KR101270743B1 - Apparatus and Method for hybrid BD for hardware load balancing of network security system - Google Patents

Abstract

The present invention relates to a hybrid buffer descriptor processing apparatus, comprising: a network interface for storing a data packet of a gigabit or 10 gigabit environment in an internal buffer descriptor and a buffer descriptor of a host system to be processed by a host system as it is input from the Internet and a network. And a host system including a card and a buffer descriptor having the same structure as the buffer descriptor included in the network interface card, for reading and processing data packets stored by the network interface card from an internal buffer descriptor.

Description

Apparatus and Method for hybrid BD for hardware load balancing of network security system

The present invention relates to network security technology, and more particularly, to an apparatus and method for processing a buffer descriptor for hardware load balancing.

Advances in global network technologies and networks have led to the emergence of various broadband services such as high performance computing, virtualization, video on demand (VOD), storage, video and voice over IP (VoIP). Accordingly, in order to handle the rapidly increasing traffic, the access speed of the communication network is increasing.

However, current Internet and network technologies designed about 40 years ago have problems such as security weakness, lack of user mobility support, and efficient content delivery weakness to meet such rapidly increasing traffic processing needs.

In particular, the problems of the explosive growth of the Internet and network access devices such as smart phones, smart TVs, and the like to cope with the traffic explosion caused by massive video traffic, and the fundamental countermeasures against network breaches such as DDoS are becoming important.

Due to network data packet processing and security problems, intrusion attempts on the network have increased and diversified. Accordingly, network security systems such as intrusion detection systems and intrusion prevention systems have been developed.

However, due to the high speed network environment and the flow of large data traffic, most network security systems collect, analyze and process data packets coming from the network, and then provide stable packet data transmission in real time. I'm having a hard time.

Therefore, a network security system (IPS / IDS) that supports high-speed packet processing by receiving data packets and large data packets moving in a gigabit environment or a 10-gigabit high-speed network without loss of hardware system load It improves the performance of the network security system by distributing the data, thereby collecting and processing the data packets coming from the network, thereby improving the security system performance such as stable data packet transmission and intrusion detection / intrusion prevention through the Internet and the network. You should be able to.

For this reason, the importance of technology for hardware load balancing in security systems is increasing. Network Interface Cards (NICs) in these network security systems have traditionally used hardware-based buffer descriptors (BDs) for hardware load balancing.

The hardware-based BD (Buffer Descriptor) method stores the packet data in the BD of the card itself for data packets flowing into the network interface card, and directly accesses the host system to process the packet data. DMA).

Using interrupts, the system calls the BD (Buffer Descriptor) of the network interface card in the DMA area to read and process packet data. This hardware-based BD (Buffer Descriptor) method requires that the host system read the packet data from the network interface card, which increases the input / output (I / O) to the interface, thereby reducing the performance of the system. Have.

Software-based BD (Buffer Descriptor) method, unlike hardware-based BD (Buffer Descriptor) method, provides both BD and DMA in the host system. The network interface card checks the BD of the host system for the packet data flowing from the network interface card, and stores the packet data. After DMA the stored packet data, the host system reads the packet data from the DMA area to process the packet data. Take the way.

The software-based BD (Buffer Descriptor) method has a problem in that input / output (I / O) time for the host system BD is increased in the network interface card in order to DMA data packets flowing from the network interface card.

As described above, both the hardware-based BD method and the software BD method for hardware load balancing of a network interface card for a network security system have problems.

In other words, in order to handle the large amount of high-speed packet data flowing in the network, the hardware-based BD method increases the cost according to the increase of the hardware itself, while the software BD method increases the time due to the packet data input / output (I / O). Due to problems such as packet data processing, collection and analysis, and stable packet data transmission, performance and reliability of the security system itself cannot be guaranteed.

The present invention provides a hybrid BD processing apparatus and method using a hardware-based BD scheme and a software-based BD scheme to distribute the hardware load of the network security system.

The present invention relates to a hybrid buffer descriptor processing apparatus, comprising: a network interface for storing a data packet of a gigabit or 10 gigabit environment in an internal buffer descriptor and a buffer descriptor of a host system to be processed by a host system as it is input from the Internet and a network. And a host system including a card and a buffer descriptor having the same structure as the buffer descriptor included in the network interface card, for reading and processing data packets stored by the network interface card from an internal buffer descriptor.

The present invention provides a method for processing a hybrid buffer descriptor in a network interface card, the method comprising: checking availability of an internal buffer descriptor area as a data packet of a gigabit or 10 gigabit environment is received; Requesting direct memory access to the host system for processing; if it is determined that the area of the internal buffer descriptor is available, storing the received packet data in the internal buffer descriptor and switching a flag for whether or not to use it; And switching a flag indicating whether or not to use the buffer descriptor of the host system through an interface, and generating an interrupt to the host system to perform packet processing.

The present invention relates to a hybrid buffer descriptor processing method in a host system, the method comprising: checking whether an internal buffer descriptor is available for processing packet data, processing packet data through direct memory access, and the buffer descriptor When all the packet data processing of is completed, and restoring a flag as to whether or not the buffer descriptor contained in the internal buffer descriptor and the network interface card.

The present invention can distribute the hardware load by reducing the number of input and output to the BD area of the network interface card in the host system for processing the packet data received by the network interface card installed in the security system, such as intrusion detection / intrusion prevention, As a result, the performance of the host system can be improved.

In addition, the DMA is allocated using the MBD in the host system during the DMA for the BD area, and the BD and the MBD of the network interface card are kept in a logically synchronized state, thereby enabling high-speed packet processing.

Therefore, it is possible to efficiently distribute the hardware load of the host system by supplementing the problems of hardware load balancing in the conventional hardware-based BD software and the software BD system.

This not only improves the performance of the host system, but also enables lossless packet collection, analysis, and processing, thereby reducing the maintenance cost of the system according to the conventional BD usage.

1 is a diagram illustrating an example of a general hardware-based BD.
2 is a diagram illustrating an example of a general software-based BD.
3 is a diagram of a hybrid BD processing apparatus according to a preferred embodiment of the present invention.
4 is a view for explaining a method of processing a Hybrid BD according to a preferred embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout.

In the following description of the present invention, when it is determined that detailed descriptions of related known functions or configurations may unnecessarily obscure the gist of the embodiments of the present invention, the detailed description thereof will be omitted.

In addition, the terms used throughout the specification are terms defined in consideration of functions in the embodiments of the present invention, and may be sufficiently modified according to the intention, custom, etc. of the user or operator, and the definitions of these terms are defined in the present invention. It should be made based on the contents throughout the specification.

1 is a signal flow diagram illustrating a general hardware-based BD scheme.

Referring to FIG. 1, as data packets are received from the Internet and network 110 to a network interface card (NIC) 120, the network interface card 120 uses the area as a BD 130 in the card in step 101. Check for availability. In other words, it is checked whether the BD is empty.

In operation 102, the network interface card 120 requests the DMA 140 of the host system 160 to process the packet data.

On the other hand, if the network interface card 120 confirms that the area of the BD 130 in the card is available in step 101, the network interface card 120 stores the packet data received in the step 130 in the BD 130 and sets a flag for use. Switch it to busy.

The network interface card 120 generates an interrupt to the device driver 150 for packet data processing in the host system in step 104.

The device driver 150 of the host system 160 reads and DMAs the hardware BD 130 to process packet data in step 105. In step 106, the contents of the DMA are read and packet processing is performed. After the packet processing is completed, the device driver 150 of the host system 150 calls the BD 130 of the network interface card again in step 107 to restore the BD flag of the processed area to 'usable'.

2 is a diagram illustrating an example of a general software-based BD.

Referring to FIG. 2, when a data packet is received from the Internet and the network 210 to the network interface card (NIC) 220, the network interface card 220 may be configured for the BD 230 area of the host system in step 201. Check availability. That is, it is checked whether the BD 230 is empty.

The network interface card 220 requests the DMA 240 for processing the packet data in step 202.

On the other hand, if the network interface card 220 confirms that the area of the BD 230 is available in step 201, the network interface card 220 stores the packet data received in the step 230 in the BD 230 and sets a flag indicating whether or not to use it. Switch to '.

In operation 204, the network interface card 220 generates an interrupt to the device driver 250 of the host system to perform packet processing.

The device driver 250 of the host system 260 checks the BD 230 region for processing the packet data in step 205, and reads the packet data to be processed from the DMA 240 in step 206.

Then, the device driver 250 switches the flag of the BD area processed in step 207 to 'usable', and when all packet data processing in the BD area is completed, the device driver 250 displays the BD 230 area in the network interface card in step 208. You will notice that it is available.

As described above, in the general BD scheme including the hardware BD and the software BD, when the network interface card is used in the inline mode in the IPS system, a flag processing for packet reception is performed through timeout. Therefore, due to the system's direct call and interrupt generation for flag switching and processing, in a 10 Gigabit environment network network with more than Gigabit, there is considerable system load during packet processing and performance is degraded. A problem occurs.

Accordingly, in order to overcome this problem, the hybrid BD method of the present invention uses a network interface card used in an IPS system, and uses a timeout flag processing method for packet processing when performing an inline mode. By using hardware BD and software BD instead of each process, the flag switching for packet processing can be reduced through the software BD, which reduces the process of calling the system directly, thereby reducing the time required for intrusion detection / intrusion prevention system load. To improve the performance of the system.

3 is a view for explaining the configuration and operation of the hybrid BD processing apparatus according to an embodiment of the present invention.

Referring to FIG. 3, a hybrid BD processing apparatus according to a preferred embodiment of the present invention includes a network interface card 315 and a host system 370.

The network interface card 315 stores a data packet of a gigabit or 10 gigabit environment in a buffer descriptor to be processed by the host system as it is input from the Internet and the network 310, and the host system 370 stores the network interface card. The data packet stored at 315 is read and processed.

To this end, the network interface card 315 includes a BD 330 therein. According to a preferred embodiment of the present invention, the host system 370 stores packet data in the MBD 340 having the same structure as the BD 330 area of the network interface card.

When received by the network interface card (NIC) 320, the network interface card 320 checks whether the BD 330 area of the host system is available in step 301. That is, it is checked whether the BD 330 is empty.

The network interface card 320 requests the DMA 350 for processing the packet data in step 302.

On the other hand, if the network interface card 320 confirms that the area of the BD 330 is available as a result of step 301, the network interface card 320 stores the packet data received in the step 303 in the BD 330 and sets a flag indicating whether the network interface card is used. Switch to '.

The network interface card 320 converts a flag of whether the MBD 340 of the host system 370 into 'in use' through the interface PCIe in step 304.

In operation 305, the network interface card 320 generates an interrupt to the device driver 360 of the host system to perform packet processing.

In operation 306, the device driver 360 of the host system 370 checks whether the MBD 340 area is available for processing the packet data. In operation 307, the packet data to be processed is read from the DMA 350.

When all packet data processing of the BD area is completed, the device driver 360 restores the flag of whether the MBD area 340 is used to 'usable' in step 308. In addition, the flag switching of the BD 309 area which has been processed in step 309 indicates that the BD area is available by switching the flag of the BD area in the card through the MBD.

4 is a flowchart illustrating a hybrid BD method according to a preferred embodiment of the present invention.

Referring to FIG. 4, in step 410, a network interface card installed in a security system such as intrusion detection / intrusion prevention from the Internet or a network network receives a packet on a network.

The packet data received by the network interface card in step 420 is stored in the BD area of the card, and the address and size information of the hardware BD area are stored in the MBD area of the host system.

In operation 430, the network interface card determines whether the BD area is available. In other words, it is determined whether packet data is stored as much as the available size of the BD area.

If it is determined in step 430 that the packet data is stored as much as the available size, in step 440, the network interface card requests a DMA from the host system via the interface PCIe to process the packet data.

When data is filled in the BD area in the network interface card, the network interface card sets the flag of the BD area used in step 450 to 'in use' and sets the flag for the MBD area used in the MBD in the host system to 'in use'. do.

When the flag setting is completed, the network interface card generates an interrupt for packet processing to the host system in step 460.

Then, the device driver of the host system receiving the interrupt checks whether the MBD region is used for packet processing in step 470.

As a result of checking in step 470, it is determined whether the MBD region is used for packet processing.

If it is determined in step 470 that it is not used, the device driver of the host system reads data from the DMA and processes it in step 480.

However, if it is confirmed that the check in step 470 is in use, the process proceeds to step 490.

In step 490, the device driver of the host system returns a flag so that the flag of the MBD area is available again, and the MBD in the host system switches back the flag of the BD area in the network interface card through the interface PCIe. BD area can be used.

Claims (6)

delete A network interface card which stores data packets in a gigabit or 10 gigabit environment as input from the Internet and a network, in an internal buffer descriptor and a buffer descriptor of the host system for processing by the host system;
Including a buffer descriptor having the same structure as the buffer descriptor included in the network interface card, including a host system for reading and processing data packets stored by the network interface card from the internal buffer descriptor,
The network interface card
As a data packet of a gigabit or 10 gigabit environment is received, the internal buffer descriptor and the buffer descriptor included in the host system are switched when the buffer packet is available, and the host system is directly requested to access the memory after the host descriptor is switched. Hybrid buffer descriptor processing device, characterized in that for transmitting an interrupt signal to the system.
3. The system of claim 2, wherein the host system
Hybrid buffer descriptor processing apparatus, characterized in that for processing the data packet by performing a direct memory access when the buffer descriptor contained therein is available.
3. The system of claim 2, wherein the host system
And a flag switching for a buffer descriptor of a network interface card which has been processed and a flag switching for an internal buffer descriptor.
A method for processing a hybrid buffer descriptor in a network interface card,
As a data packet in a gigabit or 10 gigabit environment is received, checking availability of an internal buffer descriptor area;
Requesting direct memory access to the host system for processing packet data;
If it is determined that the area of the internal buffer descriptor is available, storing the received packet data in the internal buffer descriptor and switching a flag for whether or not to use the internal buffer descriptor;
Switching a flag for whether or not the host system uses a buffer descriptor through an interface,
Generating an interrupt in the host system to perform packet processing.
In the hybrid buffer descriptor processing method in the host system,
Checking whether an internal buffer descriptor is available for processing the packet data;
Processing packet data through direct memory access,
Restoring a flag as to whether a buffer descriptor included in an internal buffer descriptor and a network interface card is used when all packet data processing of the buffer descriptor is completed.

Images