CN102437937A

CN102437937A - Deep packet inspection method

Info

Publication number: CN102437937A
Application number: CN2011104524430A
Authority: CN
Inventors: 岳培培; 李树佳; 刘钧凯
Original assignee: Beijing Ruian Technology Co Ltd
Current assignee: Beijing Ruian Technology Co Ltd
Priority date: 2011-12-29
Filing date: 2011-12-29
Publication date: 2012-05-02
Anticipated expiration: 2031-12-29
Also published as: CN102437937B

Abstract

The invention relates to a deep packet inspection method. The method comprises the following step of: building an FPGA (Field Programmable Gata Array) module, wherein the FPGA module is connected with a TCAM (Three-phase Content Addressing Memory) so as to receive a to-be-inspected data packet load and match keywords, and the supported match length of the keywords in the TCAM is M. The step concretely comprises the following sub-steps of: 1) segmenting the keyword, wherein the keyword is segmented according to a keyword segmentation length N, and N=M/2; 2) recombining the keyword in the step 1) according to a set condition which a keyword offset position and an end position meet, to get a keyword matching rule; 3) storing the segmented and recombined keyword into the TCAM and an SRAM (Static Random Access Memory) to finish the pretreatment on the keyword; 4) extracting the data packet load by the FPGA module, segmenting and recombining the load, and sending the result of treatment into the TCAM for matching by the FPGA, and returning back the result of matching to the FPGA module; and 5) returning back the mode of processing operations of corresponding data packets to the FPGA module through reading the matching address in the SRAM by the FPGA, and outputting data packet data.

Description

Deep packet detection method

Technical Field

The invention relates to a method for processing keywords in a hardware deep packet detection process, and belongs to the field of data communication.

Background

The deep packet inspection technology is widely applied in the field of data communication, and is often used in the aspects of data packet application type analysis, user behavior analysis, intrusion detection, virus/worm detection and the like.

The traditional deep packet inspection is usually realized by software, and various pattern matching algorithms are used for matching specific keywords, but the speed of the software for deep packet inspection is limited, so that the linear speed processing cannot be guaranteed. And the method of hardware is adopted to realize deep packet detection, and the linear speed processing can be realized under the condition of large flow.

Deep packet inspection is implemented using hardware, and the most common method is to use a Field Programmable Gate Array (FPGA) plus a three-phase content addressable memory (TCAM) implementation. The TCAM is a special chip for matching keywords, and when a piece of content to be matched is input, the TCAM automatically compares the content to be matched with all keywords stored in the memory, and when the same keyword exists in the memory, it indicates a hit, and returns a hit result, i.e. the address of the keyword, and the process is performed in a pipeline manner.

The process of realizing deep packet inspection by using the FPGA + TCAM mode comprises the following steps: keywords are first configured into the TCAM. When the deep packet inspection is started, the FPGA accesses data, extracts the load in the data packet and enters the TCAM for inspection as the content to be matched. If the data packet is hit, the FPGA uses the address returned by the TCAM to read the data packet in a Static Random Access Memory (SRAM), the SRAM returns the content, namely the processing mode of the data packet, and the FPGA uses the processing mode to perform corresponding operation on the data packet.

Although hardware implementation is very fast, TCAMs also have usage limitations. One is a limitation of hardware speed, and under a large flow rate, for example, in an environment of 10G to 40G, the processing speed is not yet up to only 1 byte offset for packet payload per matching, and multiple bytes (assuming that N bytes are offset per time) are required for matching. The other is the limit of matching bit width, and the key bit width of each matching is limited due to the TCAM capability limit (assuming that the bit width of each matching is M bytes).

Due to the above limitations, some fixed offset-position keys, especially long keys, may not fit within a matching rule of the TCAM. For this problem, there are the following main solutions: 1, expanding the bit width matched each time by adopting a plurality of TCAM cascade connection usage, which undoubtedly increases the complexity and cost of the system; 2, prefix matching is carried out by using TCAM, and then accurate comparison is carried out by using a Synchronous Dynamic Random Access Memory (SDRAM), and the method also has the problem of complexity of realization; and 3, dividing the keywords into a plurality of sub keywords, putting the sub keywords in a plurality of matching rules of the TCAM, performing a plurality of matching operations in the deep packet inspection process, and finally sending each sub hit result into the TCAM for one-time matching to determine whether the sub hit results are hit, wherein the number of the sub hit results is not fixed, and the sub hit results are determined by the length of the load packet, so that the matching of the sub hit results is not easy to operate.

In summary, the conventional keyword segmentation method is not easy to operate, and becomes a bottleneck for performing deep packet inspection by hardware.

Disclosure of Invention

The invention provides a method for processing keywords in the process of hardware deep packet detection, aiming at the problems, so that the processing of the keywords is as follows: the segmentation and matching are easy to operate.

The invention provides a method for segmenting and matching keywords, which aims at solving the problem that the segmentation and matching of the keywords are difficult to realize in the process of realizing deep packet detection in an FPGA + TCAM mode, and the process is convenient to realize.

A deep packet inspection method comprises the steps of,

1) establishing a Field Programmable Gate Array (FPGA) module for receiving a data packet to be tested, wherein the FPGA module is connected with a three-phase content addressable memory (TCAM) for receiving the load of the data packet to be tested and matching keywords, and the matching length of the supporting keywords in the TCAM is M;

2) connecting a Static Random Access Memory (SRAM) outside the FPGA module;

3) segmenting a keyword, wherein the keyword segmentation length N is segmented according to the condition that N is M/2;

4) recombining the keywords in the step 3) according to the set conditions met by the keyword offset position and the end position to obtain the keyword matching rule;

5) storing the segmented and recombined keywords into a TCAM and an SRAM memory to finish the keyword pretreatment;

6) the FPGA module extracts a data packet load, performs segmentation and recombination processing on the load, sends a result to a TCAM memory for matching after the processing is completed, and returns a matching result to the FPGA module;

7) and the FPGA returns the processing operation mode of the corresponding data packet to the FPGA module by reading the matching address in the SRAM memory, and outputs the data packet data.

If the offset position and the end position of the keyword meet the set condition, when the offset position of the keyword is not less than N x i, the end position of the keyword is less than N x (i +2), wherein i is 0, 1 … …, i is an integer, a certain keyword is fixed, N is the length of the keyword, the keyword occupies a TCAM for matching, the length of M bytes of the matching rule corresponds to N x i to N (i +2) -1, and the keyword is processed according to the matching rule.

If the keyword offset position and the ending position meet the set condition, when N x i is not more than the keyword offset position < N (i + 1); the ending position of the keyword is less than or equal to N x j and less than N x (j + 1); wherein i is 0, 1 … …, i is integer, fixed for some keyword, j ≧ i +2, N is keyword length, keyword occupy i-i TCAM rule, the keyword is recombined according to matching rule.

The matching rule corresponding to the M bytes of the keyword is as follows:

sub-matching rule 1: m bytes correspond to N × i to N × (i + 2);

sub-matching rule 2: m bytes correspond to N x (i +1) to N x (i + 3);

sub-matching rules j-i: m bytes correspond to N (j-1) to N (j + 1).

The i-i sub-matching rules are located in a contiguous address space in the TCAM memory.

The method for processing the data packet load comprises the steps of cutting according to the length N bytes of the key word, splicing two adjacent N bytes into M bytes, and sending the M bytes into a TCAM memory for matching. Namely:

the first matched M bytes correspond to 0 to N x 2-1 of the load

The M bytes matched for the second time correspond to N x 3-1 of the load

M bytes of the third matching correspond to N x 2 to N x 4-1 of the load

Fragmentation stops to the end of the packet.

And if the keywords are matched in the TCAM memory and the matching result is not the long keyword displayed in the SRAM memory, directly processing the data packet according to the processing mode in the SRAM memory.

If the keywords are matched in the TCAM memory and the matching result is displayed in the SRAM memory to occupy a plurality of TCAM rules occupied by the keywords, continuous address matching needs to be carried out for a plurality of times.

And replacing the last matching address with the existing matching address in the FPGA module and storing the last matching address for comparing with the next matching result.

If the keyword offset position and the ending position meet the set condition, when N x i is not more than the keyword offset position < N (i + 1); the ending position of the keyword is less than or equal to N x j and less than N x (j + 1); where i is 0, 1 … …, i is an integer, fixed for a certain split key, when j is i +2, N × i ≦ key offset position < N × i +1, N × (i +2) ≦ key end position < N (i +3), for the key length M, two sub-matching rules are used:

sub-matching rule 1: m bytes correspond to N × i to N × (i + 2);

sub-matching rule 2: the M bytes correspond to N x (i +1) to N x (i + 3).

The M is determined by TCAM device characteristics and system traffic, and is not limited herein.

The invention simplifies the processing process of the keywords by dividing the keywords, configuring the continuous addresses to the TCAM and judging the matching result. Moreover, when the keywords are cut into the sub-keywords, the length of each sub-keyword is greater than half of the matching length of the TCAM, so that the false hit caused by the over-short sub-keywords is greatly reduced, and the logic implementation and pipeline processing are easy.

Drawings

FIG. 1 is a flow of deep packet inspection by FPGA and TCAM of the present invention.

FIG. 2 is a representation of a matching rule and key for processing keys in accordance with the present invention.

FIG. 3 is another representation of matching rule keys for processing keys in accordance with the present invention.

FIG. 4 is a representation of matching rules and keywords in a preferred embodiment of the present invention for processing keywords.

Fig. 5 is a schematic diagram of payload packet segmentation in accordance with the present invention.

Wherein,

inputting a data packet, matching the load of the data packet by a TCAM, returning the matching result, reading SRAM by using the matching address, returning the content of the SRAM, and outputting the data packet after processing

Detailed Description

The working environment of the method is shown in figure 1. Before the data packet is accessed, firstly, the keywords to be matched are configured into the TCAM by the FPGA, and meanwhile, the data packet processing mode corresponding to the matching rule is configured into the SRAM corresponding to the address. The key words can also be updated during the deep packet inspection of the data packet.

The keyword has two characteristics: offset position, i.e. the value at which the start of the key is offset from the start of the packet payload, and content. When a keyword is configured, if the matching length supported by the TCAM is M, the keyword is divided by the length N being M/2. And dividing the keywords into two types of division and configuration according to the offset position and the length of the keywords.

Type 1: when the offset position and the end position of the keyword at the fixed position satisfy:

the offset position of the keyword is more than or equal to Nx i;

the keyword ending position is less than N (i + 2);

i＝0，1……；

i.e. the situation shown in fig. 2.

At this time, the keyword occupies 1 TCAM rule, the M bytes of the matching rule correspond to N × i to N × (i +2) -1,

i.e. the matching rule x shown in fig. 2.

Type 2: when the offset position and the end position of the keyword at the fixed position satisfy:

the shift position of the keyword is less than or equal to N x i and less than N x (i + 1);

the ending position of the keyword is less than or equal to N x j and less than N x (j + 1);

i＝0，1……，j≥i+2；

i.e., the situation shown in fig. 3, which is referred to as the long key case.

At this time, the keyword occupies i-i TCAM rules, and M bytes of each rule correspond to:

matching rule 1: m bytes correspond to N × i to N × (i + 2);

matching rule 2: m bytes correspond to N x (i +1) to N x (i + 3);

……

matching rules j-i: m bytes correspond to N (j-1) to N (j + 1).

Namely matching rule y-matching rule y + j-i-1 shown in fig. 3.

The i-i matching rules are located in a continuous address space in the TCAM, and the corresponding contents of the SRAM are marked as long keywords, and the SRAM corresponding to the matching rule y and the matching rule y + i-i-1 is marked as the beginning and the end of the long keywords.

Special case of type 2: the situation shown in fig. 4 is a special case of type 2. When j is i +2, i.e.

Shift position of keyword N + i ≦ N +1

The ending position of the keyword is more than or equal to N (i +2) < N (i +3)

i＝0，1……

At this time, even if the length of the keyword is less than M, it cannot be represented by only one matching rule. The two sub-matching rules used are:

matching rule 1: m bytes correspond to N x i to N x (i +2)

Matching rule 2: m bytes correspond to N (i +1) to N (i +3)

Namely matching rule z and matching rule z +1 shown in fig. 4.

Under the segmentation method, the effective length of each segmented sub-keyword is greater than N, so that the miss hit caused by over-short sub-keywords is greatly reduced.

And after the matching rules are successfully written into the TCAM and the SRAM, the deep packet detection of the data packet can be carried out. As shown in the first step of fig. 1, after a data packet is accessed to the FPGA, the data packet needs to be analyzed first, load content of the data packet needing to be filtered is extracted, and then the load is sent to the TCAM for matching in the second step. And step three, returning a matching result by the TCAM. If the matching is successful, the hit result (matching address) is sent to the SRAM in the fourth step for corresponding searching. In the fifth step, the SRAM returns the search result, namely the data packet processing mode. And outputting the data packet from the FPGA in the sixth step after corresponding processing. The processing is realized in a pipeline mode.

In the second step of fig. 1, the load of the data packet needs to be split and assembled according to the format shown in fig. 5, and then sent to the TCAM. The data packet is divided from the initial position of the load according to the length of N bytes, and each two adjacent data blocks are combined into a content of M bytes and are sequentially sent to the TCAM for matching operation. That is, the bytes, except the first N bytes, are matched twice in the TCAM.

In the third step of fig. 1, if the current hit is displayed and the hit result is not the long key word in the fifth step, it indicates that the type 1 key word is hit, and the packet is processed and output according to the processing method in the SRAM.

In the third step of fig. 1, the result of the current hit and the result of the last hit need to be compared, and if the results returned by the two times of matching are hit and the address of the matched rule is increased by 1, it indicates that the adjacent rule is continuously hit. After the fifth step, if the SRAM displays that the head of the long key is hit and then continuously hits the adjacent rule, and finally the SRAM displays that the end of the long key is hit, the long key is hit. And processing and outputting according to the search result of the last SRAM.

According to the scheme, deep packet detection of the data packet under large flow can be realized, and the length of the keyword is not limited.

Claims

1. A deep packet inspection method comprises the steps of,

2) connecting a Static Random Access Memory (SRAM) outside the FPGA module;

2. The method according to claim 1, wherein if the keyword offset position and the end position satisfy the setting condition, when the keyword offset position is greater than or equal to N × i, the keyword end position is less than N × i (i +2), where i is 0, 1 … …, i is an integer, a certain keyword is fixed, N is a keyword length, the keyword occupies a TCAM match, the M-byte length of the matching rule corresponds to N i to N (i +2) -1, and the keyword is processed according to the matching rule.

3. The method according to claim 1, wherein if the keyword offset position and the ending position satisfy the predetermined condition, when N x i ≦ the keyword offset position < N x (i + 1); the ending position of the keyword is less than or equal to N x j and less than N x (j + 1); wherein i is 0, 1 … …, i is integer, fixed for some keyword, j ≧ i +2, N is keyword length, keyword occupy j-i TCAM rule, the keyword is recombined according to matching rule.

4. The deep packet inspection method according to claim 3, wherein the matching rule corresponding to the M bytes of the key is:

sub-matching rule 1: m bytes correspond to N × i to N × (i + 2);

sub-matching rule 2: m bytes correspond to N x (i +1) to N x (i + 3);

……

sub-matching rules j-i: m bytes correspond to N (j-1) to N (j + 1).

5. The method according to claim 1, wherein the data packet load is processed by cutting according to a key length N bytes, and assembling two adjacent N bytes into M bytes, and sending the M bytes into the TCAM memory for matching. Namely:

the first matched M bytes correspond to 0 to N x 2-1 of the load

The M bytes matched for the second time correspond to N x 3-1 of the load

M bytes of the third matching correspond to N x 2 to N x 4-1 of the load

Fragmentation stops to the end of the packet.

6. The method according to claim 1, wherein if the keyword is matched in the TCAM memory and the matching result is not shown in the SRAM memory as a long keyword, the data packet is processed directly according to the processing method in the SRAM memory.

7. The method of claim 1, wherein if the keyword is matched in the TCAM memory and the matching result displayed in the SRAM memory occupies a plurality of TCAM rules, a plurality of consecutive address matching operations are required.

8. The deep packet inspection method of claim 1, wherein the last matching address is replaced with the existing matching address in the FPGA module and saved for comparison with the next matching result.

9. The method according to claim 1, wherein if the keyword offset position and the ending position satisfy the predetermined condition, when N x i ≦ the keyword offset position < N x (i + 1); the ending position of the keyword is less than or equal to N x j and less than N x (j + 1); where i is 0, 1 … …, i is an integer, fixed for a certain split key, when j is i +2, N × i ≦ key offset position < N × i +1, N × (i +2) ≦ key end position < N (i +3), for the key length M, two sub-matching rules are used:

sub-matching rule 1: m bytes correspond to N × i to N × (i + 2);

sub-matching rule 2: the M bytes correspond to N x (i +1) to N x (i + 3).