WO2020140412A1 - 一种可破坏硬件木马的可重构交换机转发引擎解析器 - Google Patents

一种可破坏硬件木马的可重构交换机转发引擎解析器 Download PDF

Info

Publication number
WO2020140412A1
WO2020140412A1 PCT/CN2019/094332 CN2019094332W WO2020140412A1 WO 2020140412 A1 WO2020140412 A1 WO 2020140412A1 CN 2019094332 W CN2019094332 W CN 2019094332W WO 2020140412 A1 WO2020140412 A1 WO 2020140412A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
unit
level
basic processing
processing unit
Prior art date
Application number
PCT/CN2019/094332
Other languages
English (en)
French (fr)
Inventor
李翔宇
杨芳
Original Assignee
清华大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 清华大学 filed Critical 清华大学
Priority to US17/261,849 priority Critical patent/US11736515B2/en
Publication of WO2020140412A1 publication Critical patent/WO2020140412A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/10—Packet switching elements characterised by the switching fabric construction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H04L45/7452—Multiple parallel or consecutive lookup operations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/20—Support for services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/35—Switches specially adapted for specific applications
    • H04L49/351—Switches specially adapted for specific applications for local area network [LAN], e.g. Ethernet switches
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/12—Protocol engines
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/24—Negotiation of communication capabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/041—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 using an encryption or decryption engine integrated in transmitted data

Definitions

  • the invention belongs to the technical field of network switch chip design, in particular to a reconfigurable switch forwarding engine parser that can destroy a hardware Trojan.
  • the switch forwarding engine is the core component of the switch chip. Its task is to parse the received layer 2 packets (also called frames), form a routing table query request, and send it to the search engine. According to the query returned by the search engine The table results forward the packet, including the modification (replacement, addition, deletion, etc.) of the packet header, and finally forward or discard the encapsulated new packet. It is the key fields of the packet header and the forwarding and classification rules set by the switch that determine the packet processing operation. Therefore, the packet header needs to be parsed and extracted.
  • the parser of the switch forwarding engine is a functional module that parses the packet header according to the frame format defined by the network protocol standard. It interprets the packet header from the input port of the switch forwarding engine and the corresponding port information, storage address and other description information ( Descriptor) as input data, the key fields in these input data are analyzed, identified and extracted, and output to the subsequent packet processing flow.
  • SDN Software Defined Network
  • the hardware Trojan attack technology is a security attack technology that implements an attack by implanting a backdoor in the hardware and cooperating with the inside and outside to trigger the undefined behavior of the system (perform wrong operation or illegal operation).
  • the hardware Trojan attack must have a good concealment to avoid being discovered during the test or being triggered by mistake during use, so that it is exposed prematurely, so it generally has a specific Triggering conditions. Only when this trigger condition is matched, the hardware Trojan attack can be implemented.
  • De-cooperative technology the basic idea is to scramble (transcode) the data input to the forwarding engine chip of the switch, change the value of the selected protection field, and then decode it (restore the original value) when the data leaves the protection field. This process Be transparent.
  • the code change can destroy the instructions to activate the Trojan, so as to prevent the Trojan attack. Specifically, if the Trojan sends the data inside the system through an abnormal channel (eavesdropping), then The eavesdropping data cannot be identified because it has not been decoded. If the Trojan generates illegal data inside the system and sends it out through normal channels, it will be destroyed due to the decoding process.
  • the key to the de-cooperative technology is to determine the location of code change and decoding, and the method of variable decoding.
  • the object of the present invention is to provide a reconfigurable switch forwarding engine parser that can destroy the hardware Trojan.
  • the parser uses a reconfigurable hardware implementation method-the number of fields in the frame format defined by the protocol, Correspondence between location, keyword content, protocol type, and frame format can be configured by configuring configuration registers and look-up tables (memory) in the chip.
  • the present invention adds a de-cooperative function to the parser.
  • a reconfigurable switch forwarding engine parser that can destroy a hardware Trojan, which includes a data preprocessing unit, several cascaded basic processing units, and is connected to the final basic processing unit
  • the extraction unit the basic processing unit at all levels has the same structure, including a data path and a key path
  • the data pre-processing unit is used to generate a key of equal length according to the packet header input by the Ethernet port of the switch intercepted by the parser , And output the key as a key frame to the key path of the first-level basic processing unit, and after the bitwise XOR of the input packet header and the generated key, the XOR result is output as a data frame to all
  • the data path of the first-level basic processing unit the key path of the first-level basic processing unit is used to extract and shift the key key of the key, and the extracted key key value is sent to the basic level In the data path of the processing unit, the shifted key value is sent to the key path of
  • the data path includes: a data frame register unit, a first shifter unit, a number of first PA units, a PB unit, a PC unit, and a number of offset buffer units; the data The input of the frame register unit is the data frame sent by the data pre-processing unit or the basic processing unit of the previous stage, and the output is connected to the first shifter unit of the current stage; the first shifter unit converts the protocol of the current stage The frame header and its payload are moved to the right to the fixed starting position of the next layer protocol frame. Its input is the offset of the next layer protocol frame header output by the PC unit at the current level in the current data frame.
  • the data frames output by the first-level data frame register unit are output as new data frames after the shift; the input of each first PA unit is the key field offset and cost of the output of the PC unit in the previous-stage basic processing unit
  • the data frame to be extracted of the data frame register unit of the level is output as a fixed-length key field extracted; the input of the PB unit is the fixed-length key field and the output of each first PA unit of the level
  • the key key value output by the level key path is output as the protocol classification and type information corresponding to the template matching the input key field combination.
  • the PC unit is a table lookup unit whose input is the protocol classification and type information of the PB unit at this level, and the output is the key field offset required by the basic processing unit at the next level and the encapsulated frame at this level.
  • the offset and field identifier of each field in the header and the offset of the next-level data frame when the next layer protocol does not need to be parsed according to this level of extraction protocol and should be skipped, the PC unit outputs a bypass signal to the next Level basic processing unit; when the PB unit sends illegal identification information, the PC unit outputs the illegal identification to the next level basic processing unit; after the basic processing unit at each subsequent level receives the bypass signal, the key And the data frame and the input of the first PA unit are copied to the corresponding port of the next level as they are, and no other operation is performed; when the basic processing unit at each subsequent level receives the illegal identification signal, the key and the data frame Copy it to the next level as it is
  • the number of the first PA units is determined according to the total length of all keywords to be extracted from the header of the encapsulated frame processed by the basic processing unit at each level and the bit width of the keywords that each first PA unit can extract.
  • the PB unit contains a matching lookup table, which stores the mapping relationship between the feature template and the protocol information, and the content of the entry can be written from the outside through the external port of the table memory,
  • the matching template stored in the PB unit and the key from the key channel of this level are bitwise XORed, and then the matching is performed.
  • the PC unit contains two look-up tables: a current look-up table and a next-level look-up table, and the inputs of the current look-up table and the next-level look-up table are respectively the current layer protocol type classification output by the PB unit The identifier and the next layer protocol type classification identifier.
  • the output of the current lookup table includes the offset and field identifier of each field in the header of the current-level encapsulated frame, and the offset of the header of the next-level encapsulated frame in the current data frame. Shift, the output of the next-level lookup table includes the key field offset required by the next-level basic processing unit, and the contents of the current lookup table and the next-level lookup table can be externally accessed through the table memory The port is written externally.
  • the key path includes a key register unit, a second shifter unit, a second PA unit, and a splicing unit; the input of the key register unit is from the previous The key frame of the stage or data pre-processing unit is connected to the output of the second shifter unit; the second shifter unit is a shift unit that converts the key of each stage and subsequent key bits Move to the right to the fixed starting position of the corresponding level.
  • the input is the key of the key register unit, the offset of the head of the next-level encapsulated frame output by the data path of the basic processing unit of this level in the current data frame, and the output It is a new key frame after the shift;
  • the number of the second PA units is consistent with the number of the first PA units in the data path of this level, and the input of each second PA unit is the previous level
  • the key field offset of the PC unit in the data path of the basic processing unit and the key value of the key register unit to be extracted are output as the extracted fixed-length key value;
  • the splicing unit is used to Several key values of a fixed length output by the second PA unit are spliced and extracted into a key for querying the corresponding position of the matching template. Its input is a number of key fields extracted by the second PA unit, and the output is generated The key value.
  • the extracting unit includes an extracting unit data path and an extracting unit key path.
  • the input of the extracting unit data path is the output of each field in each level of the basic processing unit at each level of the data path of the basic processing unit at the last stage.
  • the offset and field identification, the shifted data frame, the output is the extracted field and the corresponding field identification;
  • the input of the key path is the output of the protocol header of each level of the data path output of the last level of the basic processing unit
  • the field offset and field identifier, and the shifted key frame output from the key path are output as key fragments corresponding to the extracted data frame fields; if the extraction unit receives the packet with an illegal identification, it is not Then perform the extraction operation, but send the illegal identification and the original input data frame descriptor to the upper layer system for processing.
  • each includes N sets of extraction modules, N mapping tables and N sets of registers, and each set of extraction modules, mapping tables and registers corresponds to a network protocol layer,
  • Each group of extraction modules of the data path is used to extract the corresponding field from the data frame out of the data path of the basic processing unit of the last stage according to the received field offset and field identification, and output it to the corresponding data path register.
  • Each group of extraction modules of the key channel is used to extract the corresponding fields from the key frame of the key channel of the last basic processing unit according to the received field offset and field identifier, and output to the corresponding key channel register , XOR the corresponding fields of the extracted data frame and the key frame to obtain the required data; each mapping table is used to store the physical address of the register corresponding to each field identifier in the corresponding network protocol layer.
  • the number of concatenations of the basic processing units is equal to the maximum number of encapsulation levels to be parsed, and the encapsulation protocol of each level corresponds to the level of the basic processing unit.
  • the present invention adopts the above technical solutions, it has the following advantages: 1.
  • the feature templates in the PB unit and the look-up table in the PC unit of the basic processing unit at all levels in the present invention can be rewritten according to the user's customization, which realizes the hardware Reconfigurable, with high flexibility, and supports user-defined network protocol analysis.
  • the present invention adds a key channel to the data channel structure. By de-cooperative processing of the packet header, the role of the normal activation Trojan horse command is destroyed, and the active defense of the hardware Trojan horse is achieved, which meets the requirements of high security. Therefore, the present invention can be widely applied to the design of the parser of the switch forwarding engine chip.
  • Figure 1 is a typical structural diagram of a switch forwarding engine chip
  • FIG. 2 is an overall structure diagram of a reconfigurable switch forwarding engine Parser that can destroy a hardware Trojan of the present invention.
  • the present invention first briefly introduces the typical structure and working principle of the switch forwarding engine chip.
  • the working principle of the forwarding engine chip of the Ethernet switch is that the forwarding engine is externally connected to the Ethernet port of the switch, and receives packets from each port. After the packets from different ports are parsed and processed by the L1 layer, the layer 2 packets are aggregated step by step (combination process) to form one channel, which is serially input into the switch forwarding engine.
  • the forwarding packet processed by the forwarding engine of the switch is transmitted to the corresponding destination port for output after being shunted (shunting process).
  • the forwarding engine is connected to the CPU and a series of lookup tables (some implemented by TCAM) through a high-speed interface.
  • the received packet is cached in the packet memory (packet buffer), and the header of the packet is several bits (typical (The value is 1024 bits) along with its port information, storage address and other description information (descriptors) sent to the parser (parser).
  • Parser analyzes the received packet header and descriptor information, identifies and extracts useful fields, and sends them to the table lookup logic behind.
  • the table lookup logic obtains forwarding information based on the values of the fields in the package. This process involves the CPU and the search. The interaction of the table can be simply understood as a series of table lookup operations.
  • the forwarding information of the packet is finally obtained-that is, the processing operations, and the descriptions (new descriptors) of these operations are Send to the modifier.
  • Modifier removes the packet from the memory according to the new descriptor, modifies its frame format and content (replaces, adds, and deletes the header field), repackages it into a new packet, and sends it to the splitter for forwarding.
  • the parser module in addition to parsing and field extraction of the packet header, it also carries the original input descriptor.
  • the descriptor is passed along the pipeline to the subsequent stage, but does not participate in the extraction process.
  • the described invention features do not include the relevant functional circuits of the copy descriptor.
  • the present invention provides a reconfigurable switch forwarding engine parser that can destroy a hardware Trojan. It includes: a data preprocessing unit, several cascaded basic processing units, and a unit connected to the final basic processing unit Extractor. Among them, the data pre-processing unit is used to generate a random number (ie key) of equal length according to the packet header input by the switch's Ethernet port intercepted by the parser, and after the bitwise XOR of the input packet header and the generated key will be The XOR result and the key are output to the first-level basic processing unit; the basic processing unit at all levels has the same structure, and includes a data path and a key path.
  • a data preprocessing unit is used to generate a random number (ie key) of equal length according to the packet header input by the switch's Ethernet port intercepted by the parser, and after the bitwise XOR of the input packet header and the generated key will be The XOR result and the key are output to the first-level basic processing unit; the
  • the key path of the first-level basic processing unit is used to extract and shift the key key of the key output by the data preprocessing unit, and the extracted key key value is sent to the data path of the basic processing unit of this level ,
  • the shifted key value is sent to the key path of the lower-level basic processing unit, and the key value received by each level of basic processing unit is called a key frame;
  • the data path of the first-level basic processing unit uses the current level key
  • the key key value of the path extraction, recovering the XOR packet header, that is, the data frame, and then extracting the field and shift, the extracted field offset is sent to the key path of the basic processing unit of the current level and the next level
  • the key path and data path of the basic processing unit, and the shifted data frame is sent to the data path of the next-level basic processing unit;
  • the basic processing units of other levels sequentially extract and shift the key frame and data frame , Output to the next level basic processing unit;
  • the extraction unit extracts the fields of the key frame and data frame
  • the data path includes: a data frame register unit, a first shifter unit, a number of first PA units (keyword extraction units), PB units (query matching units), PC units (table lookup units) And several offset cache units.
  • the input of the data frame register unit is the data frame sent by the data pre-processing unit or the basic processing unit of the previous stage, and the output is connected to the first shifter unit of the current stage;
  • the first shifter unit is a shift unit, The frame header and its load of each level move to the right of the corresponding fixed start position of the corresponding level (the fixed start position can be configured by an external port), and its input is the partial deviation of the frame header of the current level output by the PC unit of this level Shift amount, the data frame stored in the data frame register unit of this level, the output is a new data frame after the shift;
  • the first PA unit is the keyword extraction unit of the PB unit, and the input of each first PA unit is the previous level
  • the keyword offset output by the PC unit in the basic processing unit and the data frame stored in the data frame register unit at this level are output as keywords with a fixed length extracted;
  • the PB unit is the query matching unit, and its input is the A fixed-length keyword output by a PA unit, and a key
  • the PC unit is a table lookup unit, whose input is the protocol information of the PB unit at this level, and the output is the keyword offset required by the basic processing unit at the next level, the offset of each field in the header of the encapsulated frame at this level and Field identification and the offset of the next-level data frame; when the next-level protocol does not need to be parsed according to this level of extraction protocol and should be skipped, the PC unit outputs a bypass signal to the next-level basic processing unit; when the PB unit sends When the illegal identification information is generated, the PC unit outputs the illegal identification to the next-level basic processing unit; after receiving the bypass signal, the basic processing units at subsequent levels copy the key and data frame, and the input of the PA unit to On the corresponding port of the next level, no other operations are performed; when the basic processing units at subsequent levels receive the illegal identification signal, the key and data frame are copied to the next level as they are
  • the number of offset buffer units is the same as the number of basic processing units, which is used to store the offsets and field identifications of all fields parsed by the basic processing units at the previous levels, as well as the current level of encapsulated frames
  • the offset and field identifier of each field in the header whose inputs are all the output of the offset buffer of the previous basic processing unit and the offset of each field in the header of the current-level encapsulated frame output by the PC unit of the current level Quantity and field identification, the output is all stored data, and its output is connected to the offset buffer of the next-level basic processing unit.
  • the key path is similar to the data path, including a key register unit, a second shifter unit, several second PA units, and a splicing unit.
  • the input of the key register unit is the key frame of the preprocessing unit or the upper-level basic processing unit, and the output is connected to the second shifter unit;
  • the second shifter unit is a shift unit, each The key of the level and subsequent key bits are moved to the right to the fixed starting position of the corresponding level.
  • the input is the key frame of the key register unit and the data of the level output by the PC unit in the data path of the basic processing unit of the level
  • the frame offset is output as a shifted new key frame and sent to the key path of the next-level basic processing unit; the number of second PA units in the key path and the first PA unit in the data path The number remains the same, one-to-one correspondence, the input of each second PA unit includes the key offset, the key frame of the key register unit to be extracted, and the key offset corresponds to the data path of this level
  • the key offset value of the second PA unit is the same, and the output is a fixed-length key value extracted; the splicing unit is used to splice and extract several fixed-length key values output by the second PA unit into a query
  • the key matching the corresponding position of the template, its input is the key field extracted by several second PA units, and the output is the generated key value.
  • the extraction unit is divided into two parts: the extraction unit data path and the extraction unit key path.
  • the input of the extraction unit data path is the offset of the field of the cache of the data path in the last level of the basic processing unit and the field identification, shift
  • the output of the data frame in the bit device unit is the extracted field and the corresponding field identifier;
  • the input of the key path is the key offset and field of the buffer of the key path of the data path in the last level of the basic processing unit
  • the key value of the shifter unit of the identification and key path is output as the extracted key fragment.
  • the data path and the key path of the extraction unit have the same structure, and each includes N sets of extraction modules, N mapping tables, and N sets of registers, and each set of extraction modules, mapping tables, and registers corresponds to a network protocol layer.
  • Each group of extraction modules of the data path is used to extract the corresponding field from the data frame or key frame output by the shifter unit according to the received field offset and field identifier output by the offset buffer unit, and output to the corresponding The data path register of the key channel; each group of extraction modules of the key channel is used to extract the corresponding field from the key frame of the key channel of the last basic processing unit according to the received field offset and field identifier, and output to Corresponding key path register, XOR the extracted data frame and the corresponding field of the key frame to obtain the required data; each mapping table is used to store the physical address of the register corresponding to each field identification in the corresponding network protocol layer; if When the extraction unit receives the illegal identifier of the data packet, it no longer performs the extraction operation, but send
  • system of the present invention further includes a field identification index unit that outputs the extracted data frame field and the corresponding key segment to the register at the corresponding address.
  • a field identification index unit that outputs the extracted data frame field and the corresponding key segment to the register at the corresponding address.
  • the data frame field and Its associated key segment can restore the original data frame field content by bitwise XOR.
  • the number of concatenations of the basic processing units N is equal to the maximum number of encapsulation levels to be parsed, and the encapsulation protocol of each level corresponds to the first-level basic processing unit.
  • the capacity of the data frame register unit is determined according to the maximum length of the packet header to be processed, and is solidified during hardware design.
  • the number of the first PA unit is determined according to the requirements of the protocol conditions supported by the system, and it is preferably unified to be consolidated into the number of keywords to be extracted in the header of the encapsulation frame corresponding to the processing of each level of basic processing unit The maximum value.
  • the PB unit contains a matching lookup table.
  • the matching lookup table stores the mapping relationship between the feature template and the protocol information.
  • the contents of the matching lookup table pass through the table memory. External ports are written from outside to achieve configurable.
  • the PC unit contains two look-up tables: the current look-up table (LUT_CUR) and the next-level look-up table (LUT_NXT).
  • the input (address) of the table is the current layer protocol type classification identifier output by the PB unit
  • the output of the current lookup table (LUT_CUR) includes the offset and field identification of each field in the header of this level of encapsulated frame, the offset of the data frame of this level, the next level lookup table
  • the output of (LUT_NXT) includes the key field offset required by the next-level basic processing unit.
  • the contents of the current look-up table and the next-level look-up table are written externally through the external port of the table memory to achieve configurability.
  • the input and output bit width and capacity of the lookup tables in the PB unit and the PC unit, and the size of Offset_buffer are determined according to the requirements of the protocol supported by the system, and are fixed after being selected at the design stage.
  • the Ethernet-IPV4 data frame is one of the common data frame structures on the network.
  • the Ethernet protocol and the IPV4 protocol correspond to the data link layer (L2) and the network layer (L3), respectively. Therefore, as shown in FIG. 2, the overall structure of a reconfigurable Parser that is protected against hardware Trojan attacks in this embodiment is as follows: the number of processing stages is two, and the input data is processed by two basic processing units with the same structure in cascade to be processed separately The frame format header of the Ethernet protocol and the IPV4 protocol, the parsed result is sent to the final extractor module and extracts the key fields in the data frame and key uniformly, and the parser's parsing function is completed.
  • the data path of the Ethernet processing layer is composed of six functional units, including a data frame register (Frame Reg unit), a shifter unit, a PA unit, a PB unit, a PC unit, and an offset buffer unit.
  • the data path receives the data frame after the key XOR processing and stores it in the data frame register unit (Frame Reg).
  • the shifter unit is a shift unit, and the input is 1024-bit data of the data frame register (Frame Reg) 3.
  • the shift amount of the data frame of the PC unit from this processing layer is moved to the starting position corresponding to the next level protocol, and the output is a new data frame after the shift;
  • Each PA unit receives the keyword offset value from the upper layer configuration, and extracts the data frame from the data frame register unit for corresponding extraction.
  • the field length extracted by each PA unit is fixed at 8 bits.
  • the PB unit is a query matching unit. Its input is the 32-bit data stitched from the key fields extracted by the four PA units and the 32-bit key output from the key layer of the basic processing unit. This key will be the same as the PB unit.
  • All matching templates stored internally are XOR respectively as the final matching template, the output is the protocol type information corresponding to the template matched by the input keyword combination;
  • the PC unit is a table lookup unit, the input is the protocol type information from the PB unit, and the output Keyword offset required for the next-level basic processing unit, the offset and field identifier of each field in the header of the current-level encapsulation frame, and the offset of the next-level data frame;
  • the offset buffer unit is It is used to store the offsets and field identifiers of all the fields parsed at the previous levels, as well as the offsets and field identifiers of the fields in the header of the encapsulated frame at this level, according to the capacity of the cache unit at each level of the offset in this example Both are fixed to 2 ⁇ 10 ⁇ 8 bits, corresponding to the two parts of the field offset and field identification, the information of the 10 fields to be extracted, and the 8 of each information (field offset and field identification) is the word length, Output offset buffer 1 connected to the IPV4
  • the PB unit contains a matching lookup table.
  • the input of the table is 32bit data extracted and spliced by four PAs.
  • Each row of the table includes: a 32bit mask, the purpose is to filter out the irrelevant information in the input 32bit; 32bit
  • the matching template is used to match the fields after the mask; according to the key field characteristics corresponding to the current layer protocol type identifier and the next layer protocol type identifier, the size of the two identifiers are 8bit.
  • the capacity of the matching lookup table is solidified during hardware design, and the content of the entry can be written from the outside through the external port of the table storage to achieve configurability.
  • the stored matching template is bit-wise XORed with the 32-bit key sent by this level of key channel, and the input 32-bit key field is first bit-wise ANDed with the matching mask corresponding to the template. Turn the irrelevant bits to 0, and then compare the matching template after the code change with the key fields after the mask. The equal value is the matching entry.
  • Ethernet layer configuration information :
  • the PC unit contains two lookup tables, the current lookup table (LUT_CUR) and the next lookup table (LUT_NXT).
  • the input (address) of the table is the current layer protocol type identifier and the next layer protocol type identifier output by the PB unit, each of which is 8 bits.
  • the current look-up table (LUT_CUR) output includes the offset and field identifier of each field in the header of the encapsulation frame at this level, whose size is 10 ⁇ 8bit, and outputs it to the offset buffer 1 of this level and performs Storage; the offset of the next-level data frame, with a length of 8 bits, is output to the shifter unit of the data path and key path of the basic processing unit of this level.
  • the capacity of the table items is solidified at the time of design, and the content of the table is written from the outside through the external port of the table memory to achieve configurability.
  • the next-level lookup table (LUT_NXT) output includes the key field offset required by the next-level basic processing unit, which is 4 ⁇ 8 bits, and is output to the four PA units of the IPV4 processing layer data path.
  • the capacity of the table is solidified during hardware design, and the content of the table is written from the outside through the external port of the table memory to achieve configurability.
  • the key channel of the Ethernet processing layer is similar to the data channel, and is composed of four functional units, including a key register unit, a shifter unit, a PA unit, and a splicing unit.
  • the input 1024-bit random number (key) with the same length as the data frame is stored in the key register (Key Reg), the four key offset values are sent to the four PA units, and the key register
  • the key in (Key Reg) extracts the key, and the length of the extracted field is the same as that in the data path, both of which are 8 bits.
  • the splicing unit splices the 8-bit key segments extracted from the four PA units.
  • the purpose is to XOR with the query template of the PB unit in the data path as a new query template.
  • the shifter unit receives the key data from the key register (Key Reg), and at the same time receives the offset information from the data frame found by the data path PC unit to perform the corresponding shift operation and outputs it to the next stage
  • the key register (Key Reg) of the IPV4 processing layer receives the key data from the key register (Key Reg), and at the same time receives the offset information from the data frame found by the data path PC unit to perform the corresponding shift operation and outputs it to the next stage
  • the key register (Key Reg) of the IPV4 processing layer receives the key data from the key register (Key Reg), and at the same time receives the offset information from the data frame found by the data path PC unit to perform the corresponding shift operation and outputs it to the next stage
  • the key register (Key Reg) of the IPV4 processing layer receives the key data from the key register (Key Reg), and at the same time receives the offset information from the data frame found by the data path PC unit to perform the corresponding shift operation and outputs it to the next stage
  • the composition of the data path unit of the IPV4 processing layer and the function of each module are the same as the data path of the Ethernet layer.
  • the number of shifter PA units is also four, and the length of the field extracted by each PA unit is also fixed at 8 bits. However, it contains two offset buffer units.
  • Offset buffer 1 is used to temporarily store the offsets and field identifiers of all fields parsed by the Ethernet processing layer, so that they can be passed backward. Their size and word length It is the same as the offset buffer 1 of the basic processing unit of the Ethernet layer.
  • the offset buffer 2 uses the case to store the offset and field identifier of each field in the header of this level.
  • the capacity of the offset buffer 2 unit of the IPV4 processing layer is fixed to 2 ⁇ 10 ⁇ 8bit, corresponding to the field offset and field identifier of the IPV4 layer, the information of the 10 fields to be extracted, and each item The 8 of the information (field offset and field identification) is the word length, which is output to the final Extractor extraction module.
  • the key channel of the IPV4 processing layer is similar to the data channel, and has the same structure as the Ethernet key channel.
  • the key data of the key register (Key Reg) comes from the key channel shifter of the previous stage, and its shifter outputs the shifted key frame to the final extractor module.
  • Key Reg The relevant programming languages are as follows:
  • IPV4 layer configuration information
  • the input of the data path of the extraction unit is the position offset value and field identifier of the field to be extracted in the offset buffer 1 unit of the IPV4 processing layer, the offset buffer 2 unit, and the data in the data path shifter of the IPV4 processing layer Frame and output the extracted fields;
  • the input of the key channel of the extraction unit is the position offset value and field identifier of the field to be extracted in the offset buffer 1 unit and offset buffer 2 unit of the IPV4 processing layer, IPV4 Process the key in the layer key path shifter and output the extracted key field.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明涉及一种可破坏硬件木马的可重构交换机转发引擎解析器，其包括数据预处理单元、若干级联的基本处理单元和提取单元；第一级基本处理单元的密钥通路对密钥进行密钥位关键字提取和移位，并将结果发送至本级的数据通路和下级的密钥通路；基本处理单元的数据通路对数据帧进行关键字段提取和移位，生成下一级基本处理单元的提取字段偏移量、本级各字段的偏移量和字段标识和移位后的数据帧分别发送至下一级或本级基本处理单元；其他各级基本处理单元依次对密钥帧和数据帧进行关键字提取和移位；提取单元从最后一级基本处理单元中进行密钥帧和数据帧的提取，并转发至后续包处理部分。本发明可广泛应用于交换机转发引擎解析器的设计中。

Description

一种可破坏硬件木马的可重构交换机转发引擎解析器 技术领域
本发明属于网络交换机芯片设计技术领域，特别是关于一种可破坏硬件木马的可重构交换机转发引擎解析器。
背景技术
交换机转发引擎是交换机芯片的核心部件，它的任务是对接收的第2层包(也称为帧)进行解析处理，形成路由表的查表请求发给搜索引擎，并根据搜索引擎返回的查表结果对包进行转发处理，包括包头部的修改(替换、添加和删除等)，最终将封装好的新的包进行转发或者丢弃。而决定包处理操作的是包头部的关键字段和交换机设置的转发和分类规则，因此需要对包头部进行解析和提取。交换机转发引擎的parser(解析器)就是根据网络协议标准定义的帧格式对包头部进行解析的功能模块，它把来自交换机转发引擎输入端口的包头部和对应的端口信息、存储地址等描述信息(描述符)作为输入数据，对这些输入数据中的关键字段进行解析、识别和提取操作，输出给后续的包处理流程。
软件定义网络(SDN)是一种新型网络创造架构，是网络虚拟化的一种实现方式。对于包的解析技术而言，SDN的需求体现在支持用户自定义的协议，即通过软件编程使得芯片能够识别并解析不同的帧格式，这就要求parser的硬件设计具有一定的灵活性，即通过软件配置能够使得同一硬件支持用户自定义的协议的包的解析。
硬件木马攻击技术是通过在硬件中植入后门，内外配合实施，触发系统的非定义行为(执行错误操作或者非法操作)而实现攻击的安全攻击技术。然而，不论上述哪种方式，硬件木马攻击都必须有良好的隐蔽性，以避免在测试过程中被发现，或者在使用过程中被误触发，从而过早暴露，所以它一般会有一个特定的触发条件。只有匹配了这个触发条件，硬件木马攻击才得以实施。
去协同技术，其基本思想是对输入交换机转发引擎芯片的数据进行扰乱(变码)，改变选定防护字段的数值，在数据离开保护域时再将其解码(恢复原来的数值)，该过程对外透明。一旦某系统中存在木马，通过变 码可以破坏发来的激活木马的指令，从而达到阻止木马攻击的效果，具体地，如果木马将系统内部的数据通过非正常通道向外发送(窃听)，则由于未经解码，而使窃听数据无法识别，如果木马在系统内部产生非法数据通过正常渠道向外发送，则会由于解码过程而被破坏。去协同技术的关键在于确定变码和解码的位置，以及变解码的方式。
然而，在交换机转发引擎解析器的数据流中，由于parser需要对接收的包中的字段进行识别、分析，都要基于数据的原始数值，所以简单地在数据入口进行变码、出口进行解码将使得包无法解析。但是如果在进行关键字查询时将数据恢复，又会使得原始输入数据出现在被保护的范围内，增加攻击指令渗透进来的风险。如何设计破坏硬件木马的parser是目前parser设计的难点之一。
发明内容
针对上述问题，本发明的目的是提供一种可破坏硬件木马的可重构交换机转发引擎解析器,该解析器采用了可重构的硬件实现方式——协议定义的帧格式的字段的数量、位置、关键字内容与协议类型、帧格式之间的对应关系都可以通过配置芯片内的配置寄存器、查找表(存储器)来实现配置。同时，为了达到阻止木马攻击的目的，增强解析器的安全性，本发明在解析器中增加了去协同的功能。
为实现上述目的，本发明采取以下技术方案：一种可破坏硬件木马的可重构交换机转发引擎解析器，其包括数据预处理单元、若干级联的基本处理单元以及与最后级基本处理单元相连的提取单元；各级所述基本处理单元结构相同，均包括数据通路和密钥通路；所述数据预处理单元用于按照解析器截取的交换机以太网端口输入的包头部生成等长的密钥，并将所述密钥作为密钥帧输出至第一级基本处理单元的密钥通路，将输入的包头部与生成的密钥按位异或后将异或的结果作为数据帧输出至所述第一级基本处理单元的数据通路；所述第一级基本处理单元的密钥通路用于对密钥进行密钥关键字提取和移位，提取的密钥关键字值发送至本级基本处理单元的数据通路，移位后的密钥值发送至下级基本处理单元的密钥通路；所述第一级基本处理单元的数据通路在本级密钥通路提取的密钥关键字值参与下，对所述数据帧进行关键字段提取和移位，并将提取的字段偏移 量发送至本级基本处理单元的密钥通路以及下一级基本处理单元的密钥通路和数据通路，移位后的数据帧发送至下一级基本处理单元的数据通路；其他各级基本处理单元依次对接收到的密钥帧和数据帧进行字段提取和移位后，输出到下一级基本处理单元；所述提取单元根据接收到的密钥值和关键字偏移量，从最后一级基本处理单元的密钥通路和数据通路中进行密钥帧和数据帧字段的提取，并转发至后续包处理部分。
进一步地，所述各级基本处理单元中，数据通路包括：数据帧寄存器单元、第一移位器单元、若干第一PA单元、PB单元、PC单元、若干偏移量缓存单元；所述数据帧寄存器单元的输入为所述数据预处理单元或前一级基本处理单元发送的数据帧，输出连接本级所述第一移位器单元；所述第一移位器单元将本级的协议帧头部及其载荷向右移动到下一层协议帧的固定起始位置，其输入为本级所述PC单元输出的下一层协议帧头部在当前数据帧中的偏移量、本级数据帧寄存器单元输出的数据帧，输出为移位后的新的数据帧；各所述第一PA单元的输入为前一级基本处理单元中PC单元输出的关键字段偏移量、本级数据帧寄存器单元的待提取的数据帧，输出为提取出来的固定长度的关键字段；所述PB单元的输入为本级各所述第一PA单元输出的固定长度的关键字段、本级密钥通路输出的密钥关键字值，输出为与输入的关键字段组合所匹配的模板对应的协议分类和类型信息，如果关键字段和任何特征模板都不匹配，则发送非法标识到所述PC单元；所述PC单元是查表单元，其输入为本级PB单元的协议分类和类型信息，输出为下一级基本处理单元所需要的关键字段偏移量、本级封装帧头部中的各个字段的偏移量和字段标识以及下一级数据帧的偏移量；当根据本级提取协议下一层协议不需要解析，应当跳过时，PC单元输出bypass信号给下一级基本处理单元；当所述PB单元发送的为非法标识信息时，所述PC单元输出非法标识给下一级基本处理单元；后续各级所述基本处理单元接收到bypass信号后，把密钥和数据帧、所述第一PA单元的输入原样复制到下一级的对应端口上，不再执行其它操作；后续各级所述基本处理单元接收到非法标识信号时，把密钥和数据帧原样复制到下一级，不再执行其它操作，同时复制非法标识到后级基本处理单元；所述偏移量缓存单元的输入为前一级基本处理单元的偏移量缓存的所有输出和本级PC单元输出的本级封装帧头部中各个字段的偏移量和字段标识， 输出为存储的所有数据。
进一步地，所述第一PA单元的数量根据每级基本处理单元对应处理的封装帧头部待提取的所有关键字总长度和每个所述第一PA单元能提取的关键字位宽确定。
进一步地，所述PB单元内包含一个匹配查找表，所述匹配查找表中存储着特征模板与协议信息之间的映射关系，且表项的内容能够通过表存储器的对外端口从外部写入，在进行匹配时，把PB单元内部存储的匹配模板与来自本级密钥通路的密钥按位异或，然后再进行匹配。
进一步地，所述PC单元内包含两个查找表：当前查找表和下一级查找表，所述当前查找表和下一级查找表的输入分别为所述PB单元输出的当前层协议类型分类标识和下一层协议类型分类标识，所述当前查找表的输出包括本级封装帧头部中的各个字段的偏移量和字段标识、下一级封装帧头部在当前数据帧中的偏移量，所述下一级查找表的输出包括下一级基本处理单元所需要的关键字段偏移量，所述当前查找表和下一级查找表的表项内容能够通过表存储器的对外端口从外部写入。
进一步地，各级所述基本处理单元中，所述密钥通路包括密钥寄存器单元、第二移位器单元、第二PA单元、拼接单元；所述密钥寄存器单元的输入是来自前一级或数据预处理单元的密钥帧，输出则连接着第二移位器单元；所述第二移位器单元是一个移位单元，将每一级的密钥及其之后的密钥比特向右移动到对应级的固定起始位置，其输入为密钥寄存器单元的密钥、本级基本处理单元数据通路输出的下一级封装帧头部在当前数据帧中的偏移量，输出为移位后的新的密钥帧；所述第二PA单元的数量与本级数据通路中所述第一PA单元的个数保持一致，各所述第二PA单元的输入为前一级基本处理单元数据通路中PC单元输出的关键字段偏移量、密钥寄存器单元的待提取的密钥值，输出为提取出来的固定长度的密钥值；所述拼接单元用于将所述第二PA单元输出的固定长度的若干个密钥值拼接、提取成查询匹配模板对应位置的密钥，它的输入是若干个所述第二PA单元提取出来的密钥字段，输出为产生的密钥值。
进一步地，所述提取单元包括提取单元数据通路和提取单元密钥通路，所述提取单元数据通路的输入为最后一级所述基本处理单元的数据通路输出的各级基本处理单元中各字段的偏移量和字段标识、移位后的数据 帧，输出为提取出的字段和对应的字段标识；密钥通路的输入为最后一级基本处理单元的数据通路输出的各级协议头部的各字段的偏移量和字段标识、密钥通路输出的移位后的密钥帧，输出为提取出来的各数据帧字段对应的密钥片段；若提取单元收到数据包有非法标识，则不再执行提取操作，而是将非法标识和原始输入的数据帧描述符上送给上层系统处理。
进一步地，所述提取单元的数据通路和密钥通路结构相同，均包括N组提取模块、N个映射表和N组寄存器，且每组提取模块、映射表和寄存器分别对应一个网络协议层，数据通路的各组提取模块用于根据接收到的字段偏移量和字段标识，从最后一级基本处理单元的数据通路出的数据帧中提取相应字段，并输出到对应的数据通路寄存器，密钥通路的各组提取模块用于根据接收到的字段偏移量和字段标识，从最后一级基本处理单元的密钥通路的密钥帧中提取相应字段，并输出到对应的密钥通路寄存器，将提取的数据帧和密钥帧的相应字段进行异或得到所需数据；各映射表用于存储相应网络协议层内各个字段标识所对应的寄存器的物理地址。
进一步地，所述解析器中，所述基本处理单元的级联数等于所要解析的最大封装层次数量，每一层次的封装协议对应一级所述基本处理单元。
本发明由于采取以上技术方案，其具有以下优点：1、本发明中各级基本处理单元中PB单元中特征模板以及PC单元中的查找表均可以根据用户自定义重新写入，实现了硬件的可重构，具有很高的灵活性，并支持用户自定义网络协议的解析。2、本发明在数据通路结构上增添了密钥通路，通过对包头部进行去协同处理，破坏正常激活木马指令的作用，实现对硬件木马的主动防御，符合高安全性的要求。因此，本发明可以广泛应用于交换机转发引擎芯片的解析器的设计中。
附图说明
图1是交换机转发引擎芯片的典型结构图；
图2是本发明可破坏硬件木马的可重构交换机转发引擎Parser总体结构图。
本发明最佳实施方式
下面结合附图和实施例对本发明进行详细的描述。
如图1所示，本发明首先对交换机转发引擎芯片的典型结构和工作原理做简单介绍。以太网交换机转发引擎芯片的工作原理为：转发引擎对外与交换机的以太网口相连，接收来自各个端口(port)的包。来自不同端口的包经过L1层的解析处理后，其第2层包经过逐级汇聚(合路过程)形成一路，串行输入到交换机转发引擎内部。交换机转发引擎处理后的转发包再经过分流被传送到对应的目的端口上输出(分路过程)。其中，转发引擎对内通过高速接口与CPU和一系列查找表(有的由TCAM实现)相连，接收到的包被缓存到包存储器(packet buffer)中，同时把包的头部若干位(典型值为1024位)和它的端口信息、存储地址等描述信息(描述符)一起发送给解析器(parser)。parser对接收的包头部和描述符信息进行解析，识别和提取出有用字段，发给后面的查表逻辑，查表逻辑根据包中字段的值获得转发信息，这一过程涉及到与CPU和查找表的交互，可以简单地理解为一系列的查表操作，经过一级一级的查表，最终获得了对包的转发信息——即处理操作，这些操作的描述(新的描述符)被发送给修改器(modifier)。Modifier根据新的描述符从存储器中取出包，对其帧格式与内容进行修改(头部字段的替换、添加、删除)重新封装成新的包发送给分路器，进行转发。
在实际的parser模块中除了对包头部的解析和字段提取，还会携带原始输入的描述符，该描述符跟随包沿着流水线向后级传递，但不参与提取过程，在本发明中为了简化结构，突出核心部件，所描述的发明特征不包括复制描述符的相关功能电路。
如图2所示，本发明提供的一种可破坏硬件木马的可重构交换机转发引擎解析器，其包括：数据预处理单元、若干级联的基本处理单元以及与最后级基本处理单元相连的提取单元(Extractor)。其中，数据预处理单元用于按照解析器截取的交换机以太网端口输入的包头部生成等长的随机数(即密钥)，并将输入的包头部与生成的密钥按位异或后将异或的结果和密钥输出至第一级基本处理单元；各级基本处理单元结构相同，均包括一数据通路和一密钥通路。其中，第一级基本处理单元的密钥通路用于对数据预处理单元输出的密钥进行密钥关键字提取和移位，提取的密钥关键字值发送至本级基本处理单元的数据通路，移位后的密钥值发送至下级基本处理单元的密钥通路，每级基本处理单元收到的密钥值称为密钥帧； 第一级基本处理单元的数据通路用本级密钥通路提取的密钥关键字值，对异或后的包头部即数据帧进行恢复，然后提取字段和移位，提取的字段偏移量发送至本级基本处理单元的密钥通路以及下一级基本处理单元的密钥通路和数据通路，移位后的数据帧发送至下一级基本处理单元的数据通路；其他各级基本处理单元依次对密钥帧和数据帧进行字段提取和移位后，输出到下一级基本处理单元；提取单元根据接收到的密钥值和字段偏移量，从最后一级基本处理单元的密钥通路和数据通路中进行密钥帧和数据帧的字段提取，并转发至后续包处理部分。
各级基本处理单元中，数据通路包括：数据帧寄存器单元、第一移位器单元、若干第一PA单元(关键字提取单元)、PB单元(查询匹配单元)、PC单元(查表单元)和若干偏移量缓存单元。其中，数据帧寄存器单元的输入为数据预处理单元或前一级基本处理单元发送的数据帧，输出连接本级第一移位器单元；第一移位器单元为移位单元，用于将每一级的帧头部及其载荷向右移动到对应级的固定起始位置(固定起始位置可由外部端口进行配置)，其输入为本级PC单元输出的本级封装帧头部的偏移量、本级数据帧寄存器单元存储的数据帧，其输出为移位后的新的数据帧；第一PA单元是PB单元的关键字提取单元，各第一PA单元的输入为前一级基本处理单元中PC单元输出的关键字偏移量、本级数据帧寄存器单元存储的数据帧，输出为提取出来的固定长度的关键字；PB单元为查询匹配单元，其输入为本级各第一PA单元输出的固定长度的关键字、本级密钥通路输出的密钥关键字值，输出为与输入的关键字组合所匹配的模板对应的协议分类和类型信息(以下简称协议信息)，在进行匹配时，将把PB单元内部存储的匹配模板与密钥异或，然后再进行匹配，如果关键字组合和任何特征模板都不匹配，则认为是非法包，发送非法标识到PC单元；PC单元是查表单元，其输入为本级PB单元的协议信息，输出为下一级基本处理单元所需要的关键字偏移量、本级封装帧头部中的各个字段的偏移量和字段标识以及下一级数据帧的偏移量；当根据本级提取协议下一层协议不需要解析，应当跳过时，PC单元输出bypass信号给下一级基本处理单元；当所述PB单元发送的为非法标识信息时，所述PC单元输出非法标识给下一级基本处理单元；后续各级所述基本处理单元接收到bypass信号后，把密钥和数据帧、PA单元的输入原样复制到下一级的对应端口上，不再执行其 它操作；后续各级所述基本处理单元接收到非法标识信号时，把密钥和数据帧原样复制到下一级，不再执行其它操作，同时复制非法标识到后级；偏移量缓存单元的数量与基本处理单元的级数相同，其用于存储前面各级基本处理单元解析出的所有字段的偏移量和字段标识，以及本级封装帧头部中的各个字段的偏移量和字段标识，其输入为前一级基本处理单元的偏移量缓存的所有输出和本级PC单元输出的本级封装帧头部中各个字段的偏移量和字段标识，输出为存储的所有数据，它的输出连接下一级基本处理单元的偏移量缓存。
各级基本处理单元中，密钥通路与数据通路相类似，包括密钥寄存器单元、第二移位器单元、若干第二PA单元和拼接单元。其中，密钥寄存器单元的输入是预处理单元或上一级基本处理单元的密钥帧，输出则连接着第二移位器单元；第二移位器单元是一个移位单元，将每一级的密钥及其之后的密钥比特向右移动到对应级的固定起始位置，其输入为密钥寄存器单元的密钥帧、本级基本处理单元数据通路中PC单元输出的本级数据帧的偏移量，输出为移位后的新的密钥帧，送往下一级基本处理单元的密钥通路；密钥通路中第二PA单元的个数与数据通路中第一PA单元的个数保持一致，一一对应，各第二PA单元的输入包括关键字偏移量、密钥寄存器单元的待提取的密钥帧，其中的关键字偏移量与本级数据通路中对应第二PA单元的关键字偏移量输入相同，输出为提取出来的固定长度的密钥值；拼接单元用于将第二PA单元输出的固定长度的若干个密钥值拼接、提取成与查询匹配模板对应位置的密钥，它的输入是若干个第二PA单元提取出来的密钥字段，输出为产生的密钥值。
提取单元分为提取单元数据通路和提取单元密钥通路两部分，提取单元数据通路的输入为最后一级基本处理单元中数据通路的若干个偏移量缓存的字段偏移量和字段标识、移位器单元中的数据帧，输出为提取出的字段和对应的字段标识；密钥通路的输入为最后一级基本处理单元中数据通路的若干个偏移量缓存的密钥偏移量和字段标识、密钥通路的移位器单元的密钥值，输出为提取出来的密钥片段。
提取单元的数据通路和密钥通路结构相同，均包括N组提取模块、N个映射表和N组寄存器，且每组提取模块、映射表和寄存器分别对应一个网络协议层。数据通路的各组提取模块用于根据接收到的偏移量缓存单元 输出的字段偏移量和字段标识，从移位器单元输出的数据帧或密钥帧中提取相应字段，并输出到对应的数据通路寄存器；密钥通路的各组提取模块用于根据接收到的字段偏移量和字段标识，从最后一级基本处理单元的密钥通路的密钥帧中提取相应字段，并输出到对应的密钥通路寄存器，将提取的数据帧和密钥帧的相应字段进行异或得到所需数据；各映射表用于存储相应网络协议层内各个字段标识所对应的寄存器的物理地址；如果提取单元收到数据包有非法标识，则不再执行提取操作，而是将非法标识和原始输入的包描述符上送给上层系统处理。
进一步地，本发明系统还包括一字段标识索引单元，该字段标识索引单元将提取的数据帧字段和对应的密钥片段输出到对应地址的寄存器中，在需要的时候，通过将数据帧字段和它的关联密钥片段按位异或就可以恢复原始的数据帧字段内容。
进一步地，解析器中，基本处理单元的级联数N等于所要解析的最大封装层次数量，每一层次的封装协议对应一级基本处理单元。
进一步地，数据通路中，数据帧寄存器单元的容量大小根据待处理的包头部最大长度决定，在硬件设计时候进行固化。
进一步地，数据通路中，第一PA单元的数量根据系统所支持的协议情况的需求来确定，优选统一固化为每级基本处理单元对应处理的封装帧头部待提取的关键字个数中的最大值。
进一步地，数据通路中，PB单元内包含一个匹配查找表，匹配查找表中存储着特征模板与协议信息之间的映射关系，该匹配查找表的内容(特征模板和协议信息)通过表存储器的对外端口从外部写入，实现可配置。
进一步地，数据通路中，PC单元内包含两个查找表：当前查找表(LUT_CUR)和下一级查找表(LUT_NXT)，表的输入(地址)分别为PB单元输出的当前层协议类型分类标识和下一层协议类型分类标识，当前查找表(LUT_CUR)的输出包括本级封装帧头部中的各个字段的偏移量和字段标识、本级数据帧的偏移量，下一级查找表(LUT_NXT)的输出包括下一级基本处理单元所需要的关键字段偏移量，当前查找表和下一级查找表的内容通过表存储器的对外端口从外部写入，实现可配置。
进一步地，数据通路中，PB单元和PC单元中查找表的输入输出位宽与容量、Offset_buffer的大小根据系统所支持的协议情况的需求来确定， 在设计阶段选取后，固定下来。
下面以具体实施例对本发明做进一步详细介绍:
以太网-IPV4数据帧是网络常见的数据帧结构之一，根据协议分层与OSI参考模型的规则，以太网协议、IPV4协议分别对应数据链路层(L2)、网络层(L3)。因此如图2所示，本实施例中具有防御硬件木马攻击且可重构的Parser整体结构如下：处理级数为两级，输入数据通过由两个结构相同的基本处理单元级联，分别处理以太网协议、IPV4协议的帧格式头部，解析出来的结果送达最后的提取器(Extractor)模块并对数据帧和密钥中的关键字段进行统一提取，至此完成Parser的解析功能。
取输入的以太网-IPV4包的前1024位，在进入解析器之前与一个等长的随机数(密钥)按位异或，异或的结果送入以太网处理层基本处理单元的数据通路的数据帧寄存器(Frame Reg)，密钥送入以太网处理层基本处理单元的密钥通路的密钥寄存器(Key Reg)，同时基本处理单元的数据通路会接收上层配置的关键字提取的偏移量。针对以太网-IPV4数据帧的解析过程，两层协议中关键字段最大的提取数量为4，因此将每级基本处理单元中PA单元的个数固定为四个。
以太网处理层的数据通路由六个功能单元组成，包括数据帧寄存器(Frame Reg)单元、移位器单元、PA单元、PB单元、PC单元、偏移量缓存单元。数据通路接收到经过密钥异或处理的数据帧并将其存储在数据帧寄存器单元(Frame Reg)，移位器单元是一个移位单元，输入为数据帧寄存器(Frame Reg)的1024位数据、来自本处理层的PC单元数据帧的移位量，根据移位量将本级协议的载荷数据移动到下一级协议对应的起始位置，输出为移位后的新的数据帧；四个PA单元分别接收上层配置而来的关键字偏移量值，并从数据帧寄存器单元中取出数据帧进行对应的提取，每个PA单元提取的字段长度固定为8位。PB单元是查询匹配单元，它的输入是四个PA单元提取出来的关键字段拼接而成的32位数据，和基本处理单元密钥层输出的32位密钥，这个密钥将同PB单元内部存储的所有匹配模板分别异或作为最终的匹配模板，输出为输入关键字组合所匹配的模板对应的协议类型信息；PC单元是一个查表单元，输入为来自PB单元的协议类型信息，输出为下一级基本处理单元所需要的关键字偏移量、本级封装帧头部中的各个字段的偏移量和字段标识、下一级数据帧的偏移量； 偏移量缓存单元是用来存储前面各级解析出的所有字段的偏移量和字段标识，以及本级封装帧头部中的各个字段的偏移量和字段标识，根据本实例每级偏移量缓存单元的容量都固化为2×10×8位，分别对应字段偏移量和字段标识两个部分、10个待提取字段的信息、和每项信息(字段偏移量和字段标识)的8为字长，输出连接IPV4基本处理单元的偏移量缓存1。
PB单元内包含一个匹配查找表，表的输入为四个PA提取拼接而成的32bit数据，表的每行内容都包括：32bit掩码，目的是为了过滤掉输入的32bit中的无关信息；32bit匹配模板，用来匹配掩码之后的字段；根据关键字段特征所对应的当前层协议类型标识和下一层协议类型标识，两个标识的大小均为8bit。匹配查找表的容量在硬件设计时进行固化，表项的内容则可以通过表存储的对外端口从外部写入，实现可配置。PB单元在匹配时先将存储的匹配模板与本级密钥通路送来的32bit密钥进行按位异或，输入的32bit关键字段则先与模板对应的匹配掩码按位相与(AND)把无关位转成0，再将变码后的匹配模板和掩码后的关键字段进行比较，值相等的则为匹配条目。
以太网层配置信息：
PB匹配查找表内容：
(
['00','00000000','00000000','00','00'],
['01','ffff0000','08000000','00','05'],
['01','ffff0000','81000000','00','03'],
['01','ffff0000','88470000','00','02'],
['01','ffff0000','88480000','00','02'],
['01','ffff0000','88a80000','00','04'],
['01','ffff0000','92000000','00','04'],
['01','ffff0000','93000000','00','04'],
)；
PC当前查找表内容：
(
['00','00','00000000000000000000','00000000000000000000','00'], ['01','00','20305060700000000000','01020304050000000000','0e'],
)；
PC下一级查找表内容：
(
['00','00000000'],
['01','0d0e0000'],
['02','03000000'],
['02','03000000'],
['03','03040000'],
['04','03040708'],
['05','010a0000'],
)；PC单元内包含两个查找表，当前查找表(LUT_CUR)和下一级查找表(LUT_NXT)。表的输入(地址)分别为PB单元输出的当前层协议类型标识和下一层协议类型标识，各为8bit。当前查找表(LUT_CUR)输出都包括本级封装帧头部中的各个字段的偏移量和字段标识，其大小均为10×8bit，并将其输出给本级的偏移量缓存1及进行存储；下一级数据帧的偏移量，长度为8位，输出给本级基本处理单元数据通路和密钥通路的移位器单元。表项的容量在设计时候进行固化，表的内容则通过表存储器的对外端口从外部写入，实现可配置。下一级查找表(LUT_NXT)输出包括下一级基本处理单元所需要的关键字段偏移量，为4×8位，分别输出给IPV4处理层数据通路的四个PA单元。表的容量在硬件设计时进行固化，表的内容通过表存储器的对外端口从外部写入，实现可配置。
以太网处理层的密钥通路与数据通路相类似，由四个功能单元组成，包括密钥寄存器(Key reg)单元、移位器单元、PA单元、拼接单元。输入的与数据帧等长的1024位随机数(密钥)存储在密钥寄存器(Key Reg)中、四个关键字偏移量值被分别送入四个PA单元中，并对密钥寄存器(Key Reg)中的密钥进行关键字的提取，所提取的字段长度与数据通路中保持一致，均为8bit。拼接单元把来自四个PA单元提取出来的8bit密钥段拼接起来，目的是与数据通路中的PB单元的查询模板异或作为新的查询模板进行匹配。移位器单元接收来自密钥寄存器(Key Reg)的密钥数据， 同时接收来自数据通路PC单元查找出的数据帧的偏移量信息进行对应的移位操作，并将其输出给下一级IPV4处理层的密钥寄存器(Key Reg)。
IPV4处理层的数据通路单元组成和各模块功能与以太网层数据通路相同。移位器移位器PA单元的数量也是四个，每个PA单元提取的字段长度也是固定为8位。但它包含两个偏移量缓存单元，偏移量缓存1是用来暂时存储以太网处理层解析出的所有字段的偏移量和字段标识，以便将它们向后传递，其大小、字长和以太网层基本处理单元种的偏移量缓存1相同。偏移量缓存2则用例存储本级头部中的各个字段的偏移量和字段标识。根据本实例IPV4处理层的偏移量缓存2单元的容量固化为2×10×8bit，分别对应IPV4层的字段偏移量和字段标识两个部分、10个待提取字段的信息、和每项信息(字段偏移量和字段标识)的8为字长，输出到最后的Extractor提取模块。
IPV4处理层的密钥通路与数据通路相类似，和以太网的密钥通路构成相同，PA单元有4个，提取字段长度也均为8bit，关键字段偏移量则是前一级基本处理单元的PC单元的输出。密钥寄存器(Key Reg)的密钥数据来自前一级的密钥通路移位器，它的移位器输出移位后的密钥帧到最后的提取器模块。相关程序语言如下：
IPV4层配置信息：
PB匹配查找表内容：
(
['00','00000000','00000000','00','00'],
['02','01000000','00000000','00','02'],
['02','01000000','01000000','00','05'],
['05','0fff0000','05060000','01','06'],
['05','0fff0000','05110000','01','07'],
['05','0fff0000','06060000','02','06'],
['05','0fff0000','06110000','02','07'],
['05','0fff0000','07060000','03','06'],
['05','0fff0000','07110000','03','07'],
)；
PC当前查找表内容：
(
['00','00','00000000000000000000','00000000000000000000','00'],
['02','00','18200000000000000000','01020000000000000000','04'],
['05','01','081020304048506080a0','0102030405060708090a','14'],
['05','02','081020304048506080a0','0102030405060708090a','18'],
['05','03','081020304048506080a0','0102030405060708090a','1c'],
)；
PC下一级查找表内容：
(
['00','00000000'],
['02','03000000'],
['02','03000000'],
['06','0d000000'],
['07','01020000'],
)；
提取单元的数据通路的输入为IPV4处理层偏移量缓存1单元、偏移量缓存2单元中的待提取字段的位置偏移量值和字段标识、IPV4处理层数据通路移位器中的数据帧，并将提取的字段输出；提取单元的密钥通路的输入为IPV4处理层偏移量缓存1单元、偏移量缓存2单元中的待提取字段的位置偏移量值和字段标识、IPV4处理层密钥通路移位器中的密钥，并将提取的密钥字段输出。
上述各实施例仅用于说明本发明，其中各部件的结构、连接方式和制作工艺等都是可以有所变化的，凡是在本发明技术方案的基础上进行的等同变换和改进，均不应排除在本发明的保护范围之外。

Claims (9)

  1. 一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：其包括：
    数据预处理单元、若干级联的基本处理单元以及与最后级基本处理单元相连的提取单元；
    各级所述基本处理单元结构相同，均包括数据通路和密钥通路；
    所述数据预处理单元用于按照解析器截取的交换机以太网端口输入的包头部生成等长的密钥，并将所述密钥作为密钥帧输出至第一级基本处理单元的密钥通路，将输入的包头部与所述密钥按位异或后将异或的结果作为数据帧输出至所述第一级基本处理单元的数据通路；
    所述第一级基本处理单元的密钥通路用于对密钥帧进行密钥关键字提取和移位，提取的密钥关键字值发送至本级基本处理单元的数据通路，移位后的密钥值发送至下级基本处理单元的密钥通路；
    所述第一级基本处理单元的数据通路根据本级密钥通路提取的密钥关键字值，对所述数据帧进行关键字段提取和移位，并将提取的字段偏移量发送至本级基本处理单元的密钥通路以及下一级基本处理单元的密钥通路和数据通路，移位后的数据帧发送至下一级基本处理单元的数据通路；
    其他各级基本处理单元依次对接收到的密钥帧和数据帧进行字段提取和移位后，输出到下一级基本处理单元；
    所述提取单元根据接收到的密钥值和关键字偏移量，从最后一级基本处理单元的密钥通路和数据通路中进行密钥帧和数据帧字段的提取，并转发至后续包处理部分。
  2. 如权利要求1所述的一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：所述各级基本处理单元中，数据通路包括：数据帧寄存器单元、第一移位器单元、若干第一PA单元、PB单元、PC单元、若干偏移量缓存单元；
    所述数据帧寄存器单元的输入为所述数据预处理单元或前一级基本处理单元发送的数据帧，输出连接本级所述第一移位器单元；
    所述第一移位器单元将本级的协议帧头部及其载荷向右移动到下一 层协议帧的固定起始位置，其输入为本级所述PC单元输出的下一层协议帧头部在当前数据帧中的偏移量、本级数据帧寄存器单元输出的数据帧，输出为移位后的新的数据帧；
    各所述第一PA单元的输入为前一级基本处理单元中PC单元输出的关键字段偏移量、本级数据帧寄存器单元的待提取的数据帧，输出为提取出来的固定长度的关键字段；
    所述PB单元的输入为本级各所述第一PA单元输出的固定长度的关键字段、本级密钥通路输出的密钥关键字值，输出为与输入的关键字段组合所匹配的模板对应的协议分类和类型信息，如果关键字段和任何特征模板都不匹配，则发送非法标识到所述PC单元；
    所述PC单元是查表单元，其输入为本级PB单元的协议分类和类型信息，输出为下一级基本处理单元所需要的关键字段偏移量、本级封装帧头部中的各个字段的偏移量和字段标识以及下一级数据帧的偏移量；当根据本级提取协议下一层协议不需要解析时，应当跳过时，PC单元输出bypass信号给下一级基本处理单元；当所述PB单元发送的为非法标识信息时，所述PC单元输出非法标识给下一级基本处理单元；后续各级所述基本处理单元接收到bypass信号后，把密钥和数据帧、所述第一PA单元的输入原样复制到下一级的对应端口上，不再执行其它操作；后续各级所述基本处理单元接收到非法标识信号时，把密钥和数据帧原样复制到下一级，不再执行其它操作，同时复制非法标识到后级基本处理单元；
    所述偏移量缓存单元的输入为前一级基本处理单元的偏移量缓存的所有输出和本级PC单元输出的本级封装帧头部中各个字段的偏移量和字段标识，输出为存储的所有字段偏移量和字段标识数据。
  3. 如权利要求2所述的一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：所述第一PA单元的数量根据每级基本处理单元对应处理的封装帧头部待提取的所有关键字总长度和每个所述第一PA单元能提取的关键字位宽确定。
  4. 如权利要求2所述的一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：所述PB单元内包含一个匹配查找表，所述匹配查找表中存储着特征模板与协议信息之间的映射关系，且表项的内容能够通过表存储器的对外端口从外部写入，在进行匹配时，把PB单元内部存 储的匹配模板与来自本级密钥通路的密钥按位异或，然后再进行匹配。
  5. 如权利要求2所述的一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：所述PC单元内包含两个查找表：当前查找表和下一级查找表，所述当前查找表和下一级查找表的输入分别为所述PB单元输出的当前层协议类型分类标识和下一层协议类型分类标识，所述当前查找表的输出包括本级封装帧头部中的各个字段的偏移量和字段标识、下一级封装帧头部在当前数据帧中的偏移量，所述下一级查找表的输出包括下一级基本处理单元所需要的关键字段偏移量，所述当前查找表和下一级查找表的表项内容能够通过表存储器的对外端口从外部写入。
  6. 如权利要求2所述的一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：各级所述基本处理单元中，所述密钥通路包括密钥寄存器单元、第二移位器单元、第二PA单元、拼接单元；
    所述密钥寄存器单元的输入是上一级或数据预处理单元的密钥帧，输出则连接着所述第二移位器单元；
    所述第二移位器单元将每一级的密钥及其之后的密钥比特向右移动到对应级的固定起始位置，其输入为密钥寄存器单元的密钥、本级基本处理单元数据通路输出的下一级封装帧头部在当前数据帧中的偏移量，输出为移位后的新的密钥帧；
    所述第二PA单元的数量与本级数据通路中所述第一PA单元的个数保持一致，各所述第二PA单元的输入为前一级基本处理单元数据通路中PC单元输出的关键字段偏移量、密钥寄存器单元的待提取的密钥值，输出为提取出来的固定长度的密钥值；
    所述拼接单元用于将所述第二PA单元输出的固定长度的若干个密钥值拼接、提取成查询匹配模板对应位置的密钥，它的输入是若干个所述第二PA单元提取出来的密钥字段，输出为产生的密钥值。
  7. 如权利要求1所述的一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：所述提取单元包括提取单元数据通路和提取单元密钥通路，所述提取单元数据通路的输入为最后一级所述基本处理单元的数据通路输出的各级基本处理单元中各字段的偏移量和字段标识、移位后的数据帧，输出为提取出的字段和对应的字段标识；密钥通路的输入为最后一级基本处理单元的数据通路的输出的各级协议头部的各字段的偏移 量和字段标识、密钥通路输出的移位后的密钥帧，输出为提取出来的各数据帧字段对应的密钥片段；若提取单元收到数据包有非法标识，则不再执行提取操作，而是将非法标识和原始输入的数据帧描述符上送给上层系统处理。
  8. 如权利要求1所述的一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：所述提取单元的数据通路和密钥通路结构相同，均包括N组提取模块、N个映射表和N组寄存器，且每组提取模块、映射表和寄存器分别对应一个网络协议层，数据通路的各组提取模块用于根据接收到的字段偏移量和字段标识，从最后一级基本处理单元的数据通路出的数据帧中提取相应字段，并输出到对应的数据通路寄存器，密钥通路的各组提取模块用于根据接收到的字段偏移量和字段标识，从最后一级基本处理单元的密钥通路的密钥帧中提取相应字段，并输出到对应的密钥通路寄存器，将提取的数据帧和密钥帧的相应字段进行异或得到所需数据；各映射表用于存储相应网络协议层内各个字段标识所对应的寄存器的物理地址。
  9. 如权利要求1所述的一种可破坏硬件木马的可重构交换机转发引擎解析器，其特征在于：所述解析器中，所述基本处理单元的级联数等于所要解析的最大封装层次数量，每一层次的封装协议对应一级所述基本处理单元。
PCT/CN2019/094332 2019-01-03 2019-07-02 一种可破坏硬件木马的可重构交换机转发引擎解析器 WO2020140412A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/261,849 US11736515B2 (en) 2019-01-03 2019-07-02 Reconfigurable switch forwarding engine parser capable of disabling hardware trojans

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910003982.2A CN109474641B (zh) 2019-01-03 2019-01-03 一种可破坏硬件木马的可重构交换机转发引擎解析器
CN201910003982.2 2019-01-03

Publications (1)

Publication Number Publication Date
WO2020140412A1 true WO2020140412A1 (zh) 2020-07-09

Family

ID=65678556

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/094332 WO2020140412A1 (zh) 2019-01-03 2019-07-02 一种可破坏硬件木马的可重构交换机转发引擎解析器

Country Status (3)

Country Link
US (1) US11736515B2 (zh)
CN (1) CN109474641B (zh)
WO (1) WO2020140412A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114070761A (zh) * 2021-11-11 2022-02-18 北京轨道交通路网管理有限公司 协议报文检测方法、其装置及电子设备

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109474641B (zh) * 2019-01-03 2020-05-12 清华大学 一种可破坏硬件木马的可重构交换机转发引擎解析器
US11831743B1 (en) * 2019-01-08 2023-11-28 Xilinx, Inc. Streaming architecture for packet parsing
CN112671713B (zh) * 2020-11-30 2023-01-20 山东电力工程咨询院有限公司 一种sdn网络数据转发方法、sdn交换机、控制器及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7551575B1 (en) * 2002-11-05 2009-06-23 Marvell Israel (M.I.S.L.) Ltd. Context-switching multi channel programmable stream parser
CN100574312C (zh) * 2002-09-06 2009-12-23 因芬奈昂技术股份有限公司 分析数据分组的分析器
CN104967575A (zh) * 2015-06-03 2015-10-07 清华大学 虚拟软件定义网络交换机
US20170064047A1 (en) * 2015-08-26 2017-03-02 Barefoot Networks, Inc. Configuring a switch for extracting packet header fields
CN109474641A (zh) * 2019-01-03 2019-03-15 清华大学 一种可破坏硬件木马的可重构交换机转发引擎解析器

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7978700B2 (en) * 2007-03-12 2011-07-12 Marvell Israel (Misl) Ltd. Apparatus for determining locations of fields in a data unit
US8854996B2 (en) * 2010-12-16 2014-10-07 International Business Machines Corporation Accelerating data packet parsing
US9848068B2 (en) * 2013-04-16 2017-12-19 Telefonaktiebolaget L M Ericsson (Publ) Method for providing a parser to extract information from fields of a data packet header
US9973599B2 (en) * 2013-12-04 2018-05-15 Mediatek Inc. Parser for parsing header in packet and related packet processing apparatus
CN103927270B (zh) * 2014-02-24 2017-02-08 东南大学 一种面向多个粗粒度动态可重构阵列的共享数据缓存装置及控制方法
DE112016001193T5 (de) * 2015-03-13 2017-11-30 Cavium, Inc. Protokollunabhängiger, programmierbarer Schalter für durch Software definierte Datenzentrumsnetzwerke
US10303878B2 (en) * 2016-01-22 2019-05-28 Yu-Liang Wu Methods and apparatus for automatic detection and elimination of functional hardware trojans in IC designs
US20180089426A1 (en) * 2016-09-29 2018-03-29 Government Of The United States As Represented By The Secretary Of The Air Force System, method, and apparatus for resisting hardware trojan induced leakage in combinational logics
US10121011B2 (en) * 2016-11-16 2018-11-06 The United States Of America As Represented By The Secretary Of The Air Force Apparatus, method and article of manufacture for partially resisting hardware trojan induced data leakage in sequential logics
CN107070906A (zh) * 2017-03-31 2017-08-18 中国人民解放军信息工程大学 一种支持网络演进的报文解析装置及方法
US11270002B2 (en) * 2018-05-14 2022-03-08 University Of Florida Research Foundation, Inc. Hardware trojan detection through information flow security verification

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100574312C (zh) * 2002-09-06 2009-12-23 因芬奈昂技术股份有限公司 分析数据分组的分析器
US7551575B1 (en) * 2002-11-05 2009-06-23 Marvell Israel (M.I.S.L.) Ltd. Context-switching multi channel programmable stream parser
CN104967575A (zh) * 2015-06-03 2015-10-07 清华大学 虚拟软件定义网络交换机
US20170064047A1 (en) * 2015-08-26 2017-03-02 Barefoot Networks, Inc. Configuring a switch for extracting packet header fields
CN109474641A (zh) * 2019-01-03 2019-03-15 清华大学 一种可破坏硬件木马的可重构交换机转发引擎解析器

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114070761A (zh) * 2021-11-11 2022-02-18 北京轨道交通路网管理有限公司 协议报文检测方法、其装置及电子设备
CN114070761B (zh) * 2021-11-11 2023-09-26 北京轨道交通路网管理有限公司 协议报文检测方法、其装置及电子设备

Also Published As

Publication number Publication date
CN109474641B (zh) 2020-05-12
US20210266332A1 (en) 2021-08-26
US11736515B2 (en) 2023-08-22
CN109474641A (zh) 2019-03-15

Similar Documents

Publication Publication Date Title
WO2020140412A1 (zh) 一种可破坏硬件木马的可重构交换机转发引擎解析器
US11677664B2 (en) Apparatus and method of generating lookups and making decisions for packet modifying and forwarding in a software-defined network engine
US9563399B2 (en) Generating a non-deterministic finite automata (NFA) graph for regular expression patterns with advanced features
US9398033B2 (en) Regular expression processing automaton
US9203805B2 (en) Reverse NFA generation and processing
US7949683B2 (en) Method and apparatus for traversing a compressed deterministic finite automata (DFA) graph
US8180803B2 (en) Deterministic finite automata (DFA) graph compression
US8571034B2 (en) Methods and apparatus related to packet classification associated with a multi-stage switch
US7292572B2 (en) Multi-level register bank based configurable ethernet frame parser
US8599859B2 (en) Iterative parsing and classification
US20140324900A1 (en) Intelligent Graph Walking
US7451216B2 (en) Content intelligent network recognition system and method
Liu et al. An overlay automata approach to regular expression matching

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19907622

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19907622

Country of ref document: EP

Kind code of ref document: A1