JP2002077256A - Connection management system using hardware - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve the problem that a high-speed processing is likely to be disturbed, since header processing by hardware in a conventional technique performs the end batch matching of reference data which are made consequently redundant in a reference table, and the redundancy level is increased each time the same host requests a service to a server, and request for increase in the capacity of a register is made. SOLUTION: This connection management system using hardware is provided with a first table 12 registered with first reference data, in which an ID value is applied to IP address set data (a transmission origination IP address and a destination IP address) in the header information of communication data, and a second table 13 registered with TCP port set data (a destination port number and a destination port number) as second reference data, so as to be made to correspond to the ID value. Also, this system is provided with a management control means for which, when the same data as the IP address set data registered in the first table 12 arrive, the second table 13 is made to register the data as new third reference data, by sharing the ID value of the first reference data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a transmission control technique used in a data communication system in a network, and more particularly to a connection management system for processing transmission and reception of communication data by hardware.

[0002]

2. Description of the Related Art In general, as a data communication system using a network, a typical Internet is known as a wide area communication, and a LAN (LAN) constructed in a narrow area such as in the same premises or the same building. local area network)
It has been known. At the head of communication data exchanged between terminals on this network, an IP header and a TCP header are provided, which include information such as the address number of the transmission destination and its own address number. The header information is provided at the head of each packet, and a predetermined process is performed by software each time communication data is fetched. The amount of data communicated has increased year by year, and it has been desired to increase the speed of header processing. However, realizing high-speed processing using only software requires an expensive CPU and corresponding software, and high communication processing was not expected despite high communication costs.

Therefore, it has been considered to realize a high-speed operation by shifting from header processing by software to header processing by hardware matching. When a system for matching by hardware is constructed, the source IP address (I
A connection identified by a set of a PSA), a destination IP address (IPDA), a source port number (TPC SrcP) of a TCP header, and a destination port number (TPC DstP) is collectively handled as one information source. Refer to this connection unit on hardware (matching)
When trying to do so, 96 bits in the IPv4 system, IPv6
The scheme requires at least a 288 bit register. If high-speed processing is expected to some extent in order to construct hardware for realizing these, expensive circuit elements and a complicated circuit configuration are required, and it is expected that the cost will increase considerably.

Therefore, for example, the present applicant has filed Japanese Patent Application No.
In Japanese Patent Publication No. 211351, the destination IP address is replaced with an ID value having a reduced data capacity in the header information of the communication data and stored in the first table, and the ID value and other remaining reference data are grouped into a second table. When the communication data coming from the network is taken in, the destination IP address of the communication data is referred to the first table, and if there is a corresponding ID value, this ID value and the communication data are stored. A header processing method is proposed in which the remaining reference data is referred to as a set, and reference is made to the second table. If the corresponding reference data set is registered, fetching of incoming communication data is permitted.

[0005]

SUMMARY OF THE INVENTION The above-mentioned Japanese Patent Application 2000
In the technology disclosed in Japanese Patent No. 2111351, matching is collectively performed on a reference table even when an ID value is used. When header processing for actually receiving a packet is performed, in such matching processing, the source IP address (IP Src
A), the same IP address pair consisting of the destination IP address (IP DstA) and the source port number (TC
P SrcP), TCP consisting of destination port number (TCP DstP)
A case occurs where the port set data is different.

That is, one of the reference tables is a table of destination IP address (IP DstA) + ID, and the other is a table of ID +
Source IP address (IP SrcA) + source port number (T
Since it is divided into a table of (CP SrcP) + destination port number (TCP DstP), a redundant source IP address (IP SrcA) is also registered each time. This redundancy increases each time the same host requests a service to the server, which requires an increase in the capacity of the register, which may be harmful to realizing high-speed processing. Accordingly, the present invention provides a hardware connection that simplifies the matching process of a redundant portion with respect to header information having a set of redundant IP addresses and realizes high-speed processing when performing header processing by hardware. The purpose is to provide a management system.

[0007]

According to the present invention, in order to achieve the above object, a first IP address set data (source IP address, destination IP address) in header information of communication data is provided with an ID value. A first table for registering reference data, a second table for registering TCP port set data (destination port number, destination port number) in the header information in association with the ID value as second reference data, When the same data as the IP address set data registered in the first table arrives, the ID value of the first reference data is shared, and new third reference data is stored in the second table. The present invention provides a hardware-based connection management system including management control means for registering a connection.

The management control means may determine that the IP address set data of the newly arrived communication data is the same as the IP address set data already registered in the first table and that the TCP port set data is different. An ID register that manages registration / deletion of these TCP port set data with a count value for the ID value when the communication data is received, and the management control means includes a flag indicating registration / deletion in the arriving communication data. A registration / deletion control unit that indicates registration / deletion of the reference data including the IP address set data, the TCP port set data, and the ID value with respect to the first and second tables when the data is included; .

In the connection management system having the above-described configuration, the IP address group data (source IP address: IP SrcA, destination IP address: IP DstA) and the TCP port group data (destination port number: TCP SrcP, destination port number: TCP DstP) and treat them as different information sources. If it is new header information, the separated first and second tables 12 and 13 are separated.
Respectively. Of the header information, the first table 12 stores an IP address set data with an ID value added thereto. The second table 13 stores the ID value in combination with the TCP port set data paired with the IP address set data.

[0010] As a matching process for taking in the communication data arriving after that, a set of IP addresses is referred to the first table 12, and if the corresponding reference data is registered, The ID value is read, the ID value is combined with the TCP port set data, and the matching is performed with reference to the second table 13. If the ID value is applicable, a signal for permitting the capture is output. If there is a flag indicating registration / deletion included in the communication data, the first and second tables 12 and 13 are sent to the system.
It is suggested that the reference data registered in is deleted.

[0011]

Embodiments of the present invention will be described below in detail with reference to the drawings. The concept of the hardware-based connection management system of the present invention will be described. In this system, when communication data to be captured arrives, the header information is converted into IP address group data (source IP address: IP SrcA, destination IP address: IPDst).
A) and TCP port set data (destination port number: TCP Src
P, destination port number: TCP DstP) and treats them as different information sources, and registers them in separate first and second tables (reference tables). That is, of the header information, the first table is registered with an ID value added to the IP address set data. In the second table, the ID value and the TCP port set data paired with the IP address set data are registered in combination.
Then, as a matching process for taking in the communication data arriving thereafter, the IP address set data is referred to the first table, and if the corresponding data is registered, its ID value is read out. ID value and TCP
Matching is performed by referring to the second table in combination with the port set data, and if applicable, a matching signal for permitting the capture is output. Also,
If the IP address set data is the same and the TCP port set data is different, the connection management control unit corresponding to the case, and if the communication data includes a flag indicating the end of communication, the IP address set data, the ID value, A registration / deletion control unit is provided which indicates deletion of the TCP port set data from the table.

FIG. 1 shows an embodiment according to the present invention.
An example of a hardware-based connection management system will be shown and described. This system includes a data input unit 1 for receiving communication data from a network, a header information extracting unit 2 provided in the data input unit 1 and extracting header information from the incoming communication data. The control unit 3 which performs a process of taking in the system, and each item and ID of the taken-in header information
It has a header box section 4 for temporarily storing and associating values with reference, and a table divided into at least two sections as will be described later. Up table 5,
A host computer 6 for receiving the matched communication data and performing predetermined data processing. In the present embodiment, the header box section 4 and the look-up table 5 are provided in the control section 3, but the look-up table 5 is not provided with an external memory or an external CA.
A storage unit such as M may be substituted.

FIG. 2 shows a specific example of the configuration of the control section 3 and will be described. The control section 3 is connected to a header box section 4 and a lookup table 5 via a bus 11. The look-up table 5 has a first stage for performing a two-stage reference process in one header process.
Table 12 and a second table 13. Among them, the first table 12 is individually assigned to the data reference area in which the IP address set data (IPSrcA, IP DstA) extracted from the communication data by the header information extracting unit 2 is stored, and the IP address set data. And a corresponding data storage area in which an ID value as a return value is registered. That is, the ID value indicates the source IP address and the destination IP address.

The second table 13 stores an ID value and a TCP combined by a reference data register 16 described later.
The port set data (TCP SrcP, TCP DstP) includes a data reference area registered via the bus 11 and a data register for registering other data such as flags.

The header box section 4 includes a reference control section 14 and a connection management control section 15.

The reference control unit 14 receives the TCP port set data (destination port number: TCP SrcP, destination port number: TCP DstP) extracted from the communication data by the header information extraction unit 2 and the first table 12 Bus 11
Is associated with an ID value that is a return value returned through
A reference data register 16 for temporarily storing is provided. This associated TCP port set data and ID
The value is transferred to the second table 13 via the bus 11 and registered as reference data, or matching with the registered reference data is performed.

As described above, if a packet is actually received and subjected to header processing, a case may occur where the TCP port set data is different even if the IP address set data is the same in the matching processing. That is, one ID
There will be a plurality of TCP port set data for the value. For this reason, the assigned ID value (IPSrcA, IP D
For stA), the TC registered in the second table 13
It is necessary to manage the number of P port set data.

Therefore, the connection management control unit 15
An ID register 17 that files the number of TCP port set data registered in the second table 13 as a counter value (the number of connections held by the ID value) in association with the ID value
And a registration / deletion control unit 18 for instructing registration or deletion of reference data. The ID register 17 is incremented each time new TCP port set data is registered. However, the initial value is 0. Further, when one piece of TCP port set data which becomes unnecessary according to the flag instruction in the communication data is deleted, the count value is set to 1
Count down. Then, when the count value becomes 0, the IP address set data registered in the first table 12 is also deleted.

Next, the operation of the connection management system of this embodiment will be described with reference to the flowchart shown in FIG.

First, the header information is extracted by the header information extracting unit 2 from the communication data arriving at the data input unit 1 from the network, and the IP address set data is transferred to the first table 12 (step S1). . In the first table 12, it is determined whether the transferred IP address set data is new data, that is, whether the IP address set data is not already registered in the first table 12 (step S).
2).

If the data is not new IP address set data (YES), the IP address set data is registered in the data reference area of the first table 12 (step S).
3), the ID value (count value) is stored in the corresponding data storage area.
0 ") is given (step S4).

Next, the assigned or retrieved ID value as a return value is transferred to the reference data register 16 of the reference control unit 14 and input to the ID register. Of the header information retrieved by the reference data register, Is input (step S5).

At this time, the registration / deletion control unit 18 of the connection management control unit 15 determines whether or not the TCP port set data is new data (new connection).
The determination is made based on the flag information (SYN flag) included in the TCP port set data (step S6). By this determination, T
If the CP port set data is new data (YE
S), the counter corresponding to the ID value given by the ID register 17 is counted up (step S7). At the same time, the ID value and the TCP port set data are registered in the second table 13 in the data reference area (step S8). Then, the output of the matching signal indicates that the acquisition of the communication data is permitted (step S9), and the series of sequences is terminated.

On the other hand, if it is determined in step S6 that there is no SYN flag, that is, if the TCP port set data is not new data (new connection) (NO), it is suggested to delete the corresponding IP address set data and ID value. After that (step S10), a signal to the effect that import is not permitted is output to the host computer 6 or the like (step S1).
1). If so, the sequence ends.

In the determination in step S2,
If the data is new IP address set data (NO), the corresponding ID value is extracted from the corresponding data storage area (step S12). Then, similarly to step S5, after inputting the ID value and the TCP port set data into the reference data register 16 (step S13), whether or not the TCP port set data is a new connection is included in the TCP port set data. The determination is made based on the flag information (SYN flag) (step S14). If it is determined that the TCP port set data is a new connection (YES), the process proceeds to step S7 to count up the counter.
On the other hand, if the connection is not a new connection (NO), reference data including an ID value and TCP port set data is referred to the second table 13 to determine whether or not the connection is registered (step S15).

In this determination, if the reference data is not registered in the second table 13 (NO), a signal to the effect that loading is not permitted is output to the host computer 6 or the like (step S16), and a series of sequences is performed. To end. However, if it is registered in the second table 13 (Y
ES), it is determined whether or not there is flag information (FIN flag) indicating the end (step S17). If there is no FIN flag in this determination (NO), step S
Then, the process proceeds to step 9 to indicate that the acquisition of the communication data is permitted.

However, if there is a FIN flag indicating the end in step S17 (YES), the counter corresponding to the ID value in the ID register 17 is counted down by one (step S18), and the count value is set to 0.
It is determined whether or not has become (step S19). If the count value is not 0 in this determination (NO), it indicates that the corresponding ID value and TCP port set data in the second table 13 are to be deleted from the data reference area (step S20). However, if the count value becomes 0 (YES), it is suggested that the corresponding IP address set data and ID value in the first table 12 be deleted together with the corresponding ID value and TCP port set data (step). S2
1). After suggesting these, it is suggested that the capture of the communication data is permitted (step S22), and the sequence ends.

If a packet for making the next connection arrives after this registration, and if it is new IP address set data, the same processing as described above is performed, and the IP address set data is already registered. Do not perform new registration.

Incidentally, the counter may be embedded in the data register of the second table 13 together with the ID value which is the return value. However, it is necessary to separate and use the ID value and the counter value so that they can be clearly distinguished.

As described above, the present embodiment is suitable mainly for a case where data that can be referred to by a particularly limited number in the data source exists as a part of the reference data. Divide the table and refer to the IP address set data, ID value, and ID
By registering the value and the TCP port set data, the redundant data portion is reduced, the maximum number of bits required for header processing per case is shorter than before, the increase in register capacity is prevented, and Can be implemented by the register used in the first embodiment. In addition, since the comparison process is performed using reference data having a short number of bits, it is possible to increase the speed of the process and prevent an increase in cost.

[0031]

As described above in detail, according to the present invention, when header processing is performed by hardware, header information having a set of redundant IP addresses is
It is possible to provide a hardware-based connection management system that realizes high-speed processing by simplifying a matching process for a redundant portion. This hardware-based connection management system eliminates the need to store redundant information in a table, provides advantages in hardware resources reduction, cost and performance, and furthermore, the final stage of the matching process is divided into two stages, so share,
Functions can be shared, and while improving processing capacity,
System simplification and cost reduction can be realized.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration example of a hardware-based connection management system according to an embodiment of the present invention.

FIG. 2 is a diagram illustrating a specific configuration example of a control unit illustrated in FIG. 1;

FIG. 3 is a flowchart for explaining the operation of the embodiment.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Data input part 2 ... Header information extraction part 3 ... Control part 4 ... Header box part 5 ... Look-up table 6 ... Host computer 11 ... Bus 12 ... First table 13 ... Second table 14 ... Reference control part 15 ... Connection management control unit 16 ... Reference data register 17 ... ID register 18 ... Registration / deletion control unit

Claims (3)

[Claims] 1. An IP in header information of communication data.
A first table for registering first reference data in which an ID value is assigned to address set data (a source IP address and a destination IP address); and a TC in the header information in association with the ID value
P port set data (destination port number, destination port number)
A second table for registering as the second reference data, and when the same data as the IP address set data registered in the first table arrives, share the ID value of the first reference data And a management control means for registering the new reference data in the second table as new third reference data. 2. The management control means according to claim 1, wherein the IP address group data of the newly arrived communication data is the same as the IP address group data already registered in the first table, and the TCP port group data is different. 2. The hardware-based connection management system according to claim 1, further comprising: an ID register that manages registration / deletion of the TCP port set data based on the count value for the ID value in the event of a failure. 3. When the communication data arriving includes a flag indicating registration / deletion, the management control means writes the IP address set data and TCP to the first and second tables. 2. The hardware-based connection management system according to claim 1, further comprising a registration / deletion control unit that suggests registration / deletion of reference data including port set data and ID values.