KR102503272B1 - Method, apparauts and computer program for processing packet in network equipment - Google Patents

Abstract

The present invention relates to a method, apparatus, and computer program for processing packets in network equipment, and more particularly, in order to process large-capacity network traffic, network equipment using multi-threads guarantees the order in which packets are processed or stored. It relates to methods, devices and computer programs for
In the present invention, in a method for processing or storing packets in network equipment, there is provided a packet collection step of collecting packets, distributing and processing them into multi-threads having a plurality of threads, and then storing the packets in a storage space; and a packet processing step of processing or storing the packets stored in the storage space according to the collected order, wherein the packets and the packet inflow times of the packets flowing into the multi-thread are matched and stored in the storage space. , In the packet processing step, a packet processing method in network equipment is disclosed, wherein an order of processing or storing the packets is calculated using the packet inflow time.

Description

Packet processing method, apparatus and computer program in network equipment

The present invention relates to a method, apparatus, and computer program for processing packets in network equipment, and more particularly, in order to process large-capacity network traffic, network equipment using multi-threads guarantees the order in which packets are processed or stored. It relates to methods, devices and computer programs for

[R&D project supporting this invention]

[Assignment identification number]　　　　　　　　 D2020100

[Name of Ministry]　　　　　　　　　　　　　　

[Research management specialized institution]　　　　

[Research project name]

[Research Project Title] Development of 100GE NIC with Smart Optical Bypass

[Contribution rate] 1/1

[Host Research Institution] 　　　　　　　　 Wins Co., Ltd.

[Research period] 2020. 2. 1. ~ 2021. 2. 28.

With the development of information and communication technology, various online services for users are spreading, and traffic that must be processed by network equipment is rapidly increasing.

Accordingly, in recent years, high-performance network equipment has been widely used to process large amounts of traffic.

However, in conventional low-performance network equipment, packet order can be guaranteed by duplicating packet processing at the point of packet inflow using a single thread. As it runs, traffic is distributed to each thread for processing.

In this case, the processing speed may vary according to the protocol or data size of the allocated packet in each thread, and accordingly, in high-performance network equipment, there may be a problem that the incoming order and processing order of packets are not guaranteed.

For a more specific example, in high-performance network security equipment, the incoming sequence of packets can be used for security analysis on various network threats, and furthermore, the incoming time of packets can also be used to analyze traffic singularities through causal relationship analysis using this. there is.

However, in an environment where high-speed traffic is processed in parallel in a multi-threaded environment, a lot of resources are required to identify the incoming order of each packet, and furthermore, significant performance degradation in network equipment when a separate process is performed for this purpose. may be induced.

Republic of Korea Patent Registration No. 10-18143680000 (2017.12.27)

The present invention was invented to solve the problems of the prior art as described above, and packets in network equipment that can guarantee the order of processing or storing packets in network equipment using multi-threads to process large-capacity network traffic. It is an object to provide processing methods, devices and computer programs.

A packet processing method in network equipment according to an aspect of the present invention for solving the above problems is a method for processing or storing packets in network equipment, collecting packets and distributing and processing them in multi-threads having a plurality of threads. A packet collection step of storing the packets in a storage space; and a packet processing step of processing or storing the packets stored in the storage space according to the collected order, wherein the packets and the packet inflow times of the packets flowing into the multi-thread are matched and stored in the storage space. , In the packet processing step, an order of processing or storing the packets is calculated using the packet inflow time.

Here, it may further include a packet management step of allocating and providing or receiving and managing a storage space capable of storing the packets.

At this time, in the packet management step, the storage space may be divided for each thread and packets output from each thread may be stored.

In addition, in the packet collection step, packets that are sequentially introduced may be divided according to predetermined rules and processed in a distributed manner in multi-threads.

Furthermore, in the packet collection step, the packets may be stored in the storage space according to the order in which each thread is divided and processed and output in each thread.

Furthermore, in the packet processing step, an order of processing or storing the packets may be calculated by comparing packet inflow times of packets output first among packets remaining for each thread in the storage space.

In addition, in the packet collection step, the packets are distributed and processed by a multi-threaded security engine, and in the packet processing step, a predetermined amount of packets may be sorted and stored according to the collected order.

In addition, in the packet collecting step, it is determined whether storage space is allocated to a thread to store the packet, and if the storage space is not allocated, the storage space may be requested and allocated.

At this time, in the packet collection step, after checking the free state of the allocated storage space and returning the allocated storage space if it is insufficient, the required storage space may be requested and allocated.

In addition, the network equipment according to another aspect of the present invention includes a packet collection unit for collecting packets, distributing and processing them into multi-threads having a plurality of threads, and then storing them in a storage space; and a packet processing unit for processing or storing the packets stored in the storage space in the collected order, wherein the packets and packet inflow times of the packets flowing into the multi-thread are matched and stored in the storage space, The packet processing unit may calculate an order of processing or storing the packets using the packet inflow time.

A packet processing method, apparatus, and computer program in network equipment according to an embodiment of the present invention can ensure the order of processing or storing packets in network equipment using multi-threads to process large-capacity network traffic. .

In addition, in the packet processing method, apparatus, and computer program in network equipment according to an embodiment of the present invention, while processing packets according to incoming order, performance degradation and packet loss in network equipment that may occur in the process of implementing them, etc. problems can be effectively prevented.

The accompanying drawings, which are included as part of the detailed description to aid understanding of the present invention, provide examples of the present invention and explain the technical idea of the present invention together with the detailed description.
1 is a flowchart of a packet processing method in network equipment according to an embodiment of the present invention.
2 is a block diagram of network equipment according to an embodiment of the present invention.
3 and 4 are diagrams illustrating a multi-threaded operating environment in network equipment according to an embodiment of the present invention.
5 is a flowchart illustrating storage space allocation of a packet processing method in network equipment according to an embodiment of the present invention.
6 is a diagram illustrating a configuration of a storage space in network equipment according to an embodiment of the present invention.
7 to 8 are diagrams illustrating storage space management in a packet management step in a packet processing method in network equipment according to an embodiment of the present invention.
9 is a diagram illustrating an operation of a packet processing step in a packet processing method in network equipment according to an embodiment of the present invention.

The present invention can apply various transformations and can have various embodiments. Hereinafter, specific embodiments will be described in detail based on the accompanying drawings.

The following examples are provided to facilitate a comprehensive understanding of the methods, apparatus and/or systems described herein. However, this is only an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of a user or operator. Therefore, the definition should be made based on the contents throughout this specification. Terms used in the detailed description are only for describing the embodiments of the present invention, and should not be limiting. Unless expressly used otherwise, singular forms of expression include plural forms. In this description, expressions such as "comprising" or "comprising" are intended to indicate any characteristic, number, step, operation, element, portion or combination thereof, one or more other than those described. It should not be construed to exclude the existence or possibility of any other feature, number, step, operation, element, part or combination thereof.

In addition, terms such as first and second may be used to describe various components, but the components are not limited by the terms, and the terms are used for the purpose of distinguishing one component from another. used only as

Hereinafter, exemplary embodiments of a packet processing method, apparatus and computer program in network equipment according to the present invention will be described in detail with reference to the accompanying drawings.

First, FIG. 1 shows a flowchart of a packet processing method in the network equipment 100 according to an embodiment of the present invention. As can be seen in Figure 1, the packet processing method in the network equipment 100 according to an embodiment of the present invention, in the method for processing or storing packets in the network equipment 100, by collecting the packets A packet collection step (S110) of distributing, processing, and storing the packets in the storage space 121 by multi-threads 112 having threads of and processing or storing the packets stored in the storage space 121 according to the collected order A packet processing step (S130) may be included.

At this time, in the storage space 121, the packet and the packet inflow time of the packet flowing into the multi-thread 112 are matched and stored, and in the packet processing step (S130), the packet inflow time is used to store the packet The order of processing or storing can be calculated and applied.

Furthermore, in the packet processing method in the network equipment 100 according to an embodiment of the present invention, as can be seen in FIG. 1, a storage space 121 capable of storing the packet is allocated and provided or returned and managed. It may further include a packet management step (S120) of doing.

In addition, as shown in FIG. 2, the network equipment 100 according to an embodiment of the present invention collects packets, distributes and processes them in a multi-thread 112 having a plurality of threads, and then stores the space 121 ) and a packet processing unit 130 that processes or stores the packets stored in the storage space 121 according to the collected order. At this time, the storage space 121 ), the packet and the packet inflow time when the packet flows into the multi-thread 112 may be matched and stored, and the packet processing unit 130 uses the packet inflow time to process or store the packet The sequence can be calculated and applied.

Furthermore, as can be seen in FIG. 2, in the network equipment 100 according to an embodiment of the present invention, a packet management unit 120 that allocates and provides or receives and manages a storage space 121 capable of storing the packets. ) may be further included.

Accordingly, in the packet processing method, apparatus, and computer program in the network equipment 100 according to an embodiment of the present invention, the network equipment 100 using the multi-thread 112 to process large-capacity network traffic It is possible to guarantee the order of processing or storing, and furthermore, while processing packets in the incoming order, problems such as performance degradation and packet loss in the network equipment 100 that may occur in the process of implementing it can be effectively prevented. do.

Hereinafter, with reference to FIGS. 1 and 2, a packet processing method, device, and computer program in the network equipment 100 according to an embodiment of the present invention will be divided into components and examined in more detail.

First, in the packet collecting step (S110), the packet collecting unit 110 of the network equipment 100 collects packets, distributes them to the multi-thread 112 having a plurality of threads, processes them, and stores them in a storage space. do.

More specifically, as can be seen in FIG. 3, in the packet collecting step (S110), packets sequentially flowing through the network interface card 111 (eg, 1 to 9 in FIG. 3) are classified according to predetermined rules. It can be divided according to the multi-thread 112 having a plurality of threads (eg, 112a to 112n in FIG. 3 ) for processing.

For example, the multi-thread 112 may be configured as a multi-threaded security engine to perform an alternate security process on incoming packets to each security engine.

Thereafter, the packets processed by each thread (eg, 112a to 112n in FIG. 3 ) may be rearranged in the order of flowing into the network equipment 100 through the buffer 113 and output 114. .

That is, in the conventional low-performance network equipment, the order of packets can be guaranteed by duplicating packet processing at the time of packet inflow using a single thread, but as shown in FIG. In high-performance network equipment for multi-thread (112) environment, traffic is distributed and processed in each thread while performing distributed processing, and the processing time required for each thread may vary, resulting in a problem that the order of output packets after processing is different. could

In contrast, in the packet processing method, device, and computer program in the network equipment 100 according to an embodiment of the present invention, as shown in FIG. 4 (b), the packet output from the multi-thread 112 is rearranged in the order of flow into the network equipment 100 and output 114.

More specifically, in the packet collecting step (S110), the packets output from the multi-thread 112 are divided into respective threads and stored in the storage space 121 according to the order in which the respective threads process and output the packets.

For a more specific example, in FIG. 3 , packets 1 and 2 input to the first thread 112a, packets 3 and 4 input to the second thread 112b, and packets 3 and 4 input to the third thread 112c Packet (3), packets (6, 8) input to the fourth thread (112d), and packets (7, 9) input to the fifth thread (112e) are output and divided into respective threads according to the order in which they are output. stored in the storage space 121 (for example, as shown in FIG. 9(a), in the first thread 112a, packet 1 is output first and packet 2 is output later, so the order save accordingly).

That is, in the packet collecting step ( S110 ), the packet collecting unit 110 processes and stores a large amount of traffic simultaneously coming into the multi-thread 112 . At this time, the traffic flows into the physical Network Interface Card (NIC) 111 and may flow into the multi-thread 112 without being guaranteed in order. In addition, in the network interface card 111, each flow of the network, for example, the source (Source) IP, destination (Destination) IP, protocol (Protocol), source (Source) Port, destination (Destination) Packets with the same port value can be delivered to the same thread for processing.

At this time, each thread of the multi-thread 112 sequentially processes input packets and outputs them according to the input order.

Also, in the packet collecting step ( S110 ), the packet collecting unit 110 may request and allocate a storage space 121 for storing packets for each thread to the packet management unit 120 .

Accordingly, the order of packets collected in the same thread is guaranteed, and the packets in the guaranteed order are stored until the time when there is a margin of the allocated storage space 121. In addition, when the storage space 121 is insufficient, the storage space 121 may be returned to the packet management unit 120 and a new storage space 121 may be requested and allocated.

At this time, in the packet collecting step (S110), the packet collecting unit 110 determines whether or not the storage space is allocated for the thread to store the packet, and if it is not allocated, the storage space can be requested and allocated. there is.

In addition, in the packet collecting step (S110), the packet collecting unit 110 checks the free state of the allocated storage space 121 and returns the allocated storage space 121 if it is insufficient, and then the required storage space It can be assigned by requesting (121).

More specifically, FIG. 5 illustrates a flow chart illustrating storage space allocation in network equipment 100 according to an embodiment of the present invention.

As can be seen in FIG. 5, C11 shows a process in which traffic is introduced and processed. Accordingly, when traffic first flows into the network interface card 111 (S410), the traffic is distributed and processed in the multi-thread 112 (S420).

Also, C12 shows a process of requesting/returning the storage space 121 and storing packets in the storage space 121.

More specifically, the packet collector 110 checks the storage space 121 for each thread (S430).

At this time, if the storage space 121 is allocated, the remaining size of the storage space 121 of each thread is checked (S440).

At this time, if the size remaining in the storage space 121 of each thread is larger than a predetermined reference value and is sufficient, the packet is stored (S480), whereas if it is insufficient, the storage space 121 is returned (S450), and a new storage space is returned (S450). The space 121 is requested to the packet management unit 120 (S460).

Next, the packet management unit 120 allocates the storage space 121 and provides it to the packet collection unit 110 (S470). Accordingly, the packet collecting unit 110 stores the packet in the newly allocated storage space 121 (S480).

6 illustrates the configuration of the storage space 121 in the network equipment 100 according to an embodiment of the present invention.

First, as can be seen in FIG. 6(a), the storage space 121 includes thread state information 122a indicating the state (eg, active/inactive) of each thread and packets output from each thread. It may include packet information (122b) for storing information about.

Also, as can be seen in FIG. 6(b), the packet information 122b includes the next storage space (eg, the address of the next storage space 122b of 121a in FIG. 6(b)) and the assigned thread. of ID (unique identifier), the state of the storage space 121 (eg, unused state / state used by the packet collection unit 110 / state used by the packet processing unit 130), of the storage space 121 It may include the total size and the currently used size, and in particular, data information including the packet and the arrival time of the packet.

In addition, in the packet management step (S120), the packet management unit 120 allocates and provides a storage space 121 capable of storing the packet, or returns and manages the storage space 121.

At this time, in the packet management step (S120), the storage space 121 may be divided for each thread to store packets output from each thread.

Accordingly, the packet management unit 120 serves to allocate a storage space 121 capable of storing packets and to provide the storage space 121 at the request of the packet collecting unit 110 . In addition, the returned storage space 121 is managed so that it can be reused.

More specifically, FIG. 7 illustrates a flowchart illustrating specific operations of the packet management unit 120 in the network equipment 100 according to an embodiment of the present invention.

As can be seen in FIG. 7, the packet management unit 120 first determines the type of request (S610).

Accordingly, if the request is for allocating the storage space 121, it is processed in C21 of FIG. 7, and if it is a request for returning the storage space 121, it is processed in C22 of FIG.

Accordingly, when the packet management unit 120 confirms the storage space provision request (S620), the size of the transferable storage space is checked (S630), and if it is larger than a predetermined reference value and is sufficient, the storage space 121 is transferred to the corresponding thread. (S640) and, on the other hand, if insufficient, the storage space 121 is secured and provided (S650).

On the other hand, when the packet management unit 120 confirms the storage space return request (S660), the last location of the created storage space 121 is checked (S670), and then the returned storage space 121 is connected to the last location. and managed (S680).

8 illustrates the structure of the storage space 121 of the packet management unit 120 in the network equipment 100 according to an embodiment of the present invention.

As shown in FIG. 8 , the packet management unit 120 may use the packet storage management structure 123 for managing the storage space 121 .

More specifically, as shown in FIG. 8, the packet storage management structure 123 includes the maximum number of storage spaces 121, the number of created storage spaces 121, the number of storage spaces 121 in use, The number of unused storage spaces 121, the number of multi-threads 112, the thread-specific management data structure 123a, and the storage space management data structure 123b area may be included.

At this time, as can be seen in FIG. 8, the thread allocation data structures 124a, 124b, and 124c allocated to each thread may be sequentially connected to the thread-specific management data structure 123a. It operates while managing the allocation data structures 124a, 124b, and 124c respectively.

In addition, as can be seen in FIG. 8, the storage space management data structure 123b, within the storage space allocated to each thread, from the storage space (head) through (used) and (curPosition) to (tail) It is sequentially connected and managed.

Accordingly, the packet management unit 120 can efficiently manage each thread while providing or returning the storage space 121 .

In addition, in the packet processing step (S130), the packet processing unit 130 processes or stores the packets stored in the storage space 121 according to the collected order.

More specifically, in the packet processing step (S130), the order of processing or storing the packets is calculated by comparing packet entry times of packets output first among packets remaining in the storage space 121 for each thread. can

Accordingly, the packet processing unit 130 identifies the arrival time of packets stored for each thread in the storage space 121 managed by the packet management unit 120, and the fastest arrival time among all packets stored in the storage space 121. A packet of is calculated and processed.

More specifically, FIG. 9 illustrates a diagram for explaining the operation of the packet processing step (S130) in the network equipment 100 according to an embodiment of the present invention.

As can be seen in FIG. 9, the packet processing unit 130 individually manages storage spaces used by M threads of the multi-thread 112, and does not compare all N packets in the storage space, By comparing only M packets, a packet having the fastest arrival time can be calculated.

That is, the packet processing unit 130 may compare only the first M packets input, processed, and output for each M thread to calculate a packet having the fastest incoming time among all stored packets.

For a more specific example, as shown in FIG. 9(a), only packet 1, packet 3, packet 5, packet 6, and packet 7 are compared, and the double packet inflow time is the highest. The fast packet 1 is calculated, and then, as shown in FIG. 9(b), only the packet 2, packet 3, packet 5, packet 6, and packet 7 are compared to double packets. A packet (2) having the fastest entry time is calculated.

By repeating this process, the collected packets go through the multi-thread 112 and each packet stored in the storage space 121 can be processed or stored again according to the collected order.

In addition, the storage space 121 used by the packet processing unit 130 is returned to the packet management unit 120 . At this time, all packets stored in the storage space 121 must be processed ((a) to (f) of FIG. 9), and the storage space 121 is returned to an initialized state.

Furthermore, in the packet processing method, device, and computer program in the network equipment 100 according to an embodiment of the present invention, the packet may be distributed and processed by a multi-threaded security engine in the packet collection step (S110), Accordingly, in the packet processing step (S130), packets of a predetermined amount may be sorted and stored according to the collected order.

Accordingly, the network equipment 100 according to an embodiment of the present invention guarantees the incoming order of a predetermined amount of packets by an administrator, etc. and stores them for various security analysis purposes, or analyzes causal relationships to identify traffic singularities, etc. It can be used to detect, but the present invention is not necessarily limited thereto.

In addition, the computer program according to another aspect of the present invention is characterized in that it is a computer program stored in a computer readable medium in order to execute each step of the packet processing method in the salpin network equipment 100 in the computer. The computer program may be a computer program including machine code generated by a compiler, as well as a computer program including high-level language code that can be executed on a computer using an interpreter or the like. At this time, the computer is not limited to a personal computer (PC) or a notebook computer, etc., and has a central processing unit (CPU) such as a server, smart phone, tablet PC, PDA, mobile phone, etc. to execute a computer program. All information processing include the device

In addition, the computer-readable medium may continuously store a computer-executable program or temporarily store it for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or combined hardware, but is not limited to a medium directly connected to a certain computer system, and may be distributed on a network. Examples of the medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROM and DVD, magneto-optical media such as floptical disks, and ROM, RAM, flash memory, etc. configured to store program instructions. In addition, examples of other media include recording media or storage media managed by an app store that distributes applications, a site that supplies or distributes various other software, and a server.

Accordingly, a packet processing method, device, and computer program in the network equipment 100 according to an embodiment of the present invention are packet packets in the network equipment 100 using the multi-thread 112 to process large-capacity network traffic. The order of processing or storing can be guaranteed.

In addition, in the packet processing method, device, and computer program in the network equipment 100 according to an embodiment of the present invention, while processing the packets according to the incoming order, in the network equipment 100 that may appear in the process of implementing them Problems such as performance degradation and packet loss can also be effectively prevented.

The above description is merely an example of the technical idea of the present invention, and various modifications and variations can be made to those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments described in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and are not limited to these embodiments. The protection scope of the present invention should be construed by the following claims, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

100: network equipment
110: packet collecting unit
111: network interface card
112: multi-thread
112a, 112b, 112c, 112d, 112e, 112n: thread
113: buffer
114: output
120: packet management unit
121, 121a, 121b, 121c: storage space
122a: thread state information
122b: packet information
123: packet storage management structure
123a: management data structure for each thread
123b: storage space management data structure
124a, 124b, 124c: thread allocation data structure
130: packet processing unit

Claims (10)

In the method of processing or storing packets in network equipment,
a packet collection step of collecting packets, distributing and processing them into multi-threads having a plurality of threads, and then storing the packets in a storage space; and
A packet processing step of processing or storing packets stored in the storage space according to the collected order;
In the storage space, the packet and the packet inflow time when the packet flows into the multi-thread are matched and stored;
In the packet collection step,
While dividing sequentially incoming packets according to predetermined rules and distributing and processing them in multi-threads,
storing the packets in the storage space according to the order in which they are divided for each thread and processed and output in each thread;
In the packet processing step,
Packet processing in network equipment, characterized in that for calculating the order of processing or storing the packets according to the collected order by comparing the packet inflow time of the packets output first among the packets remaining for each thread in the storage space method. According to claim 1,
A packet processing method in network equipment, characterized in that it further comprises; a packet management step of allocating and providing, or returning, and managing a storage space capable of storing the packet. According to claim 2,
In the packet management step,
A packet processing method in network equipment, characterized in that the storage space is divided for each thread and packets output from each thread are stored. delete delete delete According to claim 1,
In the packet collection step,
The packet is distributed and processed by a multi-threaded security engine;
In the packet processing step,
A packet processing method in a network equipment, characterized in that for storing a predetermined amount of packets in the collected order. According to claim 1,
In the packet collection step,
Determining whether to allocate storage space for a thread to store the packet,
A packet processing method in network equipment, characterized in that when it is not allocated, the storage space is requested and allocated. According to claim 7,
In the packet collection step,
A packet processing method in network equipment characterized by checking the free state of the allocated storage space, returning the allocated storage space if it is insufficient, and then requesting and allocating the required storage space. a packet collecting unit that collects packets, distributes and processes them into multi-threads having a plurality of threads, and then stores the packets in a storage space; and
A packet processor configured to process or store the packets stored in the storage space according to the collected order;
In the storage space, the packet and the packet inflow time of the packet inflow to the multi-thread are matched and stored;
In the packet collecting unit,
While dividing sequentially incoming packets according to predetermined rules and distributing and processing them in multi-threads,
storing the packets in the storage space according to the order in which they are divided for each thread and processed and output in each thread;
In the packet processing unit,
The network equipment according to claim 1 , wherein an order of processing or storing the packets is calculated according to the collected order by comparing packet inflow times of packets output first among packets remaining for each thread in the storage space.

Images