in消息，并将该Packet_in消息发送给控制器，请求控制器下发针对对该数据包进行处理的规则。
控制器在接收到Packet_in消息后，经过决策，向该交换机发送一条流表项，该流表项中包括对该数据包进行处理的规则。因此，控制器一个重要功能就是有效处理Packet_in消息。
因此，网络中恶意攻击者在对控制器进行攻击时，通常是构造大量无意义、非法或者随机的数据包，使得交换机无法与内部流表的各个流表项进行匹配，交换机便会构造大量的Packet_in消息发送给控制器。这些Packet_in 消息不仅占用控制器的资源，还会占用控制器与交换机之间安全通道的有效带宽，从而延长了控制器对非攻击的其他数据的处理时间，甚至无法响应正常用户的服务请求。
发明内容
本发明实施例提供一种防御消息攻击的方法及装置，可以在抵御消息攻击的同时，保证正常响应正常用户的服务请求。
第一方面，本发明实施例提供了一种防御消息攻击的方法，包括：
控制器接收至少一个交换机发送的上报消息；
所述控制器将接收到的各个交换机发送的所述上报消息分别保存到所述各个交换机对应的交换机队列；
所述控制器对所述各个交换机对应的交换机队列进行轮询调度。
结合第一方面，在第一方面的第一种可能的实现方式中，所述控制器将接收到的各个交换机发送的所述上报消息保存到所述各个交换机对应的交换机队列具体包括：
所述控制器确认所述上报消息所属的交换机队列；
所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列；所述主机队列为与所述上报消息所属的交换机队列对应的交换机相连的各个主机对应的各个主机队列；
在判断不存在与所述上报消息所属的交换机队列对应的主机队列且确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值时，所述控制器建立与所述上报消息所属的交换机队列对应的主机队列，并将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列；
所述控制器对所述各个交换机对应的交换机队列进行轮询调度时，若确定当前调度的交换机队列为空，还包括：
所述控制器根据所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量和第二阈值确定当前调度的交换机队列对应的各个主机队 列的优先级；
所述控制器根据所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度。
结合第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述控制器根据所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度时，还包括：
在确定所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量都小于第三阈值时，所述控制器若接收到所述当前调度的交换机队列对应的交换机发送的上报消息，则将接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列，所述第三阈值小于第二阈值。
结合第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，所述控制器将接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列之后，还包括:
在确定所述当前调度的交换机队列对应的各个主机队列中存在上报消息数量为零的主机队列时，删除所述上报消息数量为零的主机队列；
或者，在确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除所述当前调度的交换机队列对应的各个主机队列。
结合第一方面的第一种至第三种可能的实现方式中的任一一种，在第一方面的第四种可能的实现方式中，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列之后，还包括：
在判断不存在与所述上报消息所属的交换机队列对应的主机队列且确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到所述上报消息所属的交换机队列。
结合第一方面的第一种至第四种可能的实现方式中的任一一种，在第一方面的第五种可能的实现方式中，所述控制器判断是否存在所述交换机队列对应的主机队列时，还包括：
若判断存在与所述上报消息所属的交换机队列对应的主机队列、且确定任一主机队列中已存储的上报消息数量大于第四阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列，其中，所述第四阈值小于第二阈值。
结合第一方面的第一种至第五种可能的实现方式中的任一一种，在第一方面的第六种可能的实现方式中，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列时，还包括：
当判断存在与所述上报消息所属的交换机队列对应的主机队列、且确定各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到所述上报消息所属的交换机队列，其中所述第五阈值小于第二阈值。
结合第一方面和第一方面的第一种至第六种可能的实现方式中的任一一种，在第一方面的第七种可能的实现方式中，所述控制器对所述各个交换机对应的交换机队列进行轮询调度具体包括：
所述控制器根据预先为各个交换机分配的上报消息权重对所述各个交换机对应的交换机队列进行轮询调度。
第二方面，本发明实施例提供了一种防御消息攻击的装置，该装置包括：
接收模块，用于接收至少一个交换机发送的上报消息；
保存模块，用于将所述接收模块接收到的各个交换机发送的所述上报消息分别保存到所述各个交换机对应的交换机队列；
调度模块，用于对所述保存模块保存的所述各个交换机对应的交换机队列进行轮询调度。
结合第二方面，在第二方面的第一种可能的实现方式中，还包括：
确认模块，用于确认所述上报消息所属的交换机队列；
判断模块，用于判断是否存在与所述上报消息所属的交换机队列对应的 主机队列；所述主机队列为与所述上报消息所属的交换机队列对应的交换机相连的各个主机对应的各个主机队列；
第一确定模块，用于确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值；
建立模块，用于在所述判断模块判断不存在与所述上报消息所属的交换机队列对应的主机队列、且所述第一确定模块确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值时，建立与所述上报消息所属的交换机队列对应的主机队列；
所述保存模块，具体用于将所述上报消息***到所述建立模块建立的与所述上报消息所属的交换机队列对应的主机队列；
第二确定模块，用于当所述调度模块对所述各个交换机对应的交换机队列进行轮询调度时，若确定当前调度的交换机队列为空，根据所述当前调度的交换机队列对应各个主机队列中已存储的上报消息数量和第二阈值确定各个主机队列的优先级；
所述调度模块，具体用于根据所述第二确定模块确定的所述当前调度的交换机队列对应各个主机队列的优先级对各个主机队列进行轮询调度。
结合第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，还包括第三确定模块；
第三确定模块，用于在所述调度模块根据所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度时，确定所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量是否都小于第三阈值；
所述保存单元，用于当所述第三确定模块确定所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量是否都小于第三阈值时，若所述接收模块接收到所述当前调度的交换机队列对应的交换机发送的上报消息，将所述接收模块接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列，所述第三阈值小于第二 阈值。
结合第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，还包括：
第四确定模块，用于在所述保存模块将所述接收模块接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列之后，确定所述当前调度的交换机队列对应的各个主机队列中是否存在上报消息数量为零的主机队列；
删除模块，用于在所述第四确定模块确定所述当前调度的交换机队列对应的各个主机队列中存在上报消息数量为零的主机队列时，删除所述上报消息数量为零的主机队列；
或者，
第四确定模块，用于在所述保存模块将所述接收模块接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到当前调度的交换机队列之后，确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量是否均为零；
删除模块，用于在所述第四确定模块确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除所述当前调度的交换机队列对应的各个主机队列。
结合第二方面的第一种至第三种可能的实现方式中的任一一种，在第二方面的第四种可能的实现方式中，所述第一确定模块，还用于确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值；
所述保存单元，还用于在所述判断模块判断不存在与所述上报消息所属的交换机队列对应的主机队列、且所述第一确定模块确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值时，将所述上报消息***到所述上报消息所属的交换机队列。
结合第二方面的第一种至第四种可能的实现方式中的任一一种，在第二方面的第五种可能的实现方式中，还包括：
第五确定模块，用于在所述判断模块判断存在与所述上报消息所属的交换机队列对应的主机队列时，确定任一主机队列中已存储的上报消息数量大于第四阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值；
所述保存单元，还用于在所述判断模块判断存在与所述上报消息所属的交换机队列对应的主机队列、且第五确定模块确定任一主机队列中已存储的上报消息数量大于第四阈值且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列，其中，所述第四阈值小于第二阈值。
结合第二方面的第一种至第五种可能的实现方式中的任一一种，在第二方面的第六种可能的实现方式中，还包括：
第六确定模块，用于在所述判断模块判断存在与所述上报消息所属的交换机队列对应的主机队列时，确定各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值；
所述保存单元，在所述判断模块判断存在与所述上报消息所属的交换机队列对应的主机队列，且所述第六确定模块确定各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，将所述上报消息***到所述上报消息所属的交换机队列，其中所述第五阈值小于第二阈值。
结合第二方面和第二方面的第一种至第六种可能的实现方式中的任一一种，在第二方面的第七种可能的实现方式中，所述调度模块，具体用于根据预先为各个交换机分配的上报消息权重对所述各个交换机对应的交换机队列进行轮询调度。
本发明实施例中所述控制器对接收到的各个交换机发送的上报消息，分别保存到所述各个交换机对应的交换机队列；控制器不再对各个交换机发送的上报消息进行单独处理，而是对各个交换机队列中的上报消息进行轮询调 度。从而控制器不再直接针对接收到攻击的交换机发送的上报消息处理完后再处理其他交换机发送的上报消息，而是在上报消息保存一个时间长度后，统一对各个交换机发送的上报消息进行轮询调度。从而在抵御消息攻击的同时，避免了在攻击发生时造成的非攻击流量的处理时间延长，保证了正常响应正常用户的服务请求。
附图说明
图1为本发明实施例提供的一种防御消息攻击的方法流程图；
图2为本发明实施例提供的另一种防御消息攻击的方法流程图；
图3为本发明实施例提供的又一种防御消息攻击的方法流程图；
图4为本发明实施例提供的上报消息处理示意图；
图5为本发明实施例提供的一种防御消息攻击的装置示意图；
图6为本发明实施例提供的另一种防御消息攻击的装置示意图；
图7为本发明实施例提供的又一种防御消息攻击的装置示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
本发明提供一种防御消息攻击的方法及装置，可以在抵御消息攻击的同时，保证正常响应正常用户的服务请求。其中，方法和装置是基于同一发明构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
本发明实施例提供了一种防御消息攻击的方法及装置，控制器根据所连接的交换机个数维护一个共享的多队列结构，即针对每个交换机建立一个交 换机队列，所有交换机队列构成了一个共享的多队列结构。控制器在接收到任一交换机发送的上报消息后，将接收到上报消息***到该交换机对应的交换机队列。控制器不再对各个交换机发送的上报消息进行单独处理，而是对各个交换机队列中的上报消息进行轮询调度。从而控制器不再直接针对接收到攻击的交换机发送的上报消息处理完后再处理其他交换机发送的上报消息，而是对各个交换机发送的上报消息进行轮询调度。从而在抵御消息攻击的同时，避免了在攻击发生时造成的非攻击流量的处理时间延长，保证了正常响应正常用户的服务请求。
本发明实施例提供了一种防御消息攻击的方法，如图1所示，该方法包括：
步骤101，控制器接收至少一个交换机发送的上报消息。
步骤102，所述控制器将接收到的各个交换机发送的所述上报消息分别保存到所述各个交换机对应的交换机队列。
步骤103，所述控制器对所述各个交换机对应的交换机队列进行轮询调度。
需要说明的是，所述控制器在对所述各个交换机对应的交换机队列进行轮询调度时，还可能接收到至少一个交换机发送的上报消息，则控制器在对所述各个交换机对应的交换机队列进行轮询调度的同时，还会将接收到的各个交换机发送的所述上报消息分别保存到该至少一个交换机对应的交换机队列。因此，保存上报消息是有可能和轮询调度处理同时进行的。
其中，上报消息包括交换机发送的异步消息或者交换机向控制器发送的消息等等，例如Packet-in消息。交换机在接收到主机发送的数据包后，若找不到匹配的流表规则，则将这个数据包封装为packet_in消息上报给控制器；或者交换机找到了匹配的流表规则，若这条规则里指明将数据包上报到控制器，则交换机也将该数据包封装为packet_in消息上报给控制器。
后续说明以Packet-in消息举例进行说明，其他消息可以参照实施，本发明实施例不再具体赘述。
本发明实施例中所述控制器对接收到的各个交换机发送的上报消息，分别保存到所述各个交换机对应的交换机队列；控制器不再对各个交换机发送的上报消息进行单独处理，而是对各个交换机队列中的上报消息进行轮询调度。从而控制器不再直接针对接收到攻击的交换机发送的上报消息处理完后再处理其他交换机发送的上报消息，而是在上报消息保存一个时间长度后，统一对各个交换机发送的上报消息进行轮询调度。从而在抵御消息攻击的同时，避免了在攻击发生时造成的非攻击流量的处理时间延长，保证了正常响应正常用户的服务请求。
具体的，所述控制器对所述各个交换机对应的交换机队列进行轮询调度时，具体根据预设的调度该交换机队列时需要的上报消息数量分别对各个交换机对应的交换机队列进行轮询调度。
其中，所述预设的调度该交换机队列时需要调度的上报消息数量，可以根据预先为各个交换机分配的上报消息权重来确定。具体可以是管理员通过人机接口为各个交换机分配上报消息权重。
则所述控制器对所述各个交换机对应的交换机队列进行轮询调度时，具体可以通过以下方式，包括：
所述控制器确定各个交换机的上报消息权重；
所述控制器根据各个交换机队列的上报消息权重确定当前调度的交换机队列在一个调度周期中的调度的Packet-in消息数量。
所述控制器根据所述确定的当前调度的交换机队列的Packet-in消息数量调度该交换机队列中的Packet-in消息出队处理。
其中，假设与控制器相连的交换机个数为n，即各个交换机对应的交换机队列分别为S1，S2，……，Sn，确定的各个交换机的上报消息权重为WSi，i＝1,2……n。当控制器轮询到第i个交换机队列(即交换机队列Si)时，从队列中提取出
Figure PCTCN2015084694-appb-000001
个Packet-in消息进行处理。从而保证发生攻击交换机对应的交换机队列中的Packet-in消息不会阻塞其他正常交换机的 Packet-in消息处理，起到了一定的隔离防御能力。
具体的，上述加权轮询调度流程可以通过以下伪代码描述：
加权轮询调度流程：
输入：pktinMQueue:每个交换机的交换机队列组成的MAP，activeSwitches:当前激活的交换机以及其权重wsi
Figure PCTCN2015084694-appb-000002
利用上述方法解决了交换机队列之间Packet-in消息处理的竞争，但可能 存在一定的不足：在主机(Host)层面，各个Host分别与交换机相连，且Host发送的消息通过交换机进行转发，若无法匹配，则通过Packet-in消息发送给控制器。当一个Host对控制器进行发包攻击时，控制器在调度该Host所连接的交换机队列中的Packet-in消息时，每次轮询都会先去处理发生攻击Host发送的消息，因此会导致该Host连接的交换机上，其他正常的Host发送的Packet-in消息无法得到及时的接收处理。因此通过以下实现方式实施。
在其中一个实施例中，所述控制器将接收到的各个交换机发送的所述上报消息保存到所述各个交换机对应的交换机队列，具体可以过通过以下方式：
a，所述控制器确认所述上报消息所属的交换机队列。
其中，可以根据上报消息中携带的交换机的标识信息确定交换机队列。交换机的标识信息可以是交换机的端口号，还可以是地址信息等等。
b，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列；所述主机队列为与所述上报消息所属的交换机队列对应的交换机相连的各个主机对应的各个主机队列。
其中，与交换机相连的各个主机的主机队列，和该交换机的交换机队列相对应。
c，当确定不存在与所述上报消息所属的交换机队列对应的主机队列且所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值时，所述控制器建立与所述上报消息所属的交换机队列对应的主机队列，并将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列。
其中，所述控制器建立所述上报消息所属的主机队列时，可以根据所述上报消息依据主机的标识信息进行主机队列的建立，其中，Host的标识信息可以是Host的端口号，还可以是地址信息等等。
上报消息中还可以携带主机的标识信息，则根据主机的标识信息确定该上报消息所属的交换机队列对应的主机队列，从而将该上报消息***到该主机队列。
则所述控制器对所述各个交换机对应的交换机队列进行轮询调度时，若 确定当前调度的交换机队列为空，所述控制器根据所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量和第二阈值确定所述当前调度的交换机队列对应的各个主机队列的优先级；
具体的，所述控制器根据各个主机队列中已存储的上报消息数量和第二阈值确定各个主机队列的优先级，可以为：初始建立的各个主机队列的优先级相同，可以均为第一优先级等级。当监测到某个主机队列中的上报消息数量达到第二阈值时，则确定该主机为攻击源，可以将该主机队列的优先级设置为第二优先级等级，其中第二优先级等级小于第一优先级等级。
所述控制器根据所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度。
可选地，所述控制器根据当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度时，若确定所述当前调度的交换机队列对应交换机队列对应的各个主机队列中已存储的上报消息数量都小于第三阈值，所述控制器若接收到所述当前调度的交换机队列对应交换机发送的上报消息，将接收到的所述当前调度的交换机队列对应交换机发送的所述上报消息***到当前调度的交换机队列。
其中，所述控制器若接收到非当前调度的交换机队列对应交换机发送的上报消息，则根据交换机队列中存储的上报消息数量和第三阈值确定是否将接收到的上报消息存储到所述接收到的上报消息所属的交换机队列。
具体的，控制器预先为与其连接的各个交换机分别建立交换机队列。且交换机与各个Host连接。当Host发生攻击时，即该Host连接的交换机对应的交换机队列的Packet-in消息数量大于第一阈值，则为该发生攻击的Host连接的交换机依据Host的端口号进行Host队列的建立。当然还可以为与该交换机相连的各个Host分别建立Host队列。具体还可以设置建立的Host队列的优先级，且初始建立的各个Host队列的优先级相同，均为第一优先级等级。当某个Host队列中的Packet-in消息数量达到第二阈值时，则确定该Host为攻击源，可以将该Host队列的优先级设置为第二优先级等级，其中第二优先 级等级小于第一优先级等级。当攻击结束后，即各个Host队列中的Packet-in消息数量均小于第三阈值。其中，第三阈值小于第二阈值。
通过以上方案，为受到攻击的交换机连接的Host建立各自的Host队列，可将受到攻击的Host的Packet-in消息和其他正常的Host的Packet-in消息分开保存，并轮询处理，保证了其他正常的Host中的Packet-in消息得到及时的处理。
可选地，在已建立某个交换机对应的主机队列的情况下，所述控制器将接收到的该交换机发送的所述上报消息***到该交换机对应的交换机队列之后，可以确定已建立交换机队列对应的主机队列的上报消息数量，当确定所述主机队列中存在上报消息存储量为零的主机队列时，删除所述上报消息存储量为零的主机队列；或者，当确定该交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除该交换机队列对应的各个主机队列。
可选地，在确定存在当前调度的交换机对应的主机队列的情况下，所述控制器将接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列之后，在确定所述当前调度的交换机队列对应的各个主机队列中存在上报消息数量为零的主机队列时，删除所述上报消息数量为零的主机队列；或者，在确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除所述当前调度的交换机队列对应的各个主机队列。
可选地，确定已存在主机队列的情况下，所述控制器对所述各个交换机对应的交换机队列进行轮询调度时，对各个交换机的主机队列进行监控，在确定任一交换机队列对应的各个主机队列中存在上报消息数量为零的主机队列时，删除该上报消息数量为零的主机队列，或者在确定任一交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除当前调度的交换机队列对应的各个主机队列。
在其中一个可选地实施例中，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列之后，当判断不存在所述交换机队列对应 的主机队列且确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到所述上报消息所属的交换机队列。
在其中一个可选地实施例中，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列之后，当判断存在与所述上报消息所属的交换机队列对应的主机队列、且任一主机队列中已存储的上报消息数量大于第四阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列，其中，所述第四阈值小于第二阈值。
其中，第四阈值可以等于上述第三阈值，也可以不等于第三阈值。
在其中一个可选地实施例中，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列之后，当确定存在与所述上报消息所属的交换机队列对应的主机队列、且各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到所述上报消息所属的交换机队列，其中所述第五阈值小于第二阈值。
其中，第五阈值可以等于上述第三阈值或者第四阈值，也可以不等于第三阈值及第四阈值。
具体的，控制器针对Packet-in消息的接收入队流程如图2所示。控制器预先为与其连接的各个交换机分别建立交换机队列。下面针对一个交换机以Packet-in消息为例进行说明。
步骤201，接收到交换机发送的Packet-in消息；执行步骤202。其中，Packet-in消息中携带与交换机相连的Host的标识信息。
步骤202，确定是否建立有Host队列，若否，执行步骤203，若是，执行步骤206。其中Host队列为与上述交换机相连的所有Host对应的Host队列。
步骤203，确定该交换机对应的交换机队列中的Packet-in消息数量是否大于第一阈值，若是，执行步骤204，若否，执行步骤205。
步骤204，为所述Host的标识信息对应的Host建立Host队列，并将所述Packet-in消息保存到建立的Host队列。
步骤205，将接收到的Packet-in消息保存到该交换机对应的交换机队列。
步骤206，确定建立的各个Host队列中的Packet-in消息数量是否均小于第二阈值，若是，执行步骤207，若否，执行步骤208。
步骤207，确定该交换机对应的交换机队列中的Packet-in消息数量是否大于第一阈值；若是，执行步骤205，若否，执行步骤208。
步骤208，将接收到的Packet-in消息保存到所述Host的标识信息对应的Host队列。
可选地，所述控制器根据所述确定的各个交换机队列的Packet-in消息数量调度各个交换机队列中的Packet-in消息出队处理时，若确定当前调度的交换机队列为空，且确定所述当前调度的交换机队列对应的建立的任一Host队列不为空时，根据各个交换机的Packet-in消息权重确定从当前调度的交换机队列的调度的Packet-in消息数量，从所述当前调度的交换机队列对应的不为空的各个Host队列中调度出对应数量的上报消息发送。其中对应数量为确定的Packet-in消息数量。
可选地，根据各个交换机的Packet-in消息权重确定从所述当前调度的交换机队列的调度的Packet-in消息数量，从所述当前调度的交换机队列对应的不为空的各个Host队列中调度出对应数量的上报消息发送，具体可以通过以下方式：
从所述当前调度的交换机队列对应的不为空的Host队列中上报消息数量不大于第二阈值的Host队列(即第一优先级等级对应的Host队列)中优先调度第一数量的上报消息；
从所述当前调度的交换机队列对应的不为空的Host队列中上报消息的数量大于第二阈值的其他Host队列(即第二优先级等级对应的Host队列)中调度第二数量的上报消息；
其中，所述第一数量和第二数量之和小于等于所述Packet-in消息数量， 且在所述第一数量大于等于Packet-in消息数量时，所述第二数量为0。
例如：确定某个交换机队列的对应数量为10个，若当前调度的交换机队列对应的不为空的Host队列中上报消息数量不大于第二阈值的Host队列的上报消息数量总和大于等于10，则在该次轮询中，从该上报消息数量不大于第二阈值的Host队列中调度10个上报消息处理，若当前调度的交换机队列对应的不为空的Host队列中上报消息数量不大于第二阈值的Host队列的上报消息数量总和小于10，例如为8个，则从该上报消息数量不大于第二阈值的Host队列中调度8个上报消息处理，然后在当前调度的交换机队列对应的不为空的Host队列中上报消息的数量大于第二阈值的其他Host队列中调度2个上报消息处理。
其中，若确定任一交换机队列对应的各个Host队列为空，删除该交换机队列对应的各个Host队列。
具体的，控制器针对交换机队列及Host队列中的Packet-in消息的调度出队流程如图3所示。
其中，假设与控制器相连的交换机个数为n，即各个交换机对应的交换机队列分别为S1，S2，……，Sn，确定的各个交换机队列的上报消息权重为WSi，i＝1,2……n。当控制器轮询到第i个交换机队列(即交换机队列Si)时，从队列中提取出
Figure PCTCN2015084694-appb-000003
个Packet-in消息进行处理。
步骤301，确定交换机队列Si是否为空，若否，执行步骤302，若是，执行步骤304。
步骤302，对交换机队列Si中的Packet-in消息进行调度处理；执行步骤303。具体的，可以从交换机队列中提取出
Figure PCTCN2015084694-appb-000004
个Packet-in消息进行处理。
步骤303，计算i＝(i+1)％n，且经过计算后的i不等于0；执行步骤301。
步骤304，确定该交换机队列Si是否有对应的Host队列，若否，执行步 骤303，若是，执行步骤305。
步骤305，确定该交换机队列Si对应的所有Host队列是否均为空，若是，执行步骤306，若否，执行步骤307。
步骤306，删除交换机队列Si对应的所有Host队列。执行步骤303。
步骤307，处理交换机队列Si对应的各个Host队列中的Packet-in消息。执行步骤303。
其中，处理交换机队列Si对应的各个Host队列中的Packet-in消息采用轮询调度(Round Bobin)方式。具体如下：
优先对未受到攻击的Host队列之间进行轮询调度，从而保证未受到攻击的Host队列中的Packet-in消息能够得到及时的处理。若之前在建立Host队列时建立了Host队列的优先级，则可以根据优先级等级的大小对Host队列进行调度。而受到攻击的Host队列的优先级最低，最后调度。例如：当调度到交换机队列2时，该交换机队列2为空，则以轮询调度的方式依次从所有Host队列取出M个Packet-in消息进行处理，其中
Figure PCTCN2015084694-appb-000005
若所有未收到攻击的消息数量不足M个，则对收到攻击的Host队列中的Packet-in消息进行调度。如图4所示，假设M＝5，Host队列4为受到攻击的Host对应的Host队列。调度时，依次取出1、2、3、4号Packet-in消息，非攻击Host队列中的消息个数不足5个，则从Host队列4中取出5号Packet-in消息进行调度。
本发明实施例还提供了一种防御消息攻击的装置，如图5所示，该装置应用于控制器中，该装置包括：
接收模块501，用于接收至少一个交换机发送的上报消息；
保存模块502，用于将所述接收模块501接收到的各个交换机发送的所述上报消息分别保存到所述各个交换机对应的交换机队列；
调度模块503，用于对所述保存模块502保存的所述各个交换机对应的交换机队列进行轮询调度。
本发明实施例中所述控制器对接收到的各个交换机发送的上报消息，分别保存到所述各个交换机对应的交换机队列；控制器不再对各个交换机发送的上报消息进行单独处理，而是对各个交换机队列中的上报消息进行轮询调度。从而控制器不再直接针对接收到攻击的交换机发送的上报消息处理完后再处理其他交换机发送的上报消息，而是在上报消息保存一个时间长度后，统一对各个交换机发送的上报消息进行轮询调度。从而避免了在攻击发生时造成的非攻击流量的处理时间延长，甚至无法响应正常用户的服务请求。并且通过在控制器层面进行改进，减少了交换机的负担，不再影响交换机的转发效率。
可选地，如图6所示，该装置还可以包括：
确认模块504，用于确认所述上报消息所属的交换机队列。
判断模块505，用于判断是否存在与所述上报消息所属的交换机队列对应的主机队列；所述主机队列为与所述上报消息所属的交换机队列对应的交换机相连的各个主机对应的各个主机队列。
第一确定模块506，用于在所述判断模块505判断不存在与所述上报消息所属的交换机队列对应的主机队列时，确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值。
建立模块507，在所述判断模块505判断不存在所述上报消息所属的述交换机队列对应的主机队列且所述第一确定模块506确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值时，建立与所述上报消息所属的交换机队列对应的主机队列；
所述保存模块502，具体用于将所述上报消息***到所述建立模块507建立的与所述上报消息所属的交换机队列对应的主机队列；
第二确定模块508，用于当所述调度模块503对所述各个交换机对应的交换机队列进行轮询调度时，若确定当前调度的交换机队列为空，根据所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量和第二阈值确定各个主机队列的优先级；
所述调度模块503，具体用于根据所述第二确定模块508确定的所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度。
可选地，该装置还可以包括第三确定模块；
所述第三确定模块，用于在所述调度模块503根据当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度时，确定所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量是否都小于第三阈值；
所述保存单元502，用于当所述第三确定模块确定所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量是否都小于第三阈值时，若所述接收模块501接收到所述当前调度的交换机队列对应的交换机发送的上报消息，将所述接收模块501接收到的当前调度的交换机队列对应的交换机发送的所述上报消息***到当前调度的交换机队列，所述第三阈值小于第二阈值。
可选地，该装置还包括：
第四确定模块，用于在所述保存模块502将所述接收模块501接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到当前调度的交换机队列之后，确定所述当前调度的交换机队列对应的各个主机队列中是否存在上报消息存储量为零的主机队列；
删除模块，用于在所述第四确定模块确定所述当前调度的交换机队列对应的各个主机队列中存在上报消息数量为零的主机队列时，删除所述上报消息数量为零的主机队列；
或者，
第四确定模块，用于在所述保存模块502将所述接收模块501接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列之后，确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量是否均为零；
删除模块，用于在所述第四确定模块确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除所述当前调度的交换机队列对应的各个主机队列。
可选地，所述第一确定模块506，还用于确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值；
所述保存模块502，还用于在所述判断模块505判断不存在与所述上报消息所属的交换机队列对应的主机队列、且所述第一确定模块506确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值时，将所述上报消息***到所述上报消息所属的交换机队列。
可选地，该装置还包括：
第五确定模块，用于在所述判断模块505判断存在与所述上报消息所属的交换机队列对应的主机队列时，确定任一主机队列中已存储的上报消息数量大于第四阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值；
所述保存模块502，还用于在所述判断模块505判断存在与所述上报消息所属的交换机队列对应的主机队列、且第五确定模块确定任一主机队列中已存储的上报消息数量大于第四阈值且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列，其中，所述第四阈值小于第二阈值。
可选地，该装置还可以包括：
第六确定模块，用于在所述判断模块505判断存在与所述上报消息所属的交换机队列对应的主机队列时，确定各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值；
所述保存模块502，在所述判断模块505判断存在与所述上报消息所属的交换机队列对应的主机队列，且所述第六确定模块确定各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存 储的上报消息数量小于第一阈值时，将所述上报消息***到所述上报消息所属的交换机队列，其中所述第五阈值小于第二阈值。
具体的，所述调度模块503，具体用于根据预先为各个交换机分配的上报消息权重对所述各个交换机对应的交换机队列进行轮询调度。
本发明还提供了一种防御消息攻击的装置，如图7所示，其中该装置可以设置于控制器中，该装置用于执行图1或者图2或者图3所示的方法，具体包括处理器701、存储器702、收发器703。其中，处理器701分别与存储器702及收发器703连接。本发明实施例中不限定上述部件之间的具体连接介质，本发明实施例在图7中以存储器702、处理器701、收发器703之间通过总线连接，总线在图7中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。
本发明实施例中存储器702，用于存储处理器701执行的程序代码，可以是只读存储器(read-only memory，简称ROM)，随机存取存储器(random-access memory，简称：RAM)，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，简称EEPROM)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此，例如存储器702可以是上述存储器的组合。
所述处理器701执行所述存储器702所存放的程序，实现本发明图1或者图2或者图3所示的防御消息攻击的方法。
收发器703接收至少一个交换机发送的上报消息；
处理器701将收发器703接收到的各个交换机发送的所述上报消息分别保存到所述各个交换机对应的交换机队列；
处理器701对所述各个交换机对应的交换机队列进行轮询调度。
其中，各个交换机对应的交换机队列保存在存储器702中。
处理器701将收发器703接收到的各个交换机发送的所述上报消息保存到所述各个交换机对应的交换机队列，具体可以通过以下方式：
处理器701确认收发器703接收到的所述上报消息所属的交换机队列；判断是否存在与所述上报消息所属的交换机队列对应的主机队列；所述主机队列为与与所述上报消息所属的交换机队列对应的交换机相连的各个主机对应的各个主机队列；
在判断不存在与所述上报消息所属的交换机队列对应的主机队列且确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值时，所述控制器建立与所述上报消息所属的交换机队列对应的主机队列，并将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列；
处理器701对所述各个交换机对应的交换机队列进行轮询调度时，若确定当前调度的交换机队列为空，根据当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量和第二阈值确定当前调度的交换机队列对应的各个主机队列的优先级；然后根据当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度。
其中，各个主机对应的主机队列保存在存储器702中。与交换机相连的各个主机的主机队列，和该交换机的交换机队列相对应。
处理器701根据当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度时，在确定当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量都小于第三阈值时，若收发器703接收到当前调度的交换机队列对应的交换机发送的上报消息，则处理器701将收发器703接收到的当前调度的交换机队列对应的交换机发送的所述上报消息***到当前调度的交换机队列，所述第三阈值小于第二阈值。
处理器701将收发器703接收到的当前调度的交换机队列对应的交换机发送的所述上报消息***到当前调度的交换机队列之后，在确定当前调度的交换机队列对应的各个主机队列中存在上报消息数量为零的主机队列时，删除所述上报消息数量为零的主机队列；或者，在确定当前调度的交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除当前调度的交换机队列对应的各个主机队列。
处理器701判断是否存在与所述上报消息所属的交换机队列对应的主机队列之后，在判断不存在与所述上报消息所属的交换机队列对应的主机队列且确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值时，将收发器703接收到的所述上报消息***到所述上报消息所属的交换机队列。
处理器701判断是否存在与所述上报消息所属的交换机队列对应的主机队列时，若判断存在与所述上报消息所属的交换机队列对应的主机队列、且确定任一主机队列中已存储的上报消息数量大于第四阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，将收发器703接收到的所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列，其中，所述第四阈值小于第二阈值。
其中，第四阈值可以等于上述第三阈值，也可以不等于第三阈值。
处理器701判断是否存在与所述上报消息所属的交换机队列对应的主机队列时，当判断存在与所述上报消息所属的交换机队列对应的主机队列、且确定各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，将收发器703接收到的所述上报消息***到所述上报消息所属的交换机队列，其中所述第五阈值小于第二阈值。
其中，第五阈值可以等于上述第三阈值或者第四阈值，也可以不等于第三阈值及第四阈值。
处理器701对所述各个交换机对应的交换机队列进行轮询调度，具体可以通过以下方式：
根据预先为各个交换机分配的上报消息权重对所述各个交换机对应的交换机队列进行轮询调度。
本发明实施例中控制器中的处理器701对收发器703接收到的每个交换机发送的上报消息，分别保存到存储器702中存储的该交换机对应的交换机队列；控制器不再对每个交换机发送的上报消息进行单独处理，而是对所有 交换机队列中的上报消息进行轮询调度。从而控制器不再直接针对接收到攻击的交换机发送的上报消息处理完后再处理其他交换机发送的上报消息，而是在上报消息保存一个时间长度后，统一对各个交换机发送的上报消息进行轮询调度。从而在抵御消息攻击的同时，避免了在攻击发生时造成的非攻击流量的处理时间延长，保证了正常响应正常用户的服务请求。
本领域内的技术人员应明白，本发明的实施例可提供为方法、***、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明实施例进行各种改动和变型而不脱离本发明实施例的精神和范围。这样，倘若本发明实施例的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (16)

  1. 一种防御消息攻击的方法，其特征在于，包括：
    控制器接收至少一个交换机发送的上报消息；
    所述控制器将接收到的各个交换机发送的所述上报消息分别保存到所述各个交换机对应的交换机队列；
    所述控制器对所述各个交换机对应的交换机队列进行轮询调度。
  2. 如权利要求1所述的方法，其特征在于，所述控制器将接收到的各个交换机发送的所述上报消息保存到所述各个交换机对应的交换机队列具体包括：
    所述控制器确认所述上报消息所属的交换机队列；
    所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列；所述主机队列为与所述上报消息所属的交换机队列对应的交换机相连的各个主机对应的各个主机队列；
    在判断不存在与所述上报消息所属的交换机队列对应的主机队列且确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值时，所述控制器建立与所述上报消息所属的交换机队列对应的主机队列，并将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列；
    所述控制器对所述各个交换机对应的交换机队列进行轮询调度时，若确定当前调度的交换机队列为空，还包括：
    所述控制器根据所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量和第二阈值确定所述当前调度的交换机队列对应的各个主机队列的优先级；
    所述控制器根据所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度。
  3. 如权利要求2所述的方法，其特征在于，所述控制器根据所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度 时，还包括：
    在确定所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量都小于第三阈值时，所述控制器若接收到所述当前调度的交换机队列对应的交换机发送的上报消息，则将接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列，所述第三阈值小于第二阈值。
  4. 如权利要求3所述的方法，其特征在于，所述将接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列之后，还包括:
    在确定所述当前调度的交换机队列对应的各个主机队列中存在上报消息数量为零的主机队列时，删除所述上报消息数量为零的主机队列；
    或者，在确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除所述当前调度的交换机队列对应的各个主机队列。
  5. 如权利要求2至4任一所述的方法，其特征在于，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列之后，还包括：
    在判断不存在与所述上报消息所属的交换机队列对应的主机队列且确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到所述上报消息所属的交换机队列。
  6. 如权利要求2至5任一所述的方法，其特征在于，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列之后，还包括：
    若判断存在与所述上报消息所属的交换机队列对应的主机队列且确定任一主机队列中已存储的上报消息数量大于第四阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列，其中，所述第四阈值小于第二阈值。
  7. 如权利要求2至6任一所述的方法，其特征在于，所述控制器判断是否存在与所述上报消息所属的交换机队列对应的主机队列时，还包括：
    当判断存在与所述上报消息所属的交换机队列对应的主机队列、且确定各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，所述控制器将所述上报消息***到所述上报消息所属的交换机队列，其中所述第五阈值小于第二阈值。
  8. 如权利要求1至7任一所述的方法，其特征在于，所述控制器对所述各个交换机对应的交换机队列进行轮询调度具体包括：
    所述控制器根据预先为各个交换机分配的上报消息权重对所述各个交换机对应的交换机队列进行轮询调度。
  9. 一种防御消息攻击的装置，其特征在于，包括：
    接收模块，用于接收至少一个交换机发送的上报消息；
    保存模块，用于将所述接收模块接收到的各个交换机发送的所述上报消息分别保存到所述各个交换机对应的交换机队列；
    调度模块，用于对所述保存模块保存的所述各个交换机对应的交换机队列进行轮询调度。
  10. 如权利要求9所述的装置，其特征在于，还包括：
    确认模块，用于确认所述上报消息所属的交换机队列；
    判断模块，用于判断是否存在与所述上报消息所属的交换机队列对应的主机队列；所述主机队列为与所述上报消息所属的交换机队列对应的交换机相连的各个主机对应的各个主机队列；
    第一确定模块，用于确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值；
    建立模块，用于在所述判断模块判断不存在与所述上报消息所属的交换机队列对应的主机队列、且所述第一确定模块确定所述上报消息所属的交换机队列中已存储的上报消息数量大于第一阈值时，建立与所述上报消息所属的交换机队列对应的主机队列；
    所述保存模块，具体用于将所述上报消息***到所述建立模块建立的与 所述上报消息所属的交换机队列对应的主机队列；
    第二确定模块，用于当所述调度模块对所述各个交换机对应的交换机队列进行轮询调度时，若确定当前调度的交换机队列为空，根据所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量和第二阈值确定各个主机队列的优先级；
    所述调度模块，具体用于根据所述第二确定模块确定的所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度。
  11. 如权利要求10所述的装置，其特征在于，还包括第三确定模块；
    所述第三确定模块，用于在所述调度模块根据所述当前调度的交换机队列对应的各个主机队列的优先级对各个主机队列进行轮询调度时，确定所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量是否都小于第三阈值；
    所述保存单元，用于当所述第三确定模块确定所述当前调度的交换机队列对应的各个主机队列中已存储的上报消息数量是否都小于第三阈值时，若所述接收模块接收到所述当前调度的交换机队列对应的交换机发送的上报消息，则将所述接收模块接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列，所述第三阈值小于第二阈值。
  12. 如权利要求11所述的装置，其特征在于，还包括：
    第四确定模块，用于在所述保存模块将所述接收模块接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列之后，确定所述当前调度的交换机队列对应的各个主机队列中是否存在上报消息数量为零的主机队列；
    删除模块，用于在所述第四确定模块确定所述当前调度的交换机队列对应的各个主机队列中存在上报消息数量为零的主机队列时，删除所述上报消息数量为零的主机队列；
    或者，
    第四确定模块，用于在所述保存模块将所述接收模块接收到的所述当前调度的交换机队列对应的交换机发送的所述上报消息***到所述当前调度的交换机队列之后，确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量是否均为零；
    删除模块，用于在所述第四确定模块确定所述当前调度的交换机队列对应的各个主机队列存储的上报消息数量均为零时，删除所述当前调度的交换机队列对应的各个主机队列。
  13. 如权利要求10至12任一所述的装置，其特征在于，所述第一确定模块，还用于确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值；
    所述保存单元，还用于在所述判断模块判断不存在与所述上报消息所属的交换机队列对应的主机队列、且所述第一确定模块确定所述上报消息所属的交换机队列中已存储的上报消息数量小于第一阈值时，将所述上报消息***到所述上报消息所属的交换机队列。
  14. 如权利要求10至13任一所述的装置，其特征在于，还包括：
    第五确定模块，用于在所述判断模块判断存在与所述上报消息所属的交换机队列对应的主机队列时，确定任一主机队列中已存储的上报消息数量大于第四阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值；
    所述保存单元，还用于在所述判断模块判断存在与所述上报消息所属的交换机队列对应的主机队列、且第五确定模块确定任一主机队列中已存储的上报消息数量大于第四阈值且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，将所述上报消息***到与所述上报消息所属的交换机队列对应的主机队列，其中，所述第四阈值小于第二阈值。
  15. 如权利要求10至14任一所述的装置，其特征在于，还包括：
    第六确定模块，用于在所述判断模块判断存在与所述上报消息所属的交换机队列对应的主机队列时，确定各个主机队列中已存储的上报消息数量均 小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值；
    所述保存单元，在在所述判断模块判断存在与所述上报消息所属的交换机队列对应的主机队列，且所述第六确定模块确定各个主机队列中已存储的上报消息数量均小于第五阈值、且所述上报消息所属的交换机队列已存储的上报消息数量小于第一阈值时，将所述上报消息***到所述上报消息所属的交换机队列，其中所述第五阈值小于第二阈值。
  16. 如权利要求9至15任一所述的装置，其特征在于，所述调度模块，具体用于根据预先为各个交换机分配的上报消息权重对所述各个交换机对应的交换机队列进行轮询调度。
PCT/CN2015/084694 2015-02-13 2015-07-21 一种防御消息攻击的方法及装置 WO2016127582A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP15881742.9A EP3249874A4 (en) 2015-02-13 2015-07-21 Method and apparatus for defending against message attacks
US15/674,969 US10536321B2 (en) 2015-02-13 2017-08-11 Message attack defense method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510080973.5 2015-02-13
CN201510080973.5A CN105991588B (zh) 2015-02-13 2015-02-13 一种防御消息攻击的方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/674,969 Continuation US10536321B2 (en) 2015-02-13 2017-08-11 Message attack defense method and apparatus

Publications (1)

Publication Number Publication Date
WO2016127582A1 true WO2016127582A1 (zh) 2016-08-18

Family

ID=56614107

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/084694 WO2016127582A1 (zh) 2015-02-13 2015-07-21 一种防御消息攻击的方法及装置

Country Status (4)

Country Link
US (1) US10536321B2 (zh)
EP (1) EP3249874A4 (zh)
CN (1) CN105991588B (zh)
WO (1) WO2016127582A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20170036509A (ko) * 2015-09-24 2017-04-03 삼성전자주식회사 통신 시스템에서 패킷을 스케쥴링하는 장치 및 방법
CN108304254B (zh) * 2017-12-29 2022-02-22 珠海国芯云科技有限公司 快速虚拟机进程调度控制方法及装置
CN108196939B (zh) * 2017-12-29 2022-02-18 珠海国芯云科技有限公司 用于云计算的虚拟机智能管理方法及装置
CN108287753B (zh) * 2017-12-29 2022-02-22 珠海国芯云科技有限公司 计算机***快速调度方法及装置
US11388074B2 (en) * 2018-04-12 2022-07-12 Intel Corporation Technologies for performance monitoring and management with empty polling

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102326369A (zh) * 2011-08-04 2012-01-18 华为技术有限公司 队列调度方法和装置
CN103677760A (zh) * 2013-12-04 2014-03-26 北京航空航天大学 一种基于Openflow的事件并行控制器及其事件并行处理方法
CN103747026A (zh) * 2013-10-29 2014-04-23 盛科网络（苏州）有限公司 openflow流表的告警方法及告警装置
WO2014139558A1 (en) * 2013-03-12 2014-09-18 Nec Europe Ltd. A packet data network, a method for operating a packet data network and a flow-based programmable network device

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060221978A1 (en) * 2005-03-31 2006-10-05 Muthaiah Venkatachalam Backlogged queue manager
US8284660B2 (en) * 2009-10-30 2012-10-09 Qualcomm, Incorporated Method and apparatus for scheduling of quality of service (QoS) transmissions in a wireless communication system
US8363668B2 (en) * 2009-12-17 2013-01-29 Juniper Networks, Inc. Avoiding unfair advantage in weighted round robin (WRR) scheduling
US9465662B2 (en) * 2011-10-17 2016-10-11 Cavium, Inc. Processor with efficient work queuing
US20150365290A1 (en) * 2013-01-23 2015-12-17 Nec Corporation Network verification apparatus, network verification method and program
CN103346922B (zh) * 2013-07-26 2016-08-10 电子科技大学 基于sdn的确定网络状态的控制器及其确定方法
US9172651B2 (en) * 2014-02-14 2015-10-27 Telefonaktiebolaget L M Ericsson (Publ) Denial of service prevention in a software defined network
US20150263960A1 (en) * 2014-03-14 2015-09-17 Avni Networks Inc. Method and apparatus for cloud bursting and cloud balancing of instances across clouds
US9491031B2 (en) * 2014-05-06 2016-11-08 At&T Intellectual Property I, L.P. Devices, methods, and computer readable storage devices for collecting information and sharing information associated with session flows between communication devices and servers
US9379931B2 (en) * 2014-05-16 2016-06-28 Cisco Technology, Inc. System and method for transporting information to services in a network environment
EP3162017B1 (en) * 2014-06-30 2021-11-24 Alcatel Lucent Security in software defined network
US20160094491A1 (en) * 2014-09-30 2016-03-31 Genesys Telecommunications Laboratories, Inc. Pattern-controlled automated messaging system
US9838421B2 (en) * 2014-10-01 2017-12-05 Ciena Corporation Systems and methods utilizing peer measurements to detect and defend against distributed denial of service attacks
JP2018504061A (ja) * 2015-01-28 2018-02-08 ノキア ソリューションズ アンド ネットワークス オサケユキチュア ソフトウェア定義ネットワーキングコントローラ

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102326369A (zh) * 2011-08-04 2012-01-18 华为技术有限公司 队列调度方法和装置
WO2014139558A1 (en) * 2013-03-12 2014-09-18 Nec Europe Ltd. A packet data network, a method for operating a packet data network and a flow-based programmable network device
CN103747026A (zh) * 2013-10-29 2014-04-23 盛科网络（苏州）有限公司 openflow流表的告警方法及告警装置
CN103677760A (zh) * 2013-12-04 2014-03-26 北京航空航天大学 一种基于Openflow的事件并行控制器及其事件并行处理方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3249874A4 *

Also Published As

Publication number Publication date
EP3249874A4 (en) 2018-02-21
US20170338998A1 (en) 2017-11-23
CN105991588B (zh) 2019-05-28
US10536321B2 (en) 2020-01-14
EP3249874A1 (en) 2017-11-29
CN105991588A (zh) 2016-10-05

Similar Documents

Publication Publication Date Title
JP6430462B2 (ja) バーチャルマシン通信トラフィックを成形すること
US10536321B2 (en) Message attack defense method and apparatus
US10326713B2 (en) Data enqueuing method, data dequeuing method, and queue management circuit
US8565092B2 (en) Dynamic flow redistribution for head of line blocking avoidance
US8769681B1 (en) Methods and system for DMA based distributed denial of service protection
CN107404443B (zh) 队列缓存资源控制方法及装置、服务器及存储介质
CN108737447B (zh) 用户数据报协议流量过滤方法、装置、服务器及存储介质
US10880778B2 (en) Message cache management in a mesh network
US9571377B2 (en) Dynamic denial of service protection
WO2019072072A1 (zh) 一种拥塞流识别方法及网络设备
WO2020037781A1 (zh) 一种实现服务器防攻击方法及装置
US9225654B2 (en) Method and apparatus for sending packet
US8111700B2 (en) Computer-readable recording medium storing packet identification program, packet identification method, and packet identification device
CN111756586B (zh) 一种数据中心网络中基于优先级队列的公平带宽分配方法、交换机及可读存储介质
EP2417737B1 (en) Transmit-side scaler and method for processing outgoing information packets using thread-based queues
CN109450941B (zh) 一种抗DDoS的SDN控制器消息调度方法
US8149709B2 (en) Serialization queue framework for transmitting packets
US20200186564A1 (en) Method for managing a memory
CN111049758A (zh) 一种实现报文QoS处理的方法、***及设备
CN113037755B (zh) 网络连接攻击的防御方法及设备
WO2015196799A1 (zh) 报文处理方法、装置及线卡
CN115225593A (zh) 分片报文重组方法、装置、设备和介质
CN118200975A (zh) 报文处理方法及网络侧设备
CN117042055A (zh) 一种数据调整策略确定方法、装置、电子设备及存储介质
JP2013239910A (ja) 通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15881742

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2015881742

Country of ref document: EP