WO2016049802A1

WO2016049802A1 - Adaptive split and compression

Info

Publication number: WO2016049802A1
Application number: PCT/CN2014/087773
Authority: WO
Inventors: Qun Yang Lin; Jun Qing XIE; Xiaofeng Yu; David Lee
Original assignee: Hewlett Packard Development Co LP
Current assignee: Hewlett Packard Development Co LP
Priority date: 2014-09-29
Filing date: 2014-09-29
Publication date: 2016-04-07
Anticipated expiration: 2017-03-29

Abstract

Techniques involving ASC (Adaptive Split and Compression) data are described. For example, in one aspect, an ASC construction module may generate search data that include a segment array that links with first layer search data. The first layer search data may include a first layer node that links to second layer search data. The second layer search data may include a node that maps to a packet classification rule.

Description

Adaptive Split and Compression

BACKGROUND

Many switches, routers, firewalls, and other types of network devices may include packet classifiers. These network devices may include a packet classifier to perform functions relating to access control lists that may be used by firewalls, flow tables that may be used by software defined network (SDN) routers/switches, quality of service (QoS) routing used by routers, and so on. A packet classifier may be designed to compare a number of header fields of an incoming packet against a set of rules and determine an action from matched rules. Sample actions include forwarding the packet, rejecting the packet, routing the packet to a particular application, and so forth. A packet classifier searches the rules to find the highest priority one matching the incoming packet.

BRIEF DESCRIPTION OF DRAWINGS

Some embodiments are described with respect to the following figures:

FIG. 1 is a block diagram illustrating an adaptive split and compression (ASC) packet classifier system, in accordance to one example；

FIG. 2 is a flow chart illustrating a method for constructing an ASC searching structure, according to an example embodiment；

FIG. 3 is a diagram illustrating an ASC search structure that may be generated from operations of the method of FIG. 2, according to an example；

FIG. 4 is a diagram that illustrates searching data derived from the source Internet Protocol (IP) address (SA) fields of a segment element, according to an example；

FIG. 5 is a diagram that illustrates searching data derived from the destination IP address (DA) fields of a segment element, according to an example；

FIG. 6 is a diagram illustrating a working procedure of an ASC classification module, according to an example embodiment； and

FIG. 7 is a flowchart illustrating a method for performing an adaptive split, according to an example.

DETAILED DESCRIPTION

In the disclosure, numerous details are set forth to provide an understanding of the examples disclosed herein. However, it will be understood by those skilled in the art that the examples may be practiced without these details. While a limited number of examples have been disclosed, those skilled in the art will appreciate numerous modifications and variations therefrom.

One purpose of packet classification is to classify packets according to a given rule set. One approach for packet classification may include an algorithmic approach, such as HiCuts, HyperCuts, HyperSplit, RFC, and HSM. However, scalability is a big challenge for algorithm-based packet classification approaches. For example, packet classification algorithms can be categorized into decomposition-based and decision-tree-based algorithms. The decomposition-based algorithms may not efficiently handle large rule sets, so this kind of algorithm may be unappropriated for commercial high end products of routers, switches and firewalls. With regard to the decision-tree-based packet classifiers, rules are greatly replicated during the cutting procedure of decision-tree based packet classification, which can significantly lower the performances (including memory efficiency and construction time) of these types of systems.

To reach high-performance and flexible packet classification, examples of adaptive split and compression (ASC) packet classification systems are discussed in the foregoing. An ASC packet classification system may be a system that uses a divide-and-conquer principle to split a large rule set into groups. Thus, an ASC packet classification system can solve an original large classification rule set through a number of smaller ones. Further, the ASC packet classification system can match different fields in separate stages and leverage a compression algorithm to construct compact lookup data structures of the IP address fields (i. e. , source IP address and destination IP address) which are used in packet classification rules. The compact data structures can be downloaded into a field-programmable gate array’s (FPGA) on-chip memory for use in the ASC classification module of a network device. To ensure high throughput, the ASC classification module supports parallel processing via pipeline relying on the FPGA’s on-chip memory which is very limited.

Thus, it may be possible in some cases to use ASC to combine the advantages of both decomposition based algorithms and decision-tree based packet classification.

For example, an ASC construction module may generate a segment array element for a subset of a data packet classification rules based on each of the data packet classification rules of the subset that include matching fields with values that match a range of values. The ASC construction module may link the segment array element to a first layer search structure. The first layer search structure may include a first layer node that links to a second search structure. The first layer node may be reachable based on a path created from values of a first matching field (e. g. , a SA field) from the subset. The ASC construction module may also link the first layer node to a second search structure. The second search structure may include a second layer node that links to one of the data packet classification rules of the subset. The second layer node may be reachable through a path created from values of a second matching field (e. g. , a DA field) from the subset.

These and other examples are now described in greater detail. FIG. 1 is a block diagram illustrating an ASC packet classifier system 100, in accordance to one example. The ASC packet classifier system 100 includes an ASC construction module 101 and an ASC classification module 102. The ASC construction module 101 may be processor-based module that is configured to generate an ASC search structure 150 from a set of packet classification rules 104. The ASC search structures may then be downloaded in the ASC classification module 102, in come combination of off-chip memory (e. g. , DRAM) or on-chip memory (e. g. , in a FPGA) . As FIG. 1 shows, the ASC construction module 101 may include a processor 106 and a computer readable storage device 108. The processor 106 may be a device suitable to read and execute processor executable instructions. The processor executable instructions may cause the processor to implement techniques described herein. For example the instructions may cause the processor to construct an ASC search structure as described herein.

The processor 106 may be coupled to the computer-readable storage device 108. The computer-readable storage device 108 may contain thereon a set of instructions, which when executed by the processor 106, cause the processor 106 to execute the techniques described herein. For example, the storage device may include ASC construction instructions 109. Execution of these instructions to provide the functionality described herein is described in further detail below.

The ASC classification module 102 may be a processor-based module that is configured to classify incoming network packets 156 based on processing the incoming network packets in light of the downloaded ASC search structures 150a, b. In an example, the ASC classification module 102 may be implemented via commodity hardware like FPGA (Field Programmable Gate Array) with pipeline 128. The ASC classification module 102 includes a computer readable device 122 for storing the ASC search structures. In some cases, the computer readable device 122 may include on-chip memory and off-chip memory. The off-chip memory can be DRAM (Dynamic Random Access Memory) , such as FPRAM, EDORAM, DDR RAM, RDRAM, SGRAM and WRAM, and the like, and the on-chip memory can be the Block RAM and Distributed RAM of the FPGA. Relative to off-chip memory, on-chip memory 104 can be comparatively closer to the processor and comparatively limited in memory capacity.

The ASC search structures 150 may be data or logic that identifies the applicable packet classification rules for an incoming packet. As shown in FIG. 1, the ASC search structure includes a split data level 152 and a multi-tier compression data level 154. The split data level may split the set of packet classification rules into N groups. The value of N can be pre-set according to the hardware resources of the ASC classification module 102. Each of the N groups includes a number of segments which may be clustered according to a tuple of fields used by a classification rule. One example may cluster the packet classification rules according to source port, destination port, and protocol. Each segment found in a group may include the packet classification rules matching a specified hyper-range of these tuples.

To facilitate searching of the segments, an example embodiment may generate a binary space partitioning tree (e. g. , a K-D tree) to search for groups and/or segments that correspond to an incoming packet based on the headers of that packet.

The multi-layered compression data level 154 may include multiple interconnected layers of search structures for performing searches based on different matching fields. For example, the first layer may include data for searching on a source IP address (SA) and a second layer may include search structures for searching on a destination IP address (DA) . The result of the search on the first layer may identify the relevant search structures found in the second layer. The result of the search on the second layer may be identifications of relevant packet classification rules that apply to an incoming packet.

One example of a search structure is a trie. A trie can be a binary trie, which has a number of nodes (and edges connecting the nodes) that can be searched to identifying a matching field. A trie can be compressed to form a shape graph. The shape graph is a compressed representation of a trie, where certain groups of nodes of the trie can be combined into corresponding nodes of the shape graph. The shape graph thus consumes a smaller amount of storage space than the respective trie.

The operations for generating ASC searching structures are now discussed in greater detail. FIG. 2 is a flow chart illustrating a method 200 for constructing an ASC searching structure, according to an example embodiment. The method 200 may be performed by the modules, components, systems shown in FIG. 1, such as the ASC construction module 101, accordingly, is described herein merely by way of reference thereto. It will be appreciated that the method 200 may, however, be performed on any suitable hardware.

The method 200 may begin at operation 202 when an ASC construction module generates a segment array element for a subset of a data packet classification rules based on each of the data packet classification rules of the subset including matching fields with values that match a range of values. Operation 202 may be performed as part of a split stage, which is described in greater detail below.

At operation 204, the ASC construction module may link the segment array element to a fist layer search structure. In some cases, the first layer search structure includes a first layer node that links to a second search structure. The first layer node may be reachable based on a path created from values of a first matching field from the subset.

In some cases, as part of operation 204, the ASC construction module may generate a binary space partitioning tree (e. g. , a K-D tree) to search for groups and/or segments that correspond to an incoming packet based on the headers of that packet.

At operation 206, the ASC construction module may link the first layer node to a second search structure. The second search structure may include a second layer node that links to one of the data packet classification rules from the subset. The second layer node may be reachable through a path created from values of a second matching field from the subset.

FIG. 3 is a diagram illustrating an ASC search structure 300 that may be generated from operations of the method of FIG. 2, according to an example. The ASC search structure may be a multilayer search structure. For example, as shown in FIG. 3, the ASC search structure 300 can be generated according to at least two stages: a split stage 310 and a compression stage 320.

In the split stage 310, given packet classification rules 312, the ASC construction module may leverage an adaptive split (partition) method to categorize the packet classification rules into N groups 314a-n in order to reduce rule replication. The value of N can be pre-set according to the hardware resources. Each group consists of a number of segments clustered by, for example, a 3-tuple (i.e. , source port, destination port and protocol) . Accordingly, each segment, such as the segment 318, contains the rules matching a specified hyper-range of the 3-tuple. The segments may be stored in arrays referred to as segment arrays, such as segment array 316.

In the compression stage 320, the ASC construction module may generate two layers based on different matching fields, such as a source IP address (SA) layer 322 and a destination IP address (DA) layer 324. Further, in some cases, a layered indexed shape graph (ISG) approach may be leveraged to represent the SA/DA layers and the connection of the upper layer to the lower layer. An ISG may be a shape graph that indexes into another data structure. For example, an upper layer ISG may index into an inter-layer entry array. As another example, a lower layer ISG may index into a matched rule identifier (ID) array.

In constructing the SA layer 322, the ASC construction module may construct a trie, referred to as an upper trie, for each segment element found in the segment array constructed in the split stage, such as upper trie 333. The upper trie may be constructed using one of the matching fields not used to construct the segment array. In one example, the trie in the SA layer may be constructed using the source IP address (SA) matching field. For each group, the ASC construction module can generate a number of SA tries (i. e. , a SA forest) which then are compressed into an indexed shape graph (ISG) , such as ISG 337. Each valid node (in other words, whether the node is associated with rules) in the SA tries contains a sub-rule set matching its corresponding prefix. And the sub-rule set is stored in an index array referred to as an inter-layer entry array 332. Operations for constructing the SA layer is discussed in greater detail below.

In constructing the DA layer 324, the ASC construction module may construct a trie, referred to as a lower trie, for each element in the inter-layer entry array 332. Similar to the upper trie, a lower trie, such as the lower trie 335, may be constructed using one of the matching fields not used to construct the segment array or the inter-layer entry array. In one example, the lower trie may be constructed using the destination IP address (DA) matching field. For elements in each inter-layer entry array, the ASC construction module can generate a number of DA tries (i. e. , a DA forest) which then are compressed into an indexed shape graph (ISG) , such as ISG 338. Each DA trie may be a search using a DA matching field that identifies a matching classification rule. The matching classification rule may be stored in an element 342 of a matched rule ID array 346. Operations for constructing the DA layer is discussed in greater detail below.

Operations for constructing a SA layer and DA layer are now described. To illustrate these operations, an example segment element is now described. As shown in Table 1, a sample element of a segment array may include data derived from 6 rules, such as SA and DA matching fields. Assume in this example that the length of an IP address is 5 bits. Here, the syntax ‘*’ may mean that anything can follow.

Rule ID	Source-IP-Address (SA)	Destination-IP-Address (DA)
Rule ID	Source-IP-Address (SA)	Destination-IP-Address (DA)	1	00*	000*
2	00*	00*	1	00*	000*
2	00*	00*	3	0010*	10*
4	110*	010*	3	0010*	10*
4	110*	010*	5	1*	011*
6	11000*	01*	5	1*	011*

As discussed above, a SA trie may be constructed from the SA matching fields corresponding to the packet classification rules of a segment element. FIG. 4 is a diagram that illustrates a searching structure derived from the SA fields of packet classification rules of the segment element shown in Table 1, according to an example. For example, the SA of each rule shown in Table 1 may be represented in a binary trie 400 with the left edge standing for the bit ‘0’ and the right edge standing for the bit ‘1’ . As shown in FIG. 4, each valid node is associated with a set of rules whose SAs are equal to the corresponding prefix. The rule set associated with the valid node may be referred to as an associating set. For example, the valid node ‘D’ is linked to associating set 402d, the valid node ‘H’ is linked to associating set 402h, the valid node ‘C’ is linked to associating set 402c, the valid node ‘G’ is linked to associating set 402g, and the valid node ‘J’ is linked to associating set 402j.

For a valid node, a matching rule set (which may be referred to as a “matching set” ) is created based on a union of the associating sets associated with the valid nodes along the path between the valid node and the root node 400. Here, the SA of each rule in the matching set matches the corresponding prefix of the valid node. For instance, the corresponding prefix of node ‘D’ is ‘00*’ , so the associating set 404d is {Rule 1, Rule 2} , in which both rules have the SA set to ‘00*’ . As there is no other valid nodes along the path between the node ‘D’ a nd the root node ‘A’ , the matching set of the node ‘D’ is the same as its associating set. As for the node ‘H’ whose corresponding prefix is ‘0010*’ , only the SA of Rule 3 is set to ‘0010*’ , so the associating set 402h of node ‘H’ is {Rule 3} . The node ‘D’ is on the path between the node ‘H’ and the root node ‘A’ . So the matching set 404h of the node ‘H’ is {Rule 1, Rule 2, Rule 3} , which is a union of the associating sets of node ‘D’ and node ‘H’ . The matching sets may be stored in an inter-layer entry array.

After constructing the SA trie, the ASC construction module can, in some cases, leverage a compression algorithm to compress the SA trie into an ISG. The matching sets for a SA trie are stored in an indexed array which is referred to as an inter-layer entry array. All the SA tries of a group are compressed into an ISG, which may contain multiple entries. Each SA trie has its own ISG entry consisting of a root shape and a base address of the inter-layer entry array, and each element of the segment array is associated with an ISG entry of the SA trie.

In constructing the DA layer, the ASC construction module can construct a trie for each element of inter-layer entry array using destination IP address (DA) . The trie is called DA trie. Similarly, for an inter-layer entry array, the ASC construction module can construct a number DA tries (i. e. , DA forest) .

FIG. 5 is a diagram that illustrates searching data derived from the DA fields of the segment element shown in Table 1, according to an example. For example, FIG. 5 shows the DA tries 502 constructed from the inter-layer entry 410 array shown in FIG. 4. In the DA tries, each valid node is associated with a matched rule ID which has the highest priority (i. e. , minimum rule ID) among the rules matching the corresponding prefix of DA. For instance, the matched rules of node ‘d’ include Rule 1 and Rule 2. So the Rule 1 is the matched rule for node ‘d’ . All matched rule IDs of a DA trie are stored in an index array called matched rule ID array, such as matched rule ID arrays 504a, c, d. After construction, all the DA forests of a group can be compressed into another ISG. The ISG entry of each DA trie includes a root shape and a base address of the matched rule ID array. Each element of the inter-layer entry array is associated with a corresponding ISG entry of the DA trie.

As described above, the ASC search structure can be downloaded in memory storage devices of an ASC classification module. The ASC classification module can use the ASC search structure to classify incoming data packets. A data packet may be classified according to multi-dimensional data, such as, for example, including source IP address (SA) , destination IP address (DA) , source port number, destination port number and protocol. The SA and DA fields are presented as prefixes. While the source port number and destination port number can be represented as ranges. The protocol can be a bit mask or a range.

FIG. 6 is a diagram illustrating a working procedure of an ASC classification module, according to an example embodiment. Upon receiving an incoming packet 602, the ASC classification module may use the search tries for the groups 604a, b of the split stage to match a 3-tuple from the incoming packet (i. e. , source, destination port and protocol) to locate an index of a matching segment in each segment array. From the matching segments, the ASC classification module can identify the corresponding entries of SA ISGs specified by the segment arrays. After that, the ASC classification module can search the source IP address and destination IP address in the SA ISG 604 and DA ISG 606, respectively, layer by layer through pipelines. Each group returns a matched rule ID, as may be stored in a matched rule ID array. A priority resolver component 610 returns the highest priority (i. e. , smaller rule ID number meaning higher priority) one of the N rule IDs 612.

In some cases, data packet classification rules may be updated when a data packet classification rule is added, deleted, or modified. However, an update of rule may affect one or several segments in a group. In this case, an ASC construction module may then reconstruct the SA/DA tries of the affected segments and update the ISGs accordingly to represent the change in the tries. The affected ISGs can be updated incrementally. A newly updated ISG is constructed in by the ASC construction module and then downloaded into the ASC classification module computer readable storage device (e. g. , an on-chip memory of the FPGA) for lookup operation.

As described above, the ASC construction module may split the packet classification into groups. FIG. 7 is a flowchart illustrating a method 700 for performing an adaptive split, according to an example. The method 700 may be used in some cases to reduce the replication of packet classification rules while, at the same time, restricting the number of parts. The split operation can be performed based on the overlapping frequencies of any combination of the fields found in a set of packet classification rules. Further, the rule set can be split into any number of parts each time. The work flow is elaborated according to the following.

At operation 702, the ASC construction module may obtain packet classification rules and a field to split on. At operation 704, the ASC construction module calculates an overlapping frequency (OF) of each rule on a specified field and then gathers the cumulative distribution function (CDF) of the overlapping frequencies. In some cases, an overlapping frequency threshold (OFT) is used to split the rule set is calculated with largest overlapping frequencies specified by pre-set Splitting Ratio in the CDF. Based on the OFT, the ASC construction module can categorize the rules into two groups: small-OF group and big-OF group. The overlapping frequencies of rules in the small-OF group are smaller than the threshold. On the other hand, the overlapping frequencies of rules in the big-OF group are bigger than the threshold.

At operation 706, the ASC construction module can calculate the sum of overlapping frequencies (SOF) of the rules in the big-OF group.

At decision 708, the ASC construction module can decide whether or not to perform the categorizing mentioned in operation 702. If the value of SOF is larger than the pre-set expected size, the ASC construction module can categorize the rules into 2 groups according to the threshold. Otherwise, the ASC construction module may not do anything.

In some cases, the method 700 may be executed iteratively until the number of groups reaches the pre-set value of N or there is no available split any more.

The value of Splitting Ratio, Expected Size and N can be configured according to the specified requirement. For instance, some examples may use 20-80％ scheme to set the splitting ratio； the value of expected size is set to the size of input rule set； and N is set as 10.

Claims

An ASC (Adaptive Split and Compression) construction module, comprising:

a processor to:

generate a segment array element for a subset of data packet classification rules based on each of the data packet classification rules of the subset including matching fields with values that match a range of values；

link the segment array element to a first layer search structure, the first layer search structure including a first layer node that is reachable based on a path created from values of a first matching field from the subset； and

link the first layer node to a second search structure, the second search structure including a second layer node that links to one of the data packet classification rules of the subset, the second layer node being reachable through a path created from values of a second matching field from the subset.
The ASC construction module of claim 1, wherein the processor further to compress the first layer search structure as a first indexed search graph and compress the second search structure as a second indexed search graph, the first indexed search graph include a node that references a root node in the second indexed search graph.
The ASC construction module of claim 1, wherein the matching fields include a protocol matching field, a source port matching field, and a destination port matching field.
The ASC construction module of claim 1, wherein the first matching field is a source Internet Protocol address matching field.
The ASC construction module of claim 1, wherein the second matching field is a destination Internet Protocol address matching field.
The ASC construction module of claim 1, wherein the processor further to store the segment array element, the first layer search structure, and the second search structure on at least one memory storage device of an ASC classification module.
The ASC construction module of claim 6, wherein the at least one memory storage device includes on-chip memory, the segment array element, the first layer search structure, and the second search structure being stored in the on-chip memory.
The ASC construction module of claim 6, wherein the at least one memory storage device includes off-chip memory, the inter-layer entry array element and matched rule identifier (ID) array element being stored in the off-chip memory.
An ASC (Adaptive Split and Compression) classification module, comprising:

a processor to:

receive a packet that includes a first group of fields, a second group of fields, and a third group of fields；

based on a search of the first group of fields, identify a segment element that links to a first layer search structure；

identify a second layer search structure based on a search of the first layer search structure using the second group of fields；

identify a matching packet classification rule based on a search of the second layer search structure using the third group of fields； and

apply the matching packet classification rule on the packet.
The ASC classification module of claim 9, wherein the first group of fields includes a protocol field, a source port field, and a destination port field.
The ASC classification module of claim 9, wherein the processor further to retrieve the segment element from on-chip memory of a field-programmable gate array.
The ASC classification module of claim 9, wherein the processor further to:

obtain an additional matching packet classification rule based on a parallel search of an additional segment element linked to an additional first layer search structure and an additional second layer search structure； and

resolve priority in favor of the matching packet classification rule.
The ASC classification module of claim 9, wherein the first layer search structure is an indexed shape graph that compresses a binary trie.
A method, comprising:

generating a multilayer search structure for classifying a data packet from data packet classification rules, the multilayer search structure including:

an segment array that includes a segment array element referencing a first layer search structure, the segment array element representing subset of the data packet classification rules based values from a first group of matching fields；

the first layer search structure including a first layer node referencing a second layer search structure, the first layer search structure representing a subset of the subset of data packet classification rules based on values from a second group of matching fields； and

the second layer search structure including a second layer node referencing a matching packet classification rule, the matching packet classification rule being a packet classification rule in the subset of the subset of data packet classification rules based on values from a third group of matching fields.
The method of claim 14, further comprising downloading the multilayer search structure in at least one storage device in a packet classifier.