CN101645852B - Equipment and method for classifying network packet - Google Patents

Abstract

The invention provides a network packet classification device and method. The device includes: a pipeline tree search module, which is used to receive the keyword of the network packet, search the first K layers of the tree structure, and send the searched next node address and linear comparison information and keywords to the classification core and/or Or output network packet identifier and flow identifier, wherein K is a positive integer; Classification core, it is used to receive the key word that pipeline tree search module outputs, next node address and linear comparison information, access node memory and rule memory, to The part below the K layer of the tree structure is searched and compared with linear rules, and the network packet identifier and flow identifier are output; the node memory is used to store the node information after the K layer of the tree structure; the rule memory is used to store Linear comparison rules. The device and method for network packet classification proposed by the invention improve memory utilization and packet classification speed.

Description

Device and method for classifying network packets

technical field

The present invention generally relates to the field of computer network communication, and more specifically relates to the classification technology of network packets.

Background technique

Packet classification is a basic technology in the field of computer network communication and network security. With the vigorous development of the Internet, the network load increases rapidly, exceeding the growth rate of the router capacity, resulting in network congestion and packet loss. The form of "equal and best-effort service" for each network packet by traditional routers no longer satisfies all network users. Some users are willing to spend more money to obtain better network services, which requires routers to provide differentiated services, traffic Shaping, traffic accounting and other functions, these requirements directly contributed to the development and application of packet classification technology. With the increasing popularity of multimedia services and P2P applications, as well as the flooding of malicious attacks and scanning, viruses and worms on the Internet, firewall devices are required to handle a large number of network connections at a high speed and track the connection status. All these backgrounds and applications require the device to be able to classify network packets, and identify different network packets according to the content of the source address, destination address, source port number, destination port number and other fields of the network packet, matching with the established rule set , and treat it specially.

At present, many studies have been able to classify network packets at a wire speed in the case of OC-48 (2.5Gbps), but at higher speeds such as OC-192 (10Gbps), OC-384 (20Gbps), more The number of rules is more than 10k, and it is still difficult to realize line-speed packet classification. The current implementation is mainly based on TCAM (Ternary Content Addressable Memory, ternary content addressable memory). TCAM has the following disadvantages: expensive; high power consumption; low density. Various problems in TCAM prompt people to explore new packet classification implementations.

HiCuts algorithm (Packet Classification using Hierarchical Intelligent Cuttings) is an effective tree structure packet classification algorithm proposed by Pankaj Gupta and Nick Mckeown. It regards the rules of d domains as rectangles of d-dimensional space, and divides the d-dimensional space according to certain principles until the number of rules distributed in each subspace is less than a certain number. The process of splitting can be represented by a tree, and the nodes of the tree store the information of each split, such as which dimension to choose for splitting, how many times to split, and so on. The rules are distributed under the leaf nodes of the tree. Packet header search starts from the root node of the tree, proceeds along the path of the tree to the leaf node, and then compares the IP packet linearly with a small number of rules under the leaf node to complete the packet classification.

At present, there are some packet classification methods based on HiCuts algorithm, such as using software in the CPU or network processor of the computer system to search the HiCuts tree, but due to the influence of equipment operating efficiency and algorithm implementation structure, the classification speed is low.

Contents of the invention

In order to solve one of the above problems, the present invention proposes a network packet classification device, which includes a pipeline tree search module, a classification core, a node memory and a rule memory. The pipeline tree search module is used to receive the keyword of the network packet, search the first K layers of the tree structure, and send the searched next node address and linear comparison information and the keyword to the classification core and/or Or output network packet identifier and flow identifier, wherein K is a positive integer; The classification core is used to receive the keyword, the next node address and linear comparison information output by the pipeline tree search module, and access the node Memory and rule memory, search the part below the K layer of the tree structure and perform linear rule comparison, output the network packet identifier and flow identifier; the node memory is used to store the K layer of the tree structure Subsequent node information; the rule memory is used to store linear comparison rules.

According to an embodiment of the present invention, the pipeline tree search module includes a root node register, K-1 single-layer node memory modules, a root node search module, K-1 node search modules and a control module. Wherein, the root node register is used to store the root node information of the tree structure; the K-1 single-layer node memory modules include the second layer single-layer node memory module to the Kth layer single-layer node memory module, wherein Each of the single-layer node memory modules is used to store the node information of one layer of nodes in the first K layers of the tree structure except the root node; the root node search module is used to receive the keyword, access the The root node register is used to search the root node, and send the keyword and the searched next node address, linear comparison information and/or the stream identifier of the keyword to the second layer node search module; The K-1 node search modules include cascaded second layer node search modules to the Kth layer node search module, each of the node search modules is used to receive the root node search module or the upper layer node search module The key and the next node address, linear comparison information and/or the stream identifier of the key are sent, and the corresponding node is taken out from the corresponding single-layer node memory module, searched for, and The search result is sent to the next-level node search module; wherein the K-th layer node search module is used to send the keyword and the searched next node address, linear comparison information and/or flow identifier to the control module; the control module is used to receive the keyword and the next node address, linear comparison information and/or flow identifier sent by the K-th layer node search module, and output the network packet identifier and flow identifier And/or sending the keyword, next node address and linear comparison information to the sorting core.

According to an embodiment of the present invention, the classification core includes a label assignment module, a parallel tree search module, a parallel linear rule comparison module and a core classification result pool. Wherein, the label allocation module is used to receive the keywords, next node address and linear comparison information output by the pipeline tree search module, assign a label to each of the keywords, and combine the labels, keywords and the next node address are sent to the parallel tree search module, and the label, keyword and linear comparison information are sent to the parallel linear rule comparison module, and the label sent back by the core classification result pool is received and circulated Use; the parallel tree search module is used to receive the label, keyword and next node address sent by the label allocation module, access the node memory according to the next node address, perform tree search, and find the leaf node , if the leaf node is an empty node, then output the label and a default flow identifier, if the leaf node is a non-empty node, then send the label and linear comparison information to the parallel linear rule comparison module; The parallel linear rule comparison module is used to receive the labels, keywords and linear comparison information sent by the label allocation module and the parallel tree search module, access the rule storage, and generate flow identifiers matching the keywords character, send the label, network packet identifier and flow identifier to the core classification result pool; the core classification result pool is used to receive the data sent by the parallel tree search module and the parallel linear rule comparison module the label, the network packet identifier and the flow identifier, send the label to the label allocation module, and output the network packet identifier and the flow identifier.

According to an embodiment of the present invention, the parallel tree search module includes a tree search key buffer, a tag and next node address queue module, a tree search engine scheduler and multiple tree search engines. Wherein, the tree search key buffer is used to store the key sent by the label allocation module; the label and next node address queue module is used to store the label and the next node address sent by the label allocation module. Node address; the tree search engine scheduler is used to control the multiple tree search engines, when there is an idle tree search engine and the label and the next node address queue module are not empty, read the label and the next node address A label and the next node address in a node address queue module are sent to the idle tree search engine to start the idle tree search engine; the tree search engine is used for the control of the tree search engine scheduler Start up, access the tree search keyword buffer and the node memory according to the label and the next node address, read the domain of the keyword from the tree search keyword buffer, and search the tree The structure goes up to the leaf node, if the leaf node is an empty node, then output the label, network packet identifier and default flow identifier, if the leaf node is a non-empty node, then output the label and linear comparison information.

According to an embodiment of the present invention, the tree search key buffer is a dual-port memory.

According to an embodiment of the present invention, the parallel linear rule comparison module includes a linear comparison keyword buffer, a first label and a linear comparison information queue module, a second label and a linear comparison information queue module, a rule comparator, and a linear comparison engine scheduling registers and multiple linear comparison engines. Wherein, the linear comparison keyword buffer is used to receive the keyword sent by the parallel tree search module; the first tag and linear comparison information queue module is used to store the tag and the tag sent by the tag assignment module. Linear comparison information; the second label and linear comparison information queue module is used to store the label and linear comparison information sent by the tree search module; the linear comparison engine scheduler is used to control the multiple linear comparison engines, When there is an idle linear comparison engine and at least one of the first label and linear comparison information queue module and the second label and linear comparison information queue module is not empty, send the label and linear comparison information to the The idle linear comparison engine is used to start the idle linear comparison engine; the linear comparison engine is used to access the linear comparison keyword buffer according to the label under the control of the linear comparison engine scheduler, according to The linear comparison information accesses the linear rule storage, receives the comparison result of the rule comparator, until a rule matching the keyword is found or all the rules under the leaf nodes are compared, and a rule corresponding to the keyword is obtained. Matching flow identifier or default flow identifier, output the label, network packet identifier and flow identifier; the rule comparator is used to receive the keyword sent by the linear comparison keyword buffer, and the The rules output by the linear rule memory are compared, and the comparison result is sent to the linear comparison engine.

According to an embodiment of the present invention, the linear comparison key register is a dual-port memory.

According to an embodiment of the present invention, at least one of the node memory and the rule memory is a dual-port memory.

According to an embodiment of the present invention, the device further includes: a sorting result summarization module, which is connected to the pipeline tree search module and the sorting core, and is used to receive the results generated by the pipeline tree searching module and the sorting core. The keyword identifier and the stream identifier are used to output a classification result.

According to an embodiment of the present invention, the sorting core includes at least two sorting cores, and the pipeline tree search module is further configured to send the keyword, next node address and linear comparison information to an idle sorting core.

According to an embodiment of the present invention, the network packet classification device is integrated in a single chip.

The present invention also proposes a method for classifying network packets, comprising the following steps: the pipeline tree search module receives the keyword of the network packet, searches the first K layers of the tree structure, and searches the next node address and linear comparison information And the keyword is sent to the classification core and/or output network packet identifier and flow identifier, wherein K is a positive integer; the classification core receives the keyword and the next node address output by the pipeline tree search module and linear comparison information, accessing the node memory and rule memory, searching the part below the K layer of the tree structure and performing linear rule comparison, and outputting the network packet identifier and flow identifier, wherein the node The storage is used to store node information after the K level of the tree structure, and the rule storage is used to store linear comparison rules.

The device and method for classifying network packets proposed by the invention avoids the use of TCAM and improves memory utilization and packet classification speed.

Description of drawings

The above and/or additional aspects and advantages of the present invention will become apparent and easy to understand from the following description of the embodiments in conjunction with the accompanying drawings, wherein:

FIG. 1 is a schematic diagram of a data structure of a tree node according to an embodiment of the present invention;

Fig. 2 is a schematic structural diagram of a network packet classification device according to an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a pipeline tree search module according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a classification core according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a parallel tree search module according to an embodiment of the present invention;

6 is a schematic structural diagram of a parallel linear rule comparison module according to an embodiment of the present invention;

Fig. 7 is a schematic diagram of the change curve of the occupied space with the rule number according to an embodiment of the present invention;

Fig. 8 is a schematic diagram of the variation curve of classification speed with the number of rules according to an embodiment of the present invention.

Detailed ways

Embodiments of the invention are described in detail below, examples of which are illustrated in the accompanying drawings. The embodiments described below by referring to the figures are exemplary only for explaining the present invention and should not be construed as limiting the present invention.

Before packet classification, the present invention first divides the original rules to establish a HiCuts tree. After the tree is divided, all original rules are expressed in a range form, which is composed of a rule upper bound and a rule lower bound. For simplicity, the rule upper bound and the rule lower bound collectively referred to as rules.

As an embodiment of the present invention, the keyword used is made up of source address, destination address, source port number, destination port number, IP layer protocol, TOS (Type of Service, service type) and network packet identifier. As an embodiment of the present invention, the rule used is made up of source address, destination address, source port number, destination port number, IP layer protocol, TOS (Type of Service, type of service) and stream identifier. The network packet identifier is used to find the network packet corresponding to the network packet identifier after the classification is completed, and process it according to the flow identifier output by the device. As an embodiment of the present invention, if no stream identifier matching the keyword is found, 0XFFFF is output, which is called a default stream identifier in this specification.

As an embodiment of the present invention, the node structure used in the HiCuts tree is shown in Figure 1, including intermediate nodes and leaf nodes. Select 32 bits for the node width. Among them, the intermediate node and the leaf node are distinguished by a 1-bit flag F, if F is 0, it is an intermediate node, and if F is 1, it is a leaf node. In addition to the flag F, the intermediate node has the following four parts: segmentation field C, start bit S, mask M, child node address A. The split field occupies 3 bits, which is the serial number of the field selected when splitting the node; the start bit occupies 5 bits, which is the position of the lowest bit involved in splitting the field; the mask occupies 8 bits, which are irrelevant to the split For protection; the sub-node address occupies 15 bits, which is the base address of the sub-node generated after splitting when stored. In addition to the flag, the child node also has the following parts: the rule number RC and the rule start address RA. The rule number RC occupies 3 bits, indicating the number of rules under the leaf node. The rule starting address occupies 24 bits, which is the starting position where these rules are stored in the rule memory. When the rule number RC of a leaf node is equal to 0, the leaf node is called an empty node.

As an embodiment of the present invention, the search for tree nodes includes the following steps:

(1) Take out the node from the corresponding node memory according to the address of the next node. If it is the root node, the address of the next node is not needed, and the root node is directly taken out from the root node register.

(2) If the node flag F is 0, that is, the node is an intermediate node, then jump to step (3), if the node flag F is 1, that is, the node is a leaf node, then jump to step (4) .

(3) Select the corresponding field in the keyword according to the segmented field C of the node, expand the high bit of the field with 0 to 32 bits, then shift S bits to the right, take the high 8 bits and mask M, and then match with the child node address A Add and output the address of the next node, and then jump to (1) for execution.

(4) If the rule number RC of the leaf node is not equal to 0, that is, the node is a non-empty leaf node, the rule number RC and the rule start address RA are output. The rule number RC and the rule start address RA are collectively called linear Compare information. If the rule number RC of the leaf node is equal to 0, that is, the node is an empty node, then output the network packet identifier and the default flow identifier.

As shown in Figure 2, it is a schematic structural diagram of a network packet classification device according to an embodiment of the present invention. The network packet classification device includes a pipeline tree search module, a node memory, a rule memory, 2 classification cores and a classification result summary module.

Wherein, the pipeline tree search module is used to receive the keyword of the network packet, and search the first K layers of the tree structure. As an embodiment of the present invention, K can be selected according to the characteristics of the tree. If MAX_CUTS is small and the tree depth is deep, K can take a slightly larger value. If MAX_CUTS is large and the tree depth is shallow, K can be small. The value of , where MAX_CUTS is the maximum equal fraction of tree nodes.

As shown in Figure 3, it is a schematic structural diagram of a pipeline tree search module when K=2 according to an embodiment of the present invention, the implementation includes: a first-level node register; a second-level node memory; a first-level node search module; a second layer node search module; and a control module.

Among them, the first-level node register is used to store the first-level node, because the first-level node is the root node, there is only one node, and no address is needed, so it is stored in the register.

The first layer node search module is used to receive the keyword of the network packet, access the first layer node register, search the root node, and output the keyword, the next node address, the linear comparison information and the flow identifier to the first layer node Search for modules.

The second-layer node search module is used to receive the output of the root node search module, access the second-layer node memory module, search the second-layer node, and output keywords, next node addresses, linear comparison information and/or stream identifiers to control module.

The control module is used to receive the output of the second layer node search module, output the network packet identifier and flow identifier of the network packet, or send the keyword, next node address and linear comparison information to the idle classification core.

As an embodiment of the present invention, the node memory is a dual-port memory, which is used to store node information after the K level of the HiCuts tree structure. As an embodiment of the present invention, both ports of the node memory are readable, at least one port is writable, each port is connected to a classification core, and one of the readable and writable ports is multiplexed. When classifying network packets, It is connected with a sorting core to output tree node information, and when the tree structure is updated, it is connected to an external bus to receive new tree structure information input from the outside.

As an embodiment of the present invention, the rule memory is a dual-port memory for storing linear rules. As an embodiment of the present invention, the rule memory needs two memories, including a rule upper bound memory and a rule lower bound memory. The rule upper bound memory is used to store the upper bound of the linear rule. The rule lower bound memory is used to store the lower bound of the linear rule. The flow identifier of the upper bound of each rule is the same as the flow identifier of the lower bound of the rule. For simplicity, the rule upper bound and the rule lower bound are collectively referred to as linear rules. As an embodiment of the present invention, both ports of the rule upper bound memory and the rule lower bound memory are readable, at least one port is writable, each port is connected to a classification core, and one of the readable and writable ports is multiplexed. When classifying network packets, it is connected to a classification core and outputs rules. As an embodiment of the present invention, when the rules are stored, all the rules under the same child node are stored in a continuous area of the linear rule memory. The rule storage may also include a rule update module, which is connected to the external bus and receives new linear rules input from the outside when adding or deleting rules.

FIG. 4 is a schematic structural diagram of a classification core according to an embodiment of the present invention. The classification core includes: a label assignment module, a parallel tree search module, a parallel linear rule comparison module and a core classification result pool.

Among them, the label allocation module is used to receive the keywords output by the pipeline tree search, the address of the next node and the linear comparison information, and assign a label to each keyword entered. When the keyword enters the parallel tree search module and the parallel linear rule comparison module When it is stored in the cache with the tag as the address, when the keyword needs to be read, the tag will be used as the address of the cache. The total number of tags is fixed, so this module also plays a cache control function. When the tags are allocated, it indicates that the cache is full and keywords can no longer be received. According to different inputs, the address of the next node and corresponding keywords and labels are sent to the parallel tree search module, and linear comparison information and corresponding keywords and labels are sent to the parallel linear comparison module. As an example of the present invention, the total number of tags can be selected as 16, that is, the width of the tag is 4 bits.

The parallel tree search module is used to receive the label, keyword and next node address output by the label distribution module, access the node memory according to the next node address, perform tree search, and find the leaf node, if the leaf node is an empty node, then the The label and default flow identifier are output to the core classification result pool, and if the leaf node is a non-empty node, the label and linear comparison information are output to the parallel linear rule comparison module.

The parallel linear rule comparison module is used to receive the labels, keywords and linear comparison information output by the label allocation module and the parallel tree search module, access the rule storage, generate flow identifiers that match keywords, and compare labels, network packet identifiers and Flow identifiers are output to the core classification result pool.

The core classification result pool receives the labels, network packet identifiers and flow identifiers output by the parallel tree search module, outputs them immediately, and receives the labels, network packet identifiers and flow identifiers output by the parallel linear rule comparison module. As an embodiment of the present invention, the core classification result pool stores them temporarily in a FIFO (first-in-first-out memory), as can be the FIFO that depth is 16 and width is 36 bits, when parallel tree search module does not output, will FIFO content output. Labels are output to the label assignment module, and network packet identifiers and flow identifiers are output to the classification core.

In the embodiment of the present invention, both the parallel tree search module and the parallel linear rule comparison module access the memory in a read-only manner, and the resources consumed by the single-port memory and the dual-port memory realized by the programmable logic device or ASIC are almost the same. Therefore, the embodiment of the present invention designs the node memory and the linear rule memory as a dual-port mode, uses two identical classification cores, and doubles the packet processing capability without increasing memory resource consumption. Of course, in other embodiments, the number of classification cores may also be selected according to specific conditions.

FIG. 5 is a schematic structural diagram of a parallel tree search module according to an embodiment of the present invention. The parallel tree search module is used to continue tree search according to the input next node address until a leaf node is found, and then output stream identifier or linear search information according to the content of the leaf node. The parallel tree search module includes a tree search keyword buffer, a label and next node address queue module, a tree search engine scheduler and multiple tree search engines.

Wherein, the tree search keyword buffer is used to receive and store keywords. As an embodiment of the present invention, this is a dual-port memory, the write port width is the maximum width of the key field multiplied by the number of key fields, the read port width is the maximum width of the key field, and the depth is from The write port calculation is the total number of tags, it receives the input keyword, and expands the high bit of each field to 32 bits, and then stores it at the address of the tag. As an embodiment of the present invention, the tree search keyword buffer is a dual-port memory, the write port width is 256 bits, and the depth is 16 equal to the total number of tags, and the read port width is 32 bits, and the depth is 128. The high-order field of the input keyword is expanded to 32 bits with zero padding, and 192 bits are obtained for 6 fields, and 64-bit zeros are added to the high-order field to obtain 256 bits. Take the label as the address and write it into the tree key cache.

The label and next node address queue module is used to store labels and next node addresses. As an embodiment of the present invention, the label and next node address queue module stores input labels and next node addresses in a first-in first-out order. As an embodiment of the present invention, the label and next node address queue module is a FIFO with a depth of 16, storing labels, next node addresses and network packet identifiers.

The tree search engine scheduler is used to control multiple tree search engines. When there is an idle tree search engine and the label and the next node address queue module are not empty, the label and the next node address are input to the idle tree search engine to start Tree search engine. As an embodiment of the present invention, the tree search engine scheduler circulates and inquires the states of a plurality of tree search engines in turn, if the engine is in an idle state, then reads a label, the next node address from the label and the next node address queue module and the network packet identifier are sent to the tree search engine, and the tree search engine is started.

The tree search engine is used to start under the control of the tree search engine scheduler, accesses the tree search keyword buffer and node memory according to the input label and the next node address, and reads out the domain of the keyword from the tree search keyword buffer , search the tree structure until the leaf node, and output the label, network packet identifier, default flow identifier or linear comparison information according to the type of leaf node. Under the control of the tree search engine scheduler, each tree search engine staggers access to the tree search key cache and node memory.

As an embodiment of the present invention, FIG. 5 shows 6 tree search engines, but this is only an example of the present invention. In practical applications, the number of tree search engines can be increased or decreased according to the situation.

Taking six tree search engines as an example for illustration, tree search engine 1 to tree search engine 6 are six tree search engines with the same structure. There is a 6-bit circular shift register inside. When the engine is stopped, the register value is 0x1. After the engine is started, it starts to rotate to the high bit. The engine completes the steps of the tree search in sequence under the control of the shift register. The engine works as follows:

(1) Output the next node address to the node memory when the register is 0x2;

(2) Output label when the register is 0x4. At this point the node memory outputs the node. The label is used as the upper 4 bits, and the combination of the split fields of the node is used as the lower 3 bits, which are sent to the key register as the read address. The node is also sent to the engine at the same time. If it is a non-empty leaf node, it will output the label and linear comparison information. If it is an empty leaf node, it will output the label and the default flow identifier. After the tree search is over, the engine enters an idle state and waits for the next step of the scheduling engine. Start once. If it is an intermediate node, continue with (3).

(3) When the register is 0x10, the field output by the keyword cache is sent to the engine, and after calculation, the address of the next node is obtained, and then jumps to (1) for execution.

Since the layer search of the tree needs to visit the node memory once, and then spend multiple clocks to calculate the address of the next node, if a single tree search engine is used to calculate the address of the next node, the memory is idle, resulting in low memory utilization efficiency . Embodiments of the present invention employ multiple tree search engines, operating under the control of respective shift registers. The engine scheduler starts them at different times, so their access to the tree memory is staggered, and other engines can access the memory while one engine is waiting to calculate the address of the next node. This design improves the efficiency of the node memory.

FIG. 6 is a schematic structural diagram of an embodiment of the parallel linear rule comparison module of the present invention. The parallel linear rule comparison module finds the storage location of the rules under the leaf node in the rule memory according to the input linear comparison information, reads the rules from it, and compares them with keywords one by one. If a matching rule is found, the rule flow identifier is output as the classification result , otherwise output the default stream identifier. The parallel linear comparison module includes a linear comparison keyword buffer, a first label and linear comparison information queue module, a second label and linear comparison information queue module, a linear comparison engine scheduler, a plurality of linear comparison engines and a rule comparator.

Wherein, the linear comparison keyword buffer is used to receive the input keyword, and store it in the location with the label as the address. As an embodiment of the present invention, the linear comparison keyword register is a dual-port memory, and the write port and the read port width are the same, which is the width of the keyword, such as 128 bits, and the depth is the total number of labels, such as 16. Receives the entered keyword and stores it at the location addressed by the label.

The first label and linear comparison information queue module is used to store the label and linear comparison information input by the label allocation module, and store the label and linear comparison information input by the label allocation module in a first-in first-out order.

The second tag and linear comparison information queue module is used to store the tags and linear comparison information input by the tree search module, and store the tags and linear comparison information input by the tree search module in a first-in first-out order.

As an embodiment of the present invention, the first and second tag and comparison information queue modules are FIFOs with a depth of 16.

The linear comparison engine scheduler is used to control multiple linear comparison engines. When there is an idle linear comparison engine and at least one of the first label and the linear comparison information queue module or the second label and the linear comparison information queue module is not empty, the label The sum linear comparison information is output to the idle linear comparison engine, and the idle linear comparison engine is started.

As an embodiment of the present invention, the linear comparison engine scheduler loops and inquires the states of a plurality of linear comparison engines in turn, if the linear comparison engine is in an idle state, and at least one of the queue modules is not empty, then read from the queue module A tag and line comparison information are fed into the line comparison engine, and the line comparison engine is started. When reading the queue module, read the first queue module first, and only read the second queue module if the first queue module is empty.

The linear comparison engine is used to access the linear comparison keyword buffer according to the label and the rule storage according to the linear comparison information under the control of the linear comparison engine scheduler, and receive the linear rule comparison result of the rule comparator until finding the one matching the keyword Linear rules or all rules under the leaf nodes are compared to obtain the flow identifier matching the keyword, and output the label, network packet identifier and flow identifier. As an embodiment of the present invention, the linear comparison engine outputs the received label as the read address of the linear comparison keyword buffer, outputs the read address of the linear rule memory according to the linear comparison information, receives the comparison result of the rule comparator, and if the result is a rule If the keyword is not matched, the read address of the linear rule storage is increased by 1 and output until a matching rule is found or all rules under the leaf nodes are compared, the classification result is obtained, and the label, network packet identifier and flow identifier are output, and the online Under the control of the comparison engine scheduler, each engine staggers and outputs the read addresses of the linear comparison keyword cache and the linear rule memory.

The rule comparator is used to receive the keywords output by the linear comparison keyword buffer, compare them with the linear rules output by the rule memory, if each domain of the keyword is less than or equal to each domain of the upper bound of the rule and greater than or equal to each domain of the lower bound of the rule, then The keyword matches the rule. Output the linear rule comparison result to the linear comparison engine.

The following uses six linear comparison engines as examples for illustration. Linear comparison engine 1 to linear comparison engine 6 are six linear comparison engines with the same structure. There is a 6-bit circular shift register inside. When the engine is stopped, the register is 0x1. After the engine is started, it starts to rotate to the high bit. The engine completes the steps of linear comparison in sequence under the control of the shift register. There is also a rule counter inside the engine to record the number of compared rules, and the counter value is 0 when the engine stops. The engine works as follows:

(1) When the register is 0x2, output the rule address to the linear rule memory, output the label as the read port address of the keyword memory, and increase the rule counter by 1 at the same time.

(2) When the register is 0x8, the rule is sent from the rule memory, and the keyword is sent from the keyword buffer. Network packet identifiers and flow identifiers are sent to the engine for staging. Rules and keywords are fed into the rule comparator for comparison.

(3) When the register is 0x10, the result of the rule comparator is output and sent to the engine. If the rule matches, execute 4), otherwise add 1 to the rule address and execute 1) to 3) repeatedly.

(4) When the register is 0x20, if the rule matches, output the network packet identifier and the rule identifier, or the rule counter is equal to the number of leaf node rules, then output the network packet identifier and the default flow identifier, and output the label at the same time.

Just as the principle of using multiple tree search engines in the parallel tree search module, using multiple linear comparison engines improves the efficiency of the regular upper bound storage and the regular lower bound storage.

One embodiment of the present invention proposes a kind of method of network packet classification, comprises the following steps:

The pipeline tree search module receives the keyword of the network packet, searches the first K layers of the tree structure, and sends the next node address and linear comparison information and the keyword obtained by the search to the classification core and/or output network packet identifier and stream identifier, where K is a positive integer;

The classification core receives the keyword, next node address and linear comparison information output by the pipeline tree search module, accesses the node memory and the rule memory, searches the part below the K layer of the tree structure and performs linear rule comparison, and outputs the network packet identifier and stream identifiers, wherein the node storage is used to store node information after the K level of the tree structure, and the rule storage is used to store linear comparison rules.

The present invention has good performance in classification time and space occupation. As shown in FIG. 7 , the occupied space varies with the increase of the number of rules according to an embodiment of the present invention. The curve increases linearly, indicating that the occupied space of the device according to the embodiment of the present invention increases slowly when the rules increase. As shown in Figure 8, it is the curve that the classification speed of the device according to an embodiment of the present invention changes with the increase of the number of rules. It can be seen that in the case of a large number of rules, the device still has a very high packet classification speed, such as 25K rules At this time, the classification speed of 90M headers per second has been achieved. Calculated based on the average header length of 330 bytes, the packet processing capability is 237Gbps, and the minimum header length is 40 bytes, and the packet processing capability is 28.8Gbps.

Although the embodiments of the present invention have been shown and described, those skilled in the art can understand that various changes, modifications and substitutions can be made to these embodiments without departing from the principle and spirit of the present invention. and modifications, the scope of the invention is defined by the appended claims and their equivalents.

Claims (12)

1. A network packet classification device, characterized in that, comprises a pipeline tree search module, a classification core, a node memory and a rule memory, The pipeline tree search module is used to receive the keyword of the network packet, search the first K layers of the tree structure, and send the next node address and linear comparison information obtained by searching and the keyword to the classification core or output Network packet identifier and flow identifier, where K is a positive integer; The classification core is used to receive the keyword, the next node address and linear comparison information output by the pipeline tree search module, access the node memory and the rule memory, and perform Searching and performing linear rule comparison, outputting the network packet identifier and flow identifier; The node memory is used to store node information after the K layer of the tree structure; The rule memory is used to store linear comparison rules. 2. The network packet classification device according to claim 1, wherein the pipeline tree search module includes a root node register, K-1 single-layer node memory modules, a root node search module, and K-1 node search modules. module and control module, where, The root node register is used to store the root node information of the tree structure; The K-1 single-layer node memory modules include the second-layer single-layer node memory module to the Kth layer single-layer node memory module, wherein each of the single-layer node memory modules is used to store the first K of the tree structure Node information of one of the layer nodes except the root node; The root node search module is configured to receive the keyword, access the root node register, search the root node, and search for the keyword, the next node address, linear comparison information and/or the key The flow identifier of the word is sent to the K-1 node search modules; The K-1 node search modules include cascaded second layer node search modules to the Kth layer node search module, each of the node search modules is used to receive the root node search module or the upper layer node search module The keyword and the next node address, linear comparison information and/or the stream identifier of the keyword sent by the module, fetch the corresponding node from the corresponding single-layer node memory module, search it, and Send the search result to the next layer node search module; wherein the Kth layer node search module is used to send the keyword and the searched next node address, linear comparison information and/or stream identifier to the control module; The control module is configured to receive the keyword and the next node address, linear comparison information and/or flow identifier sent by the K-th layer node search module, and output the network packet identifier and flow identifier or will The key, next node address and linear comparison information are sent to the sorting core. 3. The network packet classification device according to claim 1, wherein the classification core comprises a label assignment module, a parallel tree search module, a parallel linear rule comparison module and a core classification result pool, wherein, The label allocation module is used to receive the keywords, next node address and linear comparison information output by the pipeline tree search module, assign a label to each of the keywords, and combine the labels, keywords and next A node address is sent to the parallel tree search module, and the label, keyword and linear comparison information are sent to the parallel linear rule comparison module, and the label returned by the core classification result pool is received and recycled; The parallel tree search module is used to receive the label, keyword and next node address sent by the label allocation module, access the node memory according to the next node address, perform a tree search, and find a leaf node, if The leaf node is an empty node, then output the label and the default flow identifier, if the leaf node is a non-empty node, then send the label and linear comparison information to the parallel linear rule comparison module; The parallel linear rule comparison module is used to receive the labels, keywords and linear comparison information sent by the label allocation module and the parallel tree search module, access the rule storage, and generate flow identifiers matching the keywords character, sending the label, network packet identifier and flow identifier to the core classification result pool; The core classification result pool is used to receive the label, network packet identifier and flow identifier sent by the parallel tree search module and the parallel linear rule comparison module, and send the label to the label assignment module, And output the network packet identifier and flow identifier. 4. The network packet classification device according to claim 3, wherein the parallel tree search module includes a tree search keyword buffer, a label and a next node address queue module, a tree search engine scheduler and a plurality of tree search engines search engine, where The tree search keyword buffer is used to store the keyword sent by the label assignment module; The label and next node address queue module is used to store the label and the next node address sent by the label allocation module; The tree search engine scheduler is used to control the plurality of tree search engines, and when there is an idle tree search engine and the label and the next node address queue module are not empty, read out the label and the next node address A label and the next node address in the queue module are sent to the idle tree search engine, and the idle tree search engine is started; The tree search engine is used to start under the control of the tree search engine scheduler, access the tree search key buffer and the node memory according to the label and the next node address, and search the key from the tree Read the domain of the keyword in the word buffer, search the tree structure until the leaf node, if the leaf node is an empty node, then output the label, network packet identifier and default flow identifier, if the leaf node is a non-empty node, then output the label and linear comparison information. 5. The network packet classification device according to claim 4, wherein the tree search keyword buffer is a dual-port memory. 6. The network packet classification device according to claim 3, wherein the parallel linear rule comparison module comprises a linear comparison keyword cache, a first label and a linear comparison information queue module, a second label and a linear comparison information queue module, rule comparator, linear comparison engine scheduler and multiple linear comparison engines, where, The linear comparison keyword buffer is used to receive the keyword sent by the parallel tree search module; The first label and linear comparison information queue module is used to store the label and linear comparison information sent by the label allocation module; The second label and linear comparison information queue module is used to store the label and linear comparison information sent by the tree search module; The linear comparison engine scheduler is used to control the plurality of linear comparison engines, when there is an idle linear comparison engine and at least one of the first label and linear comparison information queue module and the second label and linear comparison information queue module When there is a non-empty one, send the label and linear comparison information to the idle linear comparison engine, and start the idle linear comparison engine; The linear comparison engine is configured to, under the control of the linear comparison engine scheduler, access the linear comparison keyword buffer according to the label, access the linear rule storage according to the linear comparison information, and receive the rule The comparison result of the comparator, until the rule matching the keyword is found or all the rules under the leaf node are compared, the flow identifier or default flow identifier matching the keyword is obtained, and the label, Network packet identifiers and flow identifiers; The rule comparator is used to receive the key sent by the linear comparison key buffer, compare it with the rule output by the linear rule memory, and send the comparison result to the linear comparison engine. 7. The network packet classification device according to claim 6, wherein the linear comparison key buffer is a dual-port memory. 8. The network packet classification device according to claim 1, wherein at least one of the node memory and the rule memory is a dual-port memory. 9. The network packet classification device according to claim 1, further comprising: A classification result summarization module, connected to the pipeline tree search module and the classification core, for receiving the flow identifier generated by the pipeline tree search module and the classification core, and outputting a classification result. 10. The network packet classification device according to claim 1, wherein the classification core comprises at least two classification cores, The pipeline tree search module is also used to send the keyword, next node address and linear comparison information to the idle classification core. 11. The network packet classification device according to any one of claims 1-10, characterized in that, the network packet classification device is integrated in a single chip. 12. A method for network packet classification, characterized in that, comprising the following steps: The pipeline tree search module receives the keyword of the network packet, searches the first K layers of the tree structure, and sends the next node address and linear comparison information and the keyword obtained by the search to the classification core or outputs the network packet identifier and flow Identifier, where K is a positive integer; The classification core receives the keyword, the next node address and the linear comparison information output by the pipeline tree search module, accesses the node memory and the rule memory, searches the part below the K layer of the tree structure and performs linear Rule comparison, outputting the network packet identifier and flow identifier, wherein the node storage is used to store node information after the K level of the tree structure, and the rule storage is used to store linear comparison rules.

Images