Method for parsing network message and communication device

• US 9,819,719 B2
• Filed: 05/30/2014
• Issued: 11/14/2017
• Est. Priority Date: 11/30/2011
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Hasson, Uri, Kristal, Amit, Mo, Mo, Huang, Jian
• Primary Examiner(s): Katsikis, Kostas
• Application Number:
  US14/292,086
• Publication Number:
  US 20140280924A1
• Time in Patent Office: 1,264 Days
• Field of Search: 709224
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method for parsing a network message and a communication device, which includes: receiving a network message, where the network message includes one or more sections; identifying that an application protocol type of the network message is a first application protocol; acquiring, from a current section that is in the network message and that is described by a piece of section description information in a configuration file corresponding to the first application protocol, interesting data indicated by interesting data indication information in the section description information; and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, thereby obtaining a corresponding decision result, when the current section is a last section of the network message, the decision result includes a processing method of a next message of the network message.

Claims

1. A method for parsing a network message implemented in a network device comprising:

maintaining configuration files corresponding to different application protocol types;

receiving a network message, wherein the network message comprises one or more sections;

identifying that an application protocol type of the network message is a first application protocol;

acquiring interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in one of the configuration files corresponding to the first application protocol; and

executing a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result,

wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message,

wherein both the network message and the next message belong to a same application layer,

wherein the decision method indicates that different atomic methods are executed according to different decision conditions,

wherein the decision condition comprises one or more pieces of interesting data,

wherein the acquired interesting data comprises a protocol type information of the next section when the interesting data indication information comprises first indication information that indicates protocol type information of the next section,

wherein the decision result comprises an atomic method of changing a protocol type of a first section of the next message when the protocol type information is used as the decision condition, and

wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

2. The method according to claim 1, wherein the interesting data indication information is a header field name and the interesting data indicated by the interesting data indication information is a header field value located behind a corresponding header field.

3. The method according to claim 1, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein the decision result comprises a parameter required by execution of the following atomic method:

setting a next section.

4. The method according to claim 1, wherein the interesting data indication information is a header field name and the interesting data indicated by the interesting data indication information is interesting data indicated by the header field name.

5. The method according to claim 1, wherein the interesting data indication information is an attribute name and the interesting data indicated by the interesting data indication information is an attribute value.

6. The method according to claim 1, wherein the decision result indicates a processing method of a next section of the current section when the current section is not the last section of the network message.

7. The method according to claim 6, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein the acquired interesting data comprises a protocol type information of the next section when the interesting data indication information comprises first indication information that indicates the protocol type information of the next section, wherein the decision result comprises an atomic method of setting a protocol type of the next section when the protocol type information is used as the decision condition, and wherein the protocol type of the next section is a protocol type indicated by the protocol type information.

8. The method according to claim 6, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein the acquired interesting data comprises length information of the next section when the interesting data indication information comprises second indication information that indicates length information of the next section, wherein the decision result comprises an atomic method of setting the next section as a section with a preset length directly skipped when the length information is used as the decision condition, and wherein the preset length is a length indicated by the length information.

9. The method according to claim 6, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein the acquired interesting data comprises encoding and decoding information of the next section when the interesting data indication information comprises third indication information that indicates the encoding and decoding information of the next section, wherein the decision result comprises an atomic method of setting a decoding algorithm that needs to be performed before the next section is to be parsed when the encoding and decoding information is used as the decision condition, and wherein the decoding algorithm that needs to be performed before the next section is to be processed is the decoding algorithm indicated by the encoding and decoding information.

10. The method according to claim 1, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of the interesting data, and wherein the decision result comprises a parameter required by execution of the following atomic method:

setting a decoding algorithm that needs to be performed before the next section is to be processed.

11. The method according to claim 1, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of the interesting data, and wherein the decision result comprises a parameter required by execution of the following atomic method:

setting a protocol type of the next section.

12. The method according to claim 1, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of the interesting data, and wherein the decision result comprises a parameter required by execution of the following atomic method:

changing a protocol type of a first section of the next message.

13. The method according to claim 1, wherein the interesting data indication information is a label name and the interesting data indicated by the interesting data indication information is a label value.

14. A method for parsing a network message implemented in a network device comprising:

maintaining configuration files corresponding to different application protocol types;

receiving a network message, wherein the network message comprises one or more sections;

identifying that an application protocol type of the network message is a first application protocol;

acquiring interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in one of the configuration files corresponding to the first application protocol; and

executing a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result,

wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message,

wherein both the network message and the next message belong to a same application layer,

wherein the acquired interesting data comprises a protocol type information of a first section of the next message, length information of the first section of the next message, or encoding and decoding information of a first section of the next message,

wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method,

wherein the section type indicates a scanning method used by the current section, and

wherein acquiring interesting data indicated by the interesting data indication information in the section description information comprises;

obtaining the interesting data indication information by scanning the current section corresponding to the section name using the scanning method indicated by the section type; and

acquiring the interesting data indicated by the interesting data indication information.

15. The method according to claim 14, wherein the section type indicates a fast scanning method, and wherein obtaining the interesting data indication information by scanning the current section corresponding to the section name using the scanning method indicated by the section type comprises:

skipping characters of a specific length from a first character of the current section corresponding to the section name;

determining whether n characters, which are not data delimiters and which are behind a skipped-to character and closest to the skipped-to character, are the first n characters in the interesting data indication information when the skipped-to character is a data delimiter;

obtaining the interesting data indication information from the current section according to the first n characters in the interesting data indication information by matching when the n characters are the first n characters in the interesting data indication information, wherein n is greater than or equal to 1;

determining whether a character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is the data delimiter when the skipped-to character is a character in the first n characters in the interesting data indication information; and

obtaining, by matching, the interesting data indication information from the current section using the skipped-to character when the character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is the data delimiter.

16. A computer system, comprising:

an interface;

a memory configured to store configuration files that correspond to different application protocol types; and

a processor coupled to the memory and the interface, wherein the processor is configured to;

obtain a network message which is received from the interface, wherein the network message comprises one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in one of the configuration files corresponding to the first application protocol; and

execute a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result,

wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message,

wherein both the network message and the next message belong to a same application layer, and

wherein;

the acquired interesting data comprises a protocol type information of a first section of the next message, length information of the first section of the next message, or encoding and decoding information of a first section of the next message,

the interesting data indication information is a header field name and the interesting data indicated by the interesting data indication information is a header field value located behind a corresponding header field,

the interesting data indication information is the header field name and the interesting data indicated by the interesting data indication information is interesting data indicated by the header field name,

the interesting data indication information is an attribute name and the interesting data indicated by the interesting data indication information is an attribute value, or

the interesting data indication information is a label name and the interesting data indicated by the interesting data indication information is a label value.

17. The computer system according to claim 16, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, wherein the section type indicates a scanning method used by the current section, and wherein in acquiring interesting data indicated by the interesting data indication information in the section description information, the processor is further configured to:

obtain the interesting data indication information by scanning the current section corresponding to the section name using the scanning method indicated by the section type; and

acquire the interesting data indicated by the interesting data indication information.

18. The computer system according to claim 17, wherein the section type indicates a fast scanning method, and wherein in obtaining the interesting data indication information by scanning the current section corresponding to the section name using the scanning method indicated by the section type, the processor is further configured to:

skip characters of a specific length from a first character of the current section corresponding to the section name;

determine whether n characters, which are not data delimiters and which are behind a skipped-to character and closest to the skipped-to character, are first n characters in the interesting data indication information when the skipped-to character is a data delimiter, wherein the interesting data indication information from the current section according to the first n characters in the interesting data indication information, wherein n is greater than or equal to 1 by matching when the n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are first n characters in the interesting data indication information; and

determine whether a character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is the data delimiter when the skipped-to character is a character in the first n characters in the interesting data indication information, and wherein the interesting data indication information from the current section using the skipped-to character by matching when the character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is the data delimiter.

19. A computer system, comprising:

an interface;

a memory configured to store configuration files that correspond to different application protocol types; and

a processor coupled to the memory and the interface, wherein the processor is configured to;

obtain a network message which is received from the interface, wherein the network message comprises one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in one of the configuration files corresponding to the first application protocol; and

execute a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result, wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message, wherein both the network message and the next message belong to a same application layer, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein in acquiring interesting data indicated by the interesting data indication information in the section description information and executing a decision method in the section description information using all or a part of the acquired interesting data as a decision condition,

acquire the interesting data indicated by the interesting data indication information in the section description information from the current section that is in the network message and that is described by the section description information in the one of the configuration files corresponding to the first application protocol, wherein the interesting data indication information comprises first indication information that indicates protocol type information of a next section and second indication information that indicates length information of the next section, and wherein the acquired interesting data comprises the protocol type information and the length information; and

obtain the decision result using the protocol type information and the length information as the decision condition, wherein the length information indicates that the current section is the last section, wherein the decision result comprises an atomic method of changing a protocol type of a first section of the next message, and wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

20. A computer system, comprising:

an interface;

a memory configured to store configuration files that correspond to different application protocol types; and

a processor coupled to the memory and the interface, wherein the processor is configured to;

obtain a network message which is received from the interface, wherein the network message comprises one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in one of the configuration files corresponding to the first application protocol; and

execute a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result,

wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message, and

wherein both the network message and the next message belong to a same application layer,

wherein the decision result indicates a processing method of a next section of the current section when the current section is not the last section of the network message,

wherein the decision method indicates that different atomic methods are executed according to different decision conditions, and

wherein the decision condition comprises one or more pieces of interesting data, wherein in acquiring interesting data indicated by the interesting data indication information in the section description information and executing a decision method in the section description information using all or a part of the acquired interesting data as a decision condition, the processor is further configured to;

acquire the interesting data indicated by the interesting data indication information in the section description information from the current section that is in the network message and that is described by the section description information in the one of the configuration files corresponding to the first application protocol, wherein the interesting data indication information comprises second indication information that indicates length information of the next section, and wherein the acquired interesting data comprises the length information; and

obtain the decision result using the length information as the decision condition, wherein the decision result comprises an atomic method of setting the next section as a section with a preset length directly skipped, and wherein the preset length is a length indicated by the length information.

21. A computer system, comprising:

an interface;

a memory configured to store configuration files that correspond to different application protocol types; and

a processor coupled to the memory and the interface, wherein the processor is configured to;

obtain a network message which is received from the interface, wherein the network message comprises one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in one of the configuration files corresponding to the first application protocol; and

execute a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result,

wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message,

wherein both the network message and the next message belong to a same application layer,

wherein the decision result indicates a processing method of a next section of the current section when the current section is not the last section of the network message,

wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and

wherein in acquiring interesting data indicated by the interesting data indication information in the section description information and executing a decision method in the section description information using all or a part of the acquired interesting data as a decision condition, the processor is further configured to;

acquire the interesting data indicated by the interesting data indication information in the section description information from the current section that is in the network message and that is described by the section description information in the one of the configuration files corresponding to the first application protocol, wherein the interesting data indication information comprises first indication information that indicates protocol type information of a next section, and wherein the acquired interesting data comprises the protocol type information; and

obtain the decision result using the protocol type information as the decision condition, wherein the decision result comprises an atomic method of setting a protocol type of the next section, and wherein the protocol type of the next section is a protocol type indicated by the protocol type information.

22. A parsing system, comprising:

a processor;

a memory coupled to the processor and configured to store configuration files and a program that is used by the processor, wherein the configuration files correspond to different application protocol types;

a compiler coupled to the processor and configured to compile the configuration files into protocol parsing auxiliary data that can be identified by the processor, wherein the processor is configured to;

receive a network message comprising one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in protocol parsing auxiliary data corresponding to the first application protocol; and

execute a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result, wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message, wherein both the network message and the next message belong to a same application layer, and wherein the acquired interesting data comprises a protocol type information of a first section of the next message, length information of the first section of the next message, or encoding and decoding information of a first section of the next message;

a fast scanning compiler coupled to the processor and configured to;

compile the interesting data indication information in each section described in each of the configuration files into machine-readable protocol parsing auxiliary data; and

output a fast scanning table comprising a first n characters of the interesting data indication information and protocol parsing auxiliary data corresponding to a data delimiter in the section;

a precise matching compiler coupled to the processor and configured to compile a multi-mode matching algorithm into machine-readable protocol parsing auxiliary data; and

a logical decision compiler coupled to the processor and configured to compile the decision method in the configuration files into machine-readable protocol parsing auxiliary data.

23. The system according to claim 22, wherein the configuration files corresponding to the application protocol type comprise one or more pieces of the section description information, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, wherein the section type indicates a scanning method used by a section, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of the interesting data, wherein the decision result comprises a parameter required by execution of the following atomic method:

setting the next section.

24. The system according to claim 22, further comprising a memory manager configured to manage the memory used by the compiler and the processor, wherein different memory areas of the memory are used by the compiler and the processor.

25. The system according to claim 22, further comprising a loader configured to:

read the configuration files from an internal storage device; and

load the configuration files into the compiler.

26. The system according to claim 22, wherein the configuration files corresponding to the application protocol type comprise one or more pieces of the section description information, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, wherein the section type indicates a scanning method used by a section, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of the interesting data, wherein the decision result comprises a parameter required by execution of the following atomic method:

changing a protocol type of a first section of the next message.

27. The system according to claim 22, wherein the processor is further configured to:

skip characters of a specific length from a first character of the current section corresponding to a section name;

determine whether a skipped-to character is a data delimiter or a character in the first n characters in the interesting data indication information according to the fast scanning table;

determine whether n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are the first n characters in the interesting data indication information when the skipped-to character is the data delimiter;

determine whether a character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is the data delimiter when the skipped-to character is the character in the first n characters in the interesting data indication information, wherein n is greater than or equal to 1;

execute the compiled multi-mode matching algorithm in the protocol parsing auxiliary data according to the first n characters in the interesting data indication information to obtain the interesting data indication information in the current section by matching when the n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are the first n characters in the interesting data indication information;

execute the compiled multi-mode matching algorithm in the protocol parsing auxiliary data using the skipped-to character to obtain the interesting data indication information in the current section by matching when the character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is the data delimiter,

acquire the interesting data indicated by the interesting data indication information according to the interesting data indication information obtained by matching, and

execute the decision method in the section description information in the protocol parsing auxiliary data using all or a part of the interesting data to obtain the decision result.

28. The system according to claim 22, wherein the processor is configured to output the acquired interesting data to outside.

29. The system according to claim 22, wherein the configuration files corresponding to the application protocol type comprise one or more pieces of the section description information, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, wherein the section type indicates a scanning method used by a section, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of the interesting data, wherein the decision result comprises a parameter required by execution of the following atomic method:

setting a protocol type of the next section.

30. The system according to claim 22, wherein the configuration files corresponding to the application protocol type comprise one or more pieces of the section description information, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, wherein the section type indicates a scanning method used by a section, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of the interesting data, wherein the decision result comprises a parameter required by execution of the following atomic method:

setting a decoding algorithm that needs to be performed before the next section is to be processed.

31. The system according to claim 22, further comprising a loader configured to:

read the configuration files from an external storage device; and

load the configuration files into the compiler.

32. A computer system comprising:

an interface;

a memory configured to store configuration files that correspond to different application protocol types; and

a processor coupled to the memory and the interface, wherein the processor is configured to;

obtain a network message which is received from the interface, wherein the network message comprises one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in one of the configuration files corresponding to the first application protocol; and

execute a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result,

wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message,

wherein both the network message and the next message belong to a same application layer,

wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and

wherein in acquiring interesting data indicated by the interesting data indication information in the section description information and executing a decision method in the section description information using all or a part of the acquired interesting data as a decision condition, the processor is further configured to;

acquire the interesting data indicated by the interesting data indication information in the section description information from the current section that is in the network message and that is described by the section description information in the one of the configuration files corresponding to the first application protocol, wherein the interesting data indication information comprises first indication information that indicates protocol type information of a next section, and wherein the acquired interesting data comprises the protocol type information; and

obtain the decision result using the protocol type information as the decision condition, wherein the decision result comprises an atomic method of changing a protocol type of a first section of the next message, and wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

33. A computer system, comprising:

an interface;

a memory configured to store configuration files that correspond to different application protocol types; and

a processor coupled to the memory and the interface, wherein the processor is configured to;

obtain a network message which is received from the interface, wherein the network message comprises one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire interesting data indicated by an interesting data indication information in a section description information from a current section that is in the network message and that is described by a piece of the section description information in one of the configuration files corresponding to the first application protocol; and

execute a decision method in the section description information using all or a part of the acquired interesting data as a decision condition to obtain a decision result,

wherein the decision result comprises a processing method of a next message of the network message when the current section is a last section of the network message,

wherein both the network message and the next message belong to a same application layer,

wherein the decision result indicates a processing method of a next section of the current section when the current section is not the last section of the network message,

wherein the decision method indicates that different atomic methods are executed according to different decision conditions,

wherein the decision condition comprises one or more pieces of interesting data, and

wherein in acquiring interesting data indicated by the interesting data indication information in the section description information and executing a decision method in the section description information using all or a part of the acquired interesting data as a decision condition the processor is further configured to;

acquire the interesting data indicated by the interesting data indication information in the section description information from the current section that is in the network message and that is described by the section description information in the one of the configuration files corresponding to the first application protocol, wherein the interesting data indication information comprises third indication information that indicates encoding and decoding information of the next section, and wherein the acquired interesting data comprises the encoding and decoding information; and

obtain the decision result using the encoding and decoding information as the decision condition, wherein the decision result comprises an atomic method of setting a decoding algorithm that needs to be performed before the next section is to be processed, and wherein the decoding algorithm that needs to be performed before the next section is to be processed is the decoding algorithm indicated by the encoding and decoding information.