WO2015176212A1

WO2015176212A1 - Tcam and fpga-based packet processing method and device

Info

Publication number: WO2015176212A1
Application number: PCT/CN2014/077799
Authority: WO
Inventors: 丁玉奇; 张洪雁
Original assignee: 北京东土科技股份有限公司
Priority date: 2014-05-19
Filing date: 2014-05-19
Publication date: 2015-11-26

Abstract

A TCAM and FPGA-based packet processing method and device. The method comprises: according to a packet type of a received packet, extracting, by a switch, data header information about the packet, wherein the data header information comprises at least one piece of unary information and at least one piece of multiple information; searching for flow tables corresponding to all pieces of information in each data header in parallel and integrating output results; and judging whether a multiple flow table corresponding to the multiple information is idle when the data header information is multiple information, and sending the multiple flow table to a processing queue of the multiple flow table when the multiple flow table is not idle. By means of the solution provided in the embodiments of the present invention, the deep parsing conducted on a packet can be effectively realized, and the results obtained by looking up a table previously can be effectively associated in a manner of combining parallel connection with series connection and the processing efficiency of the packet can be effectively increased.

Description

Message processing method and device based on TCAM and FPGA

The present invention relates to the field of industrial Ethernet communication technologies, and in particular, to a packet processing method and apparatus based on TCAM and FPGA. Background technique

Industrial Ethernet is currently developing very rapidly and has a wide range of applications in various industries, making Ethernet communication a rapidly growing position in the field of industrial automation. However, Industrial Ethernet communication has the following problems:

The packet processing includes: After receiving the packet, the switch extracts the information from the packet, and the extracted information includes: (Virtual Local Area Network, VLAN) information, MAC address information, port number, etc., and searches for corresponding information according to the extracted information. The table, and according to the specific lookup for the corresponding processing. Specifically, the VLAN table is searched according to the extracted VLAN information and the port number. After the query is passed, the Layer 2 address forwarding table is queried according to the extracted MAC address, and the packet is forwarded according to the result of the query.

The processing process of the above-mentioned entire message is serial hierarchical processing, the processes are sequentially processed in order, and each process is processed separately, and the query work required in each process is also performed serially, so the entire packet processing flow is performed. The flexibility is not high and the delay is high, which affects the forwarding performance of packets.

In the industrial communication, due to the security factor, it is more and more urgent to deeply analyze the packet. The current processing method is that the packet is processed by the switch and sent to the next layer for further processing, and the subsequent processing. It is also serial, so the above process cannot perform targeted network forwarding policy configuration for a specific industrial communication protocol, thereby causing an increase in data forwarding delay.

The way to implement security for existing switches is through ACL. In use, ACL uses serial query and matching. After matching a flow table, it matches the next one. The flow table is generally implemented by TCAM. In an FPGA, it is impossible to use a large number of independent TCAMs, generally dividing one TCAM into multiple Work in the form of a logical table. At this time, there will be a problem, because the received flow table needs to be searched for different flow tables. If the serial processing method is used, the efficiency of processing the message will be seriously hindered, thereby affecting the data throughput rate of the product and causing the report. The text forwarding delay increases. Summary of the invention

In view of the above problems, the present invention has been made in order to provide a TCAM and FPGA based message processing method and apparatus that overcomes the above problems or at least partially solves the above problems.

The embodiment of the invention provides a packet processing method based on TCAM and FPGA, and the method includes:

The switch identifies the packet type of the received packet, and extracts packet header information of the packet according to the packet header extraction rule corresponding to the identified packet type, where the packet header information includes at least one unary information, and at least a multi-group information;

According to the correspondence between each information in the saved packet header and the flow table, each flow table corresponding to each information is searched in parallel, and the search results are integrated and output, wherein

When the information is unary information, determining a search result according to the unary flow table corresponding to the unary information;

When the information is the multi-group information, it is determined whether the multi-group flow table corresponding to the multi-group information is currently idle, and when the multi-group flow table is not idle, sending the multi-group information to the multi-group flow table. In the processing queue, otherwise, the multi-group flow table is searched according to the multi-group information and the search result is determined.

In order to further implement the deep processing of the packet, after the searching for the multi-group flow table according to the multi-group information and determining the search result, the method further includes:

Performing secondary analysis on the multi-group information;

According to the parsing, each information is obtained, and the secondary flow table corresponding to each information is searched for, and the secondary flow table corresponding to each information is searched in parallel, and the search result is integrated with the search result of the unary information and the multi-group information, and then output.

In order to ensure the accuracy of the processing result, in the embodiment of the present invention, the search result is integrated The post output includes:

Adding a packet descriptor to each piece of information of the extracted packet header, and obtaining each search result including the packet descriptor;

Determining, according to the packet type of the packet, whether the number of the currently obtained search results satisfies the number of search results corresponding to the packet type;

When the number of currently obtained search results satisfies the number of search results corresponding to the message type, each search result is integrated and output.

To further improve the processing efficiency of the packet, when the flow table is a multi-group flow table, the multi-group flow table includes a plurality of highest-level tuple flow tables, and determining the search result includes:

Determining the priority of the message;

When the priority of the packet satisfies a preset priority condition, determining whether each of the multi-group flow tables of the first priority is idle; when the first priority has an idle multi-group flow table, according to the multi-group The information is searched for the first priority idle multi-group flow table and determines a search result. When each multi-group flow table of the first priority is not idle, determining whether each multi-group flow table of the second priority is Idle, when the second priority has an idle multi-group flow table, searching for the idle second-priority multi-group flow table according to the multi-group information and determining a search result, otherwise, sending the multi-group information to The processing queue of the first priority multi-group flow table;

When the priority of the packet does not meet the preset priority condition, it is determined whether each of the multi-group flow tables of the second priority is idle; when the second priority has an idle multi-group flow table, according to the multiple The group information finds the idle multi-group flow table and determines a search result, and when the multi-group flow table of the second priority is not idle, sending the multi-group information to the second priority multi-group The processing table of the flow table.

In order to further improve the processing efficiency of the packet, when the flow table is a multi-group flow table, the multi-group flow table includes a highest tuple flow table and a plurality of common tuple flow tables, wherein the receiving according to the set time length is received. Set the common tuple flow table in the packet type included in each packet header, and set the common tuple flow table; wherein, determining the search result includes:

According to the packet type of the received packet, when the packet type meets the common tuple flow table, When the packet type is available, it is determined whether there is an idle common tuple flow table. When there is an idle common tuple flow table, the idle common tuple flow table is searched according to the multi-group information and the search result is determined. Otherwise, Transmitting the multi-group information to a processing queue of the common tuple flow table;

When the packet type does not meet the packet type corresponding to the common tuple flow table, it is determined whether the highest tuple flow table is idle. When the highest tuple flow table is idle, the highest tuple is searched according to the multi-group information. The flow table determines the lookup result, otherwise, the tuple information is sent to the processing queue of the highest tuple flow table.

The embodiment of the invention provides a message processing device based on TCAM and FPGA, and the device comprises:

The parsing and extracting module is configured to identify a packet type of the received packet, and extract a packet header information of the packet according to the packet header extraction rule corresponding to the identified packet type, where the packet header information includes at least one unary Information, and at least one tuple information;

a storage search module, configured to search each flow table corresponding to each information in parallel according to the correspondence between each information in the saved data packet header and the flow table, where, when the information is unary information, according to the unary information Corresponding one-way flow table, determining a search result; when the information is multi-group information, determining whether the multi-group flow table corresponding to the multi-group information is currently idle, and when the multi-group flow table is not idle, The group information is sent to the processing queue of the multi-group flow table, otherwise, the multi-group flow table is searched according to the multi-group information and the search result is determined;

Arbitration module, used to integrate the search results and output.

In order to further implement deep processing of the message, the device further includes:

a secondary parsing module, configured to perform secondary parsing on the multi-group information;

The storage search module is further configured to: obtain each information according to the parsing, and a secondary flow table corresponding to each information, and search for a secondary flow table corresponding to each information in parallel;

The arbitration module is further configured to integrate the search result with the search result of the unary information and the multi-group information and output the result.

In order to ensure the accuracy of the packet processing, the arbitration module is specifically configured to add a packet descriptor to each information of the extracted data packet header, and obtain each search result including the packet descriptor; Determining, according to the packet type of the packet, whether the number of the currently obtained search results satisfies the number of search results corresponding to the packet type; when the number of currently obtained search results satisfies the number of search results corresponding to the packet type, The results of the search are integrated and output.

In order to further improve the processing efficiency of the packet, the storage search module is specifically configured to: when the flow table is a multi-group flow table, the multi-group flow table includes a plurality of highest tuple flow tables, when When the priority of the message satisfies the preset priority condition, it is determined whether each of the multi-group flow tables of the first priority is idle; when the first priority has an idle multi-group flow table, the search is performed according to the multi-group information Determining a result of the first priority idle multi-group flow table and determining a search result. When each of the multi-group flow tables of the first priority is not idle, determining whether each multi-group flow table of the second priority is idle, when When the second priority has an idle multi-group flow table, searching for the idle second priority multi-group flow table according to the multi-group information and determining a search result, otherwise, sending the multi-group information to the first Determining, in the processing queue of a priority multi-group flow table, when the priority of the packet does not satisfy the preset priority condition, determining whether each multi-group flow table of the second priority is idle; When the priority multi-group flow table exists, the idle multi-group flow table is searched according to the multi-group information, and the search result is determined. When each multi-group flow table of the second priority is not idle, the The tuple information is sent to the processing queue of the second priority flow table of the second priority.

To further improve the processing efficiency of the packet, the storage search module is specifically configured to: when the flow table is a multi-group flow table, the multi-group flow table includes a highest tuple flow table and a plurality of common tuple flow tables. And setting a common tuple flow table according to the multi-group information included in each packet header in the received packet type within the set time length; according to the packet type of the received packet, when the packet type When the packet type corresponding to the common tuple flow table is met, it is determined whether there is an idle common tuple flow table. When there is an idle common tuple flow table, the idle common tuple flow is searched according to the multi-group information. And determining the result of the search, otherwise, sending the multi-group information to the processing queue of the common tuple flow table; when the packet type does not meet the packet type corresponding to the common tuple flow table, the judgment is the highest Whether the tuple flow table is idle, and when the highest tuple flow table is idle, searching for the highest tuple flow table according to the multi-group information and determining a search result, otherwise, sending the multi-group information The tuple processing queue up in the flow table. The embodiment of the present invention provides a packet processing method and device based on TCAM and FPGA. In this method, the switch extracts packet header information of the packet according to the packet type of the received packet, where the packet header information includes At least one unary information and at least one multi-group information, searching for a flow table corresponding to each information in each data packet header in parallel and integrating the output result, and determining that the multi-group information corresponds to when the data packet header information is a multi-group information Whether the multi-group flow table is idle, and sending the multi-group flow table to the processing queue of the multi-group flow table when not idle. Since the data packet header information extracted by the embodiment of the present invention includes the unary information and the multi-group information, the unary information directly searches for the unary flow table, and when searching the multi-group flow table according to the multi-group information, it is necessary to determine whether the current flow table is idle. That is, it is determined whether the current flow table is occupied by other messages, and the flow table needs to be queued when the flow table is occupied. Therefore, the solution provided by the embodiment of the present invention can effectively implement deep analysis of the message, and the parallel and serial connection are used. The combination method can effectively correlate the results obtained by the previous lookup table, and effectively improve the processing efficiency of the message.

The above description is only an overview of the technical solutions of the present invention, and the technical means of the present invention can be more clearly understood, and can be implemented in accordance with the contents of the specification, and the above and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below. DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

FIG. 1 is a flow chart of packet processing based on TCAM and FPGA according to an embodiment of the present invention; FIG. 2 is a flow chart of packet processing based on TCAM and FPGA according to Embodiment 1 of the present invention;

FIG. 3 is a schematic diagram of a processing process based on TCAM and FPGA according to Embodiment 2 of the present invention; FIG.

FIG. 4 is a schematic diagram of a process based on TCAM and FPGA according to Embodiment 3 of the present invention. Figure

FIG. 5 is a schematic diagram of packet processing based on TCAM and FPGA according to Embodiment 4 of the present invention; FIG.

FIG. 6 is a schematic structural diagram of a message processing apparatus based on TCAM and FPGA according to an embodiment of the present invention. detailed description

In order to effectively realize the deep analysis of the message and improve the processing efficiency of the message, a message processing method and device based on TCAM and FPGA are provided.

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the exemplary embodiments of the present invention are shown in the drawings, it is understood that Rather, these embodiments are provided so that this disclosure will be more fully understood, and the scope of the disclosure can be fully conveyed to those skilled in the art.

The embodiments of the present invention will be described below with reference to the accompanying drawings.

FIG. 1 is a flowchart of packet processing based on TCAM and FPGA according to an embodiment of the present invention, where the process includes the following steps:

S101: The switch identifies the packet type of the received packet, and extracts data packet header information of the packet according to the packet header extraction rule corresponding to the identified packet type, where the data packet header information includes at least one unary information. And at least one tuple information.

The packet type includes an IP packet, a TCP packet, and the like, and the packet type of the packet can be identified according to the information carried in the packet.

The data packet header information extracted in the data packet header of the packet in the embodiment of the present invention includes: at least one unary information and at least one multi-group information, wherein the unary information may be, for example, VLAN information, MAC address information, port number information, etc. The group information is information composed of a plurality of unary information, and may be, for example, 4-tuple information, 7-tuple information, 9-tuple information, 12-tuple information, 14-tuple information, 15-tuple information, etc., through the multi-group The information can determine the type of the text, and can determine the source and whereabouts of the message for subsequent lookup of the multi-group flow table. For example, the EtherCAT industrial protocol message commonly used in industrial communication can parse the 4-tuple information from the packet header of the message, and the 4-tuple information includes: the ingress port number, the source MAC address, the destination MAC address, and the Ethernet protocol. Type, through this 4-tuple information, the switch can accurately determine which packet is an EtherCAT packet from the data stream, and at the same time obtain the source and location of the packet for subsequent matching of the multi-group flow table.

For the ModBus TCP packet, the 12-tuple information can be parsed from the packet header of the packet. The 12-tuple information includes: the ingress port number, the source MAC address, the destination MAC address, the VLAN ID, the priority, and the Ethernet. The network type, the source IP address, the destination IP address, the IP protocol type, the TCP source port, the TCP destination port, and the ToS. Through the 12-tuple information, the switch can accurately determine which packet is a ModBus TCP packet from the data stream. And at the same time get the source and where to go for this message, for subsequent matching to use the multi-group flow table.

In the process of extracting, a corresponding packet header extraction rule is set for each type of packet, that is, for each packet type, in order to implement deep analysis of the packet, the packet of the type may be preset. The extracted packet header information forms a corresponding packet header extraction rule according to the packet header information, so as to extract the packet header information of the subsequent corresponding type of packet.

S102: Search each flow table corresponding to each information in parallel according to the correspondence between each information in the saved packet header and the flow table.

In the embodiment of the present invention, in order to effectively improve the processing efficiency of the packet, and reduce the delay of the packet processing, when the packet header information of the packet is extracted, when the flow table is searched according to each packet header information, the flow table is used. The lookup process can be performed in parallel, that is, each flow table is called in parallel for searching.

Specifically, when performing the searching, when the information is unary information, determining a search result according to the unary flow table corresponding to the unary information;

The multi-group flow table generally includes: an ingress port number, a source MAC address, a destination MAC address, and a VLAN. ID, priority, Ethernet type, source IP address, destination IP address, IP protocol type, TCP source port, TCP destination port, ToS, etc., generally corresponding to the extracted multi-group information configuration flow table content. For example, if it is 4-tuple information, the 4-tuple information includes: an inbound port number, a source MAC address, and a destination MAC address, and the corresponding multi-group flow table includes an inbound port number, a source MAC address, and a destination MAC address information. If it is 12-yuan information, the 12-tuple information includes: Incoming port number, source MAC address, destination MAC address, VLAN ID, priority, MAC protocol type, source IP address, destination IP address, IP protocol type, TCP source The port, the TCP destination port, and the ToS, the corresponding multi-group flow table includes: the inbound port number, the source MAC address, the destination MAC address, the VLAN ID, the priority, the Ethernet type, the source IP address, the destination IP address, and the IP address. Protocol type, TCP source port, TCP destination port, ToS information.

In the embodiment of the present invention, the switch searches for each corresponding flow table in parallel for each information in the data packet header information, but because the meta-information and the multi-group information exist in the data packet header information, the flow table is searched according to the unary information. The comparison is fast, and the flow table is relatively slow to search according to the multi-group information. Therefore, the flow table required for the message may be used by other messages, that is, the flow table is currently not idle, and the information is guaranteed. For a valid lookup, this information needs to be sent to the processing queue of the flow table. In addition, in order to implement deep parsing of the message, the extracted packet header information includes the multi-group information, and when the multi-group information is searched for the flow table, the multi-group information has mutual dependence, and needs to be based on a certain element or The result of finding a certain meta-information is combined with other meta-information to perform the next search, and then the search is completed according to the need, so the multi-group information is performed in a serial manner when searching for the flow table, thereby realizing A deep analysis of the message.

S103: Integrate the search result and output.

Since the data packet header information extracted by the embodiment of the present invention includes the unary information and the multi-group information, the unary information directly searches for the unary flow table, and when searching the multi-group flow table according to the multi-group information, it is necessary to determine whether the current flow table is idle. That is, it is determined whether the current flow table is occupied by other messages, and the flow table needs to be queued when the flow table is occupied. Therefore, the solution provided by the embodiment of the present invention can effectively implement deep analysis of the message, and the parallel and serial connection are used. The combination method can effectively correlate the results obtained by the previous lookup table, and effectively improve the processing efficiency of the message. In addition, in the embodiment of the present invention, in order to further implement the deep analysis of the packet, after the searching for the multi-group flow table according to the multi-group information and determining the search result, the method further includes:

Performing secondary analysis on the multi-group information;

In the embodiment of the present invention, in order to further deepen the parsing of the message, after the corresponding search result is obtained according to the multi-group information, the multi-group information is parsed twice to obtain each information, and each information is A secondary flow table is set in the switch, and each information is searched according to each secondary flow table corresponding to the corresponding search result.

For example, the received message is a Modbus TCP packet, and the 12-tuple information of the packet is first parsed (the 12-tuple information includes: an inbound port number, a source MAC address, a destination MAC address, a VLAN ID, a priority, and a MAC address). Protocol type, source IP address, destination IP address, IP protocol type, TCP source port, TCP destination port, ToS). The message can be determined according to the four types of information: MAC protocol type, IP protocol type, TCP destination port, and TCP source port. The text is a Modbus TCP packet, which contains the MBAP header. Therefore, the packet needs to be parsed twice, and then the MBAP header of the packet is parsed for analysis.

If the received packet is an Ethernet PowerLink packet, the 4-tuple information of the packet is first parsed (the 4-tuple information includes: an ingress port, a source MAC address, a destination MAC address, and a MAC protocol type), according to the 4 yuan. The MAC protocol type in the group information can be determined that the packet is an Ethernet PowerLink packet, but the packet information needs to be parsed twice, and then the Powerlink packet type, the destination NODE ID, and the source NODE of the packet are parsed. ID information for analysis.

FIG. 2 is a schematic diagram of a packet processing process based on TCAM and FPGA according to Embodiment 1 of the present invention, where the process includes the following steps:

S201: The switch identifies the packet type of the received packet, and extracts data packet header information of the packet according to the packet header extraction rule corresponding to the identified packet type, where the data packet header information The information includes at least one unary information and at least one tuple information.

S202: Search each flow table corresponding to each information in parallel according to the correspondence between each information in the saved data packet header and the flow table. It is determined whether the current information is unary information. When the current information is unary information, step S203 is performed; otherwise, step S204 is performed.

S203: Determine a search result according to the unary flow table corresponding to the unary information, and then proceed to step S207.

S204: Determine whether the multi-group flow table corresponding to the multi-group information is currently idle. When the multi-group flow table is not idle, send the multi-group information to a processing queue of the multi-group flow table. Otherwise, Finding the multi-group flow table according to the multi-group information and determining a search result. At the same time, the search result is sent to S207.

S205: Perform secondary analysis on each multi-group information.

S206: Obtain each information according to the parsing, and a secondary flow table corresponding to each information, and search for a secondary flow table corresponding to each information in parallel.

S207: The search result is integrated with the search result of the unary information and the multi-group information, and then output. In the process of searching the flow table in the embodiment of the present invention, since the parallel and serial connection is used for searching, in addition, the secondary flow table may be used, so there are multiple search results, in order to ensure the final output. Accuracy, the integrating the search result after the outputting in the embodiment of the present invention comprises: adding a packet descriptor to each information of the extracted data packet header, and obtaining each search result including the packet descriptor;

By adding a packet descriptor to the packet header information, each packet whose result belongs is identified. In addition, since each type of packet has its corresponding packet extraction rule, how many search results are obtained is also known. Therefore, when receiving the search result including the same packet descriptor, determining whether the number of currently obtained search results satisfies the packet type according to the packet type of the corresponding packet The number of corresponding search results. When the number of search results currently obtained satisfies the number of search results corresponding to the message type, each search result is integrated and output, thereby improving packet processing efficiency while ensuring packet processing efficiency. accuracy.

FIG. 3 is a schematic diagram of a process of processing a message based on a TCAM and an FPGA according to Embodiment 2 of the present invention. After receiving a packet, the switch according to the packet type of the packet, for example, may specifically report the packet according to the MAC type. The text is parsed according to the packet header extraction rule corresponding to the parsed packet type, and the packet header information of the packet is extracted, and the specific extracted information may be a meta-information VLAN information and a MAC information, and a multi-group information-12 tuple information. And add a package descriptor (package 1 descriptor) to each of the extracted information.

The switch searches for the flow table corresponding to each information in parallel according to the correspondence between each information in the saved packet header and the flow table. Specifically, the VLAN table is searched according to the extracted VLAN information, and the MAC table is searched according to the extracted MAC information, and the 12-tuple table is searched according to the extracted 12-tuple information. When searching for the unary flow table, that is, looking up the VLAN table and the MAC table in FIG. 3, directly searching for the corresponding VLAN table and MAC table according to the VLAN information and the MAC information, and searching for the 12-tuple table according to the 12-tuple group. When it is determined whether the 12-tuple table is idle, when the 12-tuple table is not idle, that is, when the 12-tuple table is used by another text, the 12-tuple information is sent to the processing queue of the 12-tuple table, Otherwise, the 12-tuple table is searched serially according to the 12-tuple until the search result is determined.

Each search result is found after each flow table is searched, and is identified as action 1, action 2, and action ₃ in FIG. 3, wherein the action 1 to action 3 carry the same packet descriptor (packet 1 descriptor).

Perform secondary parsing on the extracted 12-tuple, extract each custom field, and find each secondary flow table according to each custom field according to the correspondence between each saved custom field and the secondary flow table. . As shown in FIG. 3, each of the custom fields is searched for a custom table 1 to a custom table 3, and each table lookup result is obtained after the table lookup, and is identified as action 4, action 5, and action 6 in FIG. The same packet descriptor (packet 1 descriptor) is also carried in actions 4 to 6.

According to the obtained search result that carries the same packet descriptor, according to the packet type of the packet, it is determined whether the number of the currently obtained search results satisfies the number of search results corresponding to the packet type, and when satisfied, each will be The search results are integrated and output. In the embodiment of the present invention, in order to further improve the processing efficiency of the packet, a plurality of multi-group flow tables may be set, and specifically, a plurality of highest tuple flow tables may be set. According to the packet type of the various packets received by the switch, and the multi-group information included in the packet header information in each type of packet extracted, the tuple of the highest tuple in the packet header information may be determined. Setting a plurality of highest tuple flow tables according to the highest tuple to facilitate subsequent searching. For example, the packet header information extracted by the switch includes 4-tuple information, 7-tuple information, 12-tuple information, and 15-tuple information, and the highest The tuple flow table is a 15-tuple flow table.

When multiple top-level tuple flow tables are included, determining the lookup results includes:

Determining the priority of the message;

In the embodiment of the present invention, the plurality of highest tuple flow tables are divided into two groups, one of which is a first priority multi-group flow table, and the other is a second priority multi-group flow table, and The packet type, preset priority conditions, also divides the packets into different priorities.

When it is determined that the packet meets the preset priority condition, that is, when the packet belongs to the high priority packet, the first priority multi-group flow table is used for searching, if each multi-group flow of the first priority The table is not idle, and when the second priority has an idle multi-group flow table, the second priority can also be used. The multi-group flow table performs a search. If the first priority level and the second priority do not have an idle multi-group flow table, the multi-group information is sent to the processing queue of the first priority multi-group flow table.

When it is determined that the message does not meet the preset priority condition, that is, when the message belongs to the low priority message, the second priority flow table is used for searching, when each second of the second priority When the group flow table is not idle, the multi-group information is sent to the processing queue of the second-priority multi-group flow table.

FIG. 4 is a schematic diagram of a processing process based on TCAM and FPGA according to Embodiment 3 of the present invention, the process comprising the following steps:

S401: The switch identifies the packet type of the received packet, and extracts packet header information of the packet according to the packet header extraction rule corresponding to the identified packet type, where the packet header information includes at least one meta-information. And at least one tuple information.

S402: Search each flow table corresponding to each information in parallel according to the correspondence between each information in the saved data packet header and the flow table. It is determined whether the current information is unary information. When the current information is unary information, step S403 is performed; otherwise, step S404 is performed.

S403: Determine a search result according to the unary flow table corresponding to the unary information, and then proceed to step S407.

S404: Determine whether the priority of the packet meets a preset priority condition, and if the determination result is yes, proceed to step S405; otherwise, proceed to step S406.

S405: determining whether each of the multi-group flow tables of the first priority is idle; when the first priority has an idle multi-group flow table, searching for the first-priority idle multi-group flow table according to the multi-group information and Determining a search result, when each of the multi-group flow tables of the first priority is not idle, determining whether each of the multi-group flow tables of the second priority is idle, and when the second priority has an idle multi-group flow table, Finding the idle second priority multi-group flow table according to the multi-group information and determining a search result, otherwise, sending the multi-group information to a processing queue of the first priority multi-group flow table . And after determining the search result, the search result is sent to step S409.

S406: determining whether each of the multi-group flow tables of the second priority is idle; when the second priority has an idle multi-group flow table, searching for the idle multi-group flow table according to the multi-group information and determining Looking for a result, when each of the multi-group flow tables of the second priority is not idle, the multi-group information is sent to a processing queue of the second-priority multi-group flow table. And after determining the search result, the search result is sent to step S409.

S407: Perform secondary analysis on each of the multi-group information.

S408: Obtain each information according to the parsing, and a secondary flow table corresponding to each information, and search for a secondary flow table corresponding to each information in parallel.

S409: The search result is integrated with the search result of the unary information and the multi-group information, and then output. Or, in the embodiment of the present invention, in order to further improve the processing efficiency of the packet, one or several highest tuple flow tables and a plurality of common tuple flow tables may be set, wherein the received according to the set time length Set the common tuple flow table for the multi-group information contained in each packet header in the message type.

Wherein, determining the search result includes:

According to the packet type of the received packet, when the packet type satisfies the packet type corresponding to the common tuple flow table, it is determined whether there is an idle common tuple flow table, and when there is an idle common tuple flow table And searching for the idle common tuple flow table according to the multi-group information and determining a search result, otherwise, sending the multi-group information to a processing queue of the common tuple flow table;

In the above embodiment of the present invention, the common multi-group flow table is set according to the multi-group information included in each packet header of the packet type received by the switch within the set time length, for example, the switch is in a half year or a year. During the time, a large number of 4-tuple information, 5-tuple information, and 3-tuple information are present in the received message, and the common tuple flow table may be a 5-tuple flow table. And the common tuple flow table can be set more than one, which is convenient for subsequent search.

In addition, according to the packet type of various messages received by the switch, and the multi-group information included in the packet header information in each type of packet extracted, it can be determined how many elements of the highest tuple in the packet header information are. Group, according to the highest tuple set a plurality of highest tuple flow table, for subsequent search, For example, the packet header information extracted by the switch includes 4-tuple information, 7-tuple information, 12-tuple information, and 15-tuple information, and the highest tuple flow table is a 15-tuple flow table.

After receiving each packet, it determines whether the packet type satisfies the packet type corresponding to the common tuple flow table according to the identified packet type. This is because each packet type has its corresponding packet extraction rule. It is determined that the multi-group information extracted by each message type is also known. Therefore, according to the message type of the message, it can be determined whether the multi-group information in the packet header information of the message is searched by using a common tuple flow table. .

When it is determined that the packet type satisfies the packet type corresponding to the common tuple flow table, the common meta-group flow table is used for searching. Otherwise, the highest tuple flow table is used for searching. In addition, in order to ensure the efficiency of packet processing, a plurality of common tuple flow tables may be further classified into different priority groups, and the packets are prioritized for the packet type, and the priority is high. The packets can be searched by using the high-priority common tuple flow table and the idle low-priority common tuple flow table. The low-priority packets can only be searched by the low-priority common tuple flow table.

FIG. 5 is a schematic diagram of packet processing based on TCAM and FPGA according to Embodiment 4 of the present invention, to further illustrate the technical effects of the embodiment of the present invention. In Figure 5, when the switch receives message 1, the input time of the message 1, that is, the time for receiving the message 1 is 00. According to the message type of the message, the corresponding packet extraction rule is used to extract the packet header information of the packet, and the time for completing the packet parsing may be 01, and the parallel search for each packet header information is performed. Flow table.

The matching completion time of the lookup flow table 1 is 02, that is, the time for determining the search result is 02 (actionl arrival time 02 in FIG. 5), and the matching completion time of the search flow table 2 is 03, that is, the time for determining the search result is 03. (action2 arrival time 03 in Fig. 5). At this time, flow table 2 is a multi-group flow table, and the multi-group information in the packet header information needs to be searched sequentially for the multi-group flow table in a serial manner, so that time-consuming relative Said longer.

Perform secondary analysis on the multi-group information in the packet header information, the completion time is 04, and four pieces of information are obtained by parsing, and each information corresponding to the corresponding secondary flow table is flow table 3 to flow table 6, respectively, and each search is performed in parallel. For each flow table, the time for finding the matching completion is 05, that is, the time for determining the search result is 05 (action3~action6 arrival time 05 in Fig. 5). According to the packet type of the packet and the packet 1 descriptor information carried in each search result, when the number of the search results is the same as the number of packets corresponding to the packet type, the result is integrated and output, and the final action is output. The time is 06. According to the above description, when the message 1 is processed, the final final action output time is 06, and a total of 7 time slices are occupied.

When the switch receives the packet 2, it reports the input time of the packet 2, that is, the time for receiving the packet 2 is 01. According to the message type of the message, the corresponding packet extraction rule is used to extract the packet header information of the packet, and the time for completing the packet parsing is 02, and the parallel search for each packet header information is performed. Flow table.

The packet header information of the extracted packet 2 contains only one information, so it is only necessary to find the flow table 1 , and the flow table 1 finds that the matching completion time is 03, that is, the time for determining the search result is 03 (the actionl arrives in FIG. 5) Time 04). According to the packet type of the packet and the packet 2 descriptor information carried in each search result, when the number of the search result is the same as the number of the data packet corresponding to the packet type, the result is integrated and output, and the final action is output. The time is 05. Because the message 2 only matches the flow table 1, the search result can be output at time 05, and the switch does not need to process the message 1 after processing the message, thereby improving the processing efficiency of the message.

When the switch receives the packet 3, it reports the input time of the packet 3, that is, the time for receiving the packet 3 is 02. According to the message type of the message, the corresponding packet extraction rule is used to extract the packet header information of the packet, and the time for completing the packet parsing is 03, and the parallel search for each packet header information is performed. Flow table.

The packet header information of the extracted packet 2 contains only one information, so only the flow table 2 needs to be searched. At this time, the flow table 2 is idle, and the flow table 2 finds that the matching completion time is 05, that is, the time for determining the search result is 05 (actionl arrival time 05 in Figure 5). According to the text type of the text and the packet 3 descriptor information carried in each search result, when the number of the search results is the same as the number of data packets corresponding to the message type, the result is integrated and output, and the final action output time is 06. As long as the packet 3 matches the flow table 2, the search result can be output at time 06, and the switch does not need to process the packet 1 after processing the packet, thereby improving the processing efficiency of the packet.

According to the above figure, if you use serial to find each flow table, you can process the above three reports. The text needs 14 time slices, and the serial and parallel flow table searching method provided by the embodiment of the present invention only needs 7 time slices. Therefore, the packet processing mode in the embodiment of the present invention effectively improves the efficiency of packet processing, and implements deep processing of the packet.

FIG. 6 is a schematic structural diagram of a packet processing apparatus based on TCAM and FPGA according to an embodiment of the present disclosure, where the apparatus includes:

The parsing and extracting module 61 is configured to identify a packet type of the received packet, and extract a packet header information of the packet according to the packet header extraction rule corresponding to the identified packet type, where the packet header information includes at least one Unary information, and at least one tuple information;

The storage search module 62 is configured to search each flow table corresponding to each information in parallel according to the correspondence between each information in the saved data packet header and the flow table, where, when the information is unary information, according to the unary unit a unitary flow table corresponding to the information, determining a search result; when the information is the multi-group information, determining whether the multi-group flow table corresponding to the multi-group information is currently idle, and when the multi-group flow table is not idle, The multi-group information is sent to the processing queue of the multi-group flow table, otherwise, the multi-group flow table is searched according to the multi-group information and the search result is determined;

The arbitration module 63 is configured to integrate the search results and output the results.

The device also includes:

a secondary parsing module 64, configured to perform secondary parsing on the multi-group information;

The storage lookup module 62 is further configured to: obtain each information according to the parsing, and a secondary flow table corresponding to each information, and search for a secondary flow table corresponding to each information in parallel;

The arbitration module 63 is further configured to integrate the search result with the search result of the unary information and the multi-group information, and output the result.

The arbitration module 63 is specifically configured to add a packet descriptor to each information of the extracted data packet header, and obtain each search result including the packet descriptor; and determine the current according to the packet type of the packet. The number of the search results is equal to the number of search results corresponding to the message type. When the number of search results currently obtained satisfies the number of search results corresponding to the message type, each search result is integrated and output.

The storage search module 62 is specifically configured to: when the flow table is a multi-group flow table, the multiple The group flow table includes a plurality of highest tuple flow tables. When the priority of the packet satisfies a preset priority condition, it is determined whether each multi-group flow table of the first priority is idle; when the first priority is When there is an idle multi-group flow table, searching for the first priority idle multi-group flow table according to the multi-group information and determining a search result, when each multi-group flow table of the first priority is not idle, Determining whether each of the multi-group flow tables of the second priority is idle. When the second priority has an idle multi-group flow table, searching for the idle second-priority multi-group flow table according to the multi-group information and determining If the priority of the packet does not satisfy the preset priority condition, the second determination is performed. Whether each of the priority group flow tables of the priority is idle; when the second priority has an idle multi-group flow table, searching the idle multi-group flow table according to the multi-group information and determining a search result, when the second priority When each of the multi-group flow tables of the level is not idle, the multi-group information is sent to the processing queue of the multi-group flow table of the second priority.

The storage lookup module 62 is configured to: when the flow table is a multi-group flow table, the multi-group flow table includes a highest tuple flow table and a plurality of common tuple flow tables, wherein The packet information included in each packet header of the received packet type is set, and the common tuple flow table is set. According to the packet type of the received packet, the packet type meets the corresponding tuple flow table. When the packet type is used, it is determined whether there is an idle common tuple flow table. When there is an idle common tuple flow table, the idle common tuple flow table is searched according to the multi-group information and the search result is determined. Otherwise, And sending the multi-group information to the processing queue of the common tuple flow table; when the packet type does not meet the packet type corresponding to the common tuple flow table, determining whether the highest tuple flow table is idle, when When the highest tuple flow table is idle, searching for the highest tuple flow table according to the multi-group information and determining a search result; otherwise, sending the multi-group information to the processing group of the highest tuple flow table In the column.

The specific device can be located in the switch.

The embodiment of the present invention provides a packet processing method and device based on TCAM and FPGA. In this method, the switch extracts packet header information of the packet according to the packet type of the received packet, where the packet header information includes At least one unary information and at least one tuple information, searching for a flow table corresponding to each information in each packet header in parallel and integrating the output result, and in the data When the packet header information is the multi-group information, it is determined whether the multi-group flow table corresponding to the multi-group information is idle, and when the packet header information is not idle, the multi-group flow table is sent to the processing queue of the multi-group flow table. Since the data packet header information extracted by the embodiment of the present invention includes the unary information and the multi-group information, the unary information directly searches for the unary flow table, and when searching the multi-group flow table according to the multi-group information, it is necessary to determine whether the current flow table is idle. That is, it is determined whether the current flow table is occupied by other messages, and the flow table needs to be queued when the flow table is occupied. Therefore, the solution provided by the embodiment of the present invention can effectively implement deep analysis of the message, and the parallel and serial connection are used. The combination method can effectively correlate the results obtained by the previous lookup table, and effectively improve the processing efficiency of the message.

The algorithms and displays provided herein are not germane to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. From the above description, the structure required to construct such a system is obvious. Moreover, the invention is not directed to any particular programming language. It is to be understood that the invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention.

Numerous specific details are set forth in the description provided herein. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well known methods, structures, and techniques have not been shown in detail so as not to obscure the description.

Similarly, the various features of the present invention are sometimes grouped together into a single embodiment, in the above description of exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, and each of the claims are in their respective embodiments.

Those skilled in the art will appreciate that the modules in the devices in the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and To divide them into multiple sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed may be employed. Or combine all the processes or units of the device. Each feature disclosed in the specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent, or similar purpose, unless otherwise stated.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are included in other embodiments and not other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components of the message processing device and switch in accordance with embodiments of the present invention. . The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such an implementation The program of the present invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to be limiting, and that the invention may be devised without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. Can Interpret these words as names. The spirit and scope of the embodiments of the present invention are departed. Thus, it is intended that the present invention cover the modifications and modifications of the embodiments of the invention.

Claims

Rights request

A packet processing method based on TCAM and FPGA, characterized in that the method comprises:

The packet processing method according to claim 1, wherein the method further includes: after searching the multi-group flow table according to the multi-group information and determining a search result, the method further includes:

Performing secondary analysis on the multi-group information;

The packet processing method according to claim 1 or 2, wherein the outputting the integrated search result comprises:

Determining, according to the packet type of the packet, whether the number of the currently obtained search results satisfies the number of search results corresponding to the packet type; When the number of currently obtained search results satisfies the number of search results corresponding to the message type, each search result is integrated and output.

The packet processing method according to any one of claims 1 to 3, wherein when the flow table is a multi-group flow table, the multi-group flow table includes a plurality of highest-order flow tables. , determine the results of the search include:

Determining the priority of the message;

The packet processing method according to any one of claims 1 to 3, wherein, when the flow table is a multi-group flow table, the multi-group flow table includes a highest tuple flow table and a plurality of a common tuple flow table, wherein a common tuple flow table is set according to the multi-group information included in each data packet header received in the set time length;

Wherein, determining the search result includes:

According to the packet type of the received packet, when the packet type satisfies the packet type corresponding to the common tuple flow table, it is determined whether there is an idle common tuple flow table, and when there is an idle common tuple flow table And searching for the idle common tuple flow table according to the multi-group information and determining a search result, otherwise, sending the multi-group information to a processing queue of the common tuple flow table; When the packet type does not meet the packet type corresponding to the common tuple flow table, it is determined whether the highest tuple flow table is idle. When the highest tuple flow table is idle, the highest tuple is searched according to the multi-group information. The flow table determines the lookup result, otherwise, the tuple information is sent to the processing queue of the highest tuple flow table.

6. A packet processing apparatus based on TCAM and FPGA, wherein the apparatus comprises:

Arbitration module, used to integrate the search results and output.

The message processing device according to claim 6, wherein the device further comprises: a secondary analysis module, configured to perform secondary analysis on the multi-group information;

The packet processing apparatus according to claim 6 or 7, wherein the arbitration module is specifically configured to add a packet descriptor to each information of the extracted data packet header, and obtain the package description including According to the packet type of the packet, it is determined whether the number of currently obtained search results satisfies the number of search results corresponding to the packet type; when the number of currently obtained search results satisfies the corresponding packet type When finding the number of results, each search result is integrated and output.

The packet processing apparatus according to any one of claims 6 to 8, wherein the storage search module is specifically configured to: when the flow table is a multi-group flow table, the multi-group flow table In order to include a plurality of highest tuple flow tables, when the priority of the packet satisfies a preset priority condition, it is determined whether each multi-group flow table of the first priority is idle; when the first priority has an idle multi-priority When the flow table is configured, the first priority idle multi-group flow table is searched according to the multi-group information, and the search result is determined. When each multi-group flow table of the first priority is not idle, the second judgment is performed. Whether each of the priority group flow tables of the priority is idle, and when the second priority has an idle multi-group flow table, searching for the idle second priority multi-group flow table according to the multi-group information and determining the search result, Otherwise, the multi-group information is sent to the processing queue of the first-priority multi-group flow table; when the priority of the packet does not meet the preset priority condition, the second priority is determined. Each plural Whether the flow table is idle; when the second priority has an idle multi-group flow table, searching the idle multi-group flow table according to the multi-group information and determining a search result, when each multi-group flow of the second priority When the table is not idle, the multi-group information is sent to the processing queue of the second-priority multi-group flow table.

The packet processing apparatus according to any one of claims 6 to 8, wherein the storage search module is specifically configured to: when the flow table is a multi-group flow table, the multi-group flow table The highest tuple flow table and the plurality of common tuple flow tables are included, wherein the common tuple flow table is set according to the multi-group information included in each packet header in the received message type within the set time length; The packet type of the packet, when the packet type satisfies the packet type corresponding to the common tuple flow table, it is determined whether there is an idle common tuple flow table, and when there is an idle common tuple flow table, according to The multi-group information is searched for the idle common tuple flow table and the search result is determined; otherwise, the multi-group information is sent to the processing queue of the common tuple flow table; when the packet type is not satisfied When the packet type corresponding to the common tuple flow table is used, it is determined whether the highest tuple flow table is idle. When the highest tuple flow table is idle, the highest tuple flow table is searched according to the multi-group information and the search result is determined. , Otherwise, transmitting the group information to the processing queue polyhydric the highest tuple stream table.