JP3454884B2 - Memory and its application device - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention mainly relates to a memory suitable for application to an information processing device connected to a local area network (hereinafter referred to as LAN), a communication control device connecting the networks, A kind of associative memory (Content A) that compares the data in the memory with the data received from the LAN and judges the coincidence at high speed.
addressable Memory: "CA
"M").

[0002]

2. Description of the Related Art An apparatus for relaying packet data by connecting a plurality of networks, particularly LANs, with each other, is the International Standards Organization (ISO).
alOrganization for Standard
rd), open system interconnection (OS)
I; Open System Interconnec
device such as a "bridge" that connects in the data link layer (particularly, the media access sublayer) and a "router" that connects in the network layer that is an upper layer thereof.

In this communication control device called bridge or router, it is determined whether the received packet data received via the network should be relayed or discarded based on the filtering information provided in advance on the device side. There is a need to.

In this judgment processing, it is generally judged whether or not the received data should be relayed, based on the address indicated by the address field included in the received packet data. The addresses used in the LAN will be briefly described below.

The address used in the LAN is a MAC (Media Access Control) that is physically unique to the device, that is, defined at the time of manufacturing the device.
There are an address (48 bits), a network number to which the device is connected, a network address indicating the number of the device on the network, and the like.

The transmission / reception data transmitted on the LAN includes
At least, it includes the MAC address of the transmission destination and the transmission source, and further, depending on the upper layer protocol, it generally includes the transmission destination and the internetwork address of the transmission source.

As an internetwork address,
For example, an IP address (32 bits) in the TCP / IP protocol is well known, and in the description below, I
Use P address.

In order for a terminal device connected to a network or a communication connection device called a router to recognize whether or not there is a reception addressed to itself from the LAN, the M
Use AC address. That is, if the destination MAC address indicating the destination of the packet data on the LAN matches the MAC address assigned to the local station, the packet data is received.

On the other hand, the communication connection device called the bridge receives all packet data transmitted on the LAN, and the destination MAC address in the packet is the same LAN.
If it is the MAC address of the connected device, the packet is discarded (called filtering) without being relayed to another network.

By the way, conventionally, the MAC in the bridge
In order to realize the address filtering function at high speed, for example, "Advanced Micro Dev
The associative memory (CAM) represented by "ICE: Am99C10A" was used. In such a conventional CAM, M word data (M is a natural number) in which 48 bits, which is the data length of the MAC address, is set as one unit can be registered, and the input MAC address data is input. Comparing the 48-bit data, which is the above, with the data of a plurality of registered MAC addresses (maximum M) at the same time, the presence or absence of the matching data and the registration of the matching data in the CAM. Position, ie CAM
It was possible to output the address within.

The MAC address filtering function provided in the conventional CAM bridge will be described with reference to FIG.

FIG. 2 is an explanatory diagram of the internal configuration of a LAN connection system and a bridge device which are configured by connecting two LANs by a bridge.

In FIG. 2, 100 is a bridge and 10 is a bridge.
1 is a processor (which can be realized by, for example, a CPU, ROM, RAM, etc.), and 102 is a main memory (for example, RAM)
Etc.), 103 and 104 are LAN interface circuits (for example, can be realized by various CMOSs, transistors, etc.), 105 is a transmission / reception buffer memory for relay (can be realized by RAM, etc.), 10
6 and 107 are filtering tables (eg,
It can be realized by CPU, ROM, CAM, etc.).

Reference numeral 120 is a first LAN, and 121, 1
LAN of the bridge device 100 and the terminal devices shown at 22 and 123
The interface circuit 103 is connected. Also, 1
Reference numeral 30 denotes a second LAN, to which the terminal devices indicated by 131, 132, 133 and the LAN interface circuit 104 of the bridge 100 are connected. 103 and 104 can be realized by various CMOSs, transistors, and the like, for example.

In order to make the following description easy to understand, it is assumed that the MAC addresses of the terminal and the LAN interface circuit are the numbers in FIG. That is, for example, the MAC address of the terminal 121 is 121 and the MAC address of the LAN interface circuit 103 is 103.

In FIG. 2, the same L is stored in the filtering table 106 in the LAN interface circuit 103.
The MAC address connected to the AN is registered.
That is, it is assumed that 121, 122, and 123 are registered as MAC addresses in the filtering table 106.

If a CAM typified by Am99C10A described above is used as a memory constituting the filtering table 106, the MAC address of the received data and a plurality of MAC addresses registered in the CAM can be compared at high speed. However, if a matching MAC address exists in the CAM, it is data addressed to the MAC address in the same LAN, and there is no need to relay the data by the bridge. Therefore, the received data can be discarded. If the MAC address to be used does not exist in the CAM, the received data is stored in the relay transmission / reception buffer memory 105 in order to relay the data by the bridge.
Further, the filtering table 107 in the LAN interface circuit 103 may have a similar configuration.

As an example of data relay by a concrete bridge, a case where the terminal device 123 transmits data to the terminal device 133 connected to the second LAN 130 will be described.

First, transmission data is transmitted through the LAN 120 to the LAN interface circuit 103 of the bridge 100.
Sent to. Since the destination MAC address of the transmission data does not exist in the same LAN, that is, it is not registered in the filtering table 106, the bridge 100
Is stored in the transmission / reception buffer memory 105 for relay under the control of the processor 101,
From the LAN interface circuit 104 to the second LAN1
Send to 30. Then, finally, the transmission data reaches the terminal device 133.

Further, as an example in which the transmission data is filtered by the bridge, the terminal device 121
Is the terminal device 12 connected to the first LAN 120.
A case where data is transmitted to 2 will be described. The transmission data is sent to the terminal device 12 via the first LAN 120.
2 to the LAN interface circuit 103 including the bridge 100.

The destination MAC address of such transmission data exists in the same LAN, and the filtering table 1
06, and the LAN interface circuit 10
3 is discarded. As a result, the transmission data is not relayed to the second LAN.

As described above, in order to realize the MAC address filtering function by the bridge, the conventional C
In AM, MA that has registered one MAC address
It is used as a means to detect at high speed from the C address.

[0023]

The conventional associative memory is
One input data (in the above example, the destination MAC address of the received packet) and a plurality of data set in advance in the associative memory (in the above example, the MAs of the terminals in the same LAN).
It was possible to perform a data search by simultaneously performing a comparison process of (C address) and a plurality of comparators. Therefore, it has been used as a means for the above-mentioned bridge filtering process.

However, in recent years, routers that connect networks at the network layer, which is an upper layer of the data link layer, are required to have various filtering functions in order to guarantee security in the network connection. There are some cases where memory cannot handle it.

Specifically, the transmission data having a specific IP address (for example, the personnel department of a company) is not relayed indefinitely but the function of the router discarding it, or conversely, the specific I
There has been a demand for a function of relaying only transmission data having a P address (for example, a sales department of a company) and discarding data having another IP address by a router.

For example, in hexadecimal notation, "7FFF00
00 (h) ”(h indicates hexadecimal notation) to“ 7F
When the router receives the transmission data from the terminal device having the IP address up to “FF00FF (h)”,
It is assumed that the router implements the function of discarding the received data without relaying it.

In this case, considering that the processing is performed by the search database means configured using the conventional CAM, the IP address to be filtered is "7FF.
It is necessary to individually register 256 addresses from “F0000 (h)” to “7FFF00FF (h)” in the CAM. Therefore, the function of IP address filtering as a router is
Satisfaction with insufficient functions while keeping the number of addresses limited, or CA on a large scale ignoring economics
It is necessary to use M.

If only a pattern of one address is processed as in this example, it is possible to perform filtering by the arithmetic processing performed by the processor (corresponding to 101 in FIG. 2) included in the router. , A plurality of IP address bit patterns to be filtered (for example, in addition to the above IP filtering, "7FF8
If there are multiple conditions such as discarding IP addresses from "0000 (h)" to "7FF8000F (h)", the processor of the router processes the filtering conditions in order if they exist. Therefore, there is a performance problem that the relay processing speed decreases.

Also in the bridge, there is a demand for a kind of filtering function for security, such as the above-mentioned IP address filtering function, using the MAC address.

For example, since the MAC address has a bit field or the like representing the device manufacturer, as filtering using this, a specific manufacturer field data, that is, a transmission packet from a terminal of a specific manufacturer is transmitted. The function is that the bridge performs a discarding process so as not to relay to another LAN.

Further, in recent years, a communication device having both a bridge function and a router function has appeared. In such a communication device, in order to realize the filtering function,
Both the MAC address (48 bits) and the IP address (32 bits) need to be processed.

The object of the present invention is to provide the IP as described above.
It is to provide a memory means for realizing a filtering function at high speed by designating a variable-length bit pattern of an address or a MAC address, that is, designating a bit mask.

Further, an object of the present invention is to provide a mixture of data having network addresses having different lengths such as a MAC address (usually 48 bits) and an IP address (usually 32 bits). It is to provide an economical memory means for registering address data, searching registered address data at high speed.

[0034]

[Means for Solving the Problems] In order to solve the above problems and achieve the above object, the following means can be considered.

That is, an input data register for receiving and holding L-bit (L is an integer of 1 or more) data and an X-bit (X is an integer of L or more) data for receiving and holding. , M (M is an integer greater than or equal to 1) database registers, data writing means for writing data to the input data register and the database register, and data held in the input data register and the database register. It is determined whether or not the contents of the held data are matched for each bit, and if all L comparison results are determined to match, a determination result indicating that all bits match is output. Database register comparing means, and at least one or more of the M determination results by the database register comparing means are all bit-one. When showed the fact, and outputs the information to the effect that the data match, to at least and a data match detecting means.

Then, a database mask register capable of designating, in bit units, whether the data held by the database register is to be judged by the database register comparison means (valid) or not (invalid), The data writing means is provided for each of the database registers, and it is possible to specify validity or invalidity in the bit unit to the database mask register via the means, and further, the data held in the database register. Among these, the memory is provided with a bit mask control means for generating a control signal so that the database register comparison means makes the determination target only for the data corresponding to the bit designated by the database mask register as "valid".

In order to achieve the above-mentioned object, the following means can be considered.

That is, an input data register for receiving and holding L-bit (L is an integer of 1 or more) data, and an input data register for receiving and holding X-bit (X is an integer of L or more) data. , M (M is an integer of 1 or more)
Database register, data writing means for writing data to the input data register and the database register, and the contents of the data held in the input data register and the data held in the database register for each bit. It is determined whether or not they match, and when all L comparison results are determined to match, the M database register comparing means and the database register comparing means for outputting the determination result indicating that all the bits match. At least 1 of the M determination results by
When the above indicates that all bits match, at least data matching detection means for outputting information indicating data matching is provided.

Of the L-bit data held by the input data register, the first effective data length (length Na bit: Na is 0 or more) indicating the data portion to be judged by the database register comparing means. , L or less), a valid input data length register,
A second effective data length (length Nb bit: Nb is an integer of 0 or more and L or less) indicating a data part to be determined by the database register comparing means among the L-bit data held by the database register. ), Which is provided in each database register, and the contents of the effective database length register and the first effective data length (Na bits) and the respective second effective data lengths (Nb bits) are “matched” or M number of valid data length comparing means for comparing and judging "mismatch", and the data writing means, via the means, to the valid input data length register and the valid database length register, the first valid data. The data length and each of the second valid data lengths can be written, and further, the valid data length control means is provided. Then, when the valid data length comparison means determines “match”, the valid data length control means stores the valid data length register in which the second valid data length, which is the target of the determination, is set. When the corresponding determination result of the database register comparison means is input to the data coincidence detection means and it is determined as “mismatch”, the second valid data length which is the target of the determination is set to be valid. It is a memory which does not use the judgment result of the database register comparing means corresponding to the database length register as an input to the data coincidence detecting means.

[0040]

The constituent elements of the database (for example, the above-mentioned filtering database) to be searched in advance are set in the database register. At this time, a certain “range” (for example, the range of the above-mentioned IP address filtering) is designated for the data as the constituent elements of the database. This "range" is designated by the bit position of the data, and the designated value is called mask data and is preset in the database mask register.

In the present invention, as described above, since each database mask register is provided for each database register, the mask data may be different for each constituent element of the database.

Next, the data to be searched is written in the input data register. In the present invention, the contents of the input data register and the contents of each database register are compared on a bit-by-bit basis, and the bit mask control means determines the "range" based on the contents of the mask data set in each corresponding database mask register. The bit position indicating “” is excluded from the comparison target, and the database register comparison means is controlled as the matched bit regardless of whether the comparison result for each bit is coincident or not. As a result, a data search can be performed by designating a variable-length bit pattern, that is, a bit mask, for each component of the database.

There is also the following action.

First, the components of the database to be searched (for example, the above-mentioned filtering database) are set in the database register in advance, and the information Nb indicating how many bits each component of the database is valid is set as the valid data. -Set the database length register. In the present invention, as described above, since each valid database length register is provided for each database register, the valid data length may differ for each constituent element of the database.

Next, the data to be searched and its effective data length Na are input to the input data register and the effective input data.
Write to the data length register. In the present invention, by comparing the contents of the input data register and the contents of each database register bit by bit, it is determined whether or not they match in word units, and the contents Na of the effective input data length register Even if the contents Nb of the valid database length register are judged to match, if the data register does not match the valid data length (Na = Nb), it is judged to be "mismatch" even if it matches the contents of the input data register in word units. Then, the effective data length control means controls the input signal of the data coincidence detection means.
This makes it possible to handle data having different data lengths.

[0046]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT An embodiment of a CAM according to the present invention will be described below with reference to FIGS.

FIG. 1 shows a memory device (CA) according to the present invention.
It is a block diagram of one example of M).

In FIG. 1, 1 is a CAM of one embodiment of the present invention, and 2 is a data decision circuit cell for one entry of CAM 1. Here, one entry means a determination processing mechanism corresponding to one data element of the database.

Reference numeral 3 denotes an external interface circuit which is a data writing means (in the present embodiment, a CAM is externally supplied).
The internal register is a readable and writable interface circuit), and can be realized by a bus driver circuit or the like.

Reference numeral 4 is an input data register, which can be realized by an electronic device such as a flip-flop circuit.
Reference numeral 5 is a match detection circuit that finally determines whether or not the data that matches the input data exists in the CAM, and can be realized by an electronic device such as various logic circuits.

A plurality of data decision circuit cells 2 (M pieces: M is an integer of 1 or more) are provided in the CAM 1. Each data determination circuit cell 2 includes a database register 21 and
It is determined whether or not the contents of the data held in the database mask register 22, the input data register and the data held in the database register match for each bit, and L pieces (the input data register has L bits L is an integer greater than or equal to 1), and when it is determined that all the comparison results match, a database register comparison unit that outputs a determination result indicating that all bits match, and the database register Among the data held in the database, only the data corresponding to the bit designated by the database mask register as "valid (when the data held by the database register is to be judged by the database register comparing means)" is stored in the database. Generate a control signal so that it can be judged by the register comparison means. Bitmask function comparator circuit 2 for realizing the functions of the bit mask controller is a means for
It is configured with 3.

FIG. 3 is an explanatory diagram for explaining an operation example inside the data determination circuit cell 2 for one entry of the CAM 1. The operation of the data determination circuit cell 2 for one entry of the CAM 1 will be described below.

In FIG. 3, 31 is the contents of the database register 21 for one entry, 32 is the contents of the input data register 4, 33 is each bit of the contents 31 of the database register and the contents 32 of the input data register. Simple comparison result (without masking) of 34,
Is the database mask register 2 for one entry
It is the content of 2. Further, 35 is the content 3 of the database mask register with respect to the above-mentioned simple comparison result 33.
4 is the result of performing the masking process according to 4. Reference numeral 36 is flag information indicating whether or not all bits of the comparison result 35 after the mask processing match with each other. In other words, the input data and the contents 31 of the database register perform the comparison processing by performing the mask processing. As a result, it is a flag indicating whether or not there is a match in word units.

In this embodiment, one entry, that is,
The data length X of the database register for one word and the data length L of the input data register and the database mask register for one entry are both 48 bits.

Therefore, it is assumed that (XL) is "0 bit" and does not exist.

In the database register, the constituent elements of the database to be compared are set in advance.

In FIG. 3, for example, "34
It is assumed that "5678900001 (h)" (h represents a hexadecimal number) is set in the upper 48 bits (= L). In FIG. 3, the most significant bit is bit0 and the least significant bit is bit47. Further, in order to simplify the description, in FIG.
Up to 5 is omitted.

On the other hand, in the input data register 4, as data to be searched, for example, "745678900"
"001 (h)" is given, and comparison is made for each bit of the database register. "1" if the comparison result matches, and "0" if the comparison result does not match.
Then, in the simple comparison result 33, only bit 1 is “0” and all other bits are “1”.

Further, as the contents 34 of the database mask register, it is assumed that only bit 1 and bit 2 are not to be compared, that is, masked, and the other bits are given mask data to be compared. If the bit to be masked is represented as "1" and the bit not to be masked is represented as "0", the contents of the database mask register 34
Is a value for which "600000000 (h)" is set.

Next, according to the contents 34 of the database mask register, of the simple comparison result 33, the comparison result of the bit position for which the mask is designated is ignored, and another bit position, that is, the bit for which the mask is not designated is designated. Only the comparison result at the position is subjected to the word-unit match determination. In order to perform the mask operation for each bit, in the present embodiment, the comparison result of the bit positions for which the mask is designated is
Bit content (0 or 1) in simple comparison result 33
Regardless of, it is assumed that they match and is set to "1". Therefore, in order to determine the match in word units, it is sufficient to determine whether or not all the bits are “1” in the comparison result 35 after the mask processing.

In the present embodiment, since the bit "1" which is judged as a mismatch by the simple comparison result 33 is masked, the content of the comparison result 35 after the mask processing is "FFFFFFFFF".
FFF (h) ”, that is, all bits are“ 1 ”,
The flag information 36 is “1” indicating the match in word units.

Next, an example of a circuit for performing the processing of FIG. 3 will be described with reference to FIG.
Will be described with reference to.

FIG. 4 shows an example of the structure of the data decision circuit cell 2 for one entry. In FIG. 4, 210 is 1
One bit of the database register 21 for an entry. In FIG. 4, it is assumed that it is a 1-bit register for holding bit 0 of the content 31 of the database register in FIG. One bit of register is
Specifically, it can be configured by a flip-flop circuit.

Similarly, 220 is the b of the contents 34 of the database mask register 22 for one entry in FIG.
Assume that the register is a 1-bit register for holding it0, and 400 is the bi of the contents 32 of the input data register 4.
It is assumed that the register is a 1-bit register for holding t0. Reference numeral 230 denotes the above-mentioned bit-wise mask operation,
That is, it is assumed that it is one bit of the comparison circuit 23 in FIG. 1 having a bit mask function. In the present embodiment, the comparison circuit 23 with a bit mask function requires L = 48 bits, and the combination of the database register 21, the database mask register 22, and the input data register 4 from bit 1 to bit 47 is also used as each input. However, since it is obvious that only the comparison processing of bit0 is described, the description thereof will be omitted in FIG.

In FIG. 4, the comparison circuit 230 with a bit mask function for 1 bit first has a database register 210 for 1 bit and an input data 40 for 1 bit.
To determine a match with 0, if both are "1", the output is set to "1". In other cases, the AND circuit 231 outputs "0", and if both are "0", the output is set to "1". And a NOR circuit 232 that outputs "0" in the other cases, is provided to configure the output of the AND circuit 231 and the NOR circuit 232.
An OR circuit 233 is further provided in which the output is set to "1" when either or both of the outputs are "1" and the output is set to "0" when both are "0". .

Further, when the 1-bit database mask register 220 is “masked”, that is, “1”, the output of the OR circuit 233 is shown to indicate “match” regardless of the output of the OR circuit 233. The output of the database mask register 220 for 1 bit is compared with the OR circuit 234.
Input to. The output of this OR circuit 234 is
This is the comparison result of the processing with the mask function for 1 bit.

Further, in order to flag all bit matches of the comparison result after the mask processing shown in FIG. 3, the output of the OR circuit 234 for each bit is input to the AND circuit 235. The output of the AND circuit 235 corresponds to the flag information 36 for one entry shown in FIG.

Next, the operation of the coincidence detection circuit 5 in FIG. 1 and an example of processing the search result of the input data using the CAM according to the present invention will be described.

The CAM 1 has M data decision circuit cells for one entry. For example, if M = 256, 256 pieces of flag information 36 are present in CAM1, and if even one of them has a "1" flag indicating all bit matches, it is set in the input data register. It is understood that the obtained data (for example, MAC address) has a matching data pattern in 256 databases (for example, MAC address) with bit mask patterns registered in the CAM in advance. On the contrary, if all the 256 pieces of flag information 36 are "0" flags that do not indicate all bit matches, the value set in the input data register (for example, M
AC address) is a database of 256 databases with bit mask patterns registered in advance in the CAM (for example,
It can be seen that there is no matching data pattern in the MAC address).

Therefore, if only the search result indicating whether the input data exists in the masked database in the CAM, the match detection circuit 5 in FIG. 1 determines the M (for example, 256) flags. A circuit that determines whether at least one flag of the information 36 is "1" indicating all-bits matching or all flag information 36 is "0" indicating no all-bits matching, that is, , OR circuit.

Further, the coincidence detection circuit 5 is provided with a register for holding the output of the OR circuit which is the judgment result, and is connected to the external interface circuit 3 as shown in FIG. It becomes possible to grasp the search result of the CAM from the outside (for example, the above-mentioned router, the processor of the bridge, etc.).

The above is the description of the operation of the CAM in which the bit mask function for realizing the search range designation for each component of the database of the present invention is added to each entry.
By setting each register length to 48 bits, for example, MA
It is applicable to the filtering table for C address. To apply the CAM described above to a filtering table for IP addresses, each register length is configured with 32 bits, or the lower 16 bits of a 48-bit register, that is, bits 32 to 47.
You can mask up to use.

Depending on the CAM application system,
The contents of the input data register are the components (ie, entries) in the masked database in the CAM.
Therefore, it may be necessary to grasp whether or not it is determined that the word unit matches.

For example, assuming that there are a plurality of patterns of MAC addresses to be discarded (for example, the manufacturer number of the terminal device) in the bridge that realizes the above-mentioned security function, the number of discarded packets is statistic for each pattern. This is a case where information is counted. For such an application, the present invention uses the comparison process with the bit mask function to determine the entry number of the database register that is determined to match the contents of the input data register on a word-by-word basis (for M entries, " 0 ”to“ M-
1 ”) can be read externally.

For example, in the coincidence detection circuit 5 of FIG.
A register that holds all entries (that is, M entries) of the determination result of the data determination circuit cell 2 for one entry (this is referred to as "entry index register").
Is provided so that the index register of the entry can be read from outside the CAM.

Further, as the contents of the entry index register, the determination result of the data determination circuit cell 2 for one entry is not held as it is, but the entry number (M number of entries, for which the match is detected,
"0" to "M-1") may be coded and read. For example, in the case of M = 256, if the database register of the fifth entry number matches the data of the input register as the mask processing result, the contents of the entry index register are as follows:
It may be set to 05h. Thus, C
If the entry number of the database register that matches the input data in the AM can be obtained from the outside, which element (data) in the database can be easily grasped.

Further, depending on the application system of the present invention, the processing to be performed after the matching determination processing differs for each constituent element of the database (that is, data preset in the database register) that matches the input data to be searched. There are cases.

In the present invention, it is possible to realize a function for assisting the discrimination of the operation to be performed by the application system side after the data retrieval. An embodiment will be described with reference to FIG.

Similar to FIG. 3 described above, FIG. 8 compares the contents 32 of the input data register and the contents 31 of the database register for one entry with bit mask processing according to the contents 34 of the database mask register of the same entry. It is explanatory drawing which shows the operation example at the time of performing a process.

In the embodiment shown in FIG. 8, the number of bits X forming one word of the database register is 52 bits, and the number of bits L forming one word of the input data register and one word of the database mask register is 48.
The difference from FIG. 3 is that the bits are used, and other configurations and register contents are the same as those in FIG.

In FIG. 8, the lower (XL) bits (4 bits in this embodiment) in the database register are stored in advance.
Regarding the above, when the result of the comparison process involving the bit mask process between the data of the upper L bits and the content 32 of the input data register is a match, that is, the content of the flag information 36 indicating all bit matches is “1”. CAM when
The external device, for example, the operation information of the processor provided in the CAM will be described. The lower (XL) bits in this database register will be referred to as the "motion information field".

A case where the application system of the present invention is a bridge device and the destination MAC address of a received packet is searched will be described below. The bridge device relays or discards the received packet according to the MAC address of the received packet, records it as statistical information although it relays it, displays an alarm message to the network administrator, and prepares for the bridge. Suppose that you have to sound a buzzer, which is an example of the warning means.

In such a case, in the operation information field of the database register described above, a packet including the MAC address as the operation information in advance is filtered, that is, "1" in the case of discarding, and an alarm message to the operator. If you want to display it, you can set "2" (or other information that various operations such as data relay should be performed in advance) and set meaningful data. When the search result matches the content of the input data register, the operation information field of the database register of the entry is read, whereby the operation to be performed by the processor outside the CAM can be processed at high speed.

Next, an example of an application system using the present invention will be described with reference to FIG.

FIG. 5 is an example of a network connected by routers using the present invention.

In FIG. 5, reference numeral 500 denotes a router 501.
Is a processor, 502 is a main memory, 503, 504
Is a LAN interface circuit, and 505 is a transmission / reception buffer memory for data relay. The main memory 502 and the transmission / reception buffer memory 505 for data relay are the memory LS.
It can be realized by an electronic device such as I. Further, the LAN interface circuits 503 and 504 are usually commercially available for controlling the physical layer and the MAC layer of the LAN, and can be realized by a communication LSI.

Reference numeral 506 is a CAM according to the present invention.
However, in order to simplify the description, in this embodiment, the input data register length L is 32 bits, which is the same as the IP address, and the database register length X is 36 bits.

The CAM 506 is assumed to be connected via the internal bus of the router 500 so that the processor 501 can access it.

The network A is connected to the LAN interface circuit 503, and the LAN interface circuit 5 is connected.
It is assumed that network B is connected to 04.

Further, it is assumed that the terminal a1 and the routers r1 and r2 are connected to the network A, and the network r and the router r2 are connected to the router r1.
It is assumed that the network D is connected to.

Further, the terminal c1 and the terminal c2 are connected to the network C, and the terminal d1 is connected to the network D.
And the terminal d2 are connected. On the other hand, it is assumed that the network B is connected to the terminals b1, b2, and b3.

The router 500 in this embodiment is a LAN
Of the packet data received by the interface circuit 503, only packets originating from a host (that is, a terminal or a router) on the network A are network B.
On the other hand, it is assumed that a kind of security function of filtering packets to be relayed and originating from a host on another network is required. The packet source is TCP
In the / IP protocol, it is the source IP address of the IP header field in the IP packet.

In FIG. 5, the hosts on the network A are only the terminal a1, the router r1, and the router r2.
The router 500 relays only the packets transmitted by these hosts to the network B, and the routers r1 and r2 relay the packets from the network C and the network D to the network A. , And is discarded without being relayed to the network B.

In the present embodiment, each network address, that is, the IP address, has the upper 16 bits indicating the network and the lower 16 bits indicating the host. In FIG. 5, for example, the IP address of network A is “8F000000
(H) ”, the IP address of network B is“ 8800
0000 (h) ”, the IP address of the network C is“ 8F100000 (h) ”, and the IP address of the network D is“ 8F200000 (h) ”.

Regarding the IP address of the terminal, for example, the IP address of the terminal a1 is "8F000001".
(H) ”, the IP address of the terminal b1 is“ 8800000 ”
18h) ", and the IP address of the terminal b2 is" 880000 ".
02 (h) ”and the IP address of the terminal b3 is“ 88000 ”.
003 (h) ”, and the IP address of the terminal c1 is“ 8F10 ”.
0001 (h) ”and the IP address of the terminal c2 is“ 8F1 ”
0000 (h) ", and the IP address of the terminal d1 is" 8F
200001 (h) ”, and the IP address of the terminal d2 is“ 8
F20002 (h) ".

In the router 500, the network A
The possible IP address of the above host, ie
From "8F000000 (h)" to "8F00FFFF
If the IP address up to (h) ”is the source of the received packet of the LAN interface circuit 503, the packet needs to be relayed to the network B. Therefore, in advance, for one entry of the CAM 506, for example, for the first entry, “8F000000 (h)” is set in the upper 32 bits of the database register and “0000FFFF (h)” is set in the database mask register. However, a value (for example, "0h") representing "relay" is set as the above-mentioned operation information in the lower 4 bits (XL bits) of the database register, that is, in the operation information field.

On the contrary, in order to discard the packet transmitted from the host on the network C, the CAM is previously set.
For another entry of 506, for example, the second entry, in the upper 32 bits of the database register, “8
"F100000 (h)", "0000FFFF (h)" is set in the database mask register, and the lower 4 bits (X-L bits) of the database register, that is,
"Discard" in the operation information field as the operation information described above.
A value (for example, “1h”) that represents is set.

Similarly, in order to discard the transmission packet from the host on the network D, "8F2000" is set in the upper 32 bits of the data base register in advance for another entry of the CAM 506, for example, the third entry.
00 (h) ”,“ 000 ”in the database mask register
0FFFF (h) "is set, and the lower 4 bits (X-L bits) of the database register, that is, the value indicating" discard "as the operation information in the operation information field,
(For example, "1h") is set.

Now, assuming that an IP packet is transmitted from the terminal a1 to the terminal b2, the packet is stored in the transmission / reception buffer memory 505 for data relay via the LAN interface circuit 503.

The processor 501 determines the source IP address of the packet, that is, "8F000001 (h)".
Are set in the input data register of the CAM 506. The CAM according to the present invention compares the contents of the input data register and the contents of the upper 32 bits of the data base register of all entries with a bit mask function.

In this case, in the first entry, since the only difference between the two is the bit position to be masked, it is determined that they match in word units. The processor 501 finds the CAM search result, that is, the entry number that matches the data set in the input data register,
That is, by knowing "No. 1", the value "0h" representing "relay" is obtained as the corresponding operation information. Therefore, the processor 501 determines that the IP packet should be relayed and performs the relay process.

Further, the IP address is transmitted from the terminal c1 to the terminal b2.
If a packet is sent, it
It is stored in the relay transmission / reception buffer memory 505 via the interface circuit 503.

The processor 501 sends the source IP address of the packet, that is, "8F100001 (h)".
Are set in the input data register of the CAM 506.

The CAM according to the present invention compares the contents of the input data register and the contents of the upper 32 bits of the data base register of all entries with a bit mask function. In this case, in the second entry, since the only difference between the two is the bit position to be masked, it is determined that they match in word units. Therefore, the processor 501 knows the search result of the CAM, that is, the number of the entry that matches the data set in the input data register, that is, the number 2, and the value "1h" representing "discard" as the corresponding operation information. You can get Therefore, the processor 501
The P packet is not relayed, it is determined that it should be discarded, and the discard process is performed.

As described above, the CAM according to the present invention
With the router using, the IP address filtering as a network security function can be performed at high speed.

Next, in the case where data having different data lengths are mixed such as the MAC address (48 bits) and the IP address (32 bits), which is the second object of the present invention, the data search and match determination functions are performed. An example for realizing this will be described.

In recent years, a device called a bruta has been proposed which has both a bridge function and a router function.
Brutor acts as a router for certain network layer protocols (eg, TCP / IP protocol) and as a bridge for other types of network layer protocols (eg, OSI's CLNP protocol). It is a device that operates.

As a simple method for retrieving data of different lengths with one type of CAM, data of which the data length of the database register is a fixed length, as in the above-mentioned embodiment and conventionally known CAM, is used. By using a memory device configured to have a determination circuit cell, a block having a plurality of fixed data lengths (for example, CAM data lengths L = 48 and L = 32) is simply used as a one-chip semiconductor such as an LSI. A method of integrating as a circuit is considered. This is technically the same as using a plurality of CAMs having different data lengths, and can be easily realized from the above-described embodiment, so the description thereof will be omitted.

An embodiment in which the CAM data length L can be made variable for each entry will be described below with reference to FIGS. 6 and 7.

In FIG. 6, the constituent elements having the same numbers as those in FIG. 1 have the same functions as the constituent elements described in FIG. Further, in this embodiment, X = L = 48 bits is set as in the above-described embodiments.

In FIG. 6, reference numeral 10 is a valid input data length register, and through the external interface circuit 3,
The configuration can be set from the outside.

The valid input data length register 10 is assumed to be a Ya-bit register composed of Ya flip-flops, and in this embodiment, for example, Ya = 8 bits.

In the 8-bit effective input data length register 10, the effective number of bits (Na) of the input data set in the input data register 4 is set.

Here, the effective number of bits is the number of bits actually meaningful as data in the register. For example, if the input data to be searched is an IP address,
That is, in the case of 32-bit data, since the input data register is composed of 48 bits, it is unavoidable to set 48-bit data as the input data to the CAM, but the effective input data length register 48 for 10
As the number of bits of meaningful data in the bit input data, Na = 32, that is, 20 in hexadecimal notation.
Set (h).

Further, in FIG. 6, a plurality of (for example, M) data decision circuit cells 2 are provided in the CAM 1,
Each data judgment circuit cell 2 has a database register 21.
And a valid database length register 24 and a comparison circuit 25 with a valid data length determination function.

The effective database length register 24 stores Yb
It is assumed that the register is a Yb-bit register composed of a plurality of flip-flops, and in the present embodiment, for example, Yb = 8 bits.

In this 8-bit effective database length register 24, the effective number of bits (Nb) of the data set in the database register of each entry is set.

For example, in the database register, MAC
If the address is set, Nb is 48,
That is, 30 (h) in hexadecimal notation, 32 is set as Nb when an IP address is set, that is, 1
Hexadecimal expression 20 (h) is set in the effective database length register 24.

Further, the comparison circuit 25 with the effective data length judgment function is the comparison circuit 2 with the bit mask function shown in FIG.
Similarly to 3, a database register 21 having a valid data length of Na = Nb, which is a circuit that can be realized by a logical element such as an AND circuit and an OR circuit, and the contents of the input data register 4 are compared in bit units. , All-bits match, that is, a circuit for determining whether or not matches are made in word units, and a concrete description of the comparison process will be given with reference to FIG. 7.

FIG. 7 is an explanatory diagram of an operation example inside the data determination circuit cell 2 for one entry of the CAM 1. Below, C
The operation inside the data determination circuit cell 2 for one entry of AM1 will be described.

In FIG. 7, 310 is the contents of the database register 21 for one entry, and 320 is the contents of the input data register 4. Here, in order to simply configure the comparison circuit 25 with a valid data length determination function in the present embodiment, for convenience, the contents of the valid database length register 24 of this entry are connected immediately after the database register 21. Then, by arranging from bit 48 to bit 55, the content 310 of the database register is 5
Expressed in 6 bits.

Similarly, the contents of the input data length register 10 are concatenated immediately after the input data register 21 and arranged from bit 48 to bit 55, and the contents 320 of the input data register are 56 bits. It is represented by.

Therefore, the comparator circuit with a valid data length determination function can determine the valid data length match (Na = Nb) by performing a 56-bit bit comparison process. The contents of the comparison processing result in units of 56 bits are shown in 330.
340 indicates flag information indicating whether or not the result of the 6-bit comparison process is a match for all the bits.

It is assumed that the input data to be searched is a 32-bit IP address and a 48-bit MAC address is set in advance in the database register of this entry. Effective database length Nb of this entry
Is 30 (h) and the effective input data length Na is 20 (h). In this case, the contents of the database register 310
When the contents 320 of the input data register are simply compared with each other, a mismatch occurs at the position of the bit 51, and the bit 51 of the bit-by-bit comparison result 330 has the value “0” indicating the mismatch. Therefore, the flag information 340 indicating that all bits match has a value “0” indicating a mismatch.

As described above, by performing the comparison in consideration of the effective data length, it is possible to search even if the data having different data lengths are mixed, and the CA that can handle the variable length data.
M can be realized. As a result, in applications such as the above-mentioned bruta, not only the performance effect of high-speed processing but also the MAC address and IP address of one type of C
Since it is possible to search by AM, there is also an economical effect of reducing the device cost.

In the embodiment described with reference to FIGS. 6 and 7, both the database register length X and the input data register length L are 48 bits. In the register (X-
An L) bit motion information field may be provided.

Furthermore, as another embodiment, a configuration for simultaneously realizing the first and second objects of the present invention, that is, for fixed-length input data registers and all database registers Alternatively, a register may be provided that indicates the effective data length, and a register that performs a comparison process with a bit mask function for each database register and a comparator may be provided.

As described above, according to the embodiments of the present invention and the combination thereof, not only the CAM is made highly functional, but also its application range is expanded. In particular, according to the present invention, even if one kind of CAM is used, its application range can be widened and can be generalized, so that an industrial effect that a mass production as a one-chip memory LSI is possible is expected. it can. Such mass production contributes to the activation of related industries, and effectively presents the ultimate legal purpose of the patent law, which is the development of industry.

On the contrary, by configuring the CAM of the present invention described above (portion indicated by "1" in FIGS. 1 and 6) by a one-chip semiconductor integrated circuit, high performance and high functionality can be achieved. There is an effect that the communication control device can be downsized.

[0130]

The memory according to the present invention makes it possible to detect registered data as a search target, and whether or not given data exists in the search target at high speed in bit units. , A router, a bridge, etc., it is possible to realize a high-speed filtering function by designating a variable-length bit pattern of an IP address or a MAC address, that is, by designating a bit mask.

[Brief description of drawings]

FIG. 1 is a configuration diagram of an embodiment according to the present invention.

FIG. 2 is an explanatory diagram of a configuration example of a network using a conventional bridge device.

FIG. 3 is an explanatory diagram of the operation of the data determination circuit cell according to the present invention.

FIG. 4 is a configuration diagram of a data determination circuit cell for one entry.

FIG. 5 is an explanatory diagram of a configuration example of a network using a router device that uses a memory according to the present invention.

FIG. 6 is a configuration diagram of another embodiment according to the present invention.

FIG. 7 is an explanatory diagram of the operation of the data determination circuit cell of the memory according to the present invention, which corresponds to variable length data.

FIG. 8 is an explanatory diagram of the operation of the data determination circuit cell using the operation information field.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Associative memory, 2 ... Data determination circuit cell for 1 entry of CAM, 3 ... External interface circuit, 4 ... Input data register, 5 ... Match detection circuit, 10 ... Input data length register, 21 ... Database register, 22 ... database mask register, 23 ... comparison circuit with bit mask function, 24 ... effective database length register, 25 ...
Comparison circuit with effective data length determination function, 100 ... Bridge, 230 ... Comparison circuit with bit mask function for 1 bit of comparison circuit, 500 ... Router

─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inoue Shunada Sawada 292 Yoshida-cho, Totsuka-ku, Yokohama-shi, Kanagawa Hitachi, Ltd. Microelectronics Equipment Development Laboratory (72) Inventor Hirono Enomoto 810 Shimoimazumi, Ebina-shi, Kanagawa Hitachi, Ltd. Office System Business Department (72) Inventor Yoshito Sako 810 Shimoimaizumi, Ebina City, Kanagawa Prefecture Hitachi System Office System Business Department (56) Reference JP 3-12896 (JP, A) JP-A 1-220293 (JP, A) JP-A 4-21997 (JP, A) JP-A 5-153125 (JP, A) (58) Fields investigated (Int.Cl. ⁷ , DB name) H04L 12/46 100 G11C 15/04 601 G11C 15/04 631 H04L 12/56

Claims (7)

(57) [Claims] 1. A plurality of first data is held in advance and is stored externally.
Second data input from the above and the plurality of first data
In the memory device for determining whether or not match, L has a length of L bits (L is an integer of 1 or more),
An input data register for holding the data of 2 and a length of X bits (X is an integer greater than or equal to L),
And database registers of M (M is an integer of 1 or more) for holding a respective first data number, the first said and said second data held in the entering force data register is held in the database register De 1
Data for each bit and determine whether all
If the Tsu bets are matched, and M database registers comparing means you output a determination result indicating that all bits match, at least one or more of the M decision result that by the said M pieces of database registers comparing means If but it had shown all bits match, and Lud over data coincidence detecting means to output the information to the effect that the data match, Chi cormorants <br/> of the second data held in the input data register before serial first effective data length shows the data unit to be in the determination target by the database register comparison means (length Na bit: Na is 0 or more, L an integer) Yes <br/> effective input data length is set a register, provided for each of the database register, among the first data held in the database register, the second effective shows the data unit to be in the determination target by the database register comparison means Over data length (length Nb bit: N
b is 0 or more, and M usable database length register that X an integer) is set, the first valid data length (Na bits) and each of the two valid data length (Nb bits) and matches Determine if it is a mismatch
M valid data length comparing means for determining, and the database register comparing means determines that the valid data length comparing means match,
The second data held in the input data register
Of the first effective data length (Na bits) of the
And the first database held in the database register
Of the second effective data length (Nb bits) of the data
Judgment result whether all bits of data match or do not match
Is output to the data match detection means, and the valid data length comparison means determines that there is no match,
The second data and the first data match bit by bit.
Whether or not to execute
A memory device characterized in that the data is output to the coincidence detection means . 2. A communication line connected to the communication line
Interface circuit for transmitting and receiving packet data
Packet data transmitted and received by the interface circuit
Buffer memory for storing data and a plurality of first addresses
Data is stored in advance in the buffer memory.
The second address data included in the packet data and the previous
It is determined whether the plurality of first address data matches.
CAM (Content Addressable M
memory) and the result of the CAM determination.
Packet data stored in the buffer memory.
On a communication line different from the communication line that received the
A communication device that has a processor to
The CAM has a length of L bits (L is an integer of 1 or more), and the second
An input data register for holding the address data of X, having a length of X bits (X is an integer greater than or equal to L),
Address data of M (M is an integer of 1 or more)
Database register and L-bit data held in the input data register
Of these, the first valid data length (length N) indicating the valid data part
a bit: Na is an integer from 0 to L inclusive) is set
The effective input data length register and the database register for each database register.
Valid data among the X-bit data held by the
Second effective data length indicating a part (length Nb bit: Nb is 0
M or more valid databases that are set to an integer from X to X
Length register, the first valid data length (Na bits) and each of the two
Effective data length (Nb-bit) and the match or mismatch or Han
M effective data length comparing means to be defined, and the input data register for each database register.
Of the second address data stored in the data
Data of the first effective data length (Na bits) and the data
The first address data stored in the database register.
Data of the second effective data length (Nb bits) of the data
Data for each bit and determine whether the valid data
If the data length comparison means determines that they match, the above
The determined result is output and the valid data length comparison means is
If it is determined that there is a match, the second address data and the previous
Regardless of whether or not it matches the first address data
M database records that output the determination result of the mismatch
Output from the register comparing means and the M database register comparing means.
At least one or more of the M judgment results
Data that outputs information indicating that the data matches if there is a match
A communication device comprising: a coincidence detection unit. 3. A communication line connected to the communication line
Interface circuit for transmitting and receiving data by
Interface that stores the data sent and received by the interface circuit.
Buffer memory and a plurality of first data in advance,
The second data included in the data stored in the buffer memory
It is determined whether the data and the plurality of first data match each other.
CAM (Content Addressable)
Memory) and the CAM according to the determination result of the CAM.
A processor that processes the data stored in the buffer memory.
The CAM has a length of L bits (L is an integer of 1 or more), and
An input data register for holding the data of X, and having a length of X bits (X is an integer larger than L),
M pieces (M is 1) holding each of the plurality of first data
Database register of the above integer) and the database register for each database register.
The first data held in the star should be the judgment target
Mask information that specifies whether or not to set in bit units is set
M database mask registers, and the database mask register for each database mask register.
Of the first data stored in the register
Each bit specified by the mask information to be judged
Bit mask control means for generating a control signal for instructing
And the database register for each database register.
The control signal of the first data stored in the
Data corresponding to each bit indicated by the
The second data stored in the input data register
The data corresponding to each of the indicated bits
It is determined for each bit whether or not to match, and all bits match.
M database registers that output the determination result of whether or not
Output from the star comparison means and the M database register comparison means.
At least one or more of the M judgment results
Data that outputs information indicating that the data match if there is a match
At least a match detection means, and the lower (X-
In the L) bit area, the operation of the processor is specified in advance.
Operation information to be set is set, the processor is configured to input the input data in the CAM.
The second data stored in the register and any one of the above
The first data held in the database register and
Is determined to match, any one of the above databases
It is set in the area of the lower (XL) bits of the register.
The operation specified by the operation information is read out.
An information processing device, characterized by executing an operation. 4. A plurality of first data is held in advance and is stored externally.
Second data input from the above and the plurality of first data
In the memory device for determining whether or not the two match, the input data holding unit holding the second data and the plurality of data holding each of the plurality of first data.
The database part and each of the database parts are stored in the database part.
The valid data length of the first data
A plurality of effective data length holding units that are stored in the database unit for each database unit.
The valid data length holding unit of the first data to be stored
Wherein said effective data length of the data set in the second de
Data for each bit and determine whether all
Multiple comparisons that output the result of determining whether or not the
Section and the judgment results output from each of the plurality of comparison sections.
Input, and one of the database sections
Whether to hold the first data that matches the data
It has at least a match detection unit that outputs information.
Characteristic memory device. 5. The memory device according to claim 4, wherein each database unit is stored in the database unit.
Whether or not the first data to be judged is to be judged.
Multiple masks with mask information specified in units
The information holding unit and the mask information holding unit holds the database unit.
Of the first data that is
Control to instruct each bit that should be judged
It also has a plurality of bit mask control units for generating signals.
However , each of the comparison units is stored in the database unit.
Of the data of the effective data length of the first data
Among them, each bit designated by the control signal is paired.
The corresponding data and the instruction of the second data
Whether the data corresponding to each bit
A memory device characterized by making a determination for each set. 6. The memory according to claim 1 or 4.
The device consists of a single-chip semiconductor integrated circuit
Memory device characterized by there 7. A communication line connected to the communication line
Interface circuit for transmitting and receiving packet data
Packet data transmitted and received by the interface circuit
Buffer memory for storing data and a plurality of first addresses
Data is stored in advance in the buffer memory.
The second address data included in the packet data and the previous
It is determined whether the plurality of first address data matches.
CAM (Content t Addressable M
memory) and the result of the CAM determination.
Process the packet data stored in the buffer memory.
A communication device having a processor, wherein the CAM is an input data holding unit that holds the second address data.
And holds each of the plurality of first address data
A plurality of database units and, for each of the database units, stored in the database unit.
Valid data length of the first address data to be stored
And a plurality of effective data length holding units for which each of the database units is stored.
The valid data of the first address data
The data of the valid data length set in the length holding unit and the data
For each bit, determine whether the second address data matches
Judgment and output the judgment result of whether all bits match.
The plurality of comparing units that apply the force and the determination results output from each of the plurality of comparing units.
And any one of the database parts is input to the second add
Information about whether or not data that matches the
It has at least a coincidence detection unit that outputs information.
Communication device to collect.