KR100862195B1 - Method and Apparatus for searching by range matching using content addressable memory - Google Patents

Abstract

The present invention is to provide a method and apparatus for searching a section matching using a content address memory that can reduce unnecessary memory waste by dividing a rule into two search units and performing a basic unit search independently. In performing a fast search by storing a rule in a memory, the rule is divided into two search ranges and stored in the first and second search tables, and then the first and second search keys are extracted from the input frame. The first and second search tables are searched with the search key and the second search key, respectively, and the search results are combined to confirm the control information of the rule to be applied to the input frame.

Content Addressable Memory (CAM), Interval Match Search, Exact Match Search, Longest Prefix Match Search, 5-tuple

Description

Method and apparatus for searching section matching using content address memory {Method and Apparatus for searching by range matching using content addressable memory}

The present invention is a router system supporting Internet Protocol Version 4 (IPv4), the content address for searching the access control level or service level for each flow in order to support flow based access control or quality of service (QoS) An interval matching search method and apparatus are provided.

The present invention is derived from a study conducted as part of the IT new growth engine core technology development project of the Ministry of Information and Communication and the Ministry of Information and Communication Research and Development (Task Management Number: 2005-S-101-02, Title: Multimedia QoS Routing Technology).

In the case of a router supporting IPv4, a routing table is set using a destination IP address to determine a destination port. This is generally set through data obtained by a routing protocol or the like and input by an operator. The router searches the routing table using the destination IP address field of the input traffic as a search key, and determines the output port of the packet by checking the value of the mapping table using the index of the resulting table.

Similarly, in order to support flow-based access control or QoS, the router stores the relevant rules for determining the access control list or service level in a lookup table, and if a packet matching the rules in the lookup table is entered, it corresponds to the input packet. Apply the access control level or service level.

Currently, a content addressable memory (CAM) or a network search engine (NSE) is mainly used for storing and searching a search table.

The content address memory or the like constructs a lookup table using three bit values, namely, bit 0, bit 1, and don't care. In other words, bit 0 or bit 1 should be set if the corresponding value should match exactly. If it does not matter, it is indicated as don't care. The search table configured as described above is compared with a string (search key) to be searched, and it is determined that the value is exactly matched, or that if the value of the search table is 'don't care'.

In addition, when searching using the content address memory, a basic search unit is used as 64 bits or 72 bits. Therefore, if the length of the field used in the search rule is less than 64 bits or 72 bits, the search is performed by treating the remaining bits as 'ignore bits'. If the field is larger than this, the search is performed by grouping multiple basic search units into one. do.

Here, a case of searching using one basic search unit will be referred to as a basic search method, and a case of performing a search by combining several basic search units will be simply called an extended search method.

Therefore, the 104-bit rule that uses the 5-tuple of the flow-based router should apply an extended search method that binds two basic units to perform a search.

In general, the flow-based router uses a text search method to determine the destination port or to check the access control level and service level. For the access control level and the service level, the source IP address and the destination IP address, respectively, are used. It is necessary to search using 5-tuples such as two IP addresses having 32 bits, two port numbers having 16 bits each, such as an outgoing port number and a destination port number, and a protocol number. In general, longest prefix matching (LPM) search method is used for IP address search, Exact Matching search method is used for protocol number search, and interval matching method is used for port number search. .

Among the above mentioned search methods, the longest prefix matching search method and the perfect matching search method are simple to convert to bit 0 and bit 1 and ignore bit, so one table entry per rule when converting to a lookup table Can be converted to However, in order to create an accurate lookup table for the interval matching search method, it is necessary to convert one rule into one or more table entries.

Therefore, when a rule of an access control list used together with a longest prefix matching search method, an exact matching search method, an interval matching search method, and the like is converted into a lookup table, one rule may be converted into a plurality of lookup table entries. .

In particular, the 5-tuple-based method requires that an extended search method of grouping two basic units is used. Thus, a memory requirement is doubled compared to a search rule using only one basic search unit.

As a means for solving the above problem, the present invention divides one rule into two search units to perform basic unit search independently, thereby reducing the unnecessary memory waste. And an apparatus.

The section matching search apparatus using the content address memory according to an embodiment of the present invention may further include storing information corresponding to the first search unit in each entry when the rule is divided into a first search unit and a second search unit. 1 lookup table; A second search table for storing information corresponding to the second search unit in each entry; And a control module extracting a first search key of the input frame to search the first search table, extracting a second search key to search the second search table, and finding a matching entry.

An interval matching search method using a content address memory according to another embodiment of the present invention may include: dividing a rule into a first search unit and a second search unit, and storing the rules in first and second search tables, respectively; Extracting first and second search keys from an input frame; Searching the first and second search tables using the first search key and the second search key, respectively; And combining the search results to confirm control information of a rule to be applied to the input frame.

The first search unit is a transmission IP address and a reception IP address among the 5-tuple information, and the second search unit is a transmission port, a reception port, and a protocol number.

The second search table may further store entry address information of the first search table in which the information about the first search unit associated with the information about the second search unit is stored in each entry. 1 If a search table is found and a matching entry exists, a new second search key is generated by combining the address of the entry with the second search key, and searching for an entry that matches the new second search key. It is preferable to search in the table.

According to the above-described configuration, in the section matching search in a router or a switch system, the search rule is divided into two for an access control list or a QoS class related search that searches using the entire 5-tuple. By implementing two lookup tables, the search table memory can be reduced by allowing independent lookups.

In addition, by providing a search method through linkage between two search tables, a search using the entire 5-tuple can be performed more efficiently. When applied to an IPv6 system with an increased header length, Even if the length is increased, it can be applied immediately.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In addition, the same reference numerals are used for parts having similar functions and functions throughout the drawings.

In addition, throughout the specification, when a part is 'connected' to another part, it is not only 'directly connected' but also 'indirectly connected' with another element in between. Include. In addition, the term 'comprising' a certain component means that the component may be further included, without excluding the other component unless specifically stated otherwise.

In addition, the term 'module' refers to a unit for processing a specific function or operation, which may be implemented in hardware or software or a combination of hardware and software.

1 shows a general structure of a router to which the present invention is applied. The router 30 connects the transmitting terminal 10, which is the source of transmitting an arbitrary packet, with the receiving terminal 20, which is the destination of the packet.

Referring to FIG. 1, the router 30 checks a destination by checking an input physical layer 21 receiving a packet transmitted from a transmitting terminal 10 and a packet received through the input physical layer 21. An input packet processor 32 for performing processing according to a service level, an access control level of the protocol, and a protocol, a switching fabric 33 for delivering a packet transmitted from the input packet processor 32 to a port corresponding to a destination; An output packet processor 34 for processing a packet received from the switching fabric 33 and outputting the packet to a set port; and an output physical layer 35 for transmitting the packet processed by the output packet processor 33 toward an actual destination direction. It is composed. The present invention relates to a part of the operation of the input packet processing unit 32 that checks the QoS service level and the access control level for the packet and performs the corresponding processing. More specifically, the input packet processor 32 determines a destination port by referring to the information of the input packet, checks an access control list or service level of the input packet, and according to the control information set at the level, the packet. To process. In this case, the input packet processing unit 32 includes various search tables to check the access control list or the service level of the input packet. In general, the input packet processing unit 32 stores the search table in a content address memory (CAM) and stores the content. Output ports corresponding to each entry in the address memory, or data on the level or service level of the access control list, are stored together at the same address in the mapping table.

FIG. 2 shows a search structure provided in the input packet processing unit 32 to check an access control list or a service level. The packet processing module 321, the search module 322, and the mapping are performed for such a search process. Module 323.

The search module 322 is generally implemented as a content address memory (CAM) or a network search engine (NSE: Network Search Engine), and the mapping module 323 is implemented as a general memory.

That is, a search rule is stored in the search module 322, and information to be applied to the rule is stored in the mapping module 323, for example, an output port or a level or service level of an access control list. In this case, the rule and the corresponding control information are stored in the same address in the search module 322 and the mapping module 323.

Accordingly, when the packet processing module 321 performs a search using the information of the input packet, the packet processing module 321 checks a location where a rule corresponding to the input packet is stored through a search using the search module 322, The same location of the mapping module 323 is checked to confirm the control information, and the corresponding packet is transmitted to the switching fabric 33 using the identified information.

FIG. 3 is a block diagram showing an apparatus for searching a section matching according to the present invention, which can be applied to the input packet processor 32 as described above.

Referring to FIG. 3, when the rule is classified into a first search unit and a second search unit, the interval matching search apparatus according to the present invention stores the information corresponding to the first search unit in each entry. (100), a second search table (200) for storing information corresponding to the second search unit in each entry, and a first search key of an input frame to extract the first search table (100); And a control module 300 extracting a second search key and searching the second search table 200 to find a matching entry.

In the above, the first search table 100 and the second search table 200 are implemented in the content address memory CAM.

In the interval matching search apparatus, the first search unit is set as a transmission IP address and a reception IP address from among 5-tuple information used for checking the level of the access control list or the service level, and the second search unit. Set the sending port, receiving port and protocol number.

In addition, the second search table 200 further stores entry address information of the first search table 100 in which information on the first search unit associated with the information on the second search unit is stored in each entry. It is preferable.

That is, transmission and reception IP addresses are recorded in each entry of the first search table 100, and address information of entries in which transmission and reception ports and protocol numbers and transmission and reception IP addresses related to the rules are recorded in the second search table 200. Is recorded further.

In this case, when a packet to be searched is input, the control module 300 generates a first search key with a transmission / reception IP address of the packet, generates a second search key with a transmission / reception port and a protocol number of the packet, If a matching entry is found by searching the first search table 100 using the first search key, a new second search key is generated by adding the address of the corresponding entry to the second search key, and the new second search key. The second matching table 200 searches for an entry that matches the. Then, if there is an entry that matches the second lookup table 200, the address of the entry is output as the final mapping address.

In this case, the interval matching search apparatus may further include a mapping table 400 for storing control information for the corresponding frame for each final mapping address, and the control module 300 may search for the last mapping address found in the mapping table 400. Read and output the control information.

In this case, the control information stored in the mapping table 400 is preferably one of output port information, access control level information, or service level information.

Hereinafter, a configuration and implementation process of the first and second lookup tables according to the present invention will be described by way of example.

4 shows an example of a rule to be applied to a router presented to explain the present invention.

Referring to Fig. 4, the rules are composed of 5-tuple information, that is, a source IP address, a destination IP address, a source port number, a destination port number, and a protocol number, and the flow of rule 1 is a service level. This applies to level 1, the flow of rule 2 applies to the level 2 service level, and the flow of rule 3 applies to the level 3 service level.

In the rule illustrated in FIG. 4, '*' indicates a case in which any value is irrelevant, and corresponds to an ignore bit when the lookup table is implemented.

In the present invention, the above 5-tuple rule is divided into two search units, that is, the first search unit and the second search unit, which are applied to the rule of FIG. 4 and can be converted as shown in FIG. 5. .

In the above embodiment, it is assumed that the basic search unit is 64 bits.

Therefore, each rule composed of the 104-bit 5-tuple information is prepared by dividing each rule into 64 bits and 40 bits based on the basic search unit of 64 bits. At this time, 24 bits of the second search unit are not used.

Referring back to FIG. 5, rule 1 shown in FIG. 4 is recorded in two entries (0 and 1) in FIG. 5, and rule 2 is recorded as 4 entries (2-5). 3 is recorded in four entries (Nos. 6-9). In other words, rule 1 requires only a transceiving IP address and a protocol number, so it can be recorded as two entries, but rule 2 requires two more entries by destination port number. By number, two more entries are needed.

The present invention implements the first and second search tables by dividing the conversion table shown in FIG. 5 into two.

6 (a) and 6 (b) show examples of the first and second lookup tables according to the present invention implemented from the conversion table of FIG. 5, and FIG. 6 (a) shows the conversion table in FIG. A first lookup table that collects only entries related to the transmit / receive IP address of each rule, and (b) is a second lookup table that gathers only entries related to the transmit / receive port number and protocol number of each rule.

 Referring to FIG. 6A, since a rule entry is configured with only an IP address in the first lookup table, each rule is converted into one-to-one and only one table entry is assigned to one rule. However, since the second search table shown in Fig. 6B includes a transmission / reception port to which the interval matching search method is applied, a plurality of entries are assigned to one rule. However, according to the present invention, if two search tables are configured with one rule, the basic memory area can be saved as compared with the conventional method.

In addition, in the case of the second lookup table, the transmission and reception port and the protocol number may be allocated among the total 64 bits, and the remaining 24 bits may be used to establish correlation with the first lookup table.

That is, the address of the entry of the first lookup table associated with the entry is recorded in 24 bits of the 64 bits, and the transmission / reception port and protocol number are recorded in the remaining 40 bits. In FIG. 6, "x + n" (n is 0, 1, 2, 3, ...) represents each entry address of the first lookup table, and "y + n" (n is 0, 1, 2). , 3, ...) indicates an entry address of the second lookup table, and the rules of y + 1 and y + 2 of the second lookup table correlate with the rules of address x + 1 of the first lookup table. It can be seen.

6 is a flowchart illustrating a process of searching for a rule using the first and second lookup tables configured as described above according to the present invention.

Referring to FIG. 6, when a frame is input in a state in which a rule to be applied to each packet is divided into a first search unit and a second search unit, and stored in the first and second search tables, respectively (S71), The header information of the input frame is extracted to generate first and second search keys (S72).

The first search key is a transmission / reception IP address carried in a header of the input frame, and the second search key is a transmission / reception port number and a protocol number carried in the header of the input frame.

Then, the first and second search keys are searched for the first and second search tables, respectively. Preferably, first, the first search key is used to determine whether there is a matching rule in the first search table (S73). ).

If there is an entry that matches the first search key in the first search table, the second search key is modified to further include the address of the entry (S74).

The second search table is searched using the modified second search key to check whether there is a matching entry (S75).

In the above, if there is an entry that matches the modified second search key in the second search table, it is determined that there is a rule to be applied to the corresponding frame (S76), and in the step S73, the first search table is checked. If there is no matching entry or there is no matching entry in the second search table in step S75, it is determined that there is no rule to apply to the input frame (S77).

In the above, when it is determined that there is a rule to apply, the corresponding entry address of the second search table is checked, the entry of the same address of the mapping table in which the control information for each rule is stored, and the control information to be applied is obtained. .

In the case of a router supporting access control or QoS, the control information is one of output port information, access control level information, or service level information.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and it is common in the art that various substitutions, modifications, and changes can be made without departing from the technical spirit of the present invention. It will be apparent to those skilled in the art.

1 is a block diagram showing an example of a router system to which the present invention is applied;

2 is a block diagram showing the detailed configuration of a packet processing unit in the router system;

3 is a block diagram showing an interval matching search apparatus according to the present invention;

4 is an exemplary diagram for explaining an embodiment of the present invention;

5 is a view for explaining a method of converting the rule shown in FIG. 4 into a lookup table according to the present invention;

6 is an exemplary view of a first and second lookup table implemented by the present invention, and

7 is a flowchart illustrating an interval matching search method according to the present invention.

Claims (9)

A first search table that divides a rule into a first search unit and a second search unit, and stores information corresponding to the first search unit in each entry; A second search table for storing information corresponding to the second search unit in each entry; And And a control module extracting a first search key of an input frame to search the first search table, extracting a second search key to search the second search table, and searching for a matching entry. Wherein the first search unit is a transmission IP address and a reception IP address among 5-tuple information, and the second search unit is a transmission port, a reception port, and a protocol number. . delete The method of claim 1, wherein the second search table, And storing the entry address information of the first search table in which the information about the first search unit associated with the information about the second search unit is stored in each entry. The method of claim 3, wherein the control module If a matching entry is found by searching the first search table, the address of the entry is added to the second search key to generate a new second search key, and an entry matching the new second search key is generated. An interval matching search apparatus using a content address memory, characterized by searching in a search table. Dividing the rule into a first search unit and a second search unit, and storing the rules in the first and second search tables, respectively; Extracting first and second search keys from an input frame; Searching the first and second search tables using the first search key and the second search key, respectively; And Combining the search results to confirm control information of a rule to be applied to the input frame; The first search unit is a transmission IP address and a reception IP address among 5-tuple information, and the second search unit is a transmission port, a reception port, and a protocol number. . delete The method of claim 5, wherein dividing the rule into a first search unit and a second search unit, and storing the rules in the first and second search tables, respectively, And using the content address memory, further stores entry address information of the first search table in which the information about the first search unit associated with the information about the second search unit is stored in each entry of the second search table. Interval matching search method. 6. The method of claim 5, wherein searching the first and second lookup tables is Retrieving an entry in the first search table that matches the first search key; Modifying the second search key to further include an address of the entry if an entry matching the first search key exists in the first search table; And And searching for a second search table using the modified second search key. The method of claim 5, Storing control information for each rule in a mapping table, wherein the control information of the corresponding rule is stored at a address corresponding to each entry address of the second lookup table; Search method.

Images