KR100771125B1 - System which limits receiving rate of ethernet traffic for security of cpu and method thereof - Google Patents

Abstract

A system and a method for limiting the reception of ethernet traffic for CPU security are provided to prevent the overload of a system and increase the stability of processors by limiting the volume of receiving packets per second and regulating the volume of packets received to processors. An ethernet controller comprises a central processing part, a received packet processing part, and an interrupt processing routine part. The central processing part establishes a reference value for the volume of packets to receive, and generates an Rx interrupt when packets are received. The received packet processing part checks whether packets are supplied in excess of the established volume. If packets are supplied in excess of the established volume, the received packet processing part notifies the interrupt processing routine part of it. The interrupt processing routine part, notified that packets are supplied in excess of the established volume, inactivates the generation of Rx interrupts.

Description

System Which Limits Receiving Rate of Ethernet Traffic for Security of CPU and Method Thereof}

1 is a diagram illustrating a process of processing a packet received by a reception packet processing unit of a conventional Ethernet controller.

2 is a diagram illustrating a configuration of an Ethernet controller according to the present invention.

3 is a diagram illustrating a process of initializing a network device driver function value in an Ethernet controller according to the present invention.

4 is a diagram illustrating a process of processing a packet received by a reception packet processing unit of an Ethernet controller according to the present invention.

5 is a diagram illustrating a process of monitoring a reception state of a packet in a packet reception state monitoring unit of the Ethernet controller according to the present invention;

6 is a diagram illustrating a process of controlling a packet received by an Ethernet controller according to the present invention.

      <Description of Symbols for Main Parts of Drawings>

210: central processing unit 211: interrupt generating unit

220: interrupt processing routine unit 230: kernel thread generation unit

240: received packet processor 241: incoming packet measurement unit

250: packet reception state monitoring unit 251: incoming packet measuring unit

260: receive buffer

The present invention relates to an Ethernet traffic reception rate limiting system and method for CPU security, and more particularly, all traffic received through the Ethernet controller for CPU security in an Ethernet controller constituting a processor. A method and system for limiting the amount of traffic received.

As communication technologies have evolved, it has become possible to use networks that connect information to each other so that each system can communicate. In the system constituting the network, information is exchanged by sending and receiving packets, and for this purpose, the flow of packets and the congestion of the network are properly controlled. The control typically includes flow control and congestion control.

Flow control refers to controlling the amount of packets flowing into the network in order to avoid congestion caused by the speed difference between the transmitting and receiving terminals or the traffic conditions of the switching network in the packet switched network. Flow control is performed between the node (exchange) and the terminal or between the nodes. The flow control method generally includes a method of limiting all packets congested in the network to a certain number or less, a method of controlling the number of packets flowing into the network at the originating station, and the like. In terms of data, flow control also means adjusting the flow rate of a packet so that the packet is not lost or locked up due to an excessive amount of packets exceeding the reception limit at the receiving side when the data packet is transmitted.

For example, in the window type flow control, the maximum number of packets continuously received is determined according to the size of the buffer at the receiving side, and the number of data packets transmitted at the transmitting side before receiving a response is less than or equal to the receiving buffer. Control to suppress That is, the amount of packets sent per hour at the transmitting side is controlled so as not to exceed the amount of packets that can be received at the receiving side.

Congestion control, on the other hand, refers to limiting the number of packets in the network to below the boundary of the waiting delay limit. If a packet is input at a speed faster than the transmission rate of the packet, and the queue of packets is accumulated accordingly, the size of the queue increases without an upper limit and the packet delay time increases indefinitely.

Also, even if the input rate is slower than the output rate, the length of the queue increases rapidly as the packet instability approaches the transmission rate. (Normally, when the utilization rate of the line where the queue occurs is over 80%, the length of the queue is at a warning level. Therefore, in congestion control, the transmission rate of the packet is adjusted to prevent the phenomenon.

1 is a diagram illustrating a process of processing a packet received by a reception packet processing unit of a conventional Ethernet controller.

       When the Ethernet packet is input through the Ethernet switch (S101), the Ethernet controller generates a reception interrupt (S102). When a reception interrupt occurs, the reception packet processing unit of the Ethernet controller is called (S103).

The called reception packet processing unit checks whether an Ethernet packet exists in the reception buffer (S104). If there is an Ethernet packet in the reception buffer, an error of the packet is checked (S105), and the Ethernet packet is processed in the form of a frame and input (S106). If there are no Ethernet packets in the reception buffer, the system buffers a predetermined number of Ethernet packets and inputs them to the reception buffer (S107). As a result, the procedure for processing the packet received by the receiving packet processing unit ends.

As you can see from the above procedure, an interrupt is always generated when a packet is received. Therefore, if many packets are received that cannot be processed by the processor, the processor cannot perform other processing due to the frequent occurrence of interrupts. By exploiting this, third parties may deliberately overrun traffic to the processor, leaving the system deadly and hacking.

Of course, the flow of traffic can be controlled by the above-described flow control or congestion control. However, since the control process is generally made in the form of adjusting the amount of packets at the transmitting side or the network, it cannot be an effective measure in case of deliberate congestion of traffic at the transmitting side. In addition, since flow control and congestion control are performed in hardware components such as an Ethernet switch or a transmitting terminal, overload may occur in the process of adjusting the congested data.

Therefore, in order to solve the conventional problem in which the CPU is not able to process other processes due to the weighted traffic to the CPU without the hardware component as described above, only a certain amount of the traffic flowing into the processor is received and There is a need for a method that can control the flow of traffic by designing it so that it is not received.

Accordingly, an object of the present invention is to solve the above-mentioned conventional problems, and by directly limiting the amount of packets received by the processor at the receiving side, a third party deliberately implements the system in an unprocessable state of the processor due to congestion of traffic. It is to provide a way to prevent hacking and keep the system stable.

Another object of the present invention is to provide a method for controlling the flow of traffic by limiting the reception rate of the packet per second by a software method, without resorting to hardware components such as the existing Ethernet switch.

Ethernet traffic reception rate limiting system according to an aspect of the present invention for achieving the above object is to set a reference value of the packet receiving amount, and when the packet is received and the central processing unit for generating a receiving interrupt exceeds the set packet receiving amount A receiving packet processing unit for checking whether a packet is introduced and notifying the interrupt processing routine unit and an interrupt processing routine unit for causing the central processing unit to deactivate generation of the receiving interrupt when receiving the packet excess inflow notification from the receiving packet processing unit; .

In the Ethernet traffic reception rate limiting system, the received packet processing unit deactivates the packet not to process the received packet when a packet is introduced in excess of a preset packet reception amount.

The Ethernet traffic reception rate limiting system further includes a packet reception state monitoring unit that monitors a reception state of a packet and notifies the interrupt processing routine to notify an interrupt processing routine when a packet less than a preset packet reception amount is introduced. do.

In the Ethernet traffic reception rate limiting system, when it is determined that a reception interrupt has occurred, the interrupt processing routine unit drives the reception packet processing unit and the packet reception state monitoring unit.

The Ethernet traffic reception rate limiting system further includes a kernel thread generation unit configured to receive a reference value for the packet reception amount from the central processing unit and generate a kernel thread based on the reference value.

The Ethernet traffic reception rate limiting system further includes a reception buffer that buffers the received packet until the received packet processing unit processes the received packet.

Meanwhile, according to another aspect of the present invention, a method of limiting reception of an Ethernet traffic according to another aspect of the present invention includes generating a reception interrupt when a packet is introduced and periodically monitoring the reception state of the packet to exceed a packet reception amount. Thereby deactivating generation of a receive interrupt when a packet is introduced.

In the method of limiting the reception rate of the Ethernet traffic, generating the reception interrupt may include performing a reception packet processing and a packet reception state monitoring process when a reception interrupt occurs.

The reception rate limiting method of the Ethernet traffic may further include generating a kernel thread based on the notification of the reference value for the packet reception amount.

The reception rate limiting method of the Ethernet traffic may be configured to deactivate a reception packet processing unit when a packet flows in excess of a reference value for a predetermined reception packet amount.

The reception rate limiting method of the Ethernet traffic may further include monitoring a reception state of the packet and activating an inactive reception interrupt when a packet less than a predetermined packet reception amount is introduced.

Hereinafter, an Ethernet traffic reception rate limiting system and a method thereof for CPU security according to the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a configuration of an Ethernet controller according to the present invention.

Packets enter the Ethernet controller through the Ethernet switch. The Ethernet switch analyzes and identifies the optimal path for received packets and switches Ethernet packets along the identified path. The Ethernet switch also checks whether the port or link corresponding to the optimal path of the packet to be congested is congested.

The Ethernet controller includes a central processor 210, a kernel thread generator 230, a received packet processor 240, a packet reception status monitor 250, an interrupt processing routine 220, a receive buffer 260, and the like. It is configured by.

The central processing unit 210 generates a reception interrupt when a packet is received, and notifies the interrupt processing routine unit 220 of this. The interrupt generating unit is the interrupt generating unit 211 of the central processing unit 210. In addition, the central processing unit 210 initializes the network device driver function, sets a function value for the amount of packets received per second, and then notifies the kernel thread generation unit 230 of the set function value.

The kernel thread generation unit 230 generates a kernel thread based on a function value for the received packet amount notified from the central processing unit 210 to monitor the reception state of the packet. The generated kernel thread controls the basic operations of the incoming packet measuring units 241 and 251 in each of the receiving packet processor 240 and the packet receiving state monitor 250.

The received packet processor 240 processes the received packet. The inflow packet measuring unit 241 in the reception packet processing unit 240 measures whether the packet amount exceeds the set reference value. When a packet exceeding a reference value is received and the state of the received packet processing unit 240 is set to the packet excess inflow state, the received packet processing unit 240 notifies the interrupt processing routine unit 220 of this.

The packet reception state monitoring unit 250 monitors the reception state of the packet. The inflow packet measuring unit 251 in the packet reception state monitoring unit 250 measures the inflow state of the packet amount, and if the amount of the incoming packet is smaller than the initially set packet amount, it notifies the received packet processing unit 240. do. In this case, the interrupt processing routine unit 220 is also notified to activate a receive interrupt.

If it is determined that the Rx interrupt has occurred, the interrupt processing routine 220 calls the received packet processor 240 and the packet reception status monitor 250 to drive the received interrupt. In addition, when a notification is received from the packet reception state monitoring unit 250 to activate the reception interrupt, the reception interrupt (rx interrupt) is activated.

The reception buffer 260 buffers the reception packet until the reception packet processing unit 240 processes the reception packet.

3 is a diagram illustrating a process of initializing a network device driver function value in an Ethernet controller according to the present invention.

Network Device Driver functions allow network devices (hardware) to operate under the control of the operating system and applications. The function sets various function values required for the operation of the network device, and the network devices are operated by the function values set.

In the present invention, unlike before, the operator limits the number of packets received per second in advance, and creates a kernel thread to monitor the processing status of the received packets. The generated kernel thread may drive the incoming packet measuring unit 241 or 251 in each of the receiving packet processor 240 and the packet receiving state monitoring unit 250.

When the process of initializing the network device driver function starts, the central processing unit 210 determines whether the CPU security function is set (S301). If the CPU security function is not set, the operator does not need to limit the amount of packets received. Thus, the initialization process of the network device driver function values is terminated. However, when the CPU security function is set, the central processing unit 210 initializes the network device driver function value for the received packet amount (S302).

In this case, the central processing unit 210 sets a function value for the received packet amount by limiting the number of packets received per second to an arbitrary value (S303). After setting the function value, the central processing unit 210 notifies the kernel thread generation unit 230 of the set function value (S304).

In order to monitor the reception state of the packet, the kernel thread generation unit 230 generates a kernel thread based on a function value of the received packet amount notified from the central processing unit 210 (S305). The generated kernel thread drives the incoming packet measuring unit 241 or 251 in the receiving packet processing unit 240 and the packet receiving state monitoring unit 250. In this case, the incoming packet measuring units 241 and 251 periodically check the state (rx_status) of the received packet processing unit 240. Therefore, it is possible to monitor the reception status of the packet.

4 is a diagram illustrating a process of processing a packet received by a reception packet processing unit of an Ethernet controller according to the present invention.

The interrupt generator 211 of the central processing unit 210 generates a reception interrupt when there is an Ethernet packet received through the Ethernet switch (S401). In this case, the Ethernet controller gives priority to the processing of the incoming packet, generates a receive interrupt, and processes the incoming packet before other work being performed.

If it is determined that a reception interrupt (Rx interrupt) has occurred, the interrupt processing routine unit 220 calls the reception packet processing unit (Rx Processing unit) 240 (S402). In addition, the interrupt processing routine unit 220 also calls the packet reception state monitoring unit 250 when a reception interrupt occurs. The processing procedure in the packet reception state monitoring unit 250 will be described later in detail with reference to FIG. 5.

The called reception packet processing unit 240 starts a processing procedure for the received packet (S403). The reception packet processor 240 checks whether a packet exists in the reception buffer 260 (S404). If a packet exists in the reception buffer 260, it is checked whether an error exists in the packet (S411). The received packet processor 240 processes the received packet in which the error is checked in the form of a frame, and transmits the received packet to an upper stack (S412). The process is repeated in a loop until the packet is no longer present in the reception buffer 260.

When it is determined that the packet does not exist in the reception buffer 260, the reception packet processor 240 buffers the packet in the reception buffer 260 (S405). The reception buffer 260 may temporarily store a reception packet having a predetermined capacity. Therefore, when the reception buffer 260 is empty by processing all the stored packets, the packet is buffered again.

When the packet is buffered, the incoming packet measuring unit 241 of the receiving packet processing unit 240 determines whether the amount of packets currently flowing per second is larger than the reference value of the set receiving packet amount (S406). If more packets are being introduced per second than the preset reference value, the reception packet processing unit 240 sets the state of the reception packet processing unit 240 to the excess packet inflow state (S407). This state means that the packet reception rate is out of the normal state because the amount of packets flowing into the system is larger than the initially set state.

In this case, the received packet processing unit 240 notifies the interrupt processing routine unit 220 that the packet excess flows in the state (S408). The interrupt processing routine 220 receiving the notification from the received packet processor 240 deactivates generation of a received interrupt (rx interrupt) (S409). If you disable the generation of receive interrupts, no packets are received because no receive interrupts occur. In this case, the received packet processor 240 ends the processing procedure for the received packet (S410).

If the amount of packets flowing in per second is smaller than the packet amount set in step 406, this is a situation in which the packet is processed as much as the reference value initially set by the user, and thus the system is operating normally. Therefore, there is no need to disable receive interrupts. In this case, the received packet processor 240 ends the processing of the received packet.

That is, in the present invention, when the number of received packets per second (count) in the conventional algorithm is received more than the set reference value, by deactivating the reception interrupt to reduce the overload of the system.

5 is a diagram illustrating a process of monitoring a packet reception state of the packet reception state monitoring unit of the Ethernet controller according to the present invention.

The interrupt processing routine 220 drives the packet reception state monitoring unit 250 when a reception interrupt occurs. Accordingly, the packet reception state monitoring unit 250 starts to monitor the reception state of the packet. The packet reception state monitoring unit 250 starts a reception state monitoring procedure of the packet to periodically check the state of the reception packet processing unit 240 (S501).

The packet reception state monitoring unit 250 checks whether the reception packet processing unit 240 is in an activated state (S502). If the reception packet processing unit 240 is activated and processing the received data packet, the packet reception state monitoring unit 250 no longer executes the operation and ends the reception state monitoring procedure of the packet (S507).

However, when the reception packet processor 240 does not process the data packet, that is, when the reception packet processor 240 is in a deactivated state, it is determined whether the amount of packets flowing per second is larger than the reference value for the set amount of received packets. (S503).

As described above, when the number of packets flowing into the network per second is larger than the reference value set by the initial user, the reception interrupt is inactive. Therefore, if the packet reception state monitoring unit 250 determines that the packet excess inflow state as a result of checking the reception state of the current packet, it is not necessary to change the deactivated reception interrupt (rx interrupt) to the active state. In this case, the packet reception state monitoring unit 250 terminates the reception state monitoring procedure of the packet (S507).

However, if the amount of incoming packets per second is smaller than the set packet amount, that is, if the current amount of packets is normally flowing, the receive interrupt (rx interrupt) must be activated to process the incoming packets. Therefore, in this case, the packet reception state monitoring unit 250 notifies the received packet processing unit 240 that the packet is normally introduced (S504).

The received packet processing unit 240 which has received the notification from the packet reception state monitoring unit 250 activates the state of the received packet processing unit 240 (S505). In addition, the packet reception state monitoring unit 250 notifies the interrupt processing routine unit 220 to activate a rx interrupt (S506). In this case, the interrupt processing routine 220 activates the receive interrupt.

When the receive interrupt is activated, the packet can be received again. In this case, the packet reception state monitoring unit 250 terminates the reception state monitoring procedure of the packet (S507).

6 is a diagram illustrating a process of controlling a packet received by an Ethernet controller according to the present invention.

The central processing unit 210 initializes the network device driver function value and sets the packet amount received per second to an arbitrary value (S601). The kernel thread generation unit 230 generates a kernel thread based on a function value for the received packet amount notified from the central processing unit 210 (S602).

The interrupt generator 211 of the central processing unit 210 generates a reception interrupt when a packet is received through the Ethernet switch. In this case, when it is determined that the reception interrupt has occurred, the interrupt processing routine unit 220 drives the reception packet processing unit 240 and the packet reception state monitoring unit 250 (S611 and S621).

The incoming packet measuring unit 241 of the received packet processing unit 240 determines whether the amount of packets flowing in per second is greater than the reference value for the set packet amount (S612). When the amount of packets flowing per second is larger than the set reference value, the reception packet processor 240 sets the state of the reception packet processor 240 to the excess packet inflow state, and notifies the interrupt processing routine 220. The interrupt processing routine 220 receiving the notification deactivates the reception interrupt (S613). In this case, the reception packet processing procedure in the reception packet processing unit 240 ends (S614).

On the other hand, when a reception interrupt occurs, the interrupt processing routine unit 220 also drives the packet reception state monitoring unit 250 (S621). The packet reception state monitoring unit 250 checks whether the reception packet processing unit 240 is in an activated state (S622).

If the reception packet processing unit 240 is activated and processing the received data packet, the packet reception status monitoring unit 250 does not execute any more and ends the reception status monitoring procedure of the packet.

However, when the received packet processor 240 does not process the data packet, it is determined whether the amount of packets flowing in per second exceeds the set reference value (S623).

If the amount of packets currently being introduced per second is smaller than the set reference value of the received packet amount, the packet reception state monitoring unit 250 notifies the received packet processing unit 240 of this (S624). In this case, the received packet processor 240 activates the state of the received packet processor 240. In addition, the packet reception state monitoring unit 250 notifies the interrupt processing routine unit 220 to activate the reception interrupt (S625).

When the receive interrupt is activated, the packet can be received again. In this case, the packet reception state monitoring unit 250 ends the packet reception state monitoring procedure.

According to the present invention, the operator limits the amount of packets received per second to control the amount of packets received by the processor, thereby reducing the overload of the system, thereby increasing the stability of the processor, and allowing the processors to perform other procedures. The processes involved in this process can operate organically.

In addition, unlike the conventional hardware to control the reception of the packet in the present invention, since the reception rate of the packet is limited by software, it is not necessary to implement a separate hardware can be obtained in a significant cost reduction in the cost of developing a system.

Claims (11)

A central processing unit for setting a reference value of the packet reception amount and generating a reception interrupt when a packet is received; A received packet processing unit which checks whether a packet is introduced in excess of the set packet reception amount and notifies the interrupt processing routine unit; And And an interrupt processing routine unit for causing the central processing unit to disable generation of a receive interrupt when receiving a packet excess inflow notification from the received packet processing unit. The method of claim 1, The received packet processing unit, When the packet flows in excess of the preset packet reception amount, Ethernet traffic reception rate limiting system, characterized in that the processing to not process the received packet. The method of claim 1, And a packet reception state monitoring unit for monitoring the reception state of the packet and notifying the interrupt processing routine unit to activate the deactivated reception interrupt when a packet less than the preset packet reception amount is introduced. The method of claim 1, The interrupt processing routine unit, If it is determined that a reception interrupt has occurred, the Ethernet traffic reception rate limiting system characterized by driving the reception packet processing section and the packet reception status monitoring section. The method of claim 1, And a kernel thread generation unit configured to receive a reference value for a packet reception amount from the central processing unit and generate a kernel thread based on the reference value. The method of claim 1, And a reception buffer for buffering the received packet until the received packet processing unit processes the received packet. Generating a receive interrupt when a packet is introduced; Wow Periodically monitoring the reception state of the packet to deactivate generation of a reception interrupt when the packet is introduced in excess of a set packet reception amount. The method of claim 7, wherein Generating the receive interrupt, When the reception interrupt occurs, the reception rate limiting method of the Ethernet traffic, characterized in that for performing the process of receiving packets and monitoring the packet reception status.        The method of claim 7, wherein Receiving a reference value for the packet reception amount and generating a kernel thread based on the received value. The method of claim 7, wherein The method of limiting the reception rate of Ethernet traffic, characterized by deactivating the receiving packet processing unit when the packet is introduced in excess of the reference value for the predetermined amount of the received packet. The method of claim 7, wherein And monitoring a reception state of the packet to activate a deactivated reception interrupt when a packet less than a predetermined packet reception amount is introduced.

Images