JP2004040708A - Data filtering apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data filtering apparatus in which high-speed flexible data filtering is performed in a simple configuration. <P>SOLUTION: As a data pattern generating circuit, a counter circuit 33 successively generates pattern data CNT[5:0] corresponding to a position in a data frame synchronously with frame data MRD[7:0] and inputs the pattern data to an address input terminal of a memory 36 together with the frame data MRD[7:0]. As a result, the frame data MRD[7:0] and the pattern data CNT[5:0] are stored in a designated address. Data having a value indicating whether or not the value of the frame data MRD[7:0] fulfills selection conditions are outputted from the memory 36. Based upon the data value, a judging circuit 40 judges whether or not the inputted data frame is to be outputted. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a data filtering device, and more particularly, to a data filtering device that selectively outputs an input data frame.
[0002]
[Prior art]
In recent communication systems, data communication is performed using data blocks called data frames as basic units. Such a data frame is configured according to a communication protocol (hereinafter, simply referred to as “protocol”) and has a complicated structure. For this reason, in a communication device connected to a communication network, a data filtering function for selecting a necessary data frame from various data frames transmitted in the communication network is an essential function.
[0003]
The data filtering function as described above is always implemented in, for example, a media access control (MAC) controller of a personal computer for a communication terminal, a relay device such as a router, and a device for improving security such as a firewall. Have been. In a protocol analyzer used for investigating a failure or performance of a communication network or a device called an RMON (Remote Network Monitoring) probe, it is necessary to select a data frame according to various conditions at that time. Therefore, a general-purpose data filtering function capable of performing various data filtering is implemented.
[0004]
In order to realize such a data filtering function, various technologies have been conventionally proposed. Such conventional proposal technologies are roughly classified into a software system and a hardware system.
[0005]
In the software system, a method of realizing various types of data filtering functions by executing a data filtering algorithm by a program is generally used. On the other hand, in the hardware system, a method of realizing a data filtering function using a dedicated LSI (Large Scale Integrated Circuit) using an ASIC (Application Specific Integrated Circuit) technique is generally used. In recent years, such a hardware system generally uses a special memory called a CAM (Content Address Memory) that prepares an exclusive OR (Exclusive OR) for each memory cell on a one-to-one basis. Has become.
[0006]
[Problems to be solved by the invention]
As described above, in the realization of the data filtering function by the conventional software method, since the data filtering algorithm is executed by a program, it is easy to change or modify the algorithm, and the data filtering device has high versatility and flexibility. Can be provided. However, data filtering by executing a program requires a certain amount of time for the data filtering process, and is not suitable for data frames transmitted at high speed.
[0007]
For this reason, in view of the increase in transmission speed in recent local area network (Local Area Network) transmission standards, which are evolving in the order of 10 Mbps → 100 Mbps → 1 Gbps → 10 Gbps, the data filtering by the software method requires the transmission speed. It is difficult to appropriately cope with the speeding up of the system. In addition, even if the data frame is transmitted at a relatively low transmission rate, if the data filtering conditions are complicated, the data filtering process requires a long time. On the other hand, a situation may occur in which the data filtering process cannot be performed in time.
[0008]
On the other hand, when realizing a data filtering function by a conventional hardware method, a data filtering algorithm is executed by a hardware circuit. For this reason, the data filtering processing speed is remarkably faster than the above-mentioned software method, and there is no possibility that the data filtering processing cannot keep up with the transmission of the data frame. However, the number of data filtering algorithms that can be implemented is limited, and it is difficult to flexibly respond to changes and modifications.
[0009]
In addition, when the above-described CAM is used in the conventional hardware system, flexibility in changing or modifying the data filtering algorithm is improved, but the CAM is not a general-purpose memory and is not easily available. . Also, when data filtering is performed under relatively complicated conditions, a large-scale circuit configuration is required.
[0010]
The present invention has been made in view of the above circumstances, and has as its object to provide a data filtering device capable of performing high-speed and flexible data filtering with a simple configuration.
[0011]
[Means for Solving the Problems]
The data filtering device according to the present invention is a data filtering device for selectively outputting an input data frame, wherein pattern data corresponding to a position in the data frame is sequentially generated in synchronization with input of the data at the specific position. A data pattern generating circuit for inputting the data of the data frame and the pattern data generated by the data pattern generating means from an address input terminal, and corresponding to the data value at each position in the data frame and the position in the data frame. A rewritable memory that outputs data indicating whether a data value at each position in the data frame satisfies a selection output condition of the data frame, stored at an address determined by a pattern data value; Was Based on over data value, the decision circuit and determines whether to output the data frame the input; a data filtering apparatus comprising a.
[0012]
This data filtering device performs data filtering selectively transmitting a data frame according to a data value of specific information included in the data frame such as a source address and a destination address. In this data filtering process, in this data filtering device, the data pattern generating circuit sequentially generates pattern data corresponding to the position in the data frame in synchronization with the input of the data at the specific position. The pattern data generated by the data pattern generation circuit is input to a part of the address input terminal of the memory. The data of the data frame is input to another part of the address input terminal of the memory.
[0013]
When the data of the data frame and the pattern data corresponding to the position in the data frame are input to the address input terminal, the received data stored in the address corresponding to the value of the data at the position and the value of the pattern data corresponding to the position are received. Data having a data value indicating whether the value of the data at the specific position satisfies the selection condition is output from the memory. Thus, based on the data value output from the memory, the determination circuit determines whether to output the input data frame.
[0014]
Therefore, the data filtering device of the present invention can perform data filtering processing flexibly corresponding to various data filtering algorithms by rewriting data stored in the memory as needed. Therefore, according to the data filtering device of the present invention, a general-purpose data filtering device capable of performing high-speed and flexible data filtering with a simple configuration using a general-purpose memory and setting many filtering conditions Can be realized.
[0015]
In the data filtering device of the present invention, the data pattern generating circuit may be provided with, for example, a counter circuit. In such a case, different pattern data can be easily generated according to each position in the data frame.
[0016]
Further, in the data filtering device of the present invention, the data pattern generation circuit may be configured to generate a plurality of types of pattern data in time sequence according to positions in the data frame. In such a case, for each of the plurality of types of pattern data generated by the data pattern generation circuit in accordance with each position in the data frame, it may be determined whether or not the selection output conditions of a plurality of different data frames are satisfied. it can. That is, a plurality of data filtering processes can be performed in a time-division manner in synchronization with the input of the data frame.
[0017]
Further, in the data filtering device of the present invention, the memory outputs a plurality of bits of data in parallel, and the memory determines whether or not the memory satisfies a different output selection condition of the data frame according to each of the plurality of bits. May be stored. In such a case, a plurality of data filtering processes can be performed in a parallel processing type in synchronization with the input of the data frame.
[0018]
Further, in the data filtering device of the present invention, a data width conversion circuit for converting the data of the data frame sequentially input with a first bit width into a data string of a second bit width and outputting the data stream to the memory is provided. Further, a configuration may be provided. For example, when the transmission path is a serial transmission path, the first bit width is “1”. However, when the input width of frame data to the memory, that is, the second bit width is a plurality of bit widths, the data width is “1”. A serial-parallel converter can be used as the width conversion circuit. In such a case, even if the data frame is transmitted at a high transmission rate, a circuit that satisfies the access time of the memory can be easily configured by increasing the second bit width. If the number of address input terminals becomes insufficient in one memory by increasing the second bit width, a plurality of memories are arranged in parallel, and the second input is provided to the address input terminals of the plurality of memories. Can be input in parallel. In this case, a combinational logical value (for example, a logical product value) of bit data values output from each of the plurality of memories and related to the same filtering condition may be calculated by the determination circuit.
[0019]
Further, the data filtering device of the present invention may further include a data writing device that writes predetermined data into the memory. In such a case, the data filtering algorithm can be easily changed or modified by rewriting the data in the memory by the data writing device as needed. Therefore, the versatility and flexibility of the data filtering process can be improved.
[0020]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to FIGS.
[0021]
FIG. 1 is a block diagram showing a schematic configuration of a data filtering device 100 according to an embodiment of the present invention. The data filtering device 100 receives a data frame transmitted on the first Ethernet (registered trademark) LAN 1 and selectively directs only a data frame that meets a predetermined condition to the second Ethernet LAN 2. The transmitting device.
[0022]
Here, as shown in FIG. 2, the contents of the data frame include a reception (destination) address of 6 bytes (48 bits), a transmission (source) address of 6 bytes (48 bits), and 2 bytes (16 bits). , An arbitrary length (up to 1500 bytes) of data, and 4 bytes (32 bits) of FCS (frame check sequence). In some cases, an extension of a maximum of 448 bytes is added.
[0023]
In the following description, bit numbers included in a plurality of bits of data and addresses are continuous, and if it is necessary to specify the range of the bit numbers, the bit numbers X to Y (X In order to show that <Y), the notation [Y: X] is added after the code. In each bit of the data signal and the address signal, the signal level is “H (high level)” and is logic “1”, and “L (low level)” is logic “0”. In other control signals, the signal level is “H (high level)” and significant, and “L (low level)” is insignificant.
[0024]
As shown in FIG. 1, the data filtering apparatus 100 includes a receiving physical layer circuit 10R, a receiving MAC controller 12R, a filtering circuit 14 for executing a filtering algorithm, a frame buffer 16, a basic timing generation circuit 18, a data filtering A processing device 20 for controlling the device 100 is provided. Here, a display device 22 such as a CRT display device or a liquid crystal display device, and an input device 24 such as a keyboard and a mouse are connected to the processing device 20. Further, the data filtering device 100 includes a transmission physical layer circuit 10D and a transmission MAC controller 12D.
[0025]
The receiving physical layer circuit 10R includes a receiver circuit, receives a data signal NRD transmitted through a transmission medium (a coaxial cable or the like) of the first Ethernet LAN 1, performs bit synchronization, and performs a bit-serial receiving physical layer. Generates and outputs data PRD. A commercially available Ethernet driver / receiver can be used as the receiving physical layer circuit 10R.
[0026]
The reception MAC controller 12R receives the reception physical layer data PRD, synchronizes the frames, and outputs the frame data bytes as reception MAC data MRD [7: 0]. That is, the reception MAC controller 12R removes the flag pattern portion indicating the beginning and end of the frame from the reception physical layer data PRD input in the bit serial format, and then converts the frame data bytes in the byte serial format into the reception MAC data. Output as MRD [7: 0]. Here, when the frame synchronization is established, the reception MAC controller 12R notifies the basic timing generation circuit 18 that the frame has been received by setting the frame reception signal FDR to significant ("H"). Then, in synchronization with the MAC data read signal FRD supplied from the basic timing generation circuit 18, the received MAC data MRD [7: 0] is sequentially output. Here, the MAC controller 12 of the present embodiment outputs frame data in a format as shown in FIG. 2 in the order of reception (that is, sequentially from the upper 8 bits of the reception address) in response to the MAC data read signal FRD.
[0027]
The filtering circuit 14 receives the reception MAC data MRD [7: 0] and determines whether the input reception MAC data MRD [7: 0] includes a predetermined filtering condition, for example, a predetermined destination address. Detect every time. Then, for a data frame that satisfies the filtering condition, the fact that it should be transmitted to the second Ethernet LAN 2 is notified by a frame data transmission command signal FMS, and for a data frame that does not satisfy the filtering condition, the frame data is discarded. This is notified by a frame data discard command signal FMR. The configuration of the filtering circuit 14 will be described later.
[0028]
The frame buffer circuit 16 is a fast-in / fast-out (FIFIO) type data buffer, and receives and temporarily stores 8-bit wide reception MAC data MRD [7: 0]. In response to the frame data transmission command signal FMS or the frame data discard command signal FMR from the filtering circuit 14, the frame buffer circuit 16 makes the temporarily stored frame data available for output or discards it. When the frame buffer circuit 16 receives the frame data transmission command signal FMS and is ready to output frame data, it outputs a data ready signal DTR to the basic timing generation circuit 18. Here, data writing to the frame buffer circuit 16 is performed according to a frame buffer write signal FBI generated by the basic timing generation circuit 18. Data is read from the frame buffer circuit 16 in accordance with a frame buffer read signal FBO generated by the basic timing generation circuit 18.
[0029]
The transmission MAC controller 12D sequentially receives the transmission frame data SMD [7: 0] having an 8-bit width output from the frame buffer circuit 16. The transmission MAC controller 12D recognizes the start and end of the frame data based on the transmission frame data period signal FDP supplied from the basic timing generation circuit 18, and transmits the transmission frame data document supplied from the basic timing generation circuit 18. The transmission frame data SMD [7: 0] output from the frame buffer 16 is read in a byte serial format in accordance with the input signal FDW. Then, after adding a flag pattern portion indicating the beginning and end of the frame data, the transmission physical layer data PRD is output in a bit serial format.
[0030]
The transmission physical layer circuit 10D includes a driver circuit, and converts bit serial transmission physical layer data PSD into a signal suitable for a signal to be transmitted on a transmission medium (a coaxial cable or the like) of the second Ethernet LAN2. Then, the data is output to the transmission medium of the second Ethernet LAN 2. Note that a commercially available Ethernet driver / receiver can be used as the transmission physical layer circuit 10D.
[0031]
The basic timing generation circuit 18 generates the above-described MAC data read signal FRD and frame buffer write signal FBI according to the frame reception signal FDR from the reception MAC controller 12R. Further, the basic timing generation circuit 18 generates the above-described frame buffer read signal FBO, transmission frame data period signal FDP, and transmission frame data write signal FDW according to the data output enable signal DTR from the frame buffer circuit 16. Further, the basic timing generation circuit 18 generates a bit synchronization clock CLK0, which is a timing signal for operating the filtering circuit 14, and a filtering operation period signal FLP. Note that the basic timing generation circuit 18 can be configured as a state machine.
[0032]
The processing circuit 20 includes a microprocessor and its peripheral circuits, and controls the entire data filtering device 100. Further, the processing circuit 20 writes data according to the data filtering condition input from the input device 24 into a memory 36 of the filtering circuit 14 described later. In writing the data, the processing circuit 20 includes a memory address FLA (FLA [13: 0]) having a 14-bit width, memory data FLD (FLD [7: 0]) having a 8-bit width, a memory write signal FLW, and a memory write signal FLW. The write mode signal FLS is supplied to the filtering circuit 14. Further, the processing circuit 20 outputs a filtering execution instruction signal FLT to the basic timing generation circuit 18 in accordance with the filtering execution instruction input from the input device 24.
[0033]
Further, the processing circuit 20 receives the transmission frame data SMD output from the frame buffer circuit 14 and displays it on the display device 22.
[0034]
As shown in FIG. 3, the filtering circuit 14 includes (a) a memory 36 and (b) a selector circuit 34 and a selector circuit 35 for selecting a signal to be input to an address input terminal AD [13: 0] of the memory 36. And (c) outputting the memory data FLD (FLD [7: 0]) from the processing circuit 20 to the data terminal DT [7: 0] of the memory 36 when the output enable terminal OE is at “H”. And a state output circuit 37. Further, the filtering circuit 14 (d) divides the bit synchronization clock CLK0 received from the basic timing generation circuit 18 and generates a byte synchronization clock having a cycle eight times as long as the bit synchronization clock CLK0. (E) an AND circuit 32 that outputs the byte synchronization clock output from the frequency divider 31 as the clock CLK1 only when the filtering operation period signal FLP received from the basic timing generator 18 is significant (“H”). (F) reset when the filtering operation period signal FLP is insignificant ("L") and count the number of byte synchronization clocks input when the filtering operation period signal FLP is significant ("H"). A counter circuit 33 for outputting the number from the output terminal as 6-bit width data. Further, the filtering circuit 14 includes (g) a determination circuit 40 that receives the data FDT [7: 0] output from the memory 36 and determines whether the filtering condition is satisfied.
[0035]
The memory write signal FLW output from the processing circuit 20 is input to the write signal terminal WE of the memory 36. The memory write mode signal FLS output from the output enable terminal OE processing circuit 20 of the three-state output circuit 37 is input.
[0036]
In the selector circuit 34, the count number data output from the counter circuit 33 is input to the input terminal A [5: 0] selected when the output selection terminal S of the selector circuit 34 is “L”. The memory address FLA [13: 8] output from the processing circuit 20 is input to the input terminal B [5: 0] selected when the output selection terminal S of the selector circuit 34 is “H”. When the memory write mode signal FLS output from the processing circuit 20 is insignificant (“L”), the count number data is output from the selector circuit 34 and the address input terminals AD [13: 8] of the memory 36 are output. ]. On the other hand, when memory write mode signal FLS is significant (“H”), memory address FLA [13: 8] is output from selector circuit 34 and input to address input terminal AD [13: 8] of memory 36. I do.
[0037]
In the selector circuit 35, the reception MAC data MRD [7: 0] output from the reception MAC controller 12R to the input terminal A [7: 0] selected when the output selection terminal S of the selector circuit 35 is “L”. ] And the memory address FLA [7: 0] output from the processing circuit 20 is input to the input terminal B [7: 0] selected when the output selection terminal S of the selector circuit 35 is “H”. are doing. When the memory write mode signal FLS output from the processing circuit 20 is insignificant (“L”), the received MAC data MRD [7: 0] is output from the selector circuit 34 and the address input to the memory 36 is performed. Input to terminal AD [7: 0]. On the other hand, when the memory write mode signal FLS is significant (“H”), the memory address FLA [7: 0] is output from the selector circuit 34 and input to the address input terminal AD [7: 0] of the memory 36. I do.
[0038]
As shown in FIG. 4, the determination circuit 40 includes (i) an individual determination circuit 41 provided for each of the data FDT7 to FDT0. ₇ ~ 41 ₀ And (ii) the individual determination circuit 41 ₇ ~ 41 ₀ And a logical sum circuit 46 for calculating the logical sum of the individual determination results FLR7 to FLR0 output from and calculating the overall determination result. Further, the determination circuit 40 performs (iii) a filtering operation for generating a first operation end signal FPL1 and a second operation end signal FPL2 that are temporarily and temporarily significant (“H”) before and after the end of the filtering operation period. An end signal generation circuit 49; and (iv) a sampling circuit 47 that samples and holds a comprehensive determination result as to whether or not the filtering condition output from the OR circuit 46 is satisfied in synchronization with the first frame end signal FPL1. It has. The determination circuit 40 calculates (v) the logical product of the normal rotation output output from the normal rotation output terminal Q of the sampling circuit 47 and the second frame end signal FPL2 to generate the frame data transmission command signal FMS. A logical product circuit 48S to be generated, and (vi) an inverted output terminal Q of the sampling circuit 47. ^* And an AND circuit 48R that calculates the logical product of the inverted output output from the second and the second frame end signal FPL2 to generate the above-mentioned frame data discard command signal FMS.
[0039]
In this embodiment, a D-type flip-flop element of a rising edge trigger type is used as the sampling circuit 47.
[0040]
The individual determination circuit 41 _j (J = 0 to 7) are respectively: (a) a sampling circuit 43 that samples and holds data input to the data input terminal D in synchronization with the above-described byte synchronization clock CLK1; An AND circuit 42 that calculates the logical product of the non-inverted output output from the inverted output terminal Q and the memory data FDTj and outputs the result to the data input terminal D of the sampling circuit 43.
[0041]
In this embodiment, a D-type flip-flop element of the falling edge trigger type is used as the sampling circuit 43. Further, the filtering operation period signal FLP is input to the preset terminal S of the sampling circuit 43. When the filtering operation period signal FLP is insignificant ("L"), the filtering operation period signal FLP is significant ("H"). ), The output value of the preset terminal S is initialized to "H (logical" 1 ")".
[0042]
Next, the operation of the data filtering device 100 configured as described above will be described. In the following description, a case will be described in which, of the data frames in the first Ethernet LAN 1, a data frame having a predetermined one destination address RA is selectively transmitted to the second Ethernet LAN2. Here, the 6-byte value of the destination address RA as the filtering condition is (RA ₀ , RA ₁ , RA ₂ , RA ₃ , RA ₄ , RA ₅ ). Each byte RA of the destination address RA ₀ ~ RA ₅ Suffixes 0 to 5 correspond to the order of reception at the input from the first Ethernet LAN 1. Further, in the following description, when a plurality of bits of an address value or a data value is expressed, hexadecimal notation is used in units of 4 bits. _H ".
[0043]
It is assumed that the data filtering device 100 is in the initial state and has not started the data filtering operation. That is, it is assumed that the processing circuit 20 makes the filtering execution instruction signal FLT, the memory write mode signal FLS, and the memory write signal FLW insignificant (“L”). Although the basic timing generation circuit 18 generates the bit synchronization clock CK0, the filtering operation period signal FLP, the MAC data read signal FRD, the frame buffer write signal FBI, the frame buffer read signal FBO, the transmission frame data period signal It is assumed that the FDP and the transmission frame data write signal FDW are insignificant (“L”).
[0044]
Since there is only one filtering condition as described above, the filtering operation is performed using only the memory data bit FDT0.
[0045]
In this state, when the destination address RA is specified as a filtering condition from the input device 24, the processing circuit 20 writes data reflecting the filtering condition to the memory 36 in the filtering circuit 14. In writing such data, first, the processing circuit 20 sets the memory write mode signal FLS to significant ("H"), as shown in FIG. Subsequently, the processing circuit 20 sets the memory address FLA [13: 0] to “0000”. _H "To" 3FFF _H While sequentially changing the memory data FLD [7: 0] to “00”. _H , The memory write signal FLW is temporarily made significant (“H”), so that the data “00” _H Is written to the memory 36. As a result, the data values of all addresses in the memory 36 become “00”. _H Is set to
[0046]
Next, the processing circuit 20 sets the memory address FLA [13: 0] to “0k00” as shown in FIG. _H + RA _k (K = 1 to 6) ”, the memory data FLD [7: 0] is changed to“ FF ”. _H By temporarily making the memory write signal FLW significant, the data "01" _H Is written to the memory 36. Subsequently, the processing circuit 20 sets the memory address FLA [13: 0] to “0700 _H "To" 3FFF _H While sequentially changing the memory data FLD [7: 0] to “01”. _H By temporarily making the memory write signal FLW significant, _H Is written to the memory 36. When the data reflecting the filtering condition in the memory 36 is thus written, the processing circuit 20 sets the memory write mode signal FLS to “L”.
[0047]
After the data reflecting the filtering condition is written in the memory 36, when the start of filtering is designated from the input device 24, the processing circuit 20 sets the filtering execution instruction signal FLT to significant ("H"). As a result, a data filtering operation for selectively transmitting, to the second Ethernet LAN 2, a data frame having one predetermined destination address RA from among the data frames in the first Ethernet LAN 1 is started. That is, the filtering process period by the hardware circuit is started.
[0048]
During such a filtering processing period, when a data frame transfer is performed on the first Ethernet LAN and a data frame signal is generated on the Ethernet transmission medium, the receiving physical layer circuit 10R converts the data frame signal into the input data signal NRD. As received. The receiving physical layer circuit 10R performs bit synchronization according to the physical layer protocol, and detects the data value (“0” or “1”) of each bit of the received data frame. Then, the reception physical layer circuit 10 outputs the detection result as reception physical layer data PRD to the reception MAC controller 12R.
[0049]
The receiving MAC controller 12R, which has received the receiving physical layer data PRD, performs frame synchronization and decoding according to the MAC layer protocol and performs frame reconstruction according to the MAC layer protocol. Then, the receiving MAC controller 12R stores the reconstructed frame data in the built-in data buffer.
[0050]
When the storing of the frame data in the built-in buffer is completed as described above, the receiving MAC controller 12R sets the frame reception signal FDR to significant (“H”) and sends the frame reception signal to the basic timing generation circuit 18 as shown in FIG. , That the frame data is ready to be output. When detecting that the frame reception signal FDR has become significant, the basic timing generation circuit 18 makes the filtering operation period signal FLP significant (that is, “H”). When receiving the frame reception signal FDR, the basic timing generation circuit 18 temporarily sets the MAC data read signal FRD to significant (“H”), and permits the reception MAC controller 12R to output the frame data. Receiving the MAC data read signal FRD, the receiving MAC controller 12R outputs the first byte MD {0} of the frame data as the received MAC data [7: 0].
[0051]
While the first 1-byte MD {0} is being output, the basic timing generation circuit 18 temporarily sets the frame buffer write signal FBI to significant (“H”). As a result, the first 1-byte MD {0} is stored in the frame buffer circuit 16.
[0052]
Thereafter, the remaining frame data bytes MD {1} to MD {N-1} of one frame in the built-in buffer of the reception MAC controller 12R are sequentially read, and the frame reception signal FDR is insignificant (“L”). Until the basic timing generation circuit 18 outputs the MAC data read signal FRD and the frame buffer write signal FBI. Thus, the received frame data bytes MD {0} to MD {N−1} for one frame are stored in the frame buffer circuit 16.
[0053]
On the other hand, the frame data bytes MD {0} to MD {N−1} output from the receiving MAC controller 12R are also input to the filtering circuit 14. Then, in the filtering circuit 14, the frame data bytes MD {0} to MD # 3F in a period in which the filtering operation period signal FLP is significant ("H"), that is, in the filtering operation period. _H 8 are sequentially input to the address terminals A [7: 0] of the memory 36 via the selector circuit 35 in a byte serial manner, as shown in FIGS. FIG. 8 shows that the frame data byte MD {1} has the value RA. ₁ 6 is a timing chart showing an operation of the filtering circuit 14 when the filtering condition is not satisfied because the filtering condition is not satisfied. FIG. 9 shows that the frame data byte MD {j (j = 0 to 5)} has the value RA. _j 9 is a timing chart showing the operation of the filtering circuit 14 when the filtering condition is satisfied.
[0054]
These frame data bytes MD {0} to MD # 3F _H As shown in FIGS. 8 and 9, the 6-bit counter circuit 33 counts up by the byte synchronization clock CK1 in synchronization with the sequential input of #. This count-up is performed because the counter circuit 33 is preset in a period in which the filtering operation period signal FLP is insignificant (“L”), so that the count value is “3F”. _H ". Then, it is incremented by 1 each time the byte synchronization clock CK1 rises. As a result, the frame data byte MD @ m (m = 0-3F) _H The count value m is output from the counter circuit 33 in synchronism with｝, and is sequentially input to the address terminals A [13: 8] of the memory 36 via the selector circuit 34.
[0055]
Thus, "m00" is applied to the address terminal A [13: 0] of the memory 36. _H + MD {m} ”are sequentially input. Then, the address “m00” of the memory 36 _H + MD {m} ”is output as the memory data FDT [7: 0], and the individual determination circuit 41 based on the value of each bit FDTj (j = 0 to 7). _j Each of the individual judgment circuits 41 _j It is determined whether or not satisfies the filtering condition to be determined. As described above, since only the memory data bit FLD0 is used in the current filtering operation, the following description will be made focusing on only the memory data bit FLD0.
[0056]
First, when the first frame data byte MD {0} is received, the first frame data byte MD {0} has the value RA. ₀ , The address “0000” _H + RA ₀ "01 _H Is output from the memory 36. On the other hand, the first frame data byte MD {0} has the value RA ₀ If not, the address "0000 _H + MD {0} " _H Is output from the memory 36. The value of the memory data FDT0 output in this way is _j In the above, after passing through the AND circuit 42, it is sampled and held in the sampling circuit 43. As a result, the individual determination circuit 41 _j The determination result of whether or not the frame byte MD {0} satisfies the filtering condition is held and output to the sampling circuit 43 of.
[0057]
Here, when the determination result is affirmative, an “H” level individual determination result signal FLR0 is output from the output terminal Q of the sampling circuit 43. If the determination result is negative, an “L” level individual determination result signal FLR0 is output from the output terminal Q of the sampling circuit 43. FIGS. 8 and 9 show an example in which a positive determination result is made at this stage.
[0058]
Subsequently, when the second frame data byte MD {1} is received, the first frame data byte MD {1} has the value RA. ₁ , The address “0100 _H + RA ₁ "01 _H Is output from the memory 36. On the other hand, the second frame data byte MD {1} has the value RA ₁ If not, the address "0100 _H + MD {1} ”stored in the data“ 00 ” _H Is output from the memory 36. The logical product of the output value of the memory data FDT0 and the holding result in the sampling circuit 43 at the time of the first frame data byte MD {0} is calculated by the logical product circuit 42 and sampled in the sampling circuit 43. Is held. As a result, the sampling circuit 43 holds and outputs a determination result as to whether or not both the frame byte MD {0} and the frame data byte MD {1} satisfy the filtering condition.
[0059]
Here, when the determination result is affirmative, an “H” level individual determination result signal FLR0 is output from the output terminal Q of the sampling circuit 43. If the determination result is negative, an “L” level individual determination result signal FLR0 is output from the output terminal Q of the sampling circuit 43. FIG. 8 shows an example in which a negative determination result is made at this stage. FIG. 9 shows an example in which a positive determination result is made at this stage as well.
[0060]
Thereafter, a new frame data byte MD # n (n = 03) _H ~ 3F _H Each time｝ is received, the logical product of the value of the output memory data FDT0 and the result sampled and held by the sampling circuit 43 up to that time is calculated by the logical product circuit 42. Sampled and retained. Thus, the sampling circuit 43 includes the frame bytes MD {0} to {3F _H The determination result as to whether or not all of｝ satisfy the filtering condition is held.
[0061]
Here, when the determination result is affirmative, an “H” level individual determination result signal FLR0 is output from the output terminal Q of the sampling circuit 43. If the determination result is negative, an “L” level individual determination result signal FLR0 is output from the output terminal Q of the sampling circuit 43. FIG. 8 shows an example in which a negative determination is made at the stage of the frame data byte MD {1}, and then a negative determination is made continuously thereafter. FIG. 9 shows all the frame data bytes MD # 1 to # 3F _H 例 shows an example in which a positive determination is made.
[0062]
As described above, when the filtering operation for a predetermined number of bytes (64 bytes in the present embodiment) is completed for the received frame data, the basic timing generation circuit 18 sets the filtering operation period signal FLP to insignificant ( "L"). The filtering operation end signal generation circuit 49 temporarily makes the first operation end signal FPL1 significant ("H") so as to straddle the falling point of the filtering operation period signal FLP. At the time when the first operation end signal FPL1 rises, the value of the comprehensive judgment result signal FLR output from the OR circuit 46 is sampled by the sampling circuit 47, and the sampled value is held and output.
[0063]
Thereafter, the filtering operation end signal generation circuit 49 temporarily sets the second operation end signal FPL2 to significant ("H"). When the filtering condition is satisfied in synchronization with the second operation end signal FPL2, a frame data transmission command is output to the frame buffer circuit 16 by the frame data transmission command signal FMS. If the filtering condition is not satisfied, a frame data discard command is output to the frame buffer circuit 16 by the frame data discard signal FMR. FIG. 8 shows an example in which the filtering condition is not satisfied and the frame data discard command signal FMR is output. FIG. 9 shows an example in which the filtering condition is satisfied and the frame data transmission command signal FMS is output.
[0064]
When the frame data discard command is notified from the filtering circuit 14 to the frame buffer circuit 16 as a result of the determination regarding the filtering condition, the frame buffer circuit 16 discards the data frame corresponding to the result of the determination. On the other hand, when the frame data transmission command signal FMS is notified from the filtering circuit 14 to the frame buffer circuit 16 as a determination result regarding the filtering condition, the frame buffer circuit 16 prepares for transmission of a data frame corresponding to the determination result. .
[0065]
Then, when the data frame to be transmitted is ready, as shown in FIG. 10, the frame buffer circuit 16 outputs the first frame data byte SD {0} as the transmission frame data SMD [7: 0]. At the same time, the presence of data to be transmitted is notified to the basic timing generation circuit 18 by making the data ready signal DTR significant (“H”). When detecting that the data ready signal DTR has become significant, the basic timing generation circuit 18 notifies the transmission MAC controller 12D that the transmission frame data period signal FDP is significant (“H”).
[0066]
Next, the basic timing generation circuit 18 makes the transmission frame data write signal FDW temporarily significant ("H") and writes the first frame data byte SD {0} into the internal buffer of the transmission MAC controller 12D. Subsequently, the basic timing generation circuit 18 makes the frame buffer read signal FBO temporarily significant (“H”), and outputs the second frame data byte SD {1} as transmission frame data SMD [7: 0]. .
[0067]
Thereafter, the basic timing generation circuit 18 sequentially makes the transmission frame data write signal FDW and the frame buffer read signal FBO temporarily significant, and writes the frame data bytes into the internal buffer of the transmission MAC controller 12D. Thus, when all the frame data is written into the internal buffer of the transmission MAC controller 12D and the data of the data frame in the frame buffer circuit 16 becomes empty, the frame buffer circuit 16 changes the data ready signal DTR to insignificant (" L "). When detecting that the data ready signal DTR has become insignificant, the basic timing generation circuit 18 sets the transmission frame data period signal FDP to be insignificant (“L”) and sends the data of the transmission data frame to the transmission MAC controller 12D. Notify the end.
[0068]
Receiving the data end notification, the receiving MAC controller 12D forms a data frame including the data received from the frame buffer circuit 16, and then outputs a bit-serial transmission physical layer signal PSD. The transmission physical layer signal PSD is converted by the transmission physical layer circuit 10D into a signal suitable for a signal to be transmitted on a transmission medium (a coaxial cable or the like) of the second Ethernet LAN2, and is converted into a signal suitable for the second Ethernet LAN2. Is output to the transmission medium.
[0069]
As described above, in the present embodiment, data filtering that selectively transmits a data frame is performed according to the data value of specific information included in the data frame, such as a source address and a destination address. In such data filtering processing, in the data filtering device 100 of the present embodiment, the counter circuit 33 as a data pattern generating circuit sequentially generates pattern data corresponding to a position in a data frame in synchronization with input of data at a specific position. , Together with the data of the data frame, to the address input terminal of the memory 36. As a result, whether the value of the frame data MRD [7: 0] and the pattern data CNT [5: 0] is data stored at the specified address and the value of the frame data MRD [7: 0] satisfies the selection condition is satisfied. Data having a value indicating whether or not the data is output from the memory 36. Then, based on the data value, the determination circuit 40 determines whether to output the input data frame.
[0070]
Therefore, in the data filtering device 100 of the present embodiment, by appropriately setting the data stored in the memory 36, the data filtering processing is performed by hardware processing in accordance with a desired data filtering algorithm. Therefore, according to the data filtering device of the present invention, it is possible to perform high-speed and flexible data filtering with a simple configuration using a general-purpose memory.
[0071]
In the above-described embodiment, the filtering condition is one condition having one predetermined destination address. However, a plurality of conditions having one of eight or less predetermined destination addresses may be set. Can be. In such a case, the data may be stored in the memory 36 so that one filtering condition is assigned to each of a plurality of bits of the memory data bits. As a result, the individual determination circuit corresponding to the memory data bit to which the filtering condition is assigned determines each of the plurality of filtering conditions, and when any one of the filtering conditions is satisfied, the fact is obtained as a comprehensive determination result. Can be.
[0072]
Further, the filtering condition is not limited to the destination address, and may be a source address, a type, or the like, or may be a combination of the destination address, the source address, the type, and the like.
[0073]
In the above embodiment, whether or not the filtering condition is satisfied is checked for the first 64 bytes in the data frame. However, whether or not the filtering condition is satisfied for an arbitrary number of bytes is checked. be able to. In such a case, the number of output count bits in the counter circuit 34, the capacity of the memory 36 (the number of address input terminals), and the like may be adjusted from the configuration of the above embodiment. Furthermore, it is also possible to check whether or not the filtering condition is satisfied at the positions of the data frames different from each other for each bit of the output data of the memory 36.
[0074]
Further, in the above embodiment, the number of bits of the frame data input to the address input terminal of the memory is set to 8, but may be set to another bit number such as 16 or 32. In such a case, the capacity (the number of address input terminals) of the memory 36 may be adjusted. Note that a commercially available MAC controller that matches the number of bits of the frame data input to the address input terminal of the memory can be used as the receiving MAC controller 12R.
[0075]
Also, the number of data bits of the transmission data frame to be input to the transmission MAC controller 12D is not limited to eight, but may be another bit number such as 16 or 32. Even in such a case, a commercially available MAC controller that matches this number of bits can be used as the transmission MAC controller 12D.
[0076]
When the number of bits of the frame data input to the address input terminal of the memory is set to be large, for example, 32, the memory 36 is not constituted by one memory element, but the memory 36 is divided into a plurality of parts. A configuration including a memory element can be employed, and frame data can be distributed and input in parallel to address input terminals of the plurality of memory elements. Then, a combinational logic value (for example, a logical product value) of the bit data values output from each of the plurality of memory elements and related to the same filtering condition may be calculated by the determination circuit 40.
[0077]
In the above embodiment, the number of bits of the memory data is set to 8 and the number of filtering conditions that can be checked simultaneously is set to a maximum of 8. However, the number of bits of the memory data is set to an arbitrary number of bits, and Can be checked at the same time. In such a case, the number of data bits in the memory 36 may be adjusted.
[0078]
Further, in the above embodiment, the total judgment result is calculated by the logical sum of the individual judgment results. However, any logical operation result regarding the individual judgment result can be calculated as the total judgment result according to a desired filtering condition.
[0079]
In the above embodiment, one type of pattern data is generated for each frame data byte at the address input terminal of the memory. However, a plurality of types of pattern data may be generated. For example, as shown in FIG. 11, as the memory 36, a memory having address input terminals A14 and A15 in addition to the address input terminals A0 to A13 in the above-described embodiment is employed. The results obtained by counting up the 2-bit counter circuit 33A with the clock signal CK2 having a cycle twice as long as the bit clock CK0 may be input to the terminals A14 and A15. In such a case, as shown in FIG. 11, the circuit configuration is such that a frequency dividing circuit 31A, an AND circuit 32A, and a selector circuit 34A are added. In addition, since four types of pattern data are input for each frame data byte, four individual determinations are made at each of four timings corresponding to changes of the four types of pattern data for each memory data bit. A circuit will be prepared. In this case, a plurality of data filtering processes can be performed in a time division manner in synchronization with the input of the data frame.
[0080]
Further, in the above-described embodiment, an apparatus that receives a data frame transmitted on the first Ethernet LAN 1 and selectively transmits only a data frame that meets a predetermined condition toward the second Ethernet LAN 2 However, the present invention can be applied to a relay device such as a router, a device for improving security such as a firewall, a protocol analyzer, and a network monitoring device called an RMON probe.
[0081]
【The invention's effect】
As described above in detail, according to the data filtering device of the present invention, it is possible to perform high-speed and flexible data filtering with a simple configuration using a general-purpose memory.
[Brief description of the drawings]
FIG. 1 is a diagram showing a schematic configuration of a filtering device according to an embodiment of the present invention.
FIG. 2 is a diagram showing a configuration of a data frame.
FIG. 3 is a diagram illustrating a configuration of a filtering circuit of FIG. 1;
FIG. 4 is a diagram illustrating a configuration of a determination circuit in FIG. 3;
5 is a timing chart (part 1) for explaining a data write operation to the memory of FIG. 3;
FIG. 6 is a timing chart (2) for explaining an operation of writing data to the memory in FIG. 3;
FIG. 7 is a timing chart for describing an operation of reading received MAC data from a receiving MAC controller and an operation of writing received frame data to a frame buffer circuit.
FIG. 8 is a timing chart for explaining a filtering operation when a filtering condition is not satisfied.
FIG. 9 is a timing chart for explaining a filtering operation when a filtering condition is satisfied.
FIG. 10 is a timing chart for explaining an operation of reading transmission data frame data from a frame buffer circuit and an operation of writing transmission data to a transmission MAC controller;
FIG. 11 is a diagram for explaining a modified example.
[Explanation of symbols]
100 data filtering device, 12R reception MAC controller (data width conversion circuit), 20 processing circuit (data writing device), 33, 33A counter circuit (data pattern generation circuit), 36 memory, 40 judgment circuit.

Claims (5)

A data filtering device that selectively outputs an input data frame,
A data pattern generation circuit for sequentially generating pattern data corresponding to a position in the data frame in synchronization with input of the data at the specific position;
The data of the data frame and the pattern data generated by the data pattern generating means are input from an address input terminal to an address determined by a data value at each position in the data frame and a pattern data value corresponding to each position in the data frame. A rewritable memory that outputs stored data indicating whether a data value of each position in the data frame satisfies a selection output condition of the data frame;
A determination circuit for determining whether to output the input data frame based on a data value output from the memory. 2. The data filtering device according to claim 1, wherein the data pattern generation circuit generates a plurality of types of pattern data in time sequence according to positions in the data frame. The memory outputs a plurality of bits of data in parallel,
3. The data filtering device according to claim 1, wherein the memory stores data indicating whether selection output conditions of the data frame different from each other are satisfied according to each of the plurality of bits. 4. . The data width conversion circuit for converting data of the data frame sequentially input at a first bit width into a data string of a second bit width and outputting the data stream to the memory. The data filtering device according to any one of claims 1 to 3. The data filtering device according to any one of claims 1 to 4, further comprising a data writing device that writes predetermined data into the memory.

Images