JP2019097053A - Packet identification device and method - Google Patents

Abstract

To perform packet identification processing using key information specific for an application flexibly in small-scale and low-cost circuit configuration.SOLUTION: A delimiter information storage circuit 12 is provided for storing delimiter information DL for identifying key information Key included in an input packet for each protocol type of the input packet. On the basis of the delimiter information DL relating to the protocol type of the input packet output from the delimiter information storage circuit 12 in accordance with the protocol type identified by a header processing circuit 11, a key information extraction circuit 14 extracts key information from the vicinity of the delimiter information in the input packet output from a delay circuit 13.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a packet identification technique for identifying variable-length packets using hardware.

  A router is used as one of network devices that transmit and receive packets via a communication network. The router identifies the received packet, and performs packet routing control such as transfer processing and filtering processing based on the identification result. In low-cost routers that are mass-produced, packet identification is possible by referring to the header information of packets up to layer 4 of the OSI reference model, but packet identification at the application layer level from layer 5 that handles variable-length packets Is difficult. Therefore, for the packet identification in the fifth to upper layers, an expensive dedicated device is used for each software or application executed on the server.

  On the other hand, with the explosive increase of communication traffic in recent years, realization of more advanced packet routing control by packet identification at the application layer level is required. For example, packet routing control based on domain name identification included in URL information stored in payload information of DNS (Domain Name System) protocol may be mentioned. When domain name identification in the payload information becomes possible, for example, packets related to the domain DA are transferred to the communication device UA, and packets related to the domain DB are transferred to the communication device UB, etc., enabling finer routing control.

  Furthermore, in recent years, the movement to apply virtualization technology to communication networks is accelerating, and there are cases where multiple VMs (Virtual Machines) are built on one physical server and multiple applications are operated on one server. . Even in the case of processing different applications for each VM, distribution control technology based on packet identification is required, and if such control is to be realized only by software processing, the performance is insufficient. In addition, if it is intended to realize by a dedicated device, the cost increases because a dedicated device is required for each application. Therefore, there is a need for a packet identification technique that can identify various communication protocols at an application level by one device.

Conventionally, as a packet identification device for identifying such a packet, there is a hardware-based packet identification device capable of identifying a packet including payload information used in the fifth to upper layers.
The conventional packet identification device 50 shown in FIG. 12 includes a header processing unit 51, a key information extraction unit 52, and a search unit 53.

  In the packet identification device 50, first, the header processing unit 51 identifies header information of the input packet, and identifies a protocol type such as DNS or HTTP (Hyper Text Transfer Protocol). The key information extraction unit 52 extracts a specific area of the input packet as key information, based on the protocol type obtained by the header processing unit 51. The search unit 53 refers to each entry indicating payload information to be identified, which is registered in advance, and searches for an entry in which the key information extracted by the key information extraction unit 52 matches the payload information. Based on the search result, that is, the presence or absence of registration, it is identified whether the input packet is a packet including payload information to be identified.

The header processing in the header processing unit 51 is an identification processing in which header information is sequentially analyzed from the head of the packet according to the packet format of the input packet, and can be realized by a general known parser processing method (See, for example, Non-Patent Document 1 and Non-Patent Document 2).
In addition, the search unit 53 can be realized using a general content addressable memory (CAM) or a TCAM (Ternary Content Addressable Memory).

On the other hand, the method of extracting a specific area as key information from the payload information of the input packet in the key information extraction unit 52 is different from the prior art because the payload information to be extracted as key information and the optimum extraction method differ for each protocol type An extraction circuit is provided for each protocol type.
In the conventional key information extraction unit 52 shown in FIG. 13, an extractor 52A for extracting key information for each protocol type is provided at the former stage, and these extractors 52A are provided at the latter stage based on the designated protocol type. A selector 52B is provided to switch and select the output of the corresponding protocol type extractor 52A. According to this circuit configuration, the key information output to the search unit 53 can be switched according to the protocol type.

"SDNet Packet Processor User Guide", UG1012 (v2017.1), Xilinx, June 15, 2017 "P416 Language Specification version 1.0.0", The P4 Language Consortium, 2017-05-22

  However, in such prior art, when identifying packets relating to a plurality of protocol types, it is necessary to provide a key information extraction circuit for each of these protocol types, so that the circuit scale of the entire packet identification device increases. there were. In addition, when the key information extraction circuit is mounted on an application specific integrated circuit (ASIC), key information extraction processing other than the protocol assumed at the time of design can not be performed. For this reason, there is a problem that it lacks flexibility from the viewpoint of the correspondence to the new protocol in the future. When the key information extraction circuit is mounted on an FPGA (Field Programmable Gate Array), the circuit can be rewritten / added later, but a review of the entire design for circuit change is necessary, resulting in a design cost. It will increase.

  The present invention is intended to solve such problems, and provides a packet identification technology that can flexibly perform packet identification processing using application-specific key information with a small-scale and low-cost circuit configuration. The purpose is to

  In order to achieve such an object, the packet identification device according to the present invention is configured to input the input packet based on the protocol type of the input packet and key information specific to the application of the input packet, which are identified from the input packet. A packet identification device for identifying a packet for each application, the header processing circuit identifying a protocol type of the input packet by identifying header information of the input packet, and the protocol type of the input packet. A delimiter information storage circuit for storing delimiter information for specifying key information contained in an input packet, a delay circuit for delaying the input packet by a predetermined delay time and outputting the same, and the header information specified by the header processing circuit Output from the delimiter information storage circuit according to the protocol type A key information extraction circuit for extracting the key information from the vicinity of the delimiter information in the input packet output from the delay circuit based on the delimiter information on the protocol type of the input packet; With the key information extracted by the circuit, a search table in which key information specific to the application is registered in advance is searched for each application to be identified, and an identification result regarding the input packet based on the obtained search result And a search circuit for outputting

  In one configuration example of the packet identification device according to the present invention, the delimiter information storage circuit is configured to indicate the delimiter information and the position of the key information relative to the delimiter information for each protocol type of the input packet. The key information extraction circuit is configured to extract the key information from the input packet based on the delimiter information and the position information output from the delimiter information storage circuit.

  In one configuration example of the packet identification device according to the present invention, the position information is information indicating whether the key information is located forward or backward of the delimiter information, and the key information extraction circuit In the input packet, data of a designated length is extracted as the key information from the front or rear of the delimiter information indicated by the position information.

  Further, in one configuration example of the packet identification device according to the present invention, the delimiter information storage circuit stores a plurality of pieces of delimiter information for each protocol type of the input packet, and the key information extraction circuit stores the delimiter information. The key information is extracted from the input packet based on the corresponding delimiter information, and a plurality of key information extracted by each of the key information extraction circuits are combined into one combined key information. The search circuit further includes a key information combination circuit to be coupled, and the search circuit outputs an identification result indicating an application related to the input packet by searching the search table with the combination key information output from the key information combination circuit. It is something like that.

  In one configuration example of the packet identification device according to the present invention, the delay circuit sequentially delays the input packets divided and input with a predetermined length by the delay time and outputs the delayed data as delay data. The key information extraction circuit is a buffer for holding the delay data as buffer data, a comparator for specifying the delimiter information position where the delimiter information exists by searching for the delimiter information in the buffer data, and the delimiter And an extractor for extracting data of a position range based on an information position as the key information from the buffer data.

  In the packet identification method according to the present invention, the input is set for each application set in advance based on a protocol type of the input packet and key information specific to an application of the input packet, which are specified from the input packet. A packet identification method for use in a packet identification device for identifying a packet, the header processing step of identifying a protocol type of the input packet by identifying header information of the input packet by a header processing circuit, delimiter information A delimiter information storing step of storing delimiter information for specifying key information included in the input packet for each protocol type of the input packet; and a delay circuit storing the input packet for a predetermined delay time. Delay step to delay and output, The information extraction circuit may output the delay circuit based on the delimiter information on the protocol type of the input packet, which is output from the delimiter information storage circuit according to the protocol type specified by the header processing circuit. A key information extraction step for extracting the key information from the vicinity of the delimiter information in the input packet, and a search circuit using the key information extracted by the key information extraction circuit for each application to be identified The search step comprises searching a search table in which specific key information is registered in advance, and outputting an identification result regarding the input packet based on the obtained search result.

  According to the present invention, even when the protocol type of the input packet is different, it is possible to extract the desired key information Key by sharing the same key information extraction circuit between the protocol types. For this reason, it is not necessary to provide a key information extraction circuit for each protocol type, and key information can be extracted from a new protocol only by resetting the delimiter information of the delimiter information storage circuit. Therefore, packet identification processing using application-specific key information can be flexibly performed with a small-scale and low-cost circuit configuration.

It is a block diagram showing composition of a packet identification device concerning a 1st embodiment. It is an example of composition of delimiter information concerning a 1st embodiment. It is an example of composition of an input packet. It is a structural example of the key information extraction circuit concerning 1st Embodiment. It is a flow chart which shows key information extraction processing concerning a 1st embodiment. It is an explanatory view showing key information extraction operation. It is a block diagram which shows the other structure of the packet identification device concerning 1st Embodiment. It is a structural example of the key information extraction circuit concerning 2nd Embodiment. It is an example of composition of delimiter information concerning a 2nd embodiment. It is a flow chart which shows key information extraction processing concerning a 2nd embodiment. It is a flowchart which shows the key information extraction process (continuation) concerning 2nd Embodiment. It is a block diagram which shows the structure of the packet identification device concerning 3rd Embodiment. It is an example of a structure of the conventional packet identification apparatus. It is a structural example of the conventional key information extraction circuit.

Next, embodiments of the present invention will be described with reference to the drawings.
First Embodiment
First, with reference to FIG. 1, a packet identification device 10 according to a first embodiment of the present invention will be described.
The packet identification device 10 shown in FIG. 1 is connected to various network devices (not shown) that transmit and receive packets via a communication network (not shown) and identified from input packets inputted from the network device. This is an apparatus for identifying an input packet for each application based on the protocol type of the input packet and key information specific to the application of the input packet.

  In the following, the packet identification device 10 according to the present invention is connected to a network device (packet receiving end) that receives a packet and executes processing specified in advance for each application, and identifies the application of the received packet. Although the case will be described as an example, it is not limited thereto. For example, also in the case of identifying the application of a packet by a network device (packet relay end) that relays and transfers a packet or a network device (packet transmission end) that transmits a packet, the packet identification device according to the present invention 10 can be applied.

[Principle of the invention]
In general, since the variable-length packet varies in accordance with the amount of data to be transmitted, the data length of the payload information does not know in which position of the payload information the application specific key information such as domain information is stored. On the other hand, since the packet format is known, delimiter information to be a mark always exists in the vicinity of desired key information. Taking domain information of DNS protocol as an example, it is possible to identify a packet including "jp" if "jp" is the delimiter information among domain information "xxx.jp (x: Don't care)" It becomes.

  The present invention is based on the fact that such variable-length packets include delimiter information specific to each protocol type, and variable-length packets based on key information located near the delimiter information in the variable-length packets. It is focused on the fact that the application related to Then, on the basis of the protocol type of the variable-length packet, switching control of delimiter information for extracting key information is performed.

  Specifically, in the packet identification device 10, delimiter information is registered in advance for each protocol type, and based on delimiter information corresponding to the protocol type of the input packet, each application is received from the vicinity of the delimiter information among the input packets. Specific key information is extracted, and an identification result indicating an application related to an input packet is output based on the obtained key information.

[Packet identification device]
Next, the circuit configuration of the packet identification device 10 according to the present embodiment will be described in detail with reference to FIG.
As shown in FIG. 1, the packet identification device 10 includes, as main circuit units, a header processing circuit 11, a delimiter information storage circuit 12, a delay circuit 13, a key information extraction circuit 14, and a search circuit 15. These circuit units are realized by integrated circuits such as one or more application specific integrated circuits (ASICs) and field programmable gate arrays (FPGAs).

  The header processing circuit 11 identifies the header information of the input packet based on the sequentially input packet data Din, thereby specifying a protocol type such as DNS or HTTP, and protocol information PID indicating the specified protocol type. And the function of outputting At this time, if the packet data Din is relatively short, for example, a plurality of packet data Din may be stored for the length of the header information, and then the protocol type may be specified. As a method of specifying the protocol type by the header processing circuit 11, a known method such as the above-mentioned prior art may be used.

The delimiter information storage circuit 12 as a whole comprises a semiconductor memory, and based on the function of storing delimiter information for each protocol type, and the protocol information PID output from the header processing circuit 11, delimiter information DL corresponding to the protocol information PID And the function of outputting
For example, as shown in FIG. 2, the delimiter information storage circuit 12 may be configured to store delimiter information DL corresponding to each protocol type for each address ADR. At this time, the protocol information PID represented by a numerical value may be used as the address ADR as it is or by being multiplied by an integer.

  The delay circuit 13 has a function of outputting delay data Dd obtained by delaying the packet data Din by a predetermined delay time. This delay time has a time length required for the header information processing circuit 11 to specify the protocol information PID and for the delimiter information storage circuit 12 to output the delimiter information DL corresponding to the protocol type of the input packet.

  In the following, as shown in FIG. 3, the input packet input to the packet identification device 10 is a variable-length packet having a given packet format consisting of header information and payload information, and the data length is variable-length Lbyte. There shall be. At this time, assuming that the input packet is divided into N-byte packet data Din and sequentially input, the variable length L is L = N × H + α (H is an integer of 0 or more, α is 0 or more and N Is an integer less than or equal to byte. H indicates the number of Din contained in the input packet, and α indicates Din for a fraction less than N.

The key information extraction circuit 14 selects the vicinity of the delimiter information DL among the delay data Dd sequentially output from the delay circuit 13 based on the delimiter information DL related to the protocol type of the input packet output from the delimiter information storage circuit 12. , And has a function of extracting key information Key specific to the application of the input packet.
In FIG. 3, the delimiter information DL has a data length of Abyte, DL is present at the position from P to P + A in the input packet, and the key information Key is from the range from P to P-M ahead of Mbyte. An example to be extracted is shown. Note that DL may be included in Key and extracted.

  The search circuit 15 has a search table 15A in which the correspondence between the identification information indicating the application to be identified and the key information Key is registered in advance, and based on the key information Key extracted by the key information extraction circuit 14 It has a function of searching the search table 15A, and a function of outputting identification information corresponding to the key information Key as an identification result R of the input packet based on the obtained search result. As a method of specifying the identification result R by the search circuit 15, a known method such as the above-mentioned prior art may be used.

  Thus, for example, when identifying domain information “AAA.co.jp” and domain information “BBB.co.jp” for each application using the DNS protocol, as shown in FIG. A character code corresponding to "jp" is registered as delimiter information DL related to the DNS protocol. As a result, the key information extraction circuit 14 extracts domain information “xxx.jp” (x: Don't care) as key information of the DNS protocol.

  Therefore, in the search table 15A of the search circuit 15, identification information RA indicating an application corresponding to domain information "AAA.co.jp" and identification information RB indicating an application corresponding to domain information "BBB.co.jp" Is registered, identification information indicating an application corresponding to the key information “xxx.jp” is output from the search circuit 15 as the identification result R.

[Key information extraction circuit]
Next, the key information extraction circuit 14 according to the present embodiment will be described in detail with reference to FIG.
The key information extraction circuit 14 includes, as main circuit units, a buffer 14A, a comparator 14B, an extractor 14C, an OR circuit 14D, and a key register 14E.

  The buffer 14A has a function of temporarily holding the delay data Dd output from the delay circuit 13 as buffer data Q. The buffer data Q has a data length Lq obtained by adding at least the data length Mbyte of the key information Key and the data length Abyte of the delimiter information DL, and corresponds to one or more delay data Dd.

The comparator 14B has a function of searching for the delimiter information DL in the buffer data Q and specifying the delimiter information position P where the delimiter information DL exists.
Specifically, the comparator 14B shifts the buffer data Q of the buffer 14A by 1 byte and sequentially acquires the block BLK having a data length Abyte equal to the delimiter information DL, and the delimiter output from the delimiter information storage circuit 12 It has a function of comparing with the information DL and a function of collectively outputting a 1-bit comparison result indicating match / mismatch obtained for each of these BLKs as a bitmap Bmap which is summarized for each buffer data Q.

  Also, the comparator 14B has a function of starting comparison operation between BLK and DL based on a packet start signal SOP (Start of Packet) indicating the start timing of the input packet, and a packet end signal indicating the end timing of the input packet. It has a function of ending the comparison operation between BLK and DL based on EOP (End of Packet). These SOPs and EOPs are input in parallel in synchronization with packet data Din, for example, from a network device.

  Based on the bitmap Bmap output from the comparator 14B, the extractor 14C sets the Mbyte key from the position near P of the buffer data Q, which is preset with reference to the delimiter information position P where DL is present. It has a function to extract information Key.

  The OR circuit 14D checks whether or not the delimiter information DL is present in the buffer data Q by performing an OR operation on each bit of the bit map Bmap output from the comparator 14B. It has a function of outputting the inspection result Tx. Thereby, if DL exists in Q, Tx = 1 is output, and if DL does not exist in Q, Tx = 0 is output.

  The key register 14E has a function of holding and outputting the key information Key output from the extractor 14C when the inspection result Tx output from the OR circuit 14D indicates the presence of DL (Tx = 1). ing.

[Key information extraction operation]
Next, the key information extraction operation in the key information extraction circuit 14 will be described as the operation of the packet identification device 10 according to the present embodiment with reference to FIGS. 5 and 6.
Here, a case will be described as an example in which data of forward M bytes is extracted as key information Key from the delimiter information position P where the delimiter information DL exists among the buffer data Q accumulated in the buffer 14A.

  As shown in the key information extraction process of FIG. 5, the comparator 14B waits until the packet start signal SOP changes to “1” (step S100: NO), and the SOP changes to “1” and the buffer data Q is changed. When it is confirmed that the packet head is included in (step S100: YES), the following comparison operation between BLK and DL acquired from Q is started.

  First, the buffer 14A waits until the delay data Dd of its own buffer length Lq byte is accumulated as the buffer data Q (step S101: NO), and when the accumulation of Q is completed (step S101: YES), the buffer An Abyte long BLK is shifted by 1 byte from the search area S except the M bytes for the key information Key from the head of the data Q, and sequentially read out and output to the comparator 14B (step S102).

The comparator 14B sequentially compares these BLK and DL (step S103).
As in the example of key information extraction operation shown in FIG. 6, it is assumed that Mbyte is the key information Key from the beginning of buffer data Q of buffer length Lqbyte, and the remaining data length β (= Lq−M) bytes is It is assumed to be the search area S. When the delimiter information DL is 2 bytes long (A = 2), 2 bytes of Q are read as a block BLK from the head position M + 1 byte of S and compared with DL by the comparator 14B.

At this time, in the first comparison, BLK # 1 consisting of data qM + 1 and qM + 2 of the (M + 1) th byte and M + 2th byte of Q is compared with DL1 and DL2 of DL, and the comparison result indicating the match / mismatch is the 1st bit of Bmap It is stored in b1.
In the next second comparison, BLK # 2, which is a position shifted by 1 byte, that is, the data at the M + 2th byte of Q and the M + 3th byte qM + 2, qM + 3, is compared with DL1 Is stored in b2 of the 2nd bit of Bmap.

After this, BLK and DL are repeatedly compared β times until the end of Q, and finally BLK # 2 consisting of data qβ and qβ + 1 of β byte and β + 1 byte of Q is compared with DL1 and DL2 of DL, and the match / mismatch The comparison result indicating B is stored in bβ of the β bit at Bmap.
Therefore, as shown in FIG. 6, when the data qβ-1 is DL1 and the data qβ is DL2, these data qβ-1 and qβ match the DL, so bβ-1 at the β-1st bit of Bmap Becomes “1”, and all the other bits in Bmap become “0” indicating non-coincidence.

Thus, the comparator 14B collectively outputs the 1-bit comparison result indicating the match / mismatch obtained for each comparison as a β-bit bitmap Bmap summarized for each Q (step S104).
The extractor 14C specifies the delimiter information position P where the delimiter information DL exists in the buffer data Q based on the Bmap output from the comparator 14B (step S105), and data of forward M bytes from P of Q are extracted. Are extracted as key information Key (step S106).

Further, the OR circuit 14D performs an OR operation on each bit of Bmap output from the comparator 14B to check whether DL exists in Q and outputs the obtained test result Tx (see FIG. Step S107).
Here, in the case where Tx = 1 (step S107: YES), the key register 14E updates the held content with the Key output from the extractor 14C (step S108). If Tx = 0 (step S107: NO), the key register 14E does not update the held content (step S109).

  Thereafter, the buffer 14A acquires data of the data length Mbyte of the key information Key from the end of the buffer data Q, and shifts it to the beginning of the buffer data Q (step S110). Thus, the data at the end of the search area S used in the key information extraction process this time is used as data corresponding to the key information Key Q in the next key information extraction process. However, when the buffer data after comparison is updated, it is assumed that the data is updated to some extent and updated on the assumption that the delimiter is divided and stored at the end of the search area S. In this case, the data length of the data to be shifted to the beginning in step S110 may be increased by an amount corresponding to overlapping of M bytes.

Next, the comparator 14B confirms whether the packet end signal EOP is "1" (step S111), and if the packet end signal EOP indicates "0" (step S111: NO), the process returns to step S101. New delay data Dd are sequentially added to Q.
On the other hand, when the packet end signal EOP indicates "1" (step S111: YES), a series of key information extraction processing is ended.

[Effect of First Embodiment]
As described above, in the present embodiment, the delimiter information storage circuit 12 for storing the delimiter information DL for specifying the key information Key included in the input packet is provided for each protocol type of the input packet, and the key information extraction circuit 14 Of the input packet output from the delay circuit 13 based on the delimiter information DL related to the protocol type of the input packet output from the delimiter information storage circuit 12 according to the protocol type specified by the header processing circuit 11. The key information is extracted from the vicinity of the information.

  More specifically, the delay circuit 13 sequentially delays the packet data Din, in which the input packet is divided and input with a fixed length, by the delay time and outputs it as the delay data Dd, and the key information extraction circuit 14 14A holds delay data Dd as buffer data Q, and comparator 14B searches delimiter information DL in buffer data Q to specify delimiter information position P where DL is present, and extractor 14C determines delimiter Data of a position range based on the information position P is extracted from the buffer data Q as key information Key.

As a result, the delimiter information DL corresponding to the protocol type of the input packet is switched and output from the delimiter information storage circuit 12, and the key information Key specific to the application is extracted by the key information extraction circuit 14 from the input packet based on this DL. It will be done. Therefore, even if the protocol type of the input packet is different, the same key information extraction circuit 14 can be shared between the protocol types to extract the desired key information Key.
Therefore, as in the prior art, it is not necessary to provide a key information extraction unit for each protocol type, and key information can be extracted from a new protocol only by resetting the delimiter information DL of the delimiter information storage circuit 12. Therefore, it is possible to flexibly perform packet identification processing using application-specific key information Key with a small-scale and low-cost circuit configuration.

  Further, in the present embodiment, when the correspondence between the protocol type and the delimiter information DL stored in the delimiter information storage circuit 12 is to be re-set, as shown in FIG. The correspondence between the protocol type and the delimiter information DL may be rewritten from the control circuit (CPU). Further, with regard to the delay time of the delay circuit 13, the required time from the specification of the protocol type of the input packet by the header processing circuit 11 to the reading of the corresponding delimiter information DL by the delimiter information storage circuit 12 depends on each implementation. Do. Therefore, as shown in FIG. 7, the delay time optimum for each mounting may be set in the delay circuit 13 from a control circuit (CPU) provided inside or outside the packet identification device 10.

Second Embodiment
Next, the packet identification device 10 according to the second embodiment of the present invention will be described with reference to FIG.
In the first embodiment, the case where the key information Key exists ahead of the delimiter information DL has been described as an example in common to each protocol type. In the present embodiment, the case where the position where the key information Key is present is arbitrarily set will be described for each protocol type.

  In the present embodiment, as shown in FIG. 9, the delimiter information storage circuit 12 has a function of storing the delimiter information DL and the position information indicating the position of the key information Key with respect to this DL for each protocol type of the input packet. Have. Specifically, the position information LOC includes 1-bit position information indicating whether the key information Key is located in front of or behind the delimiter information DL.

  The extractor 14C of the key information extraction circuit 14 has a function of extracting the key information Key from the input packet based on the delimiter information DL and the position information LOC output from the delimiter information storage circuit 12. At this time, when the position information LOC indicates the forward F, the key information extraction circuit 14 extracts the forward Mbyte of DL as a key, and when the position information LOC indicates the backward B, the key information extraction circuit 14 detects the rear of DL. Extract Mbyte as Key.

  Further, the buffer 14A of the key information extraction circuit 14 has a function of specifying a search area S for searching the block BLK in the buffer data Q based on the position information LOC output from the delimiter information storage circuit 12. .

[Operation of Second Embodiment]
Next, with reference to FIGS. 10A and 10B, as an operation of the packet identification device 10 according to the present embodiment, a key information extraction operation in the key information extraction circuit 14 will be described.
Here, from the delimiter information position P where the delimiter information DL is present among the buffer data Q accumulated in the buffer 14A, data of M bytes ahead or behind indicated by the position information LOC is extracted as the key information Key. An example will be described. The same reference numerals as in FIG. 5 described above denote the same or equivalent parts in FIGS. 10A and 10B.

  As shown in the key information extraction process of FIG. 10A, the comparator 14B waits until the packet start signal SOP changes to “1” (step S100: NO), and the SOP changes to “1”, and buffer data Q changes. When it is confirmed that the packet head is included in (step S100: YES), the following comparison operation between BLK and DL acquired from Q is started.

First, the buffer 14A waits until the delay data Dd of its own buffer length Lq byte is stored as the buffer data Q (step S101: NO), and when the storage of Q is completed (step S101: YES), (Step S200).
Here, when LOC indicates F (step S200: YES), the buffer 14A sets a portion excluding Mbyte from the beginning of Q as S (step S201), and when LOC indicates B (step S200: NO), A portion excluding Mbyte from the end of Q is S (step S200). Thereafter, the buffer 14A shifts the ALK-length BLK by 1 byte from the search area S in the buffer data Q, sequentially reads out it, and outputs it to the comparator 14B (step S203).

  The comparator 14B sequentially compares the BLK and the DL (step S103), and collectively compares the 1-bit comparison result indicating the match / mismatch obtained for each comparison for each Q with the β-bit bitmap Bmap. It outputs (step S104).

After that, as shown in the key information extraction process (cont.) Of FIG. 10B, the extractor 14C determines the delimiter information position P where the delimiter information DL exists in the buffer data Q based on the Bmap output from the comparator 14B. Are identified (step S105), and the LOC is confirmed (step S210).
Here, when LOC is F (step S210: YES), the extractor 14C extracts data for the forward Mbyte from P of Q as key information Key (step S211), and when LOC is B, the extractor is The 14C extracts data of backward M bytes from P of Q as key information Key (step S212).

Further, the OR circuit 14D performs an OR operation on each bit of Bmap output from the comparator 14B to check whether DL exists in Q and outputs the obtained test result Tx (see FIG. Step S107).
Here, in the case where Tx = 1 (step S107: YES), the key register 14E updates the held content with the Key output from the extractor 14C (step S108). If Tx = 0 (step S107: NO), the key register 14E does not update the held content (step S109).

  Thereafter, the buffer 14A acquires data of the data length Mbyte of the key information Key from the end of the buffer data Q, and shifts it to the beginning of the buffer data Q (step S110). Thereby, when the key information Key exists ahead of the delimiter information DL, the data at the end of the search area S used in the key information extraction processing this time is the key information Key of Q in the next key information extraction processing. It is used as the corresponding data.

  In addition, when the key information Key exists behind the delimiter information DL, the data corresponding to the key information Key Q used in the key information extraction process at this time is the head of the search area S at the next key information extraction process. It is used as data of However, when the buffer data after comparison is updated, it is assumed that the data is updated to some extent and updated on the assumption that the delimiter is divided and stored at the end of the search area S. In this case, the data length of the data to be shifted to the beginning in step S110 may be increased by an amount corresponding to overlapping of M bytes.

Next, the comparator 14B confirms whether the packet end signal EOP is "1" (step S111), and if the packet end signal EOP indicates "0" (step S111: NO), the process returns to step S101. New delay data Dd are sequentially added to Q.
On the other hand, when the packet end signal EOP indicates "1" (step S111: YES), a series of key information extraction processing is ended.

[Effect of Second Embodiment]
As described above, according to the present embodiment, the delimiter information storage circuit 12 stores, for each protocol type of the input packet, the delimiter information DL and the position information LOC indicating the position of the key information Key with respect to this DL, and extracts the key information The circuit 14 extracts key information Key from the input packet based on the delimiter information DL and the position information LOC output from the delimiter information storage circuit 12.

Specifically, the position information LOC is information indicating whether the key information Key is located at the front F or the back B of the delimiter information DL, and the key information extraction circuit 14 detects the position information LOC in the input packet. Data of a specified length is extracted as key information Key from the front F or rear B of the delimiter information DL indicated by.
Thereby, the position where the key information Key exists can be arbitrarily set for each protocol type, and it becomes possible to greatly expand the protocol type of the packet that can be identified by one packet identification device 10.

In the present embodiment, the position information LOC is described as an example of information indicating whether the key information Key is located forward F or backward B of the delimiter information DL in the input packet. It is not limited to For example, information indicating the relative position from the delimiter information position P to the head position or the end position of the key information Key may be used as the position information LOC, and the data length of the key information Key may be further included.
This makes it possible to extract key information Key from individual positions for each protocol type.

Third Embodiment
Next, a packet identification device 10 according to a third embodiment of the present invention will be described with reference to FIG.
In the first and second embodiments, the case where the input packet is identified for each application based on one key information Key extracted from the input packet has been described as an example. In the present embodiment, the case of identifying an input packet for each application based on a plurality of key information Key extracted from the input packet will be described as an example.

In the present embodiment, the delimiter information storage circuit 12 has a function of storing a plurality of pieces of delimiter information DL for each protocol type of the input packet.
The key information extraction circuit 14 is provided for each delimiter information DL, and has a function of independently extracting the individual key information Key from the input packet based on the corresponding delimiter information DL and the position information LOC. There is.

The key information combining circuit 16 has a function of combining a plurality of key information Key extracted by each of the key information extraction circuits 14 into one combined key information Key.
The search circuit 15 has a function of outputting an identification result R indicating an application related to an input packet by searching the search table 15A with the combined key information Key output from the key information combination circuit 16.

In the example of FIG. 11, two pieces of delimiter information DLX and DLY are registered for each protocol type of the input packet, and their data lengths are X byte and Y byte.
Further, key information extraction circuits 14X and 14Y are provided for each of the DLX and DLY, and the key information KeyX and KeyY are extracted respectively. The specific key information extraction processing of the key information extraction circuits 14X and 14Y is the same as that of FIG. 10A and FIG. 10B described above.

The key information KeyX and KeyY are combined into one combined key information Key by the key information combining circuit 16. As a combining method, combining key X and key Y may generate combined key information Key of X + Y bytes.
In the search table 15A of the search circuit 15, combined key information Key specific to the application to be identified is registered in advance. Therefore, the identification result R indicating the application corresponding to the combined key information Key is output.

[Effect of Third Embodiment]
As described above, in the present embodiment, the delimiter information storage circuit 12 stores a plurality of pieces of delimiter information DL for each protocol type of the input packet, and the key information extraction circuit 14 is provided for each delimiter information DL. The individual key information Key is extracted from the input packet based on the delimiter information DL to be transmitted and the position information LOC, and the key information combination circuit 16 extracts a plurality of key information keys extracted by each of the key information extraction circuits 14 It combines with one combined key information Key.
As a result, the input packet can be identified for each application based on a plurality of key information Key extracted from the input packet, and more sophisticated packet identification can be realized.

  In the present embodiment, the case where two pieces of delimiter information DLX and DLY are registered for each protocol type of the input packet is described as an example, but the number of pieces of delimiter information DL may be three or more. In that case, the key information extraction circuit 14 may be provided in accordance with the number of delimiter information DL.

  Further, in the present embodiment, the case where the combined key information Key is generated by connecting a plurality of key information keys has been described as an example, but the present invention is not limited to this. For example, the combined key information Key may be generated by performing a logical operation or numerical calculation on a plurality of key information Key.

  Further, connection type information indicating a method of generating connection key information Key is registered in the delimiter information storage circuit 12 for each protocol type, and the connection type output from the delimiter information storage circuit 12 according to the protocol type of the input packet. The key information combining circuit 16 may generate combined key information Key based on the information. This makes it possible to realize more sophisticated and detailed packet identification.

[Extension of the embodiment]
As mentioned above, although this invention was demonstrated with reference to embodiment, this invention is not limited to the said embodiment. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. Moreover, about each embodiment, it can combine arbitrarily and can be implemented in the not conflicting range.

  DESCRIPTION OF SYMBOLS 10 ... Packet identification device, 11 ... Header processing circuit, 12 ... Delimiter information storage circuit, 13 ... Delay circuit, 14, 14X, 14Y ... Key information extraction circuit, 14A ... Buffer, 14B ... Comparator, 14C ... Extractor, 14D ... OR circuit, 14 E ... Key register, 15 ... Search circuit, 15 A ... Search table, 16 ... Key information combining circuit, 20 ... Control circuit, Din ... Packet data, Dd ... Delay data, PID ... Protocol information, DL, DLX, DLY: Delimiter information, Q: Buffer data, S: Search area, BLK: Block, Bmap: Bitmap, P: Delimiter information position, LOC: Position information, Key, KeyX, KeyY: Key information (combined key information), Tx ... inspection result, R ... identification result.

Claims (6)

A packet identification device that identifies the input packet for each application based on a protocol type of the input packet identified from the input packet and key information specific to an application of the input packet,
A header processing circuit that identifies a protocol type of the input packet by identifying header information of the input packet;
A delimiter information storage circuit that stores delimiter information for specifying key information included in the input packet for each protocol type of the input packet;
A delay circuit for delaying the input packet by a predetermined delay time and outputting the delayed signal;
Among the input packets output from the delay circuit based on delimiter information related to the protocol type of the input packet output from the delimiter information storage circuit according to the protocol type specified by the header processing circuit A key information extraction circuit for extracting the key information from the vicinity of delimiter information;
The key information extracted by the key information extraction circuit searches a search table in which key information specific to the application is registered in advance for each application to be identified, and the input is performed based on the obtained search result. What is claimed is: 1. A packet identification device comprising: In the packet identification device according to claim 1,
The delimiter information storage circuit stores, for each protocol type of the input packet, the delimiter information and position information indicating the position of the key information with respect to the delimiter information.
A packet identification device characterized in that the key information extraction circuit extracts the key information from the input packet based on the delimiter information and the position information output from the delimiter information storage circuit. In the packet identification device according to claim 2,
The position information is information indicating whether the key information is located forward or backward of the delimiter information,
The packet identification device characterized in that the key information extraction circuit extracts data of a specified length from the front or back of the delimiter information indicated by the position information among the input packets as the key information. The packet identification device according to any one of claims 1 to 3.
The delimiter information storage circuit stores a plurality of pieces of delimiter information for each protocol type of the input packet,
The key information extraction circuit is provided for each of the delimiter information and extracts individual key information from the input packet based on the corresponding delimiter information.
The information processing apparatus further includes a key information combination circuit that combines a plurality of key information extracted by each of the key information extraction circuits into one combination key information,
The packet identification device, wherein the search circuit searches the search table with the combined key information output from the key information combination circuit, and outputs an identification result indicating an application related to the input packet. In the packet identification device according to claim 1,
The delay circuit sequentially delays the input packets divided and input with a predetermined length by the delay time and outputs the delayed data as delay data.
The key information extraction circuit
A buffer for holding the delayed data as buffer data;
A comparator that specifies the delimiter information position where the delimiter information exists by searching for the delimiter information in the buffer data;
And a extractor for extracting data of a position range based on the delimiter information position as the key information from the buffer data. A packet used by a packet identification device for identifying the input packet for each preset application based on the protocol type of the input packet identified from the input packet and key information specific to the application of the input packet The identification method,
A header processing step of specifying a protocol type of the input packet by a header processing circuit identifying header information of the input packet;
A delimiter information storage step of storing delimiter information for specifying key information included in the input packet for each protocol type of the input packet;
A delay step of delaying the input packet by a predetermined delay time and outputting the input packet;
A key information extraction circuit is output from the delay circuit based on delimiter information on the protocol type of the input packet output from the delimiter information storage circuit according to the protocol type specified by the header processing circuit. A key information extraction step of extracting the key information from the vicinity of the delimiter information in the input packet;
A search circuit searches a search table in which key information specific to the application is registered in advance for each application to be identified with the key information extracted by the key information extraction circuit, and the obtained search result is And D. a search step of outputting an identification result on the input packet based on the selected packet.

Images