JP4408052B2 - Packet classifier - Google Patents

Description

  The present invention relates to a packet communication technique, and more particularly to a packet classifier device that classifies each packet according to information described in a packet received via a network.

Conventionally, relay devices such as an L2 switch (Layer 2 Switch) and an L3 switch (Layer 3 Switch) are known as network devices that perform route control of received packets. These are used to perform path control of received packets based on layer 2 and layer 3 information in an OSI (Open System Interconnection) reference model, respectively.
On the other hand, with diversification of communication, for example, communication is performed based on various communication protocols such as Layer 3 IP (Internet Protocol), Layer 4 TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and the like. It has become.

  In addition, relay devices taking communication quality (QoS: also called Quality of Service) into account are studied, and in these relay devices, information recorded in a predetermined field of a packet, for example, in the case of IPv4, ToS (Type of Service) ) Packets are distributed according to information such as values, and communication is performed with different communication qualities for each packet (see, for example, Patent Document 1). When variously classifying packets according to communication quality, packet classification for reading packet header information and the like based on a program has been performed.

The applicant has not yet found prior art documents related to the present invention by the time of filing other than the prior art documents specified by the prior art document information described in this specification.
JP 2003-244225 A

However, in the conventional packet classification technique, when trying to classify packets generated under various communication protocols in various ways, the processing time has not been sufficiently devised to reduce the time required for search processing. However, there are problems such as long power consumption and high price.
An object of the present invention is to provide a packet classifier apparatus capable of reducing the processing time required for packet classification and reducing power consumption.

In order to achieve such an object, the packet classifier apparatus according to the present invention provides information for classifying an input packet based on one or more identifier values composed of data recorded in a predetermined field in the input packet. In the packet classifier device that generates the classification value, the input packet is parsed to obtain packet data and an identifier mark that identifies a portion including the identifier value in the packet data, and the packet data A packet syntax analysis device that outputs a set of identifier marks as identifier values, and an identifier value that matches the identifier mark value set as a parameter from among the identifier values output from the packet syntax analysis device Extract the identifier from the packet data of these identifier values And identifier group value generation unit for generating a value, and a search unit which searches for any search candidate for the generated identifier group value identifier group value generating unit, and outputs a classification value for the input packets in accordance with the search result A search candidate in which one or more search candidates for the identifier group value and a candidate ID for specifying the search candidate are associated with each of one or more identifier group values composed of combinations of identifier values in the search unit A table is held, a predetermined candidate ID among candidate IDs is sequentially specified, search candidates matching each identifier group value are searched from the corresponding search candidate table, and each search candidate obtained by searching is searched. A classification value corresponding to a corresponding candidate ID is output.

  Specifically, the search unit applies an identifier group mask that is a mask corresponding to the candidate ID to the identifier group value to generate a mask identifier group value, and the identifier group mask corresponding to the candidate ID and the candidate ID in the search candidate table The mask identifier group value candidate that is the identifier group value candidate that has been subjected to the search is stored in correspondence with the mask identifier group value candidate that matches the mask identifier group value, and the mask identifier obtained by searching the search candidate table A classification value corresponding to the candidate ID corresponding to the group value candidate may be output.

  Alternatively, the hash value of the identifier group value is calculated by the search unit, and the identifier group hash value candidate that is a candidate for the hash value of the identifier group value in the search candidate table is associated with the candidate ID that identifies the identifier group hash value candidate The identifier group hash value candidate that matches the hash value of the identifier group value is searched from the search candidate table, and the classification value corresponding to the candidate ID corresponding to the identifier group hash value candidate obtained by the search is output. You may do it.

  In addition, when the search unit holds range specification information for specifying a data range as an identifier group value candidate in a predetermined entry of the search candidate table, and the identifier group value matches an identifier group value candidate for specifying the data range The classification value corresponding to the candidate ID corresponding to the matched identifier group value candidate may be output.

  For the classification value, the search unit uses a classification value indicating information indicating whether or not to discard the input packet or whether or not to discard the input packet as the classification value for the predetermined candidate ID. You may make it produce | generate.

  Alternatively, in the search unit, as a classification value for a predetermined candidate ID, information on an instruction to remove a predetermined field in the input packet, information on an instruction to add a new field in the input packet and record predetermined data, or Classification indicating information of instructions for removing a predetermined field from an input packet, adding a new field, and recording data obtained by converting data recorded in the field to be removed in the newly added field A value may be generated.

  Further, the search unit may designate only candidate IDs of predetermined entries in the search candidate table as candidate IDs.

  Further, the search unit may output the classification value added to the input packet.

Further, another packet classifier apparatus according to the present invention generates a classification value that is information for classifying an input packet based on an identifier value that is one or more data recorded in a predetermined field in the input packet. in the packet classifier device, the one or more identifiers group values consisting of the identifier value, for each of the first identifier group values, one or more identifiers group value candidate and the identifier of the first identifier group value A primary search candidate table in which candidate IDs for specifying group value candidates are associated with each other, an identifier group value candidate that matches each first identifier group value is searched from the corresponding primary search candidate table, and the detected identifier a primary search unit for generating an identifier group ID corresponding to the candidate ID corresponding to the group value candidates for each of the identifier group ID generated by the primary search unit, one of the identifier group ID First secondary search retains the candidate table, the first secondary search candidate table in the corresponding search candidate to match each identifier group ID that the candidate ID identifying the search candidate search suggestions above are associated And at least one search candidate and a search candidate for the second identifier group value are identified for each of the second identifier group values different from the first identifier group value among the identifier group values. A second secondary search candidate table corresponding to each candidate ID to be searched, and search candidates that match each second identifier group value are searched and searched from the corresponding second secondary search candidate table. And a secondary search unit that generates and outputs a classification value corresponding to the candidate ID corresponding to each search candidate.

Further, another packet classifier apparatus according to the present invention generates a classification value that is information for classifying an input packet based on an identifier value that is one or more data recorded in a predetermined field in the input packet. in the packet classifier device, the one or more identifiers group values consisting of the identifier value, for each of the first identifier group values, one or more identifiers group value candidate and the identifier of the first identifier group value A primary search candidate table in which candidate IDs for specifying group value candidates are associated with each other, an identifier group value candidate that matches each first identifier group value is searched from the corresponding primary search candidate table, and the detected identifier a primary search unit for generating an identifier group ID corresponding to the candidate ID corresponding to the group value candidates, select one or more predetermined identifier group ID from the identifier group ID generated by the primary search unit Relative to generate one or more selected identifier group ID, each of the identifier group ID, first that associates the candidate ID identifying one or more search suggestions and search the selected candidate identifier group ID The secondary search candidate table is stored, a search candidate that matches each selected identifier group ID is searched from the corresponding first secondary search candidate table, and the search is performed according to the candidate ID corresponding to each searched search candidate. And one or more secondary search units that generate and output classification values.

More specifically, in either the primary search unit, and it generates a mask identifier group value by performing identifier group mask is a mask corresponding to the candidate ID to the first identifier group values, candidate ID in the primary search candidate table And a mask identifier group value candidate, which is an identifier group value candidate subjected to an identifier group mask corresponding to the candidate ID, is stored in association with each other, and a mask identifier group value candidate matching the mask identifier group value is searched from the primary search candidate table Then, an identifier group ID corresponding to the candidate ID corresponding to the mask identifier group value candidate obtained by the search may be generated.

Alternatively, the hash value of the first identifier group value is calculated by any one of the primary search units, and the identifier group hash value candidate and the identifier group hash that are candidates for the hash value of the first identifier group value in the primary search candidate table An identifier group hash obtained by searching and searching for an identifier group hash value candidate matching the hash value of the first identifier group value in correspondence with a candidate ID for specifying a value candidate An identifier group ID corresponding to a candidate ID corresponding to a value candidate may be generated.

Further, in any one of the primary search units, range designation information for designating a data range as an identifier group value candidate is held in a predetermined entry of the primary search candidate table, and the first identifier group value designates the data range. When the identifier group value candidate matches, an identifier group ID corresponding to the candidate ID corresponding to the matched identifier group value candidate may be generated.

  As the classification value, a classification indicating information indicating whether or not to discard the input packet or whether or not to discard the input packet is determined as a classification value for the predetermined candidate ID in the secondary search unit. A value may be generated.

  In addition, as a classification value for a predetermined candidate ID, information on an instruction to remove a predetermined field in the input packet and information on an instruction to add a new field to the input packet and record predetermined data in the secondary search unit Or a command to remove a predetermined field in the input packet, add a new field, and record data obtained by converting the data recorded in the field to be removed into the newly added field. A classification value may be generated.

Further, the primary search unit, as a candidate ID, designated as a target only candidate ID of a given entry in the primary search candidate table, the secondary search unit, as a candidate ID, first in the secondary search candidate table Only a candidate ID of a predetermined entry may be designated as a target.

  In addition, the secondary search unit may add the classification value to the input packet and output it.

  According to the present invention, a search candidate that matches an identifier group value consisting of a combination of identifier values specified in advance in an input packet is searched from the search candidate table by sequentially specifying candidate IDs, and the search candidate Since the classification value corresponding to the candidate ID corresponding to is output, the processing time required to classify the packet can be shortened and the power consumption can be reduced as compared with the case where the program is used as in the past. It is possible to provide a packet classifier device having an effect.

Next, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
First, a packet classifier apparatus according to a first embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram showing a configuration of a packet classifier apparatus according to a first embodiment of the present invention.
The packet classifier device 100 is a device that classifies an input packet based on data recorded in a predetermined field in the input packet, and includes an identifier group generation unit 110 and a search unit 120.

The identifier group generation unit 110 includes an identifier value [m] (m is an integer from 1 to M, and M is a natural number) included in the control signal output from the packet syntax analysis apparatus 10 provided in the preceding stage of the packet classifier apparatus 100. Are divided into a plurality of identifier groups and output as identifier group values [n] (n is an integer of 1 to N, N is a natural number).
The search unit 120 is a circuit unit that performs a match search on the identifier group value [n] output from the identifier group generation unit 110 and outputs a classification value corresponding to the search result.

  Here, the packet syntax analysis apparatus 10 performs syntax analysis of the packets constituting the input packet data, and identifies, for example, a transmission source address, a destination address, a TCP (Transmission Control Protocol) port number, a next header ID, and the like. It is assumed that the value [m] is generated and matched with the corresponding information in the packet and output.

The packet syntax analysis apparatus 10 also outputs a flag indicating that the packet syntax analysis has ended (hereinafter referred to as a packet syntax analysis end flag).
The packet parsing end flag is composed of, for example, a 1-bit signal. When the packet parsing end flag is “1”, it indicates the end of packet parsing, and when it is “0”, it indicates that the packet parsing end is not ended. .

Each identifier value [m] and the packet syntax analysis end flag are input to the identifier group generation unit 110, and processing for generating an identifier group value by detecting that the packet syntax analysis end flag is “1” is performed. Start.
Each identifier value [m] that is input may be input to the identifier group generation unit 110 as an identifier mark that identifies packet data and a portion that includes the identifier value in the packet data. Assume that each identifier value [m] is composed of packet data and one or more identifier marks.

[Identifier group generator]
Next, the identifier group generation unit 110 will be described with reference to FIG. FIG. 2 is a block diagram illustrating a specific configuration example of the identifier group generation unit 110.
The identifier group generation unit 110 includes an nth identifier extraction unit 111 _n (n is an integer from 1 to N), an nth parameter register 112 _n , and delay circuits 113 and 114.
The n-th identifier extraction unit 111 _n receives each identifier value [m] (m is an integer from 1 to M) as packet data and an identifier mark from the packet syntax analysis apparatus 10, and uses the identifier group value [n] described above. A circuit unit to be generated.

Parameter register 112 _n of the n-th one or more parameters that specify the behavior of the identifier extracting unit 111 _n (hereinafter, referred to as parameter group) stores, circuitry for outputting the stored group of parameters identifier extracting unit 111 _n It is.
The delay circuits 113 and 114 are circuit units that delay the input packet parsing end flag so that the final identifier group value generation processing is finished.

The packet data and the identifier mark may be input to the identifier group generation unit 110 in parallel, for example, 32 bits each.
In addition to the packet data and the identifier mark, each parameter register 112 _n also receives a reset, a clock, and a packet syntax analysis end flag signal. Here, it is assumed that the reset and clock signals are input from the outside so as to be reset at the leading timing of the packet.

Each parameter register 112 _n stores each identifier extraction unit 111 such as an identifier mark value [k] (k is an integer from 1 to K, K is a natural number), an identifier group length [n], and the like. _The parameter group that specifies the operation of _n is stored. Here, “K” may be, for example, 4, the identifier mark value [k] may be, for example, 1-byte data, and the identifier group value [n] may be, for example, 4-byte (1 word) data.
At this time, the identifier group length [n] may be expressed in units of bytes, for example, and may be 3-bit data. Specifically, when the identifier group length [n] is “001”, the data length of the identifier group value may be 1 byte (8 bits). Here, the parameter group stored in each parameter register 112 _n may be arbitrarily set according to a signal from an external CPU or the like.

In addition to the packet syntax analysis end flag, a clock signal is input to the delay circuits 113 and 114. In the present embodiment, the delay circuits 113 and 114 delay the input packet syntax analysis end flag by two clocks.
When the packet syntax analysis end flag is not input from the packet syntax analysis apparatus 10, the packet syntax analysis end flag can be set by the following method, for example. The first method uses this flag when a flag indicating the final next header position is detected among the identifier marks output from the packet syntax analysis apparatus 10. The second method is to detect a designated identifier mark value and set a flag at the timing when it is detected that the packet data specified by the identifier mark value is a value designated in advance.

[Operation of identifier extractor]
Next, the operation of each identifier extraction unit 111 _n will be described with reference to FIGS. 3 to 5 are explanatory diagrams describing the operation of each identifier extracting unit 111 _n in VHDL (VHSIC (Very High Speed Integrated Circuit) -Hardware Description Language). In the following, it is assumed that four types of identifier mark values (K becomes 4) and 32-bit identifier marks are input in parallel to each identifier extraction unit 111 _n (n is an integer from 1 to N).

First, the values of the first to eighth bits of the identifier mark are the identifier mark value [1], the identifier mark value [2], the identifier mark value [3], or the identifier mark value [4]. It is determined whether or not a condition that is equal to one or more of the above is satisfied (S311). Hereinafter, this condition is referred to as S311 condition.
When it is determined in step S311 that the S311 condition is satisfied, “1” is substituted as “detection a” (S312), and “1” is added to “storage position counter value” which will be described later. (S313). When it is determined in step S311 that the S311 condition is not satisfied, “0” is substituted for “detection a” (S314), and “storage position counter value” described later is substituted for “storage position a” (S315).

Next, the values of the 9th to 16th bits of the identifier mark are the identifier mark value [1], the identifier mark value [2], the identifier mark value [3], or the identifier mark value [4]. It is determined whether or not the condition of being equal to one or more of the above is satisfied (S321). Hereinafter, this condition is referred to as S321 condition.
When it is determined in step S321 that the S321 condition is satisfied, “1” is substituted as “detection b” (S322), and “1” is added to “storage position a” set in step S313 or S315. Substituted in “storage position b” (S323). If it is determined in step S321 that the S321 condition is not satisfied, “0” is substituted for “detection b” (S324), and “storage position a” is substituted for “storage position b” (S325).

Similarly, the values of the 17th to 24th bits of the identifier mark are the identifier mark value [1], the identifier mark value [2], the identifier mark value [3], or the identifier mark value [4]. It is determined whether or not the condition of being equal to one or more of these is satisfied (S331). Hereinafter, this condition is referred to as S331 condition.
When it is determined in step S331 that the S331 condition is satisfied, “1” is substituted as “detection c” (S332), and “1” is added to “storage position b” set in step S323 or S325. Substituted in “storage position c” (S333). If it is determined in step S331 that the S331 condition is not satisfied, “0” is substituted for “detection c” (S334), and “storage position b” is substituted for “storage position c” (S335).

Similarly, the values of the 25th to 32nd bits of the identifier mark are the identifier mark value [1], the identifier mark value [2], the identifier mark value [3], or the identifier mark value [4]. It is determined whether or not the condition of being equal to one or more of these is satisfied (S341). Hereinafter, this condition is referred to as S341 condition.
When it is determined in step S341 that the S341 condition is satisfied, “1” is substituted as “detection d” (S342), and “1” is added to “storage position c” set in step S333 or S335. Substituted in “storage position d” (S343). If it is determined in step S341 that the S341 condition is not satisfied, “0” is substituted for “detection d” (S344), and “storage position c” is substituted for “storage position d” (S345).

With the above processing, a flag (“detection a” to “detection d”) is set for each detection of the identifier mark, and information on the position of these flags is counted sequentially from the next of the initial value of the storage position counter. It is generated as “storage position a” to “storage position d”.
Next, the process from step S351 to S356 is a storage position counter value update operation for updating the storage position counter value. First, when a clock is input, processing in the following steps is started (S351). Next, the rising timing of the clock is detected (S352). Next, it is determined whether or not the condition that the reset signal is “1” is satisfied (S353). When it is determined that the condition is “1”, “0” is substituted as the storage position counter value (S354). ). As a result, the storage position counter value is initialized.

  If it is determined in step S353 that the reset signal is not “1”, “storage position d” is substituted as the storage position counter value (S355). Thereby, the storage position counter value is updated from the clock after the reset signal is input. When the process in step S355 is completed, the storage position counter value initialization operation process ends (S356).

  Next, the process from step S361 to S373 is an identifier reading operation process in which the value of the identifier read from the packet data is stored in a register. First, when a clock is input, processing in the following steps is started (S361). Next, the rising timing of the clock is detected (S362). Next, it is determined whether or not the condition that the reset signal is “1” is satisfied (S363). If it is determined that the reset signal is “1”, the identifier group register value [1] to the identifier group register value [ N] is substituted with “0” (S3641-S364N). As a result, the identifier group register value is initialized. Here, N is the total number of identifier groups.

  If it is determined in step S363 that the reset signal is not “1”, it is determined whether or not the flag of “detection a” is “1” (S365), and if it is determined that it is “1”, the packet For example, data from the 1st bit to the 8th bit of the data is read and assigned to the identifier group register value [storage position a] (S366). When it is determined in step S365 that the “detection a” flag is not, it is determined whether or not the “detection b” flag is “1” (S367), and when it is determined that it is “1”, For example, data from the 9th bit to the 16th bit of the packet data is read and substituted into the identifier group register value [storage position b] (S368).

  Similarly, when it is determined in step S367 that the “detection b” flag is not “1”, it is determined whether or not the “detection c” flag is “1” (S369). If it is determined that the packet data, for example, the data from the 17th bit to the 24th bit of the packet data is read and substituted into the identifier group register value [storage position c] (S370). Next, when it is determined in step S369 that the “detection c” flag is not “1”, it is determined whether the “detection d” flag is “1” (S371) and is “1”. When it is determined that the packet data, for example, data from the 25th bit to the 32nd bit is read and substituted into the identifier group register value [storage position d] (S372). Thus, the identifier is read from the clock after the reset signal is input. When the process in step S372 is completed, the identifier reading operation process ends (S373).

  Next, the process from step S381 to S387 is an identifier group value assigning operation for assigning an identifier group register value to an identifier group value. First, when a clock is input, processing in the following steps is started (S381). Next, the rising timing of the clock is detected (S382). Next, it is determined whether or not the condition that the reset signal is “1” is satisfied (S383). When it is determined that the reset signal is “1”, the identifier group value [1] to the identifier group value [N] are determined. "0" is substituted as (S3841 to S384N). Thereby, the identifier group value is initialized.

  When it is determined in step S383 that the reset signal is not “1”, it is determined whether or not the “packet syntax analysis end flag” is “1” (S385), and when it is determined that it is “1”, The identifier group register value [n] is substituted into the identifier group value [n] (S3861 to S386N). Thereby, substitution to the identifier group value is performed from the clock after the reset signal is input. When the processing in step S386N is completed, the processing for the identifier group value substitution operation ends (S387).

[Search section]
Next, the search unit 120 will be described with reference to FIG. The search unit 120 has a search candidate table in which one or more search candidates for identifier group values and candidate IDs for specifying search candidates are associated with each of one or more identifier group values obtained by combining the identifier values. Corresponding to each search candidate obtained by searching the search candidate table corresponding to each identifier group value by sequentially designating predetermined candidate IDs among the candidate IDs, and searching the corresponding search candidate table A classification value corresponding to the candidate ID is added to the input packet separately or output separately from the input packet.

As a specific configuration, the search unit 120 includes identifier group searchers 121 _{1 to} 121 _N , a candidate ID generator 122, an AND circuit 123, a match candidate ID storage 124, and a classification value generator 125.
The identifier group searchers 121 _{1 to} 121 _N receive the identifier group values [n] (n is an integer from 1 to N) output from the identifier group generation unit 110, perform a predetermined search, and match in the search. One or more circuit units that output a match flag [n] indicating whether or not there is data.
The candidate ID generator 122 is a circuit unit that outputs candidate IDs for specifying candidates for search to the identifier group searchers 121 _{1 to} 121 _N.

The AND circuit 123 is “1” when the match flag [n] output from each of the identifier group searchers 121 _{1 to} 121 _N is a match, and becomes “1”. Is a circuit unit that outputs an all-match flag having a value of “0”.
The match candidate ID storage unit 124 receives the identifier group generation end flag, the all match flag, and the candidate ID, stores the candidate ID when the all match flag is “1”, and outputs the match candidate ID and the search end flag. It is a circuit part.
The classification value generator 125 is a circuit unit that receives a match candidate ID and a search end flag and generates a classification value.

Each identifier group value [n] output from the identifier group generation unit 110 and the candidate ID output from the candidate ID generator 122 are input to the nth identifier group searcher 121 _n . Here, it is assumed that K identifier group candidates [n, k] (k is an integer from 1 to K) are stored in advance as a search candidate table in the identifier group searcher 121 _n .
Here, k may be specified by a candidate ID, and K may be different for each identifier group searcher 121 _n . The identifier group candidate [n, k] stored in the identifier group searcher 121 _n may be set from the outside.

The nth identifier group searcher 121 _n determines whether or not the identifier group candidate [n, k] specified by the candidate ID output from the candidate ID generator 122 matches the identifier group value [n] in the order of candidate IDs. The match flag [n] is output to the AND circuit 123 when they match.
For each of the other identifier group searchers, the same signal as that of the nth identifier group searcher 121 _n is input, the same processing is performed, and the same signal is output. However, identifier group candidates differ for each identifier group searcher.

The nth identifier group searcher 121 _n may be further configured as shown in FIGS. Here, it may be possible to make a match determination without comparing all bits of the identifier group value with the identifier group candidate.
In such a case, the configuration shown in FIG. 6 masks the bits of the identifier group value that need not be compared, and compares the masked identifier group value with the identifier group candidate. ing.

The predetermined identifier group search unit 121 _n constituting the search unit 120 records range specifying information for specifying a data range as an identifier group value candidate in a predetermined entry of the search candidate table, and the identifier group value indicates the data range. When the identifier group value candidate to be designated matches, a classification value corresponding to the candidate ID corresponding to the matching identifier group value candidate may be added to the input packet and output.
Further, the predetermined identifier group searcher 121 _n constituting the search unit 120 may specify only candidate IDs of predetermined entries in the search candidate table as candidate IDs.

The n-th identifier group search unit 121 _n shown in FIG. 6 includes a mask processor 611, a candidate mask register 612, a selector 613, a comparison processor 621, an identifier group value candidate register 622, and a selector 623. Yes.
The mask processor 611 is a circuit unit that performs a process for masking an input identifier group value [n] (hereinafter referred to as a mask process).
The candidate mask register 612 is a circuit unit that stores candidates for masks (hereinafter referred to as identifier group masks) used for mask processing performed by the mask processor 611 as a search candidate table.

The selector 613 is a circuit unit that selects an identifier group mask stored in the candidate mask register 612 according to the input candidate ID and outputs the identifier group mask to the mask processor 611.
The comparison processor 621 is a circuit unit that compares the identifier group value after mask processing (hereinafter referred to as a mask identifier group value) with an identifier group value candidate (hereinafter referred to as a mask identifier group value candidate) and performs a match determination. .
The identifier group value candidate register 622 is a circuit unit that stores a mask identifier group value candidate that is a comparison target of the mask identifier group value as a search candidate table.
The selector 623 is a circuit unit that selects a mask identifier group value candidate stored in the identifier group value candidate register 622 according to the input candidate ID and outputs the mask identifier group value candidate to the comparison processor 621.

The identifier group mask is, for example, a combination of “0” and “1”, the mask processor 611 is composed of, for example, an AND circuit, and the mask identifier group value [n] has, for example, a predetermined number or more of bits having a value of “0”. You may make it show that it is not a comparison object.
The comparison processor 621 outputs the match determination result as a match flag composed of “0” and “1”. When the coincidence flag is “1”, it indicates that there is a match, and when it is “0”, it indicates that there is no match.

  By configuring as described above, it is possible to perform a match determination by applying a predetermined mask to a part of an identifier, such as an IPv4 address, and mask processing such as a MAC (Media Access Control) address. When unnecessary identifiers are mixed in the identifier group value, it is possible to specify mask information only for identifiers that require masking and perform mask processing instead of specifying mask information for all identifiers. For example, it is possible to reduce the circuit scale, such as reducing the capacity of the memory that stores the mask information, and the amount of mask processing.

  In addition, if the identifier is long and the matching process is performed for all bits, the process may take time. The configuration shown in FIG. 7 calculates a hash value of an identifier, performs a matching process on the obtained hash value, performs a matching determination on all bits when they match, and reduces processing time.

The n-th identifier group searcher 121 _n shown in FIG. 7, the hash processor 701, the hash value comparison processing 711, the hash candidate register 712, selector 713, matches the verification processor 721, identifier group value candidate register 722, And a selector 723 is provided.
The hash processor 701 is a circuit unit that calculates a hash value of the input identifier group value [n].
The hash value comparison processor 711 is a circuit unit that compares the hash value calculated by the hash processor 701 with a candidate for comparison (hereinafter referred to as identifier group hash value candidate) and outputs the result as a hash value match flag. is there.
The hash candidate register 712 is a circuit unit that stores identifier group hash value candidates used by the hash value comparison processor 711 for comparison as a search candidate table.

The selector 713 is a circuit unit that selects an identifier group hash value candidate stored in the hash candidate register 712 according to the input candidate ID and outputs the identifier group hash value candidate to the hash value comparison processor 711.
The coincidence verification processor 721 is a circuit unit that compares the identifier group with the identifier group value candidate when the hash value match flag output from the hash value comparison processor 711 indicates a match, and performs a match determination.
The identifier group value candidate register 722 is a circuit unit that stores identifier group value candidates to be compared with identifier group values as a search candidate table.
The selector 723 is a circuit unit that selects an identifier group value candidate stored in the identifier group value candidate register 722 according to the input candidate ID and outputs it to the matching verification processor 721.

  Here, the technique for generating the hash value is known and will not be described. The hash value calculated by the hash processor 701 is smaller than the number of bits of the identifier group to which the hash value is inputted, and takes a value that can shorten the processing time in the hash processor 701. The method of generating the hash value is not limited to a specific method, and the type of the hash value is not a problem as long as it is within the spirit of the present invention.

The hash value match flag output by the hash value comparison processor 711 indicates that the hash value calculated by the hash processor 701 matches the identifier group hash value candidate when the hash value match flag is “1”. “0” indicates that they do not match.
Similarly, the match flag output from the match verification processor 721 indicates that the identifier group matches the identifier group value candidate when the match flag is “1”, and does not match when the match flag is “0”. Indicates.

  By configuring as described above, when searching for an identifier having a large number of identifiers such as an IPv6 address, it does not directly determine whether all the bits match, but matches after reducing the number of bits by hash processing. By performing the determination, the processing time can be shortened. In particular, when the number of candidates is large, processing time can be shortened by performing hash processing.

The match candidate ID storage unit 124 stores the candidate ID (the match candidate ID) when the all match flag is “1” after the identifier group generation end flag is input, and the classification value together with the search end flag. Output to the generator 125.
If there is a match for a plurality of candidate IDs, the highest priority candidate ID (for example, the minimum value among the matched candidates) may be used as the match candidate.
Further, when the number of times that the all-match flag is “1” is limited to a maximum of one, or when candidate IDs are generated in order from the highest-priority candidate, it is determined that all candidates indicated by the candidate ID match. At this point (all match flags are “1”), the subsequent match determination may be interrupted and the match candidate ID and the search end flag may be output.

The classification value generator 125 holds K classification candidates, and when the search end flag and the matching candidate ID are input, the classification candidate [L] (= classification candidate [matching candidate ID] corresponding to the input matching candidate ID. L is an integer of 1 to K) and is output as a classification value.
The classification value output from the classification value generator 125 is the output of the packet classifier device 100, and can be used when the packet data is classified by another device.

The search unit 120 indicates information indicating whether or not the input packet is to be discarded (for example, filtering processing) or whether or not to discard the input packet. A classification value may be generated.
In addition, the search unit 120 may instruct the predetermined candidate ID to remove a predetermined field in the input packet, information on an instruction to add a new field to the input packet and record predetermined data, or Classification indicating information of instructions for removing a predetermined field from an input packet, adding a new field, and recording data obtained by converting data recorded in the field to be removed in the newly added field A value may be generated.

  As described above, the packet classifier device according to the first exemplary embodiment of the present invention sequentially sets candidate IDs for search candidates that match an identifier group value that is a combination of identifier values specified in advance in an input packet. Since the search is performed from the search candidate table by specifying and the classification value corresponding to the candidate ID corresponding to the search candidate is output, the packet is classified as compared with the case of using the program as in the past. Thus, it is possible to provide a packet classifier apparatus that can shorten the processing time required for the operation and reduce the power consumption.

In addition, since the search is performed by masking according to search candidates such as identifier group values having a long number of bits, the number of bits for matching determination can be reduced, and the processing time required for classifying packets can be further reduced. At the same time, power consumption can be reduced.
In addition, since hash values are calculated according to search candidates such as identifier group values having a long number of bits, and a preliminary search is performed on the hash values, it is possible to determine whether or not each identifier group value having a long number of bits matches. The number of bits to be performed can be reduced, the processing time required for classifying the packets can be shortened, and the power consumption can be reduced.

In addition, since the range designation information for designating the data range as the identifier group value candidate is entered in the search candidate table, the scale of the search candidate table can be reduced and the circuit scale can be reduced.
In addition, because the necessity of discarding input packets is generated as a classification value, it is possible to classify processes that require time for judgment and output them to a dedicated device, etc. It is possible to reduce the processing load of the apparatus.

Further, since a classification value indicating removal, addition, rewriting, etc. of a predetermined field in the input packet can be generated, it is possible to instruct processing such as tag replacement.
Further, since only the candidate ID of a predetermined entry in the search candidate table can be set as a search target, the processing time required for classifying the packets can be shortened and the power consumption can be reduced.

[Second Embodiment]
Next, a packet classifier device according to a second exemplary embodiment of the present invention will be described with reference to FIG. FIG. 8 is a diagram showing a block configuration of a packet classifier apparatus according to the second exemplary embodiment of the present invention.
In FIG. 8, the packet classifier device 800 is divided into a primary search unit 820 _n (n is an integer from 1 to N) and a secondary search unit 830 in the search unit 120 according to the first embodiment of this invention. It has a configuration.
The identifier group generation unit 810 according to the second embodiment of the present invention has a different code because the output destination of the output signal is different from the identifier group generation unit 110 according to the first embodiment of the present invention. The processing content is the same as that of the identifier group generation unit 110.

Each primary search unit 820 _n has one or more identifier group value candidates for identifier group values and candidate IDs for identifying identifier group value candidates for each of one or more identifier group values obtained by combining the identifier values. Is stored in the primary search candidate table, the identifier group value candidates matching the identifier group values are searched from the corresponding primary search candidate table, and the candidate ID corresponding to the detected identifier group value candidate is determined. An identifier group ID is generated, and the identifier group value [n] output from the identifier group generation unit 110 is converted into an identifier group ID having a small number of data.

[Primary search section]
Next, with reference to FIG. 9, each primary search part concerning the 2nd Embodiment of this invention is demonstrated. FIG. 9A is a diagram showing a block configuration of each primary search unit 820 _n according to the second embodiment of the present invention.
In FIG. 9A, each primary search unit 820 _n is provided with an identifier group searcher 821 _n candidate ID generator 822 _n and a match candidate ID storage 823 _n .

The identifier group search unit 821 _n is a circuit unit that performs a search for converting the identifier group value [n] output from the identifier group generation unit 810 into the identifier group ID [n].
The candidate ID generator 822 _n is a circuit unit that outputs a candidate ID that designates a target candidate to be searched by the identifier group searcher 821 _n .
The match candidate ID storage unit 823 _n is a circuit unit that outputs an identifier group ID [n] in accordance with a candidate ID for which a match is obtained when a match is obtained by a search performed by the identifier group search unit 821 _n. .

The identifier group search unit 821 _n receives the identifier group value [n] and the candidate ID output from the candidate ID generator 822 _n .
The identifier group searcher 821 _n stores in advance one or more candidates for the identifier group value [n] and the comparison target, and the comparison target candidate corresponding to the candidate ID output from the candidate ID generator 822 _n Then, a match determination with the identifier group value [n] is performed, and the result is output as a match flag.
A table in which one or more candidates of identifier groups stored in the identifier group searcher 821 _n are associated with each candidate ID is the primary search candidate table. The match flag is a flag that takes a value of “1” when the match is determined to be a match and takes a value of “0” when the match is not determined.

Here, the above “candidate for comparison” may be changed according to an input from an external CPU or the like.
In addition, each identifier group searcher 821 _n may perform a search by using a different method. In this case, the above “candidate for comparison” may be different for each identifier group searcher 821 _n. Good. Further, the candidate ID generated by the candidate ID generator 822 _n may be changed from the outside in the same manner as the above “candidate for comparison”.

The match candidate ID storage unit 823 _n receives the match flag output from the identifier group search unit 821 _n and the candidate ID output from the candidate ID generator 822 _n .
The match candidate ID storage unit 823 _n generates an identifier group ID [n] corresponding to the candidate ID when a match flag indicating a match (value takes “1”) is input from the identifier group search unit 821 _n. And output.
Here, the identifier group ID [n] may be set as a candidate ID when the match flag is “1” to shorten the processing time. The match candidate ID storage unit 823 _n also outputs a search end flag [n] indicating that the search is completed together with the match flag.

[Secondary search part]
Next, a secondary search unit according to the second embodiment of the present invention will be described with reference to FIG. FIG. 9B is a diagram illustrating a block configuration of the secondary search unit 830 according to the second embodiment of the present invention.
The secondary search unit 830 holds a secondary search candidate table in which one or more search candidates for the identifier group ID and a candidate ID for specifying the search candidate are associated with each of the identifier group IDs. A search candidate that matches the identifier group ID is searched from the corresponding secondary search candidate table, and a classification value corresponding to the candidate ID corresponding to each searched search candidate is generated and added to the input packet separately, or It is output separately from the input packet.

Specifically, the secondary search unit 830 includes an identifier group ID search unit 831 _n , a candidate ID generator 832, an all match flag generation AND circuit 833, an all end flag AND circuit 834, a match candidate ID storage unit 835, and A classification value generator 836 is provided.
The identifier group ID search unit 831 _n is a circuit unit that performs a search based on the identifier group ID [n] output from each primary search unit 820 _n and outputs a match flag whose content is the result of the search.

The candidate ID generator 832 is a circuit unit that outputs a candidate ID that designates a target candidate to be searched by the identifier group ID search unit 831 _n .
The all coincidence flag generation AND circuit 833 is a circuit unit that outputs an all coincidence flag whose content is whether or not all the coincidence flags output from the identifier group ID searchers 831 _n coincide.
The all end flag AND circuit 834 is a circuit unit that outputs an all search end flag whose content is whether or not all the search end flags output from the primary search units 820 _n indicate the end of the search.

The match candidate ID storage unit 835 receives the all search end flag, all match flag, and candidate ID, stores the candidate ID when the all match flag is “1”, and outputs the match candidate ID and the search end flag. Part.
The classification value generator 836 is a circuit unit that receives a match candidate ID and a search end flag and generates a classification value.

A table in which one or more candidates of identifier groups stored in the identifier group ID search unit 831 _n are associated with each candidate ID is a secondary search candidate table.
The identifier group ID search unit 831 _n and the candidate ID generator 832 are different from the nth identifier group search unit 121 _n and the candidate ID generator 122 according to the first embodiment of this invention in that the search target is the identifier group ID [ n], the configuration and operation are the same, and the description of these configuration and operation is omitted.
Similarly, the all match flag generation AND circuit 833 and the classification value generator 836 omit the description of the configuration and operation of the AND circuit 123 and the match candidate ID storage 124 according to the first embodiment of the present invention. .

The search end flag [n] output from each primary search unit 820 _n is input to the all end flag AND circuit 834.
The all end flag AND circuit 834 takes a value of, for example, “1” when all the input search end flags [n] indicate the end of the search, and one or more search end flags end the search. For example, an all-search end flag having a value of “0” is output when it indicates that the search is not performed. In the following, it is assumed that the value of the all search end flag is defined as described above.

The match candidate ID storage unit 835 performs processing when the all search end flag is “1”, and stores the candidate ID (the match candidate ID) when the all match flag is “1”. The result is output to the classification value generator 836 together with the search end flag.
The match candidate ID storage unit 835 performs the same process as the classification value generator 125 of the first exemplary embodiment of the present invention except that the process is performed when the all search end flag is “1”. May be.

Here, any one or more of the primary search units 820 _n described above applies an identifier group mask, which is a mask corresponding to the candidate ID, to the identifier group value to generate a mask identifier group value. A mask identifier group value that holds a primary search candidate table in which a candidate ID is associated with a mask identifier group value candidate that is an identifier group value candidate subjected to an identifier group mask corresponding to the candidate ID, and matches the mask identifier group value A candidate may be searched from the primary search candidate table, and an identifier group ID corresponding to a candidate ID corresponding to a mask identifier group value candidate obtained by the search may be generated.

Further, any one or more of the primary search units 820 _n described above calculates a hash value of the identifier group value, and the primary search candidate table includes an identifier group hash value candidate that is a candidate of the hash value of the identifier group value; A primary search candidate table that associates candidate IDs for identifying identifier group hash value candidates is held, and an identifier group hash value candidate that matches the hash value of the identifier group value is searched from the primary search candidate table and searched. You may comprise so that identifier group ID according to candidate ID corresponding to the identifier group hash value candidate made may be produced | generated.

In addition, any one or more of the primary search units 820 _n described above records range designation information for designating a range of data as identifier group value candidates in a predetermined entry of the primary search candidate table, and the identifier group value is the data of the identifier group value. When matching with an identifier group value candidate specifying a range, an identifier group ID corresponding to a candidate ID corresponding to the matching identifier group value candidate may be generated.
Further, the classification value indicating information indicating whether the secondary search unit 830 determines whether or not to discard the input packet or whether or not to discard the input packet for a predetermined candidate ID. May be configured to generate.

  In addition, the secondary search unit 830 described above is an instruction for removing a predetermined field in the input packet for a predetermined candidate ID, and an instruction for adding a new field in the input packet and recording predetermined data. Or an instruction to remove the predetermined field in the input packet and add a new field, and record the data obtained by converting the data recorded in the removed field in the newly added field. You may comprise so that the classification value which shows information may be produced | generated.

In addition, any one or more of the primary search units 820 _n specify a candidate ID for only a candidate ID of a predetermined entry in the primary search candidate table, and the secondary search unit 830 selects a candidate ID. May be configured to specify only candidate IDs of predetermined entries in the secondary search candidate table.

As described above, the packet classifier apparatus according to the second exemplary embodiment of the present invention includes the primary search unit, and the identifier group value is converted into the ID and then the secondary search unit performs the search. The processing time required for classification can be shortened and power consumption can be reduced.
In addition, since the search is performed by masking according to search candidates such as identifier group values having a long number of bits, the number of bits for matching determination can be reduced, and the processing time required for classifying packets can be further reduced. At the same time, power consumption can be reduced.

In addition, since hash values are calculated according to search candidates such as identifier group values having a long number of bits, and a preliminary search is performed on the hash values, it is possible to determine whether or not each identifier group value having a long number of bits matches. The number of bits to be performed can be reduced, the processing time required for classifying the packets can be shortened, and the power consumption can be reduced.
In addition, since the range designation information for designating the data range as the identifier group value candidate is entered in the search candidate table, the scale of the search candidate table can be reduced and the circuit scale can be reduced.

In addition, because the necessity of discarding input packets is generated as a classification value, it is possible to classify processes that require time for judgment and output them to a dedicated device, etc. It is possible to reduce the processing load of the apparatus.
Further, since a classification value indicating removal, addition, rewriting, etc. of a predetermined field in the input packet can be generated, it is possible to instruct processing such as tag replacement.
Further, since only the candidate ID of a predetermined entry in the search candidate table can be set as a search target, the processing time required for classifying the packets can be shortened and the power consumption can be reduced.

[Third Embodiment]
Next, with reference to FIG. 3, a packet classifier apparatus according to a third embodiment of the present invention will be described. FIG. 10 is a diagram showing a block configuration of a packet classifier apparatus according to the third exemplary embodiment of the present invention.
In FIG. 10, the packet classifier apparatus 1000 includes an identifier group value [n] (n is an integer of 1 to N) and a primary search unit 820 _n (n is an integer of 1 to N). The processing is performed by dividing the identifier group value [n] (n is an integer from N + 1 to N + O, and N and O are natural numbers) input directly to the secondary search unit 830 without going through the search unit 820 _n .

Of the components of the packet classifier apparatus 1000 according to the third embodiment of the present invention, the packet classifier apparatus 100 according to the first embodiment of the present invention or the packet according to the second embodiment of the present invention. The same components as those of the classifier device 800 are denoted by the same reference numerals, and the description thereof is omitted.
Also, the identifier group generation unit 1010 according to the third embodiment of the present invention is different from the identifier group generation unit 110 according to the first embodiment of the present invention in that the output destination of the output signal is changed. However, the processing content is the same as that of the identifier group generation unit 110.

FIG. 11 is a diagram illustrating a block configuration of the secondary search unit 1030 according to the third embodiment of the present invention. In FIG. 11, the secondary search unit 1030 includes an identifier group searcher 121 _n (n is an integer of 1 to N), an identifier group ID searcher 831 _n (n is an integer of N + 1 to N + O, and N and O are natural numbers). A candidate ID generator 1032, an all-match flag generation AND circuit 1033, an all-end flag AND circuit 834, a match candidate ID storage 1035, and a classification value generator 1036 are provided.

The identifier group search unit 121 _n includes the identifier group search unit 121 _{n according} to the first embodiment of the present invention, and the identifier group ID search unit 831 _n includes the identifier group ID search according to the second embodiment of the present invention. A container 831 _n .
Candidate ID generator 1032 is a circuit unit that outputs each candidate ID to each identifier group searcher.
The all-match flag generation AND circuit 1033 is a circuit unit that outputs an all-match flag containing whether or not all match flags output from each identifier group searcher 121 _n and each identifier group ID search unit 831 _n match. It is.

The all end flag AND circuit 834 is a circuit unit when an all search end flag including whether or not all the search end flags output from the respective primary search units 820 _n indicate the end of the search is output.
A match candidate ID storage unit 1035 is a circuit that receives all search end flags, all match flags, and candidate IDs, stores candidate IDs when the all match flags are “1”, and outputs match candidate IDs and search end flags. Part.
The classification value generator 1036 is a circuit unit that receives a match candidate ID and a search end flag and generates a classification value.

  A candidate ID generator 1032, an all-match flag generation AND circuit 1033, a match candidate ID storage 1035 and a classification value generator 1036 according to the third embodiment of the present invention are respectively the second embodiment of the present invention. The configuration and operation of the candidate ID generator 832, the all-match flag generation AND circuit 833, the match candidate ID storage unit 835, and the classification value generator 836 are the same, and description of these configurations and operations is omitted.

As described above, the packet classifier apparatus 1000 according to the third embodiment of the present invention has both a method of searching by converting an identifier group into an ID and a method of searching the identifier group directly.
In this way, regarding identifier groups that can be converted to IDs, the processing can be greatly reduced, and even when identifier groups that cannot be converted to IDs are included. Here, the “identifier group that cannot be converted to ID” corresponds to, for example, a value indicating a port number or the like as a range.

  As described above, the packet classifier device according to the third exemplary embodiment of the present invention is divided into the identifier group value that can be converted into an ID and the one that cannot be converted into an ID in addition to the effect of the second exemplary embodiment of the present invention. Since the processing can be performed, various identifier group values can be classified.

[Fourth Embodiment]
Next, with reference to FIG. 12, a packet classifier apparatus according to a fourth embodiment of the present invention will be described. FIG. 12 is a diagram showing a block configuration of a packet classifier apparatus according to the fourth exemplary embodiment of the present invention.
In FIG. 12, among the constituent parts of the packet classifier apparatus 1200 according to the fourth embodiment of the present invention, the same constituent parts as those of the packet classifier apparatus 800 according to the second embodiment of the present invention include: The same reference numerals are given and the description thereof is omitted.

The packet classifier apparatus 1200 according to the fourth exemplary embodiment of the present invention performs a search using a combination of an identifier group generation unit 810, a primary search unit 820 _n (n is an integer from 1 to N), and a predetermined identifier group ID. a plurality of secondary search unit 1230 _p (p is an integer of 1 to P, P is a natural number) for performing a packet data secondary search unit 1230 _p (p is an integer of 1 to P) processing time required for processing performed by And a packet buffer unit 1240 that delays only by the amount of time.

Among these, the primary search unit 820 _n specifies one or more identifier group value candidates of identifier group values and identifier group value candidates for each of one or more identifier group values obtained by combining the identifier values. A primary search candidate table in which candidate IDs are associated is retained, identifier group value candidates that match each identifier group value are searched from the corresponding primary search candidate table, and candidate IDs corresponding to the detected identifier group value candidates are set as candidate IDs. A corresponding identifier group ID is generated.

Further, the secondary search unit 1230 _p selects one or more predetermined identifier group IDs from each identifier group ID to generate one or more selected identifier group IDs, and for each identifier group ID, A secondary search candidate table in which one or more search candidates of the selected identifier group ID and a candidate ID for specifying the search candidate are associated is held, and a secondary search corresponding to the search candidate that matches each selected identifier group ID A search is made from the candidate table, a classification value corresponding to the candidate ID corresponding to each searched search candidate is generated, added separately to the input packet, and output.

The secondary search unit 1230 _{p according} to the fourth embodiment of the present invention is provided for each packet processing unit 20 _p (p is an integer from 1 to P) that performs predetermined packet processing.
Here, the packet processing described above includes QoS (Quality of Service) processing for distributing packets to different queues according to the classification value [p], filter processing for discarding packets according to the classification value [P], and classification value [ Packet authentication encryption processing that rewrites, adds, or deletes a specific header of a packet according to P], and performs encryption, decryption, assignment of signature data, recognition, etc. according to classification value [P] (For example, IPsec: Security Architecture for the Internet Protocol).

Here, the “header changing process” includes, for example, an IP encapsulation process, a NAT (Network Address Translation) tag, and a VLAN (Virtual LAN) tag process.
Therefore, the packet classifier device 1200 according to the fourth exemplary embodiment of the present invention can be viewed as including the secondary search unit 1230 _p according to the packet processing performed after the processing in the packet classifier device 1200.

Here, the secondary search unit 1230 _{p according} to the fourth embodiment of the present invention includes S search identifier group selectors 1231 _s (s is an integer of 1 to S, S is a natural number), and each identifier group in terms provided in front of the ID search unit 831 _s different, each identifier group ID searching unit 831 _s later, the configuration and operation of the up classification value generator 836, described in the second embodiment of the present invention It is the same as what I did.

The search identifier group selector 1231 _s selects a predetermined identifier group ID from the input identifier group ID [n] (n is an integer from 1 to N) and outputs the selected identifier group ID to the identifier group ID search unit 831 _s. ing. Here, the identifier group ID selected by the search identifier group selector 1231 _s may be fixed, or may be changed by an input from an external CPU or the like.

Further, the number “S” of search identifier group selectors may be different for each secondary search unit 1230 _p . The number “S” may be changed according to packet processing performed by the packet processing unit 20 _p (similarly, search performed by the secondary search unit 1230 _p ).
This is because, depending on the packet processing, the identifier group to be searched and the number of identifier groups are also different. Here, when the configuration and operation of the packet processing and the secondary search unit 1230 _p are related and fixed, the circuit scale is reduced by matching the number “S” with the packet processing whose relationship is fixed in advance. it can.

Further, since all the search identifier group selectors 1231 _s select an identifier group ID and output it to the identifier group ID search unit 831 _s , a search that selects and outputs an identifier group ID by an input from an external CPU or the like. The identifier group selector may be changed.
Also, some fixed search identifier group selectors 1231 _s may select an identifier group ID and output the identifier group ID to the identifier group ID search unit 831 _s .
In this case, it is preferable because means (for example, the above-described external CPU) required for changing the secondary search unit 1230 _p and the identifier group ID search unit 831 _s can be deleted or reduced in scale.

  As described above, the packet classifier device according to the fourth exemplary embodiment of the present invention includes a secondary search unit for each packet processing after output in addition to the effects of the second exemplary embodiment of the present invention. Since the identifier group value is converted into an ID after the identifier group value is converted into an ID, and the search is performed on the selected identifier group value, the processing amount in the secondary search unit can be increased. Furthermore, it is possible to shorten the processing time required for classifying the packets and reduce the power consumption.

Industrial application fields

  The packet classifier apparatus according to the present invention can be applied to applications such as a repeater and a switch on a network that can shorten the processing time required for classifying packets and can reduce power consumption.

It is a block diagram which shows the structure of the packet classifier apparatus concerning one embodiment of this invention. It is a block diagram which shows the structure of the identifier group production | generation part concerning the 1st Embodiment of this invention. It is a figure for demonstrating operation | movement of the identifier group production | generation part concerning the 1st Embodiment of this invention. It is a figure for demonstrating operation | movement of the identifier group production | generation part concerning the 1st Embodiment of this invention. It is a figure for demonstrating operation | movement of the identifier group production | generation part concerning the 1st Embodiment of this invention. It is a block structural example of the identifier group searcher concerning the 1st Embodiment of this invention. It is another example of block composition of an identifier group searcher concerning a 1st embodiment of the present invention. It is a block diagram which shows the structure of the packet classifier apparatus concerning the 2nd Embodiment of this invention. It is a block diagram which shows the structure of each primary search part and secondary search part concerning the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the packet classifier apparatus concerning the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the secondary search part concerning the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the packet classifier apparatus concerning the 4th Embodiment of this invention. It is a block diagram which shows the structure of each secondary search part concerning the 4th Embodiment of this invention.

Explanation of symbols

10 ... packet parsing unit, 100,800,1000,1200 ... packet classifier device, 110,810,1010 ... identifier group generation _{unit, 111 1 ~111 N, 111 n} ... identifier extraction unit, 112 ₁ to 112 _N, 112 _n ... parameter register, 113, 114 ... delay circuit, 120 ... search unit, 121 _{1 to} 121 _N , 121 _n , 821 _n ... identifier group search unit, 122, 822 _n , 832, 1032 ... candidate ID generator, 123 ... AND circuit, 124, 823 _n , 835, 1035 ... matching candidate ID storage, 125, 836, 1036 ... classification value generator, 611 ... mask processor, 612 ... candidate mask register, 613, 623, 713, 723 ... selection 621 ... Comparative processor 622 ... Identifier group value candidate register 701 ... Hash processor 711 Hash value comparison processing unit, 712 ... hash candidate register, 721 ... matching verification processor, 722 ... identifier group value candidate _{register, 820 1 ~820 N, 820 n} ... primary search unit, 830,1030,1230 ₁ ~1230 _P, 1230 _p ... Secondary search unit, 831 _{1 to} 831 _N , 831 _n , 831 _s ... Identifier group ID search unit, 833, 1033 ... All match flag generation AND circuit, 834 ... All end flag AND circuit, 1231 _{1 to} 1231 _S , 1231 _s ... Search identifier group selector.

Claims (17)

In a packet classifier device that generates a classification value as information for classifying the input packet based on one or more identifier values composed of data recorded in a predetermined field in the input packet.
Parsing the input packet to obtain packet data from the input packet and an identifier mark for identifying a portion including the identifier value in the packet data, and a set of the packet data and the identifier mark is set as an identifier value. A packet parser that outputs as
From the identifier values output from the packet parsing device, the identifier value whose identifier mark matches the identifier mark value set as a parameter is extracted, and the identifier group value is extracted from the packet data of these identifier values. An identifier group value generation unit to generate;
The searching any search candidates for the identifier group value generated by the identifier group value generation unit, and a retrieval unit that outputs a classification value for the input packet in accordance with the search result,
The search unit associates one or more search candidates for the identifier group value with a candidate ID for specifying the search candidate for each of one or more identifier group values composed of combinations of the identifier values. A search candidate table is stored, predetermined candidate IDs among the candidate IDs are sequentially specified, and the search candidates that match the identifier group values are searched from the corresponding search candidate table and obtained by searching. The packet classifier apparatus, wherein the classification value corresponding to the candidate ID corresponding to each of the search candidates is output. The packet classifier device according to claim 1,
The search unit generates an identifier group value by applying an identifier group mask, which is a mask corresponding to the candidate ID, to the identifier group value, and the identifier group corresponding to the candidate ID and the candidate ID in the search candidate table A mask identifier group value candidate that is a masked identifier group value candidate is stored in correspondence, and the mask identifier group value candidate that matches the mask identifier group value is retrieved from the search candidate table and retrieved. The packet classifier apparatus, wherein the classification value corresponding to the candidate ID corresponding to the mask identifier group value candidate is output. The packet classifier device according to claim 1,
The search unit calculates a hash value of the identifier group value, and an identifier group hash value candidate that is a candidate for the hash value of the identifier group value in the search candidate table and a candidate ID that identifies the identifier group hash value candidate, The identifier group hash value candidate matching the hash value of the identifier group value is searched from the search candidate table, and the candidate ID corresponding to the identifier group hash value candidate obtained by the search is stored. A packet classifier device that outputs the corresponding classification value. The packet classifier device according to claim 1,
The search unit retains range specification information for specifying a range of data as the identifier group value candidate in a predetermined entry of the search candidate table, and the identifier group value candidate for which the identifier group value specifies the range of data The packet classifier apparatus outputs the classification value corresponding to the candidate ID corresponding to the identifier group value candidate that matches. The packet classifier device according to claim 1,
The search unit generates, as the classification value for a predetermined candidate ID, a classification value indicating information indicating whether or not the input packet needs to be discarded or whether or not the input packet needs to be discarded. A packet classifier device. The packet classifier device according to claim 1,
The search unit, as the classification value for a predetermined candidate ID, information on an instruction to remove a predetermined field in the input packet, information on an instruction to add a new field in the input packet and record predetermined data Or an instruction to remove a predetermined field in the input packet, add a new field, and record data obtained by converting data recorded in the removed field in the newly added field A packet classifier device that generates a classification value indicating the information of the packet. The packet classifier device according to claim 1,
The packet classifier apparatus, wherein the search unit specifies only candidate IDs of predetermined entries in the search candidate table as the candidate IDs. The packet classifier device according to claim 1,
The search unit adds the classification value to the input packet and outputs the packet. In a packet classifier device that generates a classification value that is information for classifying the input packet, based on an identifier value that is one or more data recorded in a predetermined field in the input packet.
The one or more identifiers group values consisting of a combination of the identifier values, for each of the first identifier group values, the first one or more identifiers group value candidate with the identifier group value of identifier group value A primary search candidate table that associates candidate IDs that identify candidates is held, and the identifier group value candidates that match the first identifier group values are searched from the corresponding primary search candidate table and detected. A primary search unit for generating an identifier group ID corresponding to a candidate ID corresponding to the identifier group value candidate;
For each of the identifier group ID generated by the primary search unit, the first secondary search candidates made to correspond to the candidate ID for identifying the search candidate with one or more search candidates of the identifier group ID A table is held, and the search candidates that match the identifier group IDs are searched from the corresponding first secondary search candidate table. Among the identifier group values, the first identifier group value is A second secondary search candidate table in which one or more search candidates of the second identifier group value and a candidate ID for specifying the search candidate are associated with each different second identifier group value. Holding the search candidate that matches the second identifier group value from the corresponding second secondary search candidate table, and according to the candidate ID corresponding to each searched search candidate A secondary search unit for generating and outputting classification values A packet classifier device. In a packet classifier device that generates a classification value that is information for classifying the input packet, based on an identifier value that is one or more data recorded in a predetermined field in the input packet.
The one or more identifiers group values consisting of a combination of the identifier values, for each of the first identifier group values, the first one or more identifiers group value candidate with the identifier group value of identifier group value A primary search candidate table that associates candidate IDs that identify candidates is held, and the identifier group value candidates that match the first identifier group values are searched from the corresponding primary search candidate table and detected. A primary search unit that generates an identifier group ID corresponding to a candidate ID corresponding to the identifier group value candidate;
One or more predetermined identifier group IDs are selected from each of the identifier group IDs generated by the primary search unit to generate one or more selected identifier group IDs, and for each of the identifier group IDs , Holding a first secondary search candidate table in which one or more search candidates of the selection identifier group ID and a candidate ID for specifying the search candidate are associated with each other, and the search that matches each of the selection identifier group IDs One or more secondary search units that search for candidates from the corresponding first secondary search candidate table, and generate and output the classification values corresponding to the candidate IDs corresponding to the searched search candidates. And a packet classifier device. In the packet classifier device according to claim 9 or 10,
Any of the primary search units generates an identifier group value by applying an identifier group mask, which is a mask corresponding to the candidate ID, to the first identifier group value, and generates a mask identifier group value in the primary search candidate table. A mask identifier group value candidate that is an identifier group value candidate subjected to an identifier group mask corresponding to the candidate ID is stored in association with each other, and the mask identifier group value candidate that matches the mask identifier group value is the primary search candidate. A packet classifier device, characterized in that an identifier group ID corresponding to the candidate ID corresponding to the mask identifier group value candidate obtained by searching from a table and corresponding to the mask is generated. In the packet classifier device according to claim 9 or 10,
Wherein any of the primary searching unit, the first calculating a hash value of the identifier group values, the primary search candidates the said first candidates for hash value of the identifier group value identifier group hash value candidate table A candidate ID for identifying an identifier group hash value candidate is stored in correspondence, and the identifier group hash value candidate that matches the hash value of the first identifier group value is searched from the primary search candidate table and searched. An identifier group ID corresponding to a candidate ID corresponding to the obtained identifier group hash value candidate is generated. In the packet classifier device according to claim 9 or 10,
One of the primary search units retains range designation information for designating a range of data as the identifier group value candidate in a predetermined entry of the primary search candidate table, and the first identifier group value is a range of the data When the identifier group value candidate designating the identifier group value matches, the identifier group ID corresponding to the candidate ID corresponding to the matched identifier group value candidate is generated. In the packet classifier device according to claim 9 or 10,
The secondary search unit, as the classification value for a predetermined candidate ID, a classification value indicating information indicating the necessity of discarding the input packet or the necessity of discarding determination for determining the necessity of discarding the input packet A packet classifier device. In the packet classifier device according to claim 9 or 10,
The secondary search unit, as the classification value for a predetermined candidate ID, information on an instruction to remove a predetermined field in the input packet, an instruction to add a new field to the input packet and record predetermined data Information or a predetermined field in the input packet is removed and a new field is added, and data obtained by converting the data recorded in the removed field is recorded in the newly added field. A packet classifier device that generates a classification value indicating instruction information to be transmitted. In the packet classifier device according to claim 9 or 10,
The primary search unit specifies only the candidate ID of a predetermined entry in the primary search candidate table as the candidate ID,
The secondary search unit specifies only the candidate ID of a predetermined entry in the first secondary search candidate table as the candidate ID. In the packet classifier device according to claim 9 or 10,
The secondary search unit adds the classification value to the input packet and outputs the packet.

Images