Background technology
In data network, development along with Internet, many new COS are introduced among the Internet, as VPN (virtual private network) (Virtual Private Network, VPN), distributed fire wall, route, Differentiated Services, charge on traffic and IP security gateway etc. based on strategy.These new COS are all based on traffic classification (Flow Classification) technology.In data network, traffic classification is actually the classification to packet, promptly according to one or more critical fielies of packet head, based on certain strategy and rule, discern the affiliated stream of this packet, based on the attribute of affiliated stream, this packet is handled accordingly then.
The process of traffic classification as shown in Figure 1, system extracts critical field according to the rule of traffic classification from packet head byte, search the stream that obtains under the packet the storage list from stream.Wherein, the algorithm of traffic classification mainly partly realized by stream classification checking, so stream classification checking is the key of traffic classification process, determined the speed of traffic classification speed and taken the size of memory space.
For the consideration to the packet throughput, the stream classification checking in the flow classification techniques generally adopts hardware to realize, mainly contains three class methods: memory directly searches, search and utilize hash algorithm to search based on search tree.The most representative TCAM of being based in the traffic classification method that memory is directly searched (Ternary Content Addressable Memory) searches, be characterized in that seek rate is fast, support prefix and commensurate in scope, but the CAM device cost an arm and a leg, power consumption is big, and the renewal of rule is comparatively complicated.The characteristics of utilizing hash algorithm to carry out stream classification checking are to realize that simply classification speed is fast, and memory space is little, but intrinsic conflict and the divergence problem of hash algorithm makes that the efficient of stream classification checking is lower, directly influences the effect of traffic classification.
Under comparing, be a kind of scheme of compromise based on the stream classification checking of search tree, relatively typically be based on the stream classification checking of binary tree based on the stream classification checking of search tree, its space complexity is less, can adopt internal RAM to realize that cost is low.
Be used for stream classification checking binary tree structure as shown in Figure 2, based on the stream classification checking flow process of binary tree as shown in Figure 3.
When packet carries out stream classification checking, at first read the critical field of system configuration in the binary tree root node, compare with the critical field of packet, if equate, then stream classification checking success; Otherwise, search the next stage node of binary tree.If the critical field in the binary tree node is less than the critical field of packet, then search the node that occupies a left side (or right) in the next stage node, if the critical field in the binary tree node, is then searched the node that occupies right (or left side) in the next stage node greater than the critical field of packet.Then according to the critical field numerical value in the next stage node, determine whether success of stream classification checking, the perhaps position of next stage node again, the rest may be inferred, to the last the one-level node.If the critical field of afterbody node is still unequal, then stream classification checking failure.
The deploy content of binary tree nodes at different levels can be stored among (or polylith) RAM, and hardware is realized simple.Its shortcoming is that the step of binary tree search is more, the time of traffic classification is long, and the renewal of rule is slower, compare operation need be repeatedly searched in once complete binary tree search, and the number of times maximum equals the progression of binary tree, thereby causes the time of traffic classification long, in addition, for consistency and the correctness that keeps the binary tree search result, in the process of binary tree search, do not allow to change the deploy content of binary tree, so binary tree is not generally supported dynamic-configuration.
Embodiment
Below in conjunction with accompanying drawing, technical scheme of the present invention is described further by embodiment.
This embodiment needs two block RAMs to be used for the rule of storage flow classification as the principal and subordinate binary tree, and the number of entries of RAM is 2L, and L is the progression of binary tree node, depends on the quantity of flow classification rule.The content of clauses and subclauses is as shown in table 1:
Table 1
Title |
The position |
Explanation |
The critical field of rule base |
(L+n-1): L |
Critical field in the rule base is used for comparing with the critical field of packet, if equate, then searches successfully. |
Data packet stream ID |
(L-1): 0 |
Stream ID under the packet during binary tree search success |
Also need M register to be used for preserving the critical field of packet in the M level production line among the present invention, form is as shown in table 2:
Table 2
Title |
The position |
Explanation |
The packet critical field |
(n-1): 0 |
The critical field of from packet head byte, extracting. |
Regular quantity in the flow classification rule storehouse has determined the node number of binary tree in the system, the packet throughput constraints of traffic classification time of each level production line inside during binary tree search, thereby determined the pipeline series of binary tree search.There is L level node in binary tree in the supposing the system, binary tree search is divided into the M level production line, then a level production line inside comprises N (N={L/M}, { } expression rounds up) the searching of individual binary tree node, four steps such as searching of each binary tree node comprise read memory operation, obtain the numerical value stored in the node, the comparison of critical field and the generation of next stage storage address:
Clock cycle 1: binary tree node read signal and to read address (RAM reads) effective;
Clock cycle 2: obtain critical field and stream ID in the binary tree node;
Clock cycle 3: the critical field in the comparison binary tree node and the critical field of packet;
Clock cycle 4:, adopt the stream ID of this node if the critical field in the binary tree node equates that with the critical field of packet binary tree search is successful; Otherwise produce next stage binary tree address of node.
After receiving the critical field of packet, then begin to search step by step balanced binary tree from root node, finish after the searching of first order streamline, if search not success, then enter searching of second level streamline, meanwhile, the another one packet begins to carry out searching of first order streamline from root node.Finish searching of second level streamline at first packet, second packet finished searching of first order streamline simultaneously, if do not search successfully, then first packet enters third level streamline and searches, second packet enters second level streamline and searches, simultaneously the 3rd data are unwrapped the beginning and are carried out first order streamline from root node and search, and the rest may be inferred, finishes searching of whole binary tree up to all packets.
Under the worst case (in the end the one-level node is searched successfully), once complete binary tree search need be visited the binary tree node memory L time in the different moment, adopt after the pipeline organization, will certainly sternly give birth to the M level production line situation of reference to storage simultaneously, in this embodiment, to read the time point of binary tree node be identical to the different pieces of information bag in the same level production line, same packet reads the node of binary tree respectively at different time points in different level production lines, thereby avoided the access conflict of RAM.
The flow process of the binary tree stream classification checking of the employing pipeline organization that this embodiment proposes as shown in Figure 4, its main operational steps is as follows:
(1) the 1st packet enters the 1st level production line, and the critical field of packet is saved in critical field 1 register, carries out searching of the 1st grade of node of binary tree;
(2) the 1st packets carry out searching of the 2nd grade of binary tree node of the 1st level production line;
Carry out successively;
(3) the 1st packets carry out searching of N level binary tree node in the 1st level production line;
(4) the 1st packets enter the 2nd level production line, and the critical field of the 1st packet in critical field 1 register is saved in critical field 2 registers, carry out searching of binary tree N+1 level node in the 2nd level production line; Simultaneously, the 2nd packet enters the 1st level production line, and the critical field of the 2nd packet is saved in critical field 1 register, carries out searching of the 1st grade of node of binary tree in the 1st level production line;
Carry out successively;
(5) the 1st packets are finished searching of the 2nd level production line 2*N level node, and the critical field of the 1st packet in critical field 2 registers is saved in critical field 3 registers, enter the 3rd level streamline and search; Simultaneously, the 2nd packet finished searching of the 1st level production line N level node, and the critical field of the 2nd packet in critical field 1 register is saved in critical field 2 registers, enters the 2nd level production line; The 3rd packet enters the 1st level production line, and the critical field of the 3rd packet is saved in critical field 1 register, carries out searching of the 1st grade of node of binary tree in the 1st level production line;
Carry out successively;
(6) the 1st packets are finished searching of M-1 level production line, and the critical field of the 1st packet in the critical field M-1 register is saved in the critical field M register, enter searching of M level production line; Simultaneously, the 2nd packet finished searching of M-2 level production line, and the critical field of the 2nd packet in the critical field M-2 register is saved in the critical field M-1 register, enters the M-1 level production line; M-1 packet enters the 1st level production line, and the critical field of M-1 packet is saved in critical field 1 register, carries out searching of the 1st grade of node of the 1st level production line;
Carry out successively;
(7) the 1st packets are finished searching of M level production line L level node (binary tree afterbody node), and the 1st packet binary tree search finishes; Simultaneously, the 2nd packet finished searching of M-1 level production line, enters the M level production line; M packet enters the 1st level production line, carries out searching of the 1st grade node (being root node);
Carry out successively;
(8) the 2nd packets are finished searching of M level production line L level node (binary tree afterbody node), and the 2nd packet binary tree search finishes; Simultaneously, the 3rd packet finished searching of M-1 level production line, enters the M level production line; M-1 data are unwrapped searching of beginning the 1st level production line the 1st grade node (being root node);
Carry out successively;
(a 9) M packet are finished searching of M level production line L level node (binary tree afterbody node), and M packet binary tree search finishes.
In this embodiment, for fear of the RAM access conflict that causes because of pipeline organization, the RAM read operation of the 2nd level production line is postponed a clock cycle than the RAM read operation in the 1st level production line, the RAM read operation of 3rd level streamline is postponed a clock cycle than the RAM read operation in the 2nd level production line, and the RAM read operation of M level production line is postponed a clock cycle than the RAM read operation in the M-1 level production line.Be that the time point that the different pieces of information bag reads the binary tree node in the same level production line is identical, same packet reads the node of binary tree respectively at different time points in different level production lines.
Specify the operation that each level production line different clocks cycle carried out below.The node of supposing binary tree has 12 grades, divides 4 level production lines, and every level production line is finished searching of 3 grades of binary tree nodes, because searching of one-level binary tree node needs 4 clock cycle, then every level production line needs 12 clock cycle.
The operation of first order streamline comprises:
The 1st clock cycle: the keyword of packet is saved in critical field 1 register; The 1st grade of node R AM read signal is effective, and the address is 1;
The 2nd clock cycle: the 1st grade of node R AM read data is effective;
The 3rd clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 4th clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 2nd grade of address of node 2*address or 2*address+1, wherein address represents the address of even higher level of node;
The 5th clock cycle: the 2nd grade of node R AM read signal is effective;
The 6th clock cycle: the 2nd grade of node R AM read data is effective;
The 7th clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 8th clock cycle: if critical field equates then stream classification checking success, otherwise generation 3rd level address of node 2*address or 2*address+1;
The 9th clock cycle: 3rd level node R AM read signal is effective;
The 10th clock cycle: 3rd level node R AM read data is effective;
The 11st clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 12nd clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 4th grade of address of node 2*address or 2*address+1.
The operation of second level streamline comprises:
The 1st clock cycle: the keyword of packet is saved in critical field 2 registers;
The 2nd clock cycle: the 4th grade of node R AM read signal is effective;
The 3rd clock cycle: the 4th grade of node R AM read data is effective;
The 4th clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 5th clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 5th grade of address of node 2*address or 2*address+1;
The 6th clock cycle: the 5th grade of node R AM read signal is effective;
The 7th clock cycle: the 5th grade of node R AM read data is effective;
The 8th clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 9th clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 6th grade of address of node 2*address or 2*address+1;
The 10th clock cycle: the 6th grade of node R AM read signal is effective;
The 11st clock cycle: the 6th grade of node R AM read data is effective;
The 12nd clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 12nd clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 7th grade of address of node 2*address or 2*address+1;
Second " the 12nd clock cycle " expression postpones " the 12nd clock cycle " 1 clock cycle because the 1st clock cycle of next stage streamline do not begin to read node, so can utilize aperture time to carry out the generation of address.
The operation of third level streamline comprises:
The 1st clock cycle: the keyword of packet is saved in critical field 3 registers;
The 2nd clock cycle: sky;
The 3rd clock cycle: the 7th grade of node R AM read signal is effective;
The 4th clock cycle: the 7th grade of node R AM read data is effective;
The 5th clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 6th clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 8th grade of address of node 2*address or 2*address+1;
The 7th clock cycle: the 8th grade of node R AM read signal is effective;
The 8th clock cycle: the 8th grade of node R AM read data is effective;
The 9th clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 10th clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 9th grade of address of node 2*address or 2*address+1;
The 11st clock cycle: the 9th grade of node R AM read signal is effective;
The 12nd clock cycle: the 9th grade of node R AM read data is effective;
The 12nd clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 12nd clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 10th grade of address of node 2*address or 2*address+1;
Second " the 12nd clock cycle " expression postpones the 1st clock cycle of " the 12nd clock cycle " because the 1st clock cycle of next stage streamline do not begin to read node, so can utilize aperture time to carry out the comparison of critical field;
The 3rd " the 12nd clock cycle " expression postpones the 2nd clock cycle of " the 12nd clock cycle " because the 2nd clock cycle of next stage streamline do not begin to read node, so can utilize aperture time to carry out the generation of address.
The operation of fourth stage streamline comprises:
The 1st clock cycle: sky;
The 2nd clock cycle: the keyword of packet is saved in critical field 4 registers;
The 3rd clock cycle: sky;
The 4th clock cycle: the 10th grade of node R AM read signal is effective;
The 5th clock cycle: the 10th grade of node R AM read data is effective;
The 6th clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 10th clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 11st grade of address of node 2*address or 2*address+1;
The 8th clock cycle: the 11st grade of node R AM read signal is effective;
The 9th clock cycle: the 11st grade of node R AM read data is effective;
The 10th clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 10th clock cycle: if critical field equates that then stream classification checking is successful, otherwise produces the 12nd grade of address of node 2*address or 2*address+1;
The 12nd clock cycle: the 12nd grade of node (afterbody node) RAM read signal is effective;
The 12nd clock cycle: the 12nd grade of node R AM read data is effective;
The 12nd clock cycle: the critical field in the comparison binary tree node and the critical field of packet;
The 12nd clock cycle: if critical field equates then stream classification checking success, otherwise stream classification checking failure.
The 1st, the 2nd and the 3rd clock cycle after second, third and the 4th " the 12nd clock cycle " are represented respectively to postpone " the 12nd clock cycle ", because be the afterbody streamline, and do not carry out the read operation of binary tree node, so do not influence the pile line operation of binary tree stream classification checking.
The binary tree maximum of 12 grades of nodes can comprise 2
12-1=4095 node, promptly maximum can be supported 4095 flow classification rules.If the operating frequency of hardware unit is 100MHz, then the processing time of a level production line is 120ns, under the situation of system's full rate, the time of a packet stream classification checking of average treatment is 120ns, and can finish the stream classification checking of 800 ten thousand packets each second.No matter be quantity from flow classification rule, or the throughput of stream classification checking, all can satisfy the requirement of flow classifier in the general networking.
Critical field when supposing stream classification checking is that 32bit is wide, and then the resource of required RAM is 2 * 4K * (12+32)=352Kbit.
In order to realize dynamically updating of classifying rules in the traffic classification process, two balanced binary trees of principal and subordinate have been introduced in this embodiment.It is main binary tree that data packet stream divides the time-like binary tree that hardware is searched, when system need upgrade flow classification rule, from binary tree, send binary tree principal and subordinate switching command to hardware then by software arrangements, original main binary tree is become from binary tree, originally become main binary tree from binary tree.In other words, what hardware was searched in the traffic classification process is main binary tree forever, and what systems soft ware disposed is from binary tree forever, is independent of each other, and upgrades thereby guaranteed to carry out with no damage in the binary tree search process flow classification rule.
In actual application, the renewal of flow classification rule generally all is renewal among a small circle, the root node of binary tree is addressed to 1 among the present invention, other child node increases successively, add flow classification rule if desired, then only need rules of arrangement, at the new Rule content of node corresponding configuration according to balanced binary tree, need not to change the addressing mode of memory, the change of binary tree content is minimized.
Fig. 5 is a binary tree principal and subordinate switching state schematic flow sheet among the present invention.As shown in Figure 5, when the principal and subordinate binary tree is switched,, then switch and finish at once if there is not packet to carry out binary tree search.
When if system sends switching command, there is packet carrying out searching of binary tree, then main binary tree can not switch to from state at once, the packet that has begun binary tree search still uses original main binary tree, the packet that enters at last before switching command is finished after the binary tree search, and main binary tree just switches to from state.
When if system sends switching command, there is packet carrying out searching of binary tree, then can not switch to major state at once from binary tree yet, up to there being new packet to begin searching of binary tree, the packet that perhaps enters at last before switching command is finished after the binary tree search, just switches to major state from binary tree.
The above; only for the preferable embodiment of the present invention, but protection scope of the present invention is not limited thereto, and anyly is familiar with the people of this technology in the disclosed technical scope of the present invention; the variation that can expect easily or replacement all should be encompassed within protection scope of the present invention.Therefore, protection scope of the present invention should be as the criterion with the protection range of claim.