JP2005286833A - Packet filter apparatus and packet filter method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a packet filter apparatus and a packet filter method whereby data after filtering can be acquired without the need for a data processing side using received data to execute processing for data capturing in particular and without limiting a filtering object in particular. <P>SOLUTION: A filtering LSI 114 compares received data 122 sequentially stored in an FIFO memory 123 with an abort pattern stored in a filtering setting register 132 and deletes data coincident with the abort pattern. A timing generating circuit 124 generates a clock timing receivable by a CPU at a post stage (not shown) and gives data read in this timing from the FIFO memory in the older order to the CPU. Thus, it is not required for the CPU to receive a notice denoting the arrival of required data and to carry out the processing for extracting required data. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a packet filter device and a packet filter method for discarding unnecessary packets, and more particularly, a packet filter device for discarding unnecessary packets sent from a communication network and passing them to a data processing side. The present invention relates to a packet filter method.

  As communication networks such as the Internet and LAN (local area network) become larger and communication processing speeds up, a lot of data has been targeted for use by users of communication networks. In view of this, for example, various packet filter devices for discarding unnecessary packets among data sent from a WAN (Wide Area Network) via a router have been proposed for packet selection.

  For example, register an unnecessary protocol type in the protocol type storage, compare the protocol type of the received frame with the protocol type stored in the protocol type storage, and if the frame is an unnecessary protocol type Has made a first proposal not to send an interrupt signal to the CPU (see, for example, Patent Document 1). Specifically, it is first determined whether or not the received data is a broadcast frame. If the received data is a broadcast frame, a frame conforming to the IEEE (Institute of Electrical and Electronics Engineers, Inc.) 802.3 specification or DIX ( DEC, Intel, Xerox) frame, and if it is an IEEE 802.3 frame, the protocol type field is checked, and if it is a received frame, it is received. In other cases, these frames are discarded.

  In this first proposal, a number of discrimination processes are required for each received data. Finally, data can only be discriminated by protocol type, and there is a problem that detailed packet filtering is impossible.

Therefore, a lookup table in which addresses for comparison are registered is prepared, a comparison process is performed with the address extracted from the header information of the packet, and only the communication data that completely matches this is allowed to be captured. Such a packet filter device has been proposed as a second proposal (see, for example, Patent Document 2). There is also a third proposal in which the filter condition is divided into a plurality of parts and stored, each of which is compared with a part of the packet, and the packet is selected from these results (for example, Patent Documents). 3).
Japanese Patent Laid-Open No. 11-275149 (paragraphs 0016 and 0017, FIG. 4) Japanese Patent Laying-Open No. 2001-230813 (paragraph 0036, FIG. 4) Japanese Patent Laying-Open No. 2001-69173 (paragraph 0043, FIG. 3)

  FIG. 4 shows an outline of the packet filter device according to the second proposal. The communication data 201 is held in the register unit 202 and compared with the contents of the lookup table 203 in which a comparison address is registered. When the communication data 201 matches any of the data stored in the lookup table 203, a signal indicating that the matching process is completed is sent to the matching logic circuit 204. In response to this, the matching logic circuit 204 outputs a signal permitting the reception of incoming communication data to the data processing unit 205 that performs data processing.

  In the second proposed packet filter device, MAC (Media Access Control) address and TCP (Transmission Control Protocol) header data are stored in the look-up table 203, so that only the data can be filtered. Yes. Therefore, there is a problem that filtering cannot be effectively performed on various data flowing through the communication network. In the second proposal, when the address matching is completed in the register unit 202, the result is sent to the matching logic circuit 204, and the matching logic circuit 204 allows the data processing unit 205 to accept the communication data. Is sent out. Therefore, it is necessary for the data processing unit 205 side to monitor the arrival of a signal permitting the capture of communication data and perform a process of capturing this signal when it arrives.

  In the third proposal, when the comparison target address or protocol matches, the determination result is notified. Therefore, like the second proposal shown in FIG. 4, the data processing unit waits for the determination result to be notified, and if there is a notification, processing for extracting the target data from the storage unit is required. The

  In the first proposal shown above, the processing up to the determination of the arrival of the necessary data is performed by a circuit other than the CPU, and when the necessary data arrives, the CPU is interrupted and received. The CPU is freed from the process of distributing necessary data from the data. However, in the second and third proposals, it is impossible to further reduce the processing of the CPU, and a process of waiting for a notification that necessary data has been received and capturing the notification when the notification is received Is required on the CPU side.

  Therefore, an object of the present invention is to specifically acquire data after filtering without specifically limiting the object of filtering and without requiring a data processing side that uses received data to perform special data acquisition processing. A packet filter device and a packet filter method are provided.

  According to the first aspect of the present invention, (a) received data storage means for sequentially storing received packets in the order of reception, and (b) a predetermined data processing side among the packets stored in the received data storage means Filtering data storage means storing filtering data for selecting necessary and unnecessary ones, and (c) filtering data stored in the filtering data storage means stored in the received data storage means. Comparing means for comparing the corresponding portions in the packet to determine whether or not there is a match, and Means, (e) timing generation means for generating clock timing to be used on the data processing side, and ( ) This clock timing generated by the timing generation unit, received from the temporally older packets from the data storage means is read in order to and a packet sending means for sending the data processing side packet filter device.

  That is, according to the first aspect of the present invention, the received packet is stored in time series in the reception data storage means including, for example, a first-in first-out memory, and unnecessary reception data is deleted, and this is performed at the clock timing used by the data processing side. Is sent to the data processing side. Therefore, on the data processing side, it is possible to acquire the necessary data without performing a special data acquisition process.

  According to the fifth aspect of the present invention, (a) a received data storage step for sequentially storing received packets in a predetermined received data storage means in the order of reception, and (b) the received data storage means at the received data storage step A discard step for deleting a packet that is not required by the predetermined data processing side from each stored packet; and (c) a clock timing used by the predetermined data processing side for each packet that has not been deleted by the discard step. The packet filtering method includes a packet transmission step of reading from the received data storage means in the order of storage and transmitting to the data processing side.

  That is, in the invention according to claim 5, the received packet is stored in the reception data storage means in time series, and unnecessary reception data is deleted, and this is sent to the data processing side at the clock timing used by the data processing side. Since the data is sent out, the data processing side can acquire the necessary data without performing a special data acquisition process.

  As described above, according to the present invention, received packets are stored in the received data storage means in time series, and unnecessary packets are deleted, and this is processed at the clock timing used by the data processing side. Therefore, it is possible to eliminate the burden on the data processing side not only for data selection but also for data extraction, and it is necessary to use a higher-speed CPU without reducing the data processing speed. Sex is lost. Moreover, since the data processing side can acquire data in the order of the received data in a state where unnecessary received data is deleted, the inconvenience due to receiving out-of-order data can be solved.

  Hereinafter, the present invention will be described in detail with reference to examples.

  FIG. 1 shows the configuration of a packet processing apparatus according to an embodiment of the present invention. The packet processing device 100 includes a home connection device 102 connected to a WAN (Wide Area Network) via a communication cable 101 via a router (not shown), and a set box (STB) connected to the home connection device 102 via another communication cable 103. ) 104, and the in-home connection device 102 is further connected to a LAN (Local Area Network) by another communication cable 105. Here, as the communication cables 101, 103, and 105, cables having a communication speed of 100 megabits / second or 10 megabits / second called “100base-TX” or “10base-T” are used. In this embodiment, there is a multicast television broadcast station (not shown) on the WAN side, and a packet incorporating a television program of a predetermined number of channels is distributed to the in-home connection device 102 by video on demand (VOD) or the like. It has become so. The streaming of these television programs does not require transmission to the LAN side, and the in-home connection apparatus 102 performs a filtering process so that the streaming is sent only to the set box 104 side, as will be described later. Various types of packets such as data representing e-mail and homepage contents have also been transmitted to the in-home connection device 102. Of these, those that were not filtered by the in-home connection device 102 are those on the LAN side. To be sent to.

  The home connection device 102 that performs such a filtering function includes a WAN switching hub (SW-HUB) 111 connected to two communication cables 101 and 103, and a LAN (Local Area Network) side connected to the communication cable 105. Two switching hubs of the switching hub 112 are provided. The WAN side switching hub 111 internally connects the two communication cables 101 and 103 at the L2 (layer 2: data link layer) level, and the set box 104 is connected to the WAN at the L2 level. . The WAN-side switching hub 111 is connected to a filtering LSI (Large Scale Integration) 114 via an MII (Media Independent Interface) 113. The LAN side switching hub 112 is connected to a CPU (Central Processing Unit) 116 via the MII 115. The CPU 116 is further connected to the filtering LSI 114 via another MII 117 and a control bus 118. The MIIs 113 and 117 are adapted to perform packet communication using Ethernet (registered trademark).

  The home connection apparatus 102 having such a configuration inputs streaming data sent to the set box 104 by video on demand or the like to the filtering LSI 114 via the WAN side switching hub 111 and the MII 113. The filtering LSI 114 discards unnecessary data on the LAN side using the data to be filtered that is given in advance from the CPU 116, and eliminates unnecessary packet discarding processing performed by the CPU. To reduce the load. The filtered data is sent to the information processing apparatus side such as a personal computer (not shown) on the LAN side via the MII 117 and 115 and the LAN side switching hub 112.

  FIG. 2 shows a main part of the filtering LSI of this embodiment. A clock 121 and data 122 are sent to the filtering LSI 114 from the WAN switching hub 111 shown in FIG. Of these, the clock 121 is supplied to a FIFO (First In First Out) memory 123 and a timing generation circuit 124 and is transmitted to the CPU (see FIG. 1) 116 side. For the data 122, a specific bit string (hereinafter referred to as a comparison bit string) is sequentially supplied to the input side of the FIFO memory 123 for each packet. A timing generation circuit 124 is disposed on the output side of the FIFO memory 123. The timing generation circuit 124 corrects a phase shift caused by a delay of a PHY (physical layer) clock 121 sent from the WAN side and creates a clock timing that can be received by the CPU 116 (FIG. 1). Thus, the data 126 sequentially read from the FIFO memory 123 is sent to the CPU 116 side by the MII 117.

  Incidentally, the filtering LSI 114 is provided with a CPU interface 127 so as to interface with the CPU 116 through the address bus 128, the data bus 129 and the control signal line 130. A filtering setting register 132 is connected to the CPU interface 127, and a pattern (hereinafter referred to as a discard pattern) made up of a specific bit string of each packet discarded by filtering is stored therein. . The comparator 133 compares each discard pattern stored in the filtering setting register 132 with the comparison bit string stored in the FIFO memory 123. If there is a comparison bit string that matches any one of the discard patterns, a packet including the comparison bit string is deleted from the FIFO memory 123, and unnecessary packets are discarded.

FIG. 3 shows a comparison bit string stored in the FIFO memory in the IP header as an example. FIG. 4A shows the position of a comparison bit string in an IP (Internet Protocol) header based on IPV ₄ that manages address resources in 32 bits. Comparison bit sequence 141A corresponds is 32-bit destination (destination) address beginning from where it Skips 16 bytes from the beginning of the IP header 142 by IPV _4. That is, when it is determined that the sent data 122 is an IP header 142 based on IPV ₄ , the FIFO memory 123 fetches the 32-bit destination address as a comparison bit string 141A.

On the other hand, FIG. 4B shows the position of the comparison bit string of the IP header by IPV ₆ in which the address space is improved as compared with IPV ₄ . Comparison bit string 141B corresponds 128-bit destination (destination) addresses starting skipped location only 24 bytes from the head of the IP header 143 by IPV _6. That is, when it is determined that the transmitted data 122 is the IP header 143 based on IPV ₆ , the FIFO memory 123 takes in the 128-bit destination address as the comparison bit string 141B.

The filtering setting register 132 stores not only such discard patterns of IPV ₄ and IPV ₆ to be discarded, but also discard patterns for other protocols as necessary. For example, ICMPv6 ₆ participation in a group of hosts, or IGMP as protocol when the exchange of information about the groups between withdrawal and the multicast router (Internet Group Management Protocol), a protocol for controlling a protocol error of IPV ₆ (Internet Control Message Protocol for IPV ₆ ) or VLAN-TAG (Tagged VLAN) with a tag attached to an Ethernet (registered trademark) frame in order to determine which VLAN (Virtual Local Area Network) a certain frame belongs to The discard pattern may be stored.

In the case of IGMP, there are fields of type (type) and group (group) address. Therefore, filtering is possible by comparing these fields with a discard pattern as a comparison bit string. In the case of ICMPV ₆ , there is a type field, which can be compared with a discard pattern as a comparison bit string. In these two cases, the discard pattern is registered when it is not desired to add to the data communication performed on the LAN side. When communication is performed in the VLAN mode, by registering VLAN-TAG as a discard pattern in the filtering setting register 132 instead of the IP address, filtering based on matching of tags can be performed.

  The comparator 133 deletes the data 122 corresponding to each of the comparison bit strings stored in the FIFO memory 123 in units of packets if there is a match with any of the discard patterns. Therefore, for example, when packet data such as a multicast packet is sent from the above-mentioned television broadcasting station, the CPU 116 (FIG. 1) registers these IP addresses in the filtering setting register 132 in advance. Can be deleted from the FIFO memory 123.

  As described above, in the embodiment, the filtering for the data flowing in the direction from the WAN side switching hub 111 to the LAN side switching hub 112 has been described. On the contrary, the data flowing in the direction from the LAN side switching hub 112 to the WAN side switching hub 111 is described. In particular, no filtering process is performed.

  Note that the control as described above of the FIFO memory 123 may be performed by software processing by a dedicated control unit, or may be performed by hardware.

  In the embodiment, the comparison bit string of the data 122 is sequentially stored in the FIFO memory 123, and the data not to be deleted is sent to the timing generation circuit 124 in the oldest order. However, the present invention is not limited to this. . For example, data in units of packets is written in RAM (Random Access Memory) so that the order can be understood, and those that match the discard pattern are deleted or overwritten with new data in units of packets. The data 126 may be read in units of packets from the oldest at the timing indicated by the timing generation circuit 124. The storage time information may be appended instead of the order.

  Further, packet data that is transmitted through filtering is stored in the filtering setting register 132, and data other than those that match are deleted from the received data storage means such as the FIFO memory 123, and the remaining data is read from the received data storage means. You may do it.

It is a block diagram showing the structure of the packet processing apparatus in one Example of this invention. It is a block diagram showing the principal part of the LSI for filtering of a present Example. It is explanatory drawing showing the bit string for a comparison stored in the FIFO memory in an IP header in a present Example. It is a block diagram showing the outline | summary of the packet filter apparatus by the 2nd conventional proposal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Packet processing apparatus 102 In-home connection apparatus 104 Set box 111 WAN side switching hub 112 LAN side switching hub 114 Filtering LSI
116 CPU
122 Data 123 FIFO Memory 124 Timing Generation Circuit 132 Filtering Setting Register 133 Comparator

Claims (5)

Received data storage means for sequentially storing received packets in the received order;
Filtering data storage means for storing filtering data for selectively selecting what is required by the predetermined data processing side among the packets stored in the received data storage means,
Comparison means for comparing the filtering data stored in the filtering data storage means with each other in each packet stored in the received data storage means to determine whether there is a match;
Unnecessary packet deletion means for deleting from the received data storage means a packet that the predetermined data processing side does not need from the comparison result of the comparison means;
Timing generating means for generating clock timing used by the data processing side;
A packet filter device comprising: packet sending means for reading out from the received data storage means in order from the oldest packet at the clock timing generated by the timing generation means and sending it to the data processing side.   2. The packet filter device according to claim 1, wherein the received data storage means is constituted by a first-in first-out memory, and data at positions corresponding to the filtering data among received packets is sequentially stored.   2. The packet filter device according to claim 1, wherein said received data storage means is constituted by a random access memory, and stores data indicating the storage order or storage time and each packet.   In the filtering data storage means, filtering data that is sent to a predetermined set box side and specifies streaming data that is unnecessary on the predetermined data processing side is stored as at least a part of filtering data that represents an unnecessary packet. The packet filter device according to claim 1, wherein A received data storage step of sequentially storing received packets in a predetermined received data storage means in the received order;
A discarding step for deleting what is not needed by the predetermined data processing side from each packet stored in the reception data storage means in this reception data storage step;
A packet sending step of reading each packet that has not been deleted in the discarding step from the received data storage means in the order of storage at the clock timing used by the predetermined data processing side and sending it to the data processing side A packet filtering method characterized by the above.

Images