WO2021234765A1 - Packet identification device, packet identification method, and packet identification program - Google Patents

Packet identification device, packet identification method, and packet identification program Download PDF

Info

Publication number
WO2021234765A1
WO2021234765A1 PCT/JP2020/019596 JP2020019596W WO2021234765A1 WO 2021234765 A1 WO2021234765 A1 WO 2021234765A1 JP 2020019596 W JP2020019596 W JP 2020019596W WO 2021234765 A1 WO2021234765 A1 WO 2021234765A1
Authority
WO
WIPO (PCT)
Prior art keywords
rule
field
information
packet
identification
Prior art date
Application number
PCT/JP2020/019596
Other languages
French (fr)
Japanese (ja)
Inventor
悠介 関原
祐太 右近
奈美子 池田
高庸 新田
Original Assignee
日本電信電話株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 日本電信電話株式会社 filed Critical 日本電信電話株式会社
Priority to PCT/JP2020/019596 priority Critical patent/WO2021234765A1/en
Priority to JP2022523748A priority patent/JP7359299B2/en
Publication of WO2021234765A1 publication Critical patent/WO2021234765A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks

Definitions

  • the present invention relates to a packet identification technique for identifying a specified packet from among the input packets.
  • TCAM Ternary Content Addressable Memory
  • the present invention is for solving such a problem, and an object of the present invention is to provide a packet identification technique capable of speeding up comparison processing with a relatively small rule storage capacity.
  • the packet identification device has, for each rule for identifying a packet, a first field value relating to a specific field included in the header of the packet as a matching condition of the rule. Based on the storage unit that stores the rule information in which the received packet is registered and the second field value for each field included in the header of the received received packet, the received packet is the rule registered in the rule information. It includes a control unit that identifies whether or not they match and outputs the obtained identification result, and the control unit calculates a second hash value for a second field value extracted from the header of the received packet.
  • the second identification key information peculiar to the received packet is calculated from the second hash value of the field corresponding to the specific field of the rule.
  • the first identification key information peculiar to the rule calculated from the first field value registered in the rule information is compared with the second identification key information, and the above comparison result is obtained.
  • the identification result is output.
  • rule information in which a first field value relating to a specific field included in the header of the packet is registered as a matching condition of the rule is registered. Based on the storage unit to be stored and the second field value for each field included in the header of the received received packet, it is determined whether or not the received packet matches the rule registered in the rule information.
  • a packet identification method used in a packet identification device including a control unit that outputs the obtained identification result, wherein the control unit has a second hash relating to a second field value extracted from the header of the received packet.
  • the control unit Based on the step of calculating the value and the arbitrary rule registered in the rule information, the control unit is unique to the received packet from the second hash value of the field corresponding to the specific field of the rule.
  • the packet identification program causes a computer to execute the packet identification method described above.
  • FIG. 1 is a block diagram showing a configuration of a packet identification device.
  • FIG. 2 is a block diagram showing a configuration of a network device including a packet identification device.
  • FIG. 3 is an explanatory diagram showing a configuration example of a packet header.
  • FIG. 4 is an explanatory diagram showing an example of setting a rule.
  • FIG. 5 is an explanatory diagram showing a configuration example of rule information.
  • FIG. 6 is a flowchart showing the packet identification process.
  • FIG. 7 is an explanatory diagram showing an operation example of the packet identification device.
  • FIG. 1 is a block diagram showing a configuration of a packet identification device.
  • FIG. 2 is a block diagram showing a configuration of a network device including a packet identification device.
  • the packet identification device 10 is a device that analyzes the header of the input packet and identifies which group the packet belongs to among the preset groups.
  • the packet identification device 10 is used together with the network device 50.
  • the network device 50 is, for example, a management device such as a traffic monitoring device for monitoring traffic, which is connected to a communication network NW such as the Internet, acquires packets flowing through the communication network NW, and performs predetermined packet processing. ..
  • the network device 50 is provided with a network I / F 51, an operation input unit 52, a screen display unit 53, a storage unit 54, and a control device 55 as main configurations.
  • the network I / F51 acquires (captures) a packet from the communication network NW.
  • the operation input unit 52 includes an operation input device such as a keyboard, a mouse, and a touch panel, and detects an operator operation and outputs the operator operation to the control device 55.
  • the screen display unit 53 includes a screen display device such as an LCD, and displays screen data output from the control device 55 on the screen.
  • the storage unit 54 stores processing data and programs used for packet processing operations in the control device 55.
  • the control device 55 includes a packet identification device 10 and a packet processing device 20.
  • the packet acquired from the communication network NW by the network I / F 51 is input to the packet identification device 10 and the packet processing device 20 of the control device 55.
  • the packet identification device 10 identifies the group (flow) to which the input packet belongs, and outputs the identification result to the packet processing device 20.
  • the packet processing device 20 processes the input packet for each group (flow) based on the identification result from the packet identification device 10.
  • the amount of data in each flow packet is accumulated and the amount of traffic is measured. Burst traffic generated in each flow can be detected by comparing the traffic volume with the set threshold value.
  • the packet identification device 10 is provided with a packet receiving unit 11, a storage unit 12, and a control unit 13 as main configurations.
  • the packet receiving unit 11 is a circuit that receives an input packet.
  • the storage unit 12 is composed of a storage device such as a semiconductor memory or a hard disk as a whole, and is a circuit for storing various processing data and a program 12P used for packet identification processing executed by the control unit 13.
  • the program 12P is a program for realizing various processing units that execute packet identification processing in cooperation with the CPU of the control unit 13.
  • the program 12P is read from an external device or recording medium (both not shown) connected to the packet identification device 10 and stored in the storage unit 12 in advance.
  • the main processing data stored in the storage unit 12 is the rule information 12A used when identifying a packet.
  • the rule information 12A is composed of data for identifying the flow to which the packet belongs, and the field value of the field used for identification is registered as the first field value for each flow to be identified.
  • the rule information 12A is registered in the storage unit 12 in advance by an operator operation, for example, from the operation input unit 52 of the network device 50. Alternatively, it is registered in the storage unit 12 in advance from an external device or recording medium (both not shown) connected to the network device 50 or the packet identification device 10. The details of the rule information 12A will be described later.
  • the control unit 13 is a circuit that includes a CPU and its peripheral circuits, and realizes various processing units that execute packet identification processing by coordinating the CPU and the program 12P of the storage unit 12.
  • the control unit 13 is mainly composed of a CPU will be described as an example, but the present invention is not limited to this.
  • the packet identification device 10 of the present invention can be realized by a computer and a program, and a program such as a packet identification program can be recorded on a recording medium or provided through a network.
  • the control unit 13 is provided with a header analysis unit 13A, a hash calculation unit 13B, a field selection unit 13C, an identification key calculation unit 13D, a rule calculation unit 13E, and a comparison determination unit 13F as main processing units.
  • the header analysis unit 13A analyzes (parses) the header of the received packet input from the packet reception unit 11 and extracts each field value as a second field value from each field provided in the header. It is configured.
  • FIG. 3 is an explanatory diagram showing a configuration example of a packet header. As shown in FIG. 3, the packet is provided with a header, which is an area in which header information used for transmitting and receiving the packet is stored, and data, which is an area in which user information used by the user is stored. ..
  • the header is provided with an L2 header, an L3 header, and an L4 header corresponding to the layers of the OSI (Open Systems Interconnection) reference model.
  • L2 is a data link layer for transmitting / receiving data (frames) between nodes using a MAC address.
  • L3 is a network layer for transmitting / receiving data (packets) between user terminals by routing processing using IP addresses.
  • L4 is a transport layer for ensuring the reliability of data (segment) transfer using a protocol such as TCP or UDP.
  • the L2 header is provided with fields called source MAC address, destination MAC address, and type.
  • the bit data stored in these fields is called a field value.
  • a group of packets whose field values match is called a flow, and packet processing such as traffic monitoring is executed for each flow.
  • the flows having the same field used for packet identification are collectively referred to as a group.
  • the hash calculation unit 13B is configured to calculate a second hash value by using a hash function for each second field value obtained by the header analysis unit 13A.
  • the hash function is a function that calculates an irreversible value of a fixed length, that is, a hash value, which can identify the input data in the assumed data space by using a predetermined algorithm. Hash values often consist of fewer bits than the input data.
  • FIG. 4 is an explanatory diagram showing an example of setting a rule.
  • a rule for identifying a packet by using a layer 2 field as a match condition is shown.
  • source MAC address is referred to as “source MAC address”.
  • a field value of "01-23-45-67-89-ab” and a field value of "8894" for the field of "type” are set as matching conditions.
  • "*" wildcard is set in the "destination MAC address”. This "*" indicates that the field value of the corresponding field "destination MAC address” may be any field value, that is, the field is not used as a rule.
  • FIG. 5 is an explanatory diagram showing a configuration example of rule information.
  • FIG. 5 shows rule information 12A for each rule of FIG. In the rule information 12A, among the rules, the rules having the same field used for each identification are collectively registered in one group.
  • “rule # 2" and “rule # 4" that use “destination MAC address” and “type” as fields and do not use "source MAC address” are set as "group # 1". It is registered.
  • “rule # 1" and “rule # 3" that use "source MAC address” and "type” as fields and do not use “destination MAC address” are registered as "group # 2".
  • the specific field information is information in which bit values of "1/0" indicating whether or not the field is used are arranged in the order of the fields registered in the rule. For example, in the case of "Rule # 2", since "source MAC address” is not used as a field but "destination MAC address” and “type” are used for packet identification, "destination MAC address” and “type” are used as specific field information. 011 "is registered.
  • the identification key information obtained from the hash value of the field value used for packet identification is registered as the first identification key information for each rule.
  • the first identification key information "A12bcd34effg” is obtained and registered by an operation such as an exclusive OR operation.
  • the first identification key information may be calculated in advance by the rule calculation unit 13E and registered in the rule information 12A, and each time a received packet is identified, the rule calculation unit 13E calculates from the rule information 12A. You may. Further, in FIG. 5, the case where the specific field information is registered for each group has been described as an example, but the present invention is not limited to this. For example, specific field information may be registered for each rule.
  • the field selection unit 13C is a field used for packet identification from among the second hash values obtained by the hash calculation unit 13B based on the specific field information included in the rule information 12A stored in the storage unit 12. It is configured to select only the hash value. For example, as described above, when “011" is registered as the specific field information in the rule information 12A of "Rule # 2", the bit value is selected from the second hash value obtained by the hash calculation unit 13B. Only the hash values of the fields "source MAC address" and "type” corresponding to "1” are selected. Further, as the hash value of the field corresponding to the bit value "0”, the values "0" and “null” that do not affect the operation of the packet identification key are output.
  • the identification key calculation unit 13D calculates the second identification key information from the second hash value of the field selected by the field selection unit 13C, for example, by performing an exclusive OR operation of these second hash values. It is configured to do.
  • This calculation method a method equivalent to the calculation method in the rule calculation unit 13E is used.
  • the second identification key information can be shared by all the rules belonging to the same group, and the processing required for the calculation processing of the second identification key information. The burden can be greatly reduced.
  • the rule calculation unit 13E calculates a first hash value for each first field value related to a specific field for each rule used for packet identification based on the rule information 12A stored in the storage unit 12, and these first hash values are calculated. It is configured to calculate the first identification key information from the hash value of 1. As this calculation method, a method equivalent to the calculation method in the identification key calculation unit 13D is used. Regarding the first identification key information of each rule, the rule calculation unit 13E may calculate from the rule information 12A every time the received packet is identified, but as shown in FIG. 5 above, the rule calculation is performed in advance. It may be calculated by the unit 13E and registered in the rule information 12A. This makes it possible to reduce the processing load required for the calculation of the first identification key information.
  • the comparison determination unit 13F compares the second identification key information obtained by the identification key calculation unit 13D with the first identification key information obtained by the rule calculation unit 13E, and packet identification is based on the comparison result. It is configured to output the result. For example, when the second identification key information obtained from the received packet matches the first identification key information of any rule, the identification information indicating the rule and the corresponding flow is the identification information of the received packet. It will be output as an identification result. At this time, when the specific field information is registered for each group, the second identification key information can be shared by all the rules belonging to the same group, and is required for the comparison process with the second identification key information. The processing load can be significantly reduced.
  • FIG. 6 is a flowchart showing the packet identification process.
  • the control unit 13 of the packet identification device 10 executes the packet identification process of FIG. 6 each time a received packet is input from the packet reception unit 11. It is assumed that the rule information 12A as shown in FIG. 5 is registered in advance in the storage unit 12, and the packet identification process is executed for the rules belonging to the group designated in advance.
  • the header analysis unit 13A analyzes the header of the received packet input from the packet reception unit 11 and extracts the second field value for each field included in the header (step S100). Subsequently, the hash calculation unit 13B calculates a second hash value for each second field value extracted by the header analysis unit 13A (step S101).
  • the field selection unit 13C acquires the specific field information of the designated group from the rule information 12A of the storage unit 12 (step S102), and selects the unprocessed field from the second field related to the received packet. Select one as the target field (step S103). After that, the field selection unit 13C refers to the specific field information and confirms whether or not the target field corresponds to the specific field (step S104).
  • step S104 when the target field corresponds to the specific field (step S104: YES), the field selection unit 13C has the second hash corresponding to the target field among the second hash values output from the hash calculation unit 13B. A value is selected, output to the identification key calculation unit 13D (step S105), and the process proceeds to step S107 described later.
  • step S104: NO when the target field does not correspond to the specific field (step S104: NO), the field selection unit 13C identifies "0" (zero) or "null” as the second hash value corresponding to the target field. It is output to the unit 13D (step S106), and the process proceeds to step S107 described later.
  • the field selection unit 13C confirms whether an unprocessed field remains among the second fields related to the received packet (step S107), and if an unprocessed field remains (step S107: YES), step S103. Return to. On the other hand, when no unprocessed field remains (step S107: NO), the identification key calculation unit 13D calculates the second identification key information from the second hash value selected by the field selection unit 13C. , Is output to the comparison determination unit 13F (step S108).
  • the rule calculation unit 13E calculates the first identification key information for each rule belonging to the designated group (step S108). At this time, when the first identification key information is registered in the rule information 12A, the rule calculation unit 13E may output the first identification key information acquired from the rule information 12A to the comparison determination unit 13F.
  • the comparison determination unit 13F compares the second identification key information obtained by the identification key calculation unit 13D with each of the first identification key information output from the rule calculation unit 13E (step S109). Based on the obtained comparison result, an identification result indicating whether or not the received packet matches each rule of the designated group registered in the rule information 12A is output (step S110), and a series of packet identification processes are completed. do.
  • FIG. 7 is an explanatory diagram showing an operation example of the packet identification device.
  • the second field value extracted from the received packet by the header analysis unit 13A is output to the hash calculation unit 13B, and the second hash value is calculated.
  • "9ar3gj65h48”, “2sdj36tm647”, and "nei468ie45I” are used as the second hash value for the second field value consisting of "source MAC address", "destination MAC address", and "type". Each is calculated.
  • These second hash values are output to the field selection unit 13C and are selected based on the specific field information acquired from the rule information 12A, in this example, the specific field information related to "group # 1" in FIG.
  • the bit order of the specific field information corresponds to the second field value in order from the beginning of the packet
  • "0" of the first bit in the specific field information "011” is the "source MAC address”. Will correspond to.
  • the second hash value "9ar3gj65h48" regarding the "source MAC address” is not selected, and "0" (zero) is the identification key calculation unit 13D. It is output to.
  • the remaining bits indicate "1", indicating that the corresponding second field values "destination MAC address” and "type” are specific fields. Therefore, the second hash values "2sdj36tm647" and “nei468ie45I” related to these are selected and output to the identification key calculation unit 13D.
  • the identification key calculation unit 13D calculates the second identification key information common to each rule of the "group # 1" based on these "0” (zero), "2sdj36tm647" and "nei468ie45I".
  • the control unit 13 calculates the second hash value for the second field value extracted from the header of the received packet, and is based on an arbitrary rule registered in the rule information 12A. Then, the second identification key information peculiar to the received packet was calculated from the second hash value of the field corresponding to the specific field of the rule, and the first field value registered in the rule information 12A was calculated. The first identification key information peculiar to the rule is compared with the second identification key information, and the identification result is output according to the obtained comparison result.
  • the rule information 12A stores specific field information indicating whether or not each field included in the header is a specific field for each rule
  • the header analysis unit 13A stores the received packet.
  • the header of is analyzed, the second field value for each field included in the header is extracted, the hash calculation unit 13B calculates the second hash value for each second field value, and the field selection unit 13C calculates the second hash value.
  • the second hash value of the field corresponding to the specific field is selected from the second hash values based on the specific field information of any rule, and the identification key calculation unit 13D selects the second hash value.
  • the second identification key information is calculated from the hash value, and the rule calculation unit 13E calculates the first hash value for each first field value related to the specific field of any rule, and from these first hash values.
  • the first identification key information is calculated, and the comparison determination unit 13F outputs the identification result based on the comparison result obtained by comparing the first identification key information and the second identification key information. It was done.
  • the hash value related to the field value used in the rule is aggregated into one first identification key information unique to the rule and obtained from the packet. It will be compared with the second identification key information obtained. Therefore, the number of comparisons can be significantly reduced and the processing time required for the comparison processing can be significantly shortened as compared with the case where the hash values are compared for each field. Further, since the first and second identification key information is calculated from the hash value corresponding to the specific field, it is the identification key information corresponding to the combination of the specific fields required in the rule. Therefore, packets can be identified without considering unnecessary field combinations, and the memory capacity required for comparison can be significantly reduced. Therefore, according to the present embodiment, it is possible to speed up the comparison process with a relatively small rule storage capacity.
  • the rule information 12A stores specific field information indicating whether or not each field included in the header is a specific field for each rule
  • the control unit 13 stores the rule information 12A.
  • the second identification key information peculiar to the received packet may be calculated based on the specific field information about any rule registered in. This makes it possible to calculate the second identification key information corresponding to the combination of specific fields with an extremely simple configuration.
  • the rules having the same specific field are stored as a group, and the specific field information is stored for each of these groups, and the control unit 13 stores the rule.
  • the second identification key information is calculated based on the specific field information of the group, and the first identification key information for each rule belonging to the arbitrary group can be arbitrarily obtained. It may be compared with the second identification key information about the group.
  • the rules having the same specific field are stored as a group, and the specific field information is stored for each of these groups, and the field selection unit 13C registers the rules in the rule information 12A.
  • the second hash value of the field corresponding to the specific field is selected from the second hash values obtained by the hash calculation unit 13B based on the specific field information of any group, and the identification key calculation is performed.
  • the unit 13D calculates the second identification key information for an arbitrary group from the second hash value selected by the field selection unit 13C, and the comparison determination unit 13F is the first for each rule belonging to the arbitrary group.
  • the identification key information may be compared with the second identification key information for any group.
  • the second identification key information that can be shared by the rules belonging to the group can be calculated, the number of calculation processing of the second identification key information can be reduced, and the processing time required for the calculation processing can be significantly shortened. ..
  • the rule information 12A stores the first identification key information calculated in advance by the rule calculation unit 13E for each rule, and the comparison determination unit 13F is included in the rule information 12A.
  • the first identification key information and the second identification key information regarding the rule may be compared.
  • the number of arithmetic processing of the first identification key information can be reduced, and the processing time required for the arithmetic processing can be significantly shortened.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

A control circuit (13) calculates a second hash value associated with a second field value extracted from the header of a received packet; calculates, on the basis of an arbitrary rule registered in rule information (12A), second identification key information unique to the received packet from a second hash value for the field corresponding to the specific field of said rule; compares first identification key information unique to the rule, said information being calculated from a first field value registered in the rule information (12A), with the second identification key information; and outputs identification results according to the obtained comparison results. As a result, the comparison processing can be made faster with a relatively small rule storage capacity.

Description

パケット識別装置、パケット識別方法およびパケット識別プログラムPacket identification device, packet identification method and packet identification program
　本発明は、入力されたパケットのうちから指定されたパケットを識別するためのパケット識別技術に関する。 The present invention relates to a packet identification technique for identifying a specified packet from among the input packets.
　ネットワークの通信状況を把握するなど、ネットワークを流れるパケットをパケット処理装置で処理する場合、パケットおよびその情報を取得する必要がある。これまで、ネットワーク上のパケットはその設計思想において固有のフィールド構造を持っていることが一般的であった。しかし、ネットワークの仮想化が進み複数のネットワークが単一の物理構成上で構成されるようになったことに伴い、ネットワーク上のパケットのフィールド構造は一意に定まらなくなってきている。したがって、通信データの取得技術において、パケットのフィールド構造に対して柔軟に取得対象を識別できることが要求されている。 When processing a packet flowing through the network with a packet processing device, such as grasping the communication status of the network, it is necessary to acquire the packet and its information. Until now, packets on the network have generally had a unique field structure in their design concept. However, with the progress of network virtualization and the fact that multiple networks are configured on a single physical configuration, the field structure of packets on the network is not uniquely determined. Therefore, in the communication data acquisition technique, it is required to be able to flexibly identify the acquisition target with respect to the field structure of the packet.
　このような課題に対し、一般にはＴＣＡＭ（Ternary Content Addressable Memory）を用いた比較一致方式がある（例えば、非特許文献１参照。）。しかし、ＴＣＡＭは専用のチップとして実装されるため、高価な専用装置でないと導入できないという問題がある。 For such problems, there is generally a comparison and matching method using TCAM (Ternary Content Addressable Memory) (see, for example, Non-Patent Document 1). However, since the TCAM is mounted as a dedicated chip, there is a problem that it cannot be introduced unless it is an expensive dedicated device.
　従来、専用チップでないハードウェアおよびソフトウェアを用いたパケット識別技術として、種々のアプローチが存在している。例えば、入力されたパケットから各ルールに対して、逐一、パケットの全フィールドを用いて比較を行うことで、多様なフィールド構造に対応したパケット識別を実現する方式や、入力されたルールに対して、予測されるフィールドの組み合わせを予めルールとして登録しておくことで、逐次の検索を回避して、高速な比較一致を実現する方式が提案されている。 Conventionally, there are various approaches as packet identification technology using hardware and software that are not dedicated chips. For example, for a method that realizes packet identification corresponding to various field structures by comparing each rule from the input packet using all the fields of the packet one by one, or for the input rule. , A method has been proposed in which a combination of predicted fields is registered as a rule in advance to avoid sequential searches and realize high-speed comparison matching.
　しかしながら、入力されたパケットから各ルールに対して、パケットの全フィールドを用いて比較する方式の場合、パケットの全フィールドを用いて比較を行うため、利用するフィールド数が増えると検索回数がそれに比例して増加するため、比較処理時間が長くなり、結果として高速なネットワークへの対応が難しいという問題点があった。
　また、予測されるフィールドの組み合わせをルール化して並列的に取り扱う方式の場合、フィールド数が増えると組み合わせの数が増大し、ルールの記憶に必要な記憶容量が大規模化するという問題があった。 However, in the case of the method of comparing each rule from the input packet using all the fields of the packet, the comparison is performed using all the fields of the packet, so the number of searches is proportional to it as the number of fields to be used increases. As a result, the comparison processing time becomes long, and as a result, it is difficult to support a high-speed network.
Further, in the case of the method in which the expected combinations of fields are made into rules and handled in parallel, there is a problem that the number of combinations increases as the number of fields increases, and the storage capacity required for storing the rules increases. ..
　本発明はこのような課題を解決するためのものであり、比較的少ないルール記憶容量で、比較処理を高速化できるパケット識別技術を提供することを目的としている。 The present invention is for solving such a problem, and an object of the present invention is to provide a packet identification technique capable of speeding up comparison processing with a relatively small rule storage capacity.
　このような目的を達成するために、本発明にかかるパケット識別装置は、パケットを識別するためのルールごとに、当該ルールの一致条件として前記パケットのヘッダに含まれる特定フィールドに関する第１のフィールド値が登録されているルール情報を記憶する記憶部と、受信した受信パケットのヘッダに含まれる各フィールドに関する第２のフィールド値に基づいて、当該受信パケットが、前記ルール情報に登録されているルールと一致するか否かを識別し、得られた識別結果を出力する制御部とを備え、前記制御部は、前記受信パケットのヘッダから抽出した第２のフィールド値に関する第２のハッシュ値を演算し、前記ルール情報に登録されている任意のルールに基づいて、当該ルールの特定フィールドと対応するフィールドの前記第２のハッシュ値から、前記受信パケットに固有の第２の識別キー情報を演算し、前記ルール情報に登録されている前記第１のフィールド値から演算した、当該ルールに固有の第１の識別キー情報を前記第２の識別キー情報と比較し、得られた比較結果に応じて前記識別結果を出力するようにしたものである。 In order to achieve such an object, the packet identification device according to the present invention has, for each rule for identifying a packet, a first field value relating to a specific field included in the header of the packet as a matching condition of the rule. Based on the storage unit that stores the rule information in which the received packet is registered and the second field value for each field included in the header of the received received packet, the received packet is the rule registered in the rule information. It includes a control unit that identifies whether or not they match and outputs the obtained identification result, and the control unit calculates a second hash value for a second field value extracted from the header of the received packet. , Based on an arbitrary rule registered in the rule information, the second identification key information peculiar to the received packet is calculated from the second hash value of the field corresponding to the specific field of the rule. The first identification key information peculiar to the rule calculated from the first field value registered in the rule information is compared with the second identification key information, and the above comparison result is obtained. The identification result is output.
　また、本発明にかかるパケット識別方法は、パケットを識別するためのルールごとに、当該ルールの一致条件として前記パケットのヘッダに含まれる特定フィールドに関する第１のフィールド値が登録されているルール情報を記憶する記憶部と、受信した受信パケットのヘッダに含まれる各フィールドに関する第２のフィールド値に基づいて、当該受信パケットが、前記ルール情報に登録されているルールと一致するか否かを識別し、得られた識別結果を出力する制御部とを備えるパケット識別装置で用いられるパケット識別方法であって、前記制御部が、前記受信パケットのヘッダから抽出した第２のフィールド値に関する第２のハッシュ値を演算するステップと、前記制御部が、前記ルール情報に登録されている任意のルールに基づいて、当該ルールの特定フィールドと対応するフィールドの前記第２のハッシュ値から、前記受信パケットに固有の第２の識別キー情報を演算するステップと、前記制御部が、前記ルール情報に登録されている前記第１のフィールド値から演算した、当該ルールに固有の第１の識別キー情報を前記第２の識別キー情報と比較し、得られた比較結果に応じて前記識別結果を出力するステップとを備えている。 Further, in the packet identification method according to the present invention, for each rule for identifying a packet, rule information in which a first field value relating to a specific field included in the header of the packet is registered as a matching condition of the rule is registered. Based on the storage unit to be stored and the second field value for each field included in the header of the received received packet, it is determined whether or not the received packet matches the rule registered in the rule information. , A packet identification method used in a packet identification device including a control unit that outputs the obtained identification result, wherein the control unit has a second hash relating to a second field value extracted from the header of the received packet. Based on the step of calculating the value and the arbitrary rule registered in the rule information, the control unit is unique to the received packet from the second hash value of the field corresponding to the specific field of the rule. The step of calculating the second identification key information of the above, and the first identification key information peculiar to the rule calculated by the control unit from the first field value registered in the rule information. It is provided with a step of comparing with the identification key information of No. 2 and outputting the identification result according to the obtained comparison result.
　また、本発明にかかるパケット識別プログラムは、前述したパケット識別方法をコンピュータに実行させる。 Further, the packet identification program according to the present invention causes a computer to execute the packet identification method described above.
　本発明によれば、比較的少ないルール記憶容量で、比較処理を高速化することが可能となる。 According to the present invention, it is possible to speed up the comparison process with a relatively small rule storage capacity.
図１は、パケット識別装置の構成を示すブロック図である。FIG. 1 is a block diagram showing a configuration of a packet identification device. 図２は、パケット識別装置を含むネットワーク機器の構成を示すブロック図である。FIG. 2 is a block diagram showing a configuration of a network device including a packet identification device. 図３は、パケットヘッダの構成例を示す説明図である。FIG. 3 is an explanatory diagram showing a configuration example of a packet header. 図４は、ルールの設定例を示す説明図である。FIG. 4 is an explanatory diagram showing an example of setting a rule. 図５は、ルール情報の構成例を示す説明図である。FIG. 5 is an explanatory diagram showing a configuration example of rule information. 図６は、パケット識別処理を示すフローチャートである。FIG. 6 is a flowchart showing the packet identification process. 図７は、パケット識別装置の動作例を示す説明図である。FIG. 7 is an explanatory diagram showing an operation example of the packet identification device.
　次に、本発明の一実施の形態について図面を参照して説明する。
［パケット識別装置］
　まず、図１および図２を参照して、本実施の形態にかかるパケット識別装置１０について説明する。図１は、パケット識別装置の構成を示すブロック図である。図２は、パケット識別装置を含むネットワーク機器の構成を示すブロック図である。
　このパケット識別装置１０は、入力されたパケットのヘッダを解析し、パケットが予め設定されているグループのうち、どのグループに属するパケットであるかを識別する装置である。 Next, an embodiment of the present invention will be described with reference to the drawings.
[Packet identification device]
First, the packet identification device 10 according to the present embodiment will be described with reference to FIGS. 1 and 2. FIG. 1 is a block diagram showing a configuration of a packet identification device. FIG. 2 is a block diagram showing a configuration of a network device including a packet identification device.
The packet identification device 10 is a device that analyzes the header of the input packet and identifies which group the packet belongs to among the preset groups.
［ネットワーク機器］
　図２に示すように、パケット識別装置１０は、ネットワーク機器５０とともに用いられる。ネットワーク機器５０は、例えばトラフィックを監視するトラフィック監視装置などの管理装置からなり、インターネットなどの通信網ＮＷに接続されて、通信網ＮＷを流れるパケットを取得して所定のパケット処理を行う装置である。 [Network equipment]
As shown in FIG. 2, the packet identification device 10 is used together with the network device 50. The network device 50 is, for example, a management device such as a traffic monitoring device for monitoring traffic, which is connected to a communication network NW such as the Internet, acquires packets flowing through the communication network NW, and performs predetermined packet processing. ..
　ネットワーク機器５０には、主な構成として、網Ｉ／Ｆ５１、操作入力部５２、画面表示部５３、記憶部５４、および制御装置５５が設けられている。
　網Ｉ／Ｆ５１は、通信網ＮＷからパケットを取得（キャプチャ）する。操作入力部５２は、キーボード、マウス、タッチパネルなどの操作入力装置からなり、オペレータ操作を検出して制御装置５５へ出力する。画面表示部５３は、ＬＣＤなどの画面表示装置からなり、制御装置５５から出力された画面データを画面表示する。記憶部５４は、制御装置５５でのパケット処理動作に用いる処理データやプログラムを記憶する。制御装置５５は、パケット識別装置１０とパケット処理装置２０から構成されている。 The network device 50 is provided with a network I / F 51, an operation input unit 52, a screen display unit 53, a storage unit 54, and a control device 55 as main configurations.
The network I / F51 acquires (captures) a packet from the communication network NW. The operation input unit 52 includes an operation input device such as a keyboard, a mouse, and a touch panel, and detects an operator operation and outputs the operator operation to the control device 55. The screen display unit 53 includes a screen display device such as an LCD, and displays screen data output from the control device 55 on the screen. The storage unit 54 stores processing data and programs used for packet processing operations in the control device 55. The control device 55 includes a packet identification device 10 and a packet processing device 20.
　網Ｉ／Ｆ５１により通信網ＮＷから取得したパケットは、制御装置５５のパケット識別装置１０とパケット処理装置２０に入力される。パケット識別装置１０は、入力されたパケットが属するグループ（フロー）を識別し、識別結果をパケット処理装置２０へ出力する。パケット処理装置２０は、パケット識別装置１０からの識別結果に基づいて、入力されたパケットをグループ（フロー）ごとにパケット処理する。トラフィックを監視する場合、各フローのパケットのデータ量を累計してトラフィック量を測定する。トラフィック量を設定されている閾値と比較することにより、各フローで発生したバーストトラフィックを検出できる。 The packet acquired from the communication network NW by the network I / F 51 is input to the packet identification device 10 and the packet processing device 20 of the control device 55. The packet identification device 10 identifies the group (flow) to which the input packet belongs, and outputs the identification result to the packet processing device 20. The packet processing device 20 processes the input packet for each group (flow) based on the identification result from the packet identification device 10. When monitoring traffic, the amount of data in each flow packet is accumulated and the amount of traffic is measured. Burst traffic generated in each flow can be detected by comparing the traffic volume with the set threshold value.
［パケット識別装置の構成］
　次に、図１を参照して、本実施の形態にかかるパケット識別装置１０の構成について詳細に説明する。
　図１に示すように、パケット識別装置１０には、主な構成として、パケット受信部１１、記憶部１２、および制御部１３が設けられている。 [Packet identification device configuration]
Next, with reference to FIG. 1, the configuration of the packet identification device 10 according to the present embodiment will be described in detail.
As shown in FIG. 1, the packet identification device 10 is provided with a packet receiving unit 11, a storage unit 12, and a control unit 13 as main configurations.
　パケット受信部１１は、入力されたパケットを受信する回路である。
　記憶部１２は、全体として、半導体メモリやハードディスクなどの記憶装置からなり、制御部１３で実行するパケット識別処理に用いる各種処理データやプログラム１２Ｐを記憶する回路である。
　プログラム１２Ｐは、制御部１３のＣＰＵと協働して、パケット識別処理を実行する各種処理部を実現するためのプログラムである。プログラム１２Ｐは、パケット識別装置１０に接続された外部装置や記録媒体（ともに図示せず）から読み出されて予め記憶部１２に格納される。 The packet receiving unit 11 is a circuit that receives an input packet.
The storage unit 12 is composed of a storage device such as a semiconductor memory or a hard disk as a whole, and is a circuit for storing various processing data and a program 12P used for packet identification processing executed by the control unit 13.
The program 12P is a program for realizing various processing units that execute packet identification processing in cooperation with the CPU of the control unit 13. The program 12P is read from an external device or recording medium (both not shown) connected to the packet identification device 10 and stored in the storage unit 12 in advance.
　記憶部１２で記憶する主な処理データとして、パケットを識別する際に用いるルール情報１２Ａがある。ルール情報１２Ａは、パケットが属するフローを識別するためのデータからなり、識別対象となるフローごとに、識別に用いるフィールドのフィールド値が第１のフィールド値として登録されている。ルール情報１２Ａは、例えばネットワーク機器５０の操作入力部５２からオペレータ操作により、予め記憶部１２に登録される。あるいは、ネットワーク機器５０やパケット識別装置１０に接続された外部装置や記録媒体（ともに図示せず）から予め記憶部１２に登録される。ルール情報１２Ａの詳細については後述する。 The main processing data stored in the storage unit 12 is the rule information 12A used when identifying a packet. The rule information 12A is composed of data for identifying the flow to which the packet belongs, and the field value of the field used for identification is registered as the first field value for each flow to be identified. The rule information 12A is registered in the storage unit 12 in advance by an operator operation, for example, from the operation input unit 52 of the network device 50. Alternatively, it is registered in the storage unit 12 in advance from an external device or recording medium (both not shown) connected to the network device 50 or the packet identification device 10. The details of the rule information 12A will be described later.
［制御部］
　制御部１３は、ＣＰＵとその周辺回路を備え、ＣＰＵと記憶部１２のプログラム１２Ｐとを協働させることにより、パケット識別処理を実行する各種処理部を実現する回路である。なお、以下では、制御部１３が主にＣＰＵから構成されている場合を例として説明するがこれに限定されるものではない。例えば、ＡＳＩＣ（Application Specific Integrated Circuit）やＦＰＧＡ（Field-Programmable Gate Array）で、バースト検出処理に特化した回路を制御部１３として用いてもよい。また、本発明のパケット識別装置１０は、コンピュータとプログラムによっても実現でき、パケット識別プログラム等のプログラムを記録媒体に記録することも、ネットワークを通して提供することも可能である。 [Control unit]
The control unit 13 is a circuit that includes a CPU and its peripheral circuits, and realizes various processing units that execute packet identification processing by coordinating the CPU and the program 12P of the storage unit 12. In the following, a case where the control unit 13 is mainly composed of a CPU will be described as an example, but the present invention is not limited to this. For example, in an ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array), a circuit specialized for burst detection processing may be used as the control unit 13. Further, the packet identification device 10 of the present invention can be realized by a computer and a program, and a program such as a packet identification program can be recorded on a recording medium or provided through a network.
　制御部１３には、主な処理部として、ヘッダ解析部１３Ａ、ハッシュ演算部１３Ｂ、フィールド選択部１３Ｃ、識別キー演算部１３Ｄ、ルール演算部１３Ｅ、および比較判定部１３Ｆが設けられている。 The control unit 13 is provided with a header analysis unit 13A, a hash calculation unit 13B, a field selection unit 13C, an identification key calculation unit 13D, a rule calculation unit 13E, and a comparison determination unit 13F as main processing units.
［ヘッダ解析部］
　ヘッダ解析部１３Ａは、パケット受信部１１から入力された受信パケットのヘッダを解析（パース）して、ヘッダに設けられている各フィールドからそれぞれのフィールド値を第２のフィールド値として抽出するように構成されている。
　図３は、パケットヘッダの構成例を示す説明図である。図３に示すように、パケットには、パケットの送受信に用いるヘッダ情報が格納されている領域であるヘッダと、ユーザが利用するユーザ情報が格納されている領域であるデータとが設けられている。 [Header analysis unit]
The header analysis unit 13A analyzes (parses) the header of the received packet input from the packet reception unit 11 and extracts each field value as a second field value from each field provided in the header. It is configured.
FIG. 3 is an explanatory diagram showing a configuration example of a packet header. As shown in FIG. 3, the packet is provided with a header, which is an area in which header information used for transmitting and receiving the packet is stored, and data, which is an area in which user information used by the user is stored. ..
　ヘッダには、ＯＳＩ（Open Systems Interconnection）参照モデルのレイヤに対応するＬ２ヘッダ、Ｌ３ヘッダ，Ｌ４ヘッダが設けられている。Ｌ２は、ＭＡＣアドレスを用いてデータ（フレーム）をノード間で送受信するためのデータリンクレイヤである。Ｌ３は、ＩＰアドレスを用いたルーティング処理によりデータ（パケット）をユーザ端末間で送受信するためのネットワークレイヤである。Ｌ４は、ＴＣＰやＵＤＰなどのプロトコルを用いてデータ（セグメント）転送の信頼性を確保するためのトランスポートレイヤである。 The header is provided with an L2 header, an L3 header, and an L4 header corresponding to the layers of the OSI (Open Systems Interconnection) reference model. L2 is a data link layer for transmitting / receiving data (frames) between nodes using a MAC address. L3 is a network layer for transmitting / receiving data (packets) between user terminals by routing processing using IP addresses. L4 is a transport layer for ensuring the reliability of data (segment) transfer using a protocol such as TCP or UDP.
　これらレイヤごとのヘッダには、複数のフィールドがそれぞれ設けられている。図３に示すように、例えば、Ｌ２ヘッダには、送信元ＭＡＣアドレス、送信先ＭＡＣアドレス、およびタイプと呼ばれるフィールドが設けられている。これらフィールドに格納されているビットデータをフィールド値と云う。一般には、これらフィールド値が一致するパケットの一群をフローと呼び、フローごとにトラフィック監視などのパケット処理が実行される。本発明において、これらフローのうちパケットの識別に用いるフィールドが等しいフローをまとめてグループと呼ぶ。 Multiple fields are provided in the header of each of these layers. As shown in FIG. 3, for example, the L2 header is provided with fields called source MAC address, destination MAC address, and type. The bit data stored in these fields is called a field value. Generally, a group of packets whose field values match is called a flow, and packet processing such as traffic monitoring is executed for each flow. In the present invention, among these flows, the flows having the same field used for packet identification are collectively referred to as a group.
［ハッシュ演算部］
　ハッシュ演算部１３Ｂは、ヘッダ解析部１３Ａで得られた第２のフィールド値ごとに、ハッシュ関数を用いて第２のハッシュ値を演算するように構成されている。ハッシュ関数とは、所定のアルゴリズムを用いて入力データを、想定されるデータ空間内で識別可能な、固定長の不可逆的な値、すなわちハッシュ値を演算する関数である。多くの場合、ハッシュ値は、入力データより少ないビット数からなる。 [Hash calculation unit]
The hash calculation unit 13B is configured to calculate a second hash value by using a hash function for each second field value obtained by the header analysis unit 13A. The hash function is a function that calculates an irreversible value of a fixed length, that is, a hash value, which can identify the input data in the assumed data space by using a predetermined algorithm. Hash values often consist of fewer bits than the input data.
［ルールとルール情報］
　本実施の形態にかかるパケット識別装置１０で用いるルールと、記憶部１２で記憶するルール情報１２Ａについて説明する。
　図４は、ルールの設定例を示す説明図である。図４の例では、一致条件としてレイヤ２のフィールドを用いてパケットを識別するためのルールが示されており、例えば、「ルール＃１」では、「送信元ＭＡＣアドレス」というフィールドに対して「０１－２３－４５－６７－８９－ａｂ」というフィールド値と、「タイプ」というフィールドに対して「８８９４」というフィールド値が、一致条件として設定されている。この際、「送信先ＭＡＣアドレス」には「＊」（ワイルドカード）が設定されている。この「＊」は、対応するフィールド「送信先ＭＡＣアドレス」のフィールド値は、任意のフィールド値でよい、すなわち当該フィールドは、ルールとして利用しないことを示している。 [Rules and rule information]
The rules used in the packet identification device 10 according to the present embodiment and the rule information 12A stored in the storage unit 12 will be described.
FIG. 4 is an explanatory diagram showing an example of setting a rule. In the example of FIG. 4, a rule for identifying a packet by using a layer 2 field as a match condition is shown. For example, in "rule # 1", "source MAC address" is referred to as "source MAC address". A field value of "01-23-45-67-89-ab" and a field value of "8894" for the field of "type" are set as matching conditions. At this time, "*" (wildcard) is set in the "destination MAC address". This "*" indicates that the field value of the corresponding field "destination MAC address" may be any field value, that is, the field is not used as a rule.
　図５は、ルール情報の構成例を示す説明図である。図５には、図４の各ルールに関するルール情報１２Ａが示されている。ルール情報１２Ａでは、各ルールのうち、それぞれの識別に用いるフィールドが同一であるルールが、１のグループにまとめて登録されている。図５の例では、フィールドとして「送信先ＭＡＣアドレス」と「タイプ」を用い、「送信元ＭＡＣアドレス」を用いない、「ルール＃２」と「ルール＃４」が、「グループ＃１」として登録されている。またフィールドとして「送信元ＭＡＣアドレス」と「タイプ」を用い、「送信先ＭＡＣアドレス」を用いない「ルール＃１」と「ルール＃３」が「グループ＃２」として登録されている。 FIG. 5 is an explanatory diagram showing a configuration example of rule information. FIG. 5 shows rule information 12A for each rule of FIG. In the rule information 12A, among the rules, the rules having the same field used for each identification are collectively registered in one group. In the example of FIG. 5, "rule # 2" and "rule # 4" that use "destination MAC address" and "type" as fields and do not use "source MAC address" are set as "group # 1". It is registered. Further, "rule # 1" and "rule # 3" that use "source MAC address" and "type" as fields and do not use "destination MAC address" are registered as "group # 2".
　ルール情報１２Ａにおいて、各ルールには、フィールドごとに、当該フィールドをパケット識別に利用するか利用しないかを示す特定フィールド情報が登録されている。特定フィールド情報は、ルールに登録されているフィールドの順に、利用有無を示す「１／０」のビット値が並べられた情報である。例えば、「ルール＃２」の場合、パケットの識別に、フィールドとして「送信元ＭＡＣアドレス」を利用せず、「送信先ＭＡＣアドレス」と「タイプ」を利用しているため、特定フィールド情報として「０１１」が登録されている。 In the rule information 12A, specific field information indicating whether or not the field is used for packet identification is registered for each field in each rule. The specific field information is information in which bit values of "1/0" indicating whether or not the field is used are arranged in the order of the fields registered in the rule. For example, in the case of "Rule # 2", since "source MAC address" is not used as a field but "destination MAC address" and "type" are used for packet identification, "destination MAC address" and "type" are used as specific field information. 011 "is registered.
　また、図５の例では、ルールごとに、パケット識別に利用するフィールド値のハッシュ値から求めた識別キー情報が第１の識別キー情報として登録されている。例えば、「ルール＃２」の場合、「送信先ＭＡＣアドレス」と「タイプ」のフィールド値「６６－６６－６６－６６－６６－６６」と「０８００」のハッシュ値から、例えばこれらハッシュ値の排他的論理和演算などの演算より、第１の識別キー情報「Ａ１２ｂｃｄ３４ｅｆｇ」が求められて、登録されている。受信パケットがこの「ルール＃２」のフローに該当するか否かを識別する際、この第１の識別キー情報が、受信パケットから演算した第２の識別キー情報と比較されることになる。 Further, in the example of FIG. 5, the identification key information obtained from the hash value of the field value used for packet identification is registered as the first identification key information for each rule. For example, in the case of "Rule # 2", from the hash values of the field values "66-66-66-66-66-66" and "0800" of the "destination MAC address" and "type", for example, of these hash values. The first identification key information "A12bcd34effg" is obtained and registered by an operation such as an exclusive OR operation. When identifying whether or not the received packet corresponds to the flow of this "rule # 2", the first identification key information is compared with the second identification key information calculated from the received packet.
　なお、第１の識別キー情報については、予めルール演算部１３Ｅにより演算してルール情報１２Ａに登録しておいてもよく、受信パケットを識別するごとにルール情報１２Ａからルール演算部１３Ｅが演算してもよい。
　また、図５では、グループごとに特定フィールド情報を登録した場合を例として説明したが、これに限定されるものではない。例えば、ルールごとに特定フィールド情報を登録してもよい。 The first identification key information may be calculated in advance by the rule calculation unit 13E and registered in the rule information 12A, and each time a received packet is identified, the rule calculation unit 13E calculates from the rule information 12A. You may.
Further, in FIG. 5, the case where the specific field information is registered for each group has been described as an example, but the present invention is not limited to this. For example, specific field information may be registered for each rule.
［フィールド選択部］
　フィールド選択部１３Ｃは、記憶部１２で記憶しているルール情報１２Ａに含まれる特定フィールド情報に基づいて、ハッシュ演算部１３Ｂで得られた第２のハッシュ値のうちから、パケット識別に用いるフィールドのハッシュ値だけを選択するように構成されている。
　例えば、前述したように、「ルール＃２」のルール情報１２Ａにおいて特定フィールド情報として「０１１」が登録されていた場合、ハッシュ演算部１３Ｂで得られた第２のハッシュ値のうちから、ビット値「１」に相当するフィールド「送信元ＭＡＣアドレス」と「タイプ」のハッシュ値のみが選択される。また、ビット値「０」に相当するフィールドのハッシュ値としては、パケット識別キーの演算を左右しない値「０」や「ｎｕｌｌ」が出力される。 [Field selection section]
The field selection unit 13C is a field used for packet identification from among the second hash values obtained by the hash calculation unit 13B based on the specific field information included in the rule information 12A stored in the storage unit 12. It is configured to select only the hash value.
For example, as described above, when "011" is registered as the specific field information in the rule information 12A of "Rule # 2", the bit value is selected from the second hash value obtained by the hash calculation unit 13B. Only the hash values of the fields "source MAC address" and "type" corresponding to "1" are selected. Further, as the hash value of the field corresponding to the bit value "0", the values "0" and "null" that do not affect the operation of the packet identification key are output.
［識別キー演算部］
　識別キー演算部１３Ｄは、フィールド選択部１３Ｃで選択されたフィールドの第２のハッシュ値から、例えばこれら第２のハッシュ値の排他的論理和演算などの演算より、第２の識別キー情報を演算するように構成されている。この演算手法は、ルール演算部１３Ｅでの演算手法と等しい手法が用いられる。この際、特定フィールド情報がグループごとに登録されている場合、第２の識別キー情報は、同一グループに属するすべてのルールで共用することができ、第２の識別キー情報の演算処理に要する処理負担を大幅に軽減できる。 [Identification key calculation unit]
The identification key calculation unit 13D calculates the second identification key information from the second hash value of the field selected by the field selection unit 13C, for example, by performing an exclusive OR operation of these second hash values. It is configured to do. As this calculation method, a method equivalent to the calculation method in the rule calculation unit 13E is used. At this time, when the specific field information is registered for each group, the second identification key information can be shared by all the rules belonging to the same group, and the processing required for the calculation processing of the second identification key information. The burden can be greatly reduced.
［ルール演算部］
　ルール演算部１３Ｅは、記憶部１２で記憶しているルール情報１２Ａに基づいて、パケット識別に用いるルールごとに、特定フィールドに関する第１のフィールド値ごとに第１のハッシュ値を演算し、これら第１のハッシュ値から第１の識別キー情報を演算するように構成されている。この演算手法は、識別キー演算部１３Ｄでの演算手法と等しい手法が用いられる。なお、各ルールの第１の識別キー情報については、受信パケットを識別するごとにルール情報１２Ａからルール演算部１３Ｅが演算してもよいが、前述の図５に示したように、予めルール演算部１３Ｅにより演算してルール情報１２Ａに登録しておいてもよい。これにより、第１の識別キー情報の演算に要する処理負担を軽減することができる。 [Rule calculation unit]
The rule calculation unit 13E calculates a first hash value for each first field value related to a specific field for each rule used for packet identification based on the rule information 12A stored in the storage unit 12, and these first hash values are calculated. It is configured to calculate the first identification key information from the hash value of 1. As this calculation method, a method equivalent to the calculation method in the identification key calculation unit 13D is used. Regarding the first identification key information of each rule, the rule calculation unit 13E may calculate from the rule information 12A every time the received packet is identified, but as shown in FIG. 5 above, the rule calculation is performed in advance. It may be calculated by the unit 13E and registered in the rule information 12A. This makes it possible to reduce the processing load required for the calculation of the first identification key information.
［比較判定部］
　比較判定部１３Ｆは、識別キー演算部１３Ｄで得られた第２の識別キー情報と、ルール演算部１３Ｅで得られた第１の識別キー情報とを比較し、その比較結果に基づいてパケット識別結果を出力するように構成されている。例えば、受信パケットから得られた第２の識別キー情報が、いずれかのルールの第１の識別キー情報と一致した場合、当該ルールやこれに対応するフローを示す識別情報が、当該受信パケットの識別結果として出力されることになる。この際、特定フィールド情報がグループごとに登録されている場合、第２の識別キー情報は、同一グループに属するすべてのルールで共用することができ、第２の識別キー情報との比較処理に要する処理負担を大幅に軽減できる。 [Comparison judgment unit]
The comparison determination unit 13F compares the second identification key information obtained by the identification key calculation unit 13D with the first identification key information obtained by the rule calculation unit 13E, and packet identification is based on the comparison result. It is configured to output the result. For example, when the second identification key information obtained from the received packet matches the first identification key information of any rule, the identification information indicating the rule and the corresponding flow is the identification information of the received packet. It will be output as an identification result. At this time, when the specific field information is registered for each group, the second identification key information can be shared by all the rules belonging to the same group, and is required for the comparison process with the second identification key information. The processing load can be significantly reduced.
［本実施の形態の動作］
　次に、図６を参照して、本実施の形態にかかるパケット識別装置１０のパケット識別方法の動作について説明する。図６は、パケット識別処理を示すフローチャートである。
　パケット識別装置１０の制御部１３は、パケット受信部１１から受信パケットが入力されるごとに、図６のパケット識別処理を実行する。なお、記憶部１２には、図５に示したようなルール情報１２Ａが予め登録されているものとし、予め指定されているグループに属するルールについてパケット識別処理を実行するものとする。 [Operation of this embodiment]
Next, with reference to FIG. 6, the operation of the packet identification method of the packet identification device 10 according to the present embodiment will be described. FIG. 6 is a flowchart showing the packet identification process.
The control unit 13 of the packet identification device 10 executes the packet identification process of FIG. 6 each time a received packet is input from the packet reception unit 11. It is assumed that the rule information 12A as shown in FIG. 5 is registered in advance in the storage unit 12, and the packet identification process is executed for the rules belonging to the group designated in advance.
　まず、ヘッダ解析部１３Ａは、パケット受信部１１から入力された受信パケットのヘッダを解析して、ヘッダに含まれる各フィールドに関する第２のフィールド値を抽出する（ステップＳ１００）。
　続いて、ハッシュ演算部１３Ｂは、ヘッダ解析部１３Ａで抽出された第２のフィールド値ごとに第２のハッシュ値を演算する（ステップＳ１０１）。 First, the header analysis unit 13A analyzes the header of the received packet input from the packet reception unit 11 and extracts the second field value for each field included in the header (step S100).
Subsequently, the hash calculation unit 13B calculates a second hash value for each second field value extracted by the header analysis unit 13A (step S101).
　次に、フィールド選択部１３Ｃは、記憶部１２のルール情報１２Ａから、指定されたグループの特定フィールド情報を取得して（ステップＳ１０２）、受信パケットに関する第２のフィールドのうちから未処理のフィールドを対象フィールドとして１つ選択する（ステップＳ１０３）。
　この後、フィールド選択部１３Ｃは、特定フィールド情報を参照して、対象フィールドが特定フィールドに相当するか否か確認する（ステップＳ１０４）。 Next, the field selection unit 13C acquires the specific field information of the designated group from the rule information 12A of the storage unit 12 (step S102), and selects the unprocessed field from the second field related to the received packet. Select one as the target field (step S103).
After that, the field selection unit 13C refers to the specific field information and confirms whether or not the target field corresponds to the specific field (step S104).
　ここで、対象フィールドが特定フィールドに相当する場合（ステップＳ１０４：ＹＥＳ）、フィールド選択部１３Ｃは、ハッシュ演算部１３Ｂから出力された第２のハッシュ値のうち、対象フィールドに対応する第２のハッシュ値を選択して、識別キー演算部１３Ｄへ出力し（ステップＳ１０５）、後述するステップＳ１０７へ移行する。
　一方、対象フィールドが特定フィールドに相当しない場合（ステップＳ１０４：ＮＯ）、フィールド選択部１３Ｃは、対象フィールドに対応する第２のハッシュ値として、「０」（ゼロ）または「ｎｕｌｌ」を識別キー演算部１３Ｄへ出力し（ステップＳ１０６）、後述するステップＳ１０７へ移行する。 Here, when the target field corresponds to the specific field (step S104: YES), the field selection unit 13C has the second hash corresponding to the target field among the second hash values output from the hash calculation unit 13B. A value is selected, output to the identification key calculation unit 13D (step S105), and the process proceeds to step S107 described later.
On the other hand, when the target field does not correspond to the specific field (step S104: NO), the field selection unit 13C identifies "0" (zero) or "null" as the second hash value corresponding to the target field. It is output to the unit 13D (step S106), and the process proceeds to step S107 described later.
　その後、フィールド選択部１３Ｃは、受信パケットに関する第２のフィールドのうち未処理のフィールドが残っているか確認し（ステップＳ１０７）、未処理のフィールドが残っている場合（ステップＳ１０７：ＹＥＳ）、ステップＳ１０３へ戻る。
　一方、未処理のフィールドが残っていない場合（ステップＳ１０７：ＮＯ）、識別キー演算部１３Ｄは、フィールド選択部１３Ｃで選択された第２のハッシュ値から、第２の識別キー情報を演算して、比較判定部１３Ｆへ出力する（ステップＳ１０８）。 After that, the field selection unit 13C confirms whether an unprocessed field remains among the second fields related to the received packet (step S107), and if an unprocessed field remains (step S107: YES), step S103. Return to.
On the other hand, when no unprocessed field remains (step S107: NO), the identification key calculation unit 13D calculates the second identification key information from the second hash value selected by the field selection unit 13C. , Is output to the comparison determination unit 13F (step S108).
　また、ルール演算部１３Ｅは、指定されたグループに属するルールごとに、第１の識別キー情報を演算する（ステップＳ１０８）。この際、ルール情報１２Ａに第１の識別キー情報が登録されている場合、ルール演算部１３Ｅは、ルール情報１２Ａから取得した第１の識別キー情報を比較判定部１３Ｆへ出力してもよい。 Further, the rule calculation unit 13E calculates the first identification key information for each rule belonging to the designated group (step S108). At this time, when the first identification key information is registered in the rule information 12A, the rule calculation unit 13E may output the first identification key information acquired from the rule information 12A to the comparison determination unit 13F.
　この後、比較判定部１３Ｆは、識別キー演算部１３Ｄで得られた第２の識別キー情報を、ルール演算部１３Ｅから出力された第１の識別キー情報のそれぞれと比較し（ステップＳ１０９）、得られた比較結果に基づいて、受信パケットがルール情報１２Ａに登録されている指定グループの各ルールと一致するか否かを示す識別結果を出力し（ステップＳ１１０）、一連のパケット識別処理を終了する。 After that, the comparison determination unit 13F compares the second identification key information obtained by the identification key calculation unit 13D with each of the first identification key information output from the rule calculation unit 13E (step S109). Based on the obtained comparison result, an identification result indicating whether or not the received packet matches each rule of the designated group registered in the rule information 12A is output (step S110), and a series of packet identification processes are completed. do.
［本実施の形態の動作例］
　次に、図７を参照して、本実施の形態にかかるパケット識別装置１０の動作例について説明する。図７は、パケット識別装置の動作例を示す説明図である。
　ヘッダ解析部１３Ａで受信パケットから抽出された第２のフィールド値は、ハッシュ演算部１３Ｂに出力されて、第２のハッシュ値が演算される。図７の例では、「送信元ＭＡＣアドレス」、「送信先ＭＡＣアドレス」、「タイプ」からなる第２のフィールド値に関する第２のハッシュ値として、「９ａｒ３ｇｊ６５ｈ４８」、「２ｓｄｊ３６ｔｍ６４７」、「ｎｅｉ４６８ｉｅ４５Ｉ」がそれぞれ演算されている。 [Operation example of this embodiment]
Next, an operation example of the packet identification device 10 according to the present embodiment will be described with reference to FIG. 7. FIG. 7 is an explanatory diagram showing an operation example of the packet identification device.
The second field value extracted from the received packet by the header analysis unit 13A is output to the hash calculation unit 13B, and the second hash value is calculated. In the example of FIG. 7, "9ar3gj65h48", "2sdj36tm647", and "nei468ie45I" are used as the second hash value for the second field value consisting of "source MAC address", "destination MAC address", and "type". Each is calculated.
　これら第２のハッシュ値は、フィールド選択部１３Ｃに出力されて、ルール情報１２Ａから取得した特定フィールド情報、この例では図５の「グループ＃１」に関する特定フィールド情報に基づいて選択される。ここで、特定フィールド情報のビット順が、パケット先頭から順で第２のフィールド値と対応している場合、特定フィールド情報「０１１」のうち、先頭ビットの「０」が「送信元ＭＡＣアドレス」に対応することになる。この際「０」は、特定フィールドではないことを示しているため、「送信元ＭＡＣアドレス」に関する第２のハッシュ値「９ａｒ３ｇｊ６５ｈ４８」は選択されず、「０」（ゼロ）が識別キー演算部１３Ｄに出力されている。 These second hash values are output to the field selection unit 13C and are selected based on the specific field information acquired from the rule information 12A, in this example, the specific field information related to "group # 1" in FIG. Here, when the bit order of the specific field information corresponds to the second field value in order from the beginning of the packet, "0" of the first bit in the specific field information "011" is the "source MAC address". Will correspond to. At this time, since "0" indicates that the field is not a specific field, the second hash value "9ar3gj65h48" regarding the "source MAC address" is not selected, and "0" (zero) is the identification key calculation unit 13D. It is output to.
　一方、残りのビットは「１」を示しており、対応する第２のフィールド値「送信先ＭＡＣアドレス」および「タイプ」が特定フィールドであることを示している。このため、これらに関する第２のハッシュ値「２ｓｄｊ３６ｔｍ６４７」と「ｎｅｉ４６８ｉｅ４５Ｉ」が選択されて、識別キー演算部１３Ｄに出力されている。
　識別キー演算部１３Ｄは、これら「０」（ゼロ）、「２ｓｄｊ３６ｔｍ６４７」および「ｎｅｉ４６８ｉｅ４５Ｉ」に基づいて、「グループ＃１」の各ルールに共通する第２の識別キー情報が演算される。 On the other hand, the remaining bits indicate "1", indicating that the corresponding second field values "destination MAC address" and "type" are specific fields. Therefore, the second hash values "2sdj36tm647" and "nei468ie45I" related to these are selected and output to the identification key calculation unit 13D.
The identification key calculation unit 13D calculates the second identification key information common to each rule of the "group # 1" based on these "0" (zero), "2sdj36tm647" and "nei468ie45I".
［本実施の形態の効果］
　このように、本実施の形態は、制御部１３により、受信パケットのヘッダから抽出した第２のフィールド値に関する第２のハッシュ値を演算し、ルール情報１２Ａに登録されている任意のルールに基づいて、当該ルールの特定フィールドと対応するフィールドの第２のハッシュ値から、受信パケットに固有の第２の識別キー情報を演算し、ルール情報１２Ａに登録されている第１のフィールド値から演算した、当該ルールに固有の第１の識別キー情報を第２の識別キー情報と比較し、得られた比較結果に応じて識別結果を出力するようにしたものである。 [Effect of this embodiment]
As described above, in the present embodiment, the control unit 13 calculates the second hash value for the second field value extracted from the header of the received packet, and is based on an arbitrary rule registered in the rule information 12A. Then, the second identification key information peculiar to the received packet was calculated from the second hash value of the field corresponding to the specific field of the rule, and the first field value registered in the rule information 12A was calculated. The first identification key information peculiar to the rule is compared with the second identification key information, and the identification result is output according to the obtained comparison result.
　具体的には、ルール情報１２Ａで、ルールごとに、ヘッダに含まれる各フィールドが特定フィールドであるか否かを示す特定フィールド情報を記憶し、制御部１３において、ヘッダ解析部１３Ａが、受信パケットのヘッダを解析して、ヘッダに含まれる各フィールドに関する第２のフィールド値を抽出し、ハッシュ演算部１３Ｂが、第２のフィールド値ごとに第２のハッシュ値を演算し、フィールド選択部１３Ｃが、任意のルールの特定フィールド情報に基づいて、第２のハッシュ値のうちから、特定フィールドと対応するフィールドの第２のハッシュ値を選択し、識別キー演算部１３Ｄが、選択された第２のハッシュ値から第２の識別キー情報を演算し、ルール演算部１３Ｅが、任意のルールの特定フィールドに関する第１のフィールド値ごとに第１のハッシュ値を演算して、これら第１のハッシュ値から第１の識別キー情報を演算し、比較判定部１３Ｆが、第１の識別キー情報と第２の識別キー情報とを比較して得られた比較結果に基づいて、識別結果を出力するようにしたものである。 Specifically, the rule information 12A stores specific field information indicating whether or not each field included in the header is a specific field for each rule, and in the control unit 13, the header analysis unit 13A stores the received packet. The header of is analyzed, the second field value for each field included in the header is extracted, the hash calculation unit 13B calculates the second hash value for each second field value, and the field selection unit 13C calculates the second hash value. , The second hash value of the field corresponding to the specific field is selected from the second hash values based on the specific field information of any rule, and the identification key calculation unit 13D selects the second hash value. The second identification key information is calculated from the hash value, and the rule calculation unit 13E calculates the first hash value for each first field value related to the specific field of any rule, and from these first hash values. The first identification key information is calculated, and the comparison determination unit 13F outputs the identification result based on the comparison result obtained by comparing the first identification key information and the second identification key information. It was done.
　これにより、複数のフィールドを用いてパケットを識別する場合であっても、ルールで利用するフィールド値に関するハッシュ値が、ルールに固有の１つの第１の識別キー情報に集約されて、パケットから得られた第２識別キー情報と比較されることになる。このため、フィールドごとにハッシュ値を比較する場合と比較して、比較回数を大幅に削減でき、比較処理に要する処理時間を大幅に短縮することが可能となる。また、第１および第２の識別キー情報は、特定フィールドと対応するハッシュ値から演算されるため、ルールで必要となる特定フィールドの組合せに対応した識別キー情報である。このため、不要なフィールド組合せを考慮することなくパケットを識別でき、比較に要するメモリ容量を大幅に削減することができる。したがって、本実施の形態によれば、比較的少ないルール記憶容量で、比較処理を高速化することが可能となる。 As a result, even when the packet is identified using a plurality of fields, the hash value related to the field value used in the rule is aggregated into one first identification key information unique to the rule and obtained from the packet. It will be compared with the second identification key information obtained. Therefore, the number of comparisons can be significantly reduced and the processing time required for the comparison processing can be significantly shortened as compared with the case where the hash values are compared for each field. Further, since the first and second identification key information is calculated from the hash value corresponding to the specific field, it is the identification key information corresponding to the combination of the specific fields required in the rule. Therefore, packets can be identified without considering unnecessary field combinations, and the memory capacity required for comparison can be significantly reduced. Therefore, according to the present embodiment, it is possible to speed up the comparison process with a relatively small rule storage capacity.
　また、本実施の形態において、ルール情報１２Ａで、ルールごとに、ヘッダに含まれる各フィールドが特定フィールドであるか否かを示す特定フィールド情報を記憶しておき、制御部１３で、ルール情報１２Ａに登録されている、任意のルールに関する特定フィールド情報に基づいて、受信パケットに固有の第２の識別キー情報を演算するようにしてもよい。これにより、極めて簡素な構成で、特定フィールドの組合せに対応した第２の識別キー情報を演算することが可能となる。 Further, in the present embodiment, the rule information 12A stores specific field information indicating whether or not each field included in the header is a specific field for each rule, and the control unit 13 stores the rule information 12A. The second identification key information peculiar to the received packet may be calculated based on the specific field information about any rule registered in. This makes it possible to calculate the second identification key information corresponding to the combination of specific fields with an extremely simple configuration.
　また、本実施の形態において、ルール情報１２Ａで、ルールのうち、特定フィールドが同一であるルールをグループとして記憶するとともに、これらグループごとに特定フィールド情報を記憶しておき、制御部１３で、ルール情報１２Ａに登録されている任意のグループごとに、当該グループの特定フィールド情報に基づいて第２の識別キー情報を演算し、任意のグループに属する各ルールに関する第１の識別キー情報を、任意のグループに関する第２の識別キー情報と比較するようにしてもよい。 Further, in the present embodiment, in the rule information 12A, among the rules, the rules having the same specific field are stored as a group, and the specific field information is stored for each of these groups, and the control unit 13 stores the rule. For each arbitrary group registered in the information 12A, the second identification key information is calculated based on the specific field information of the group, and the first identification key information for each rule belonging to the arbitrary group can be arbitrarily obtained. It may be compared with the second identification key information about the group.
　具体的には、ルール情報１２Ａで、ルールのうち、特定フィールドが同一であるルールをグループとして記憶するとともに、これらグループごとに特定フィールド情報を記憶し、フィールド選択部１３Ｃが、ルール情報１２Ａに登録されている任意のグループの特定フィールド情報に基づいて、ハッシュ演算部１３Ｂで得られた第２のハッシュ値のうちから、特定フィールドと対応するフィールドの第２のハッシュ値を選択し、識別キー演算部１３Ｄが、フィールド選択部１３Ｃで選択された第２のハッシュ値から、任意のグループに関する第２の識別キー情報を演算し、比較判定部１３Ｆが、任意のグループに属する各ルールに関する第１の識別キー情報を、任意のグループに関する第２の識別キー情報と比較するようにしてもよい。 Specifically, in the rule information 12A, among the rules, the rules having the same specific field are stored as a group, and the specific field information is stored for each of these groups, and the field selection unit 13C registers the rules in the rule information 12A. The second hash value of the field corresponding to the specific field is selected from the second hash values obtained by the hash calculation unit 13B based on the specific field information of any group, and the identification key calculation is performed. The unit 13D calculates the second identification key information for an arbitrary group from the second hash value selected by the field selection unit 13C, and the comparison determination unit 13F is the first for each rule belonging to the arbitrary group. The identification key information may be compared with the second identification key information for any group.
　これにより、グループに属するルールで共用できる第２の識別キー情報を演算でき、第２の識別キー情報の演算処理回数を削減でき、演算処理に要する処理時間を大幅に短縮することが可能となる。 As a result, the second identification key information that can be shared by the rules belonging to the group can be calculated, the number of calculation processing of the second identification key information can be reduced, and the processing time required for the calculation processing can be significantly shortened. ..
　また、本実施の形態において、ルール情報１２Ａで、ルールごとに、ルール演算部１３Ｅで予め演算された第１の識別キー情報を記憶し、比較判定部１３Ｆが、ルール情報１２Ａに含まれる任意のルールに関する第１の識別キー情報と第２の識別キー情報とを比較するようにしてもよい。
　これにより、第１の識別キー情報の演算処理回数を削減でき、演算処理に要する処理時間を大幅に短縮することが可能となる。 Further, in the present embodiment, the rule information 12A stores the first identification key information calculated in advance by the rule calculation unit 13E for each rule, and the comparison determination unit 13F is included in the rule information 12A. The first identification key information and the second identification key information regarding the rule may be compared.
As a result, the number of arithmetic processing of the first identification key information can be reduced, and the processing time required for the arithmetic processing can be significantly shortened.
［実施の形態の拡張］
　以上、実施形態を参照して本発明を説明したが、本発明は上記実施形態に限定されるものではない。本発明の構成や詳細には、本発明のスコープ内で当業者が理解しうる様々な変更をすることができる。 [Extension of embodiment]
Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the structure and details of the present invention within the scope of the present invention.
　１０…パケット識別装置、１１…パケット受信部、１２…記憶部、１２Ａ…ルール情報、１２Ｐ…プログラム、１３…制御部、１３Ａ…ヘッダ解析部、１３Ｂ…ハッシュ演算部、１３Ｃ…フィールド選択部、１３Ｄ…識別キー演算部、１３Ｅ…ルール演算部、１３Ｆ…比較判定部、２０…パケット処理装置、５０…ネットワーク機器、５１…網Ｉ／Ｆ、５２…操作入力部、５３…画面表示部、５４…記憶部、５５…制御装置、ＮＷ…通信網。 10 ... Packet identification device, 11 ... Packet receiving unit, 12 ... Storage unit, 12A ... Rule information, 12P ... Program, 13 ... Control unit, 13A ... Header analysis unit, 13B ... Hash calculation unit, 13C ... Field selection unit, 13D ... Identification key calculation unit, 13E ... Rule calculation unit, 13F ... Comparison judgment unit, 20 ... Packet processing device, 50 ... Network equipment, 51 ... Network I / F, 52 ... Operation input unit, 53 ... Screen display unit, 54 ... Storage unit, 55 ... Control device, NW ... Communication network.

Claims (8)

  1. 　パケットを識別するためのルールごとに、当該ルールの一致条件として前記パケットのヘッダに含まれる特定フィールドに関する第１のフィールド値が登録されているルール情報を記憶する記憶部と、
    　受信した受信パケットのヘッダに含まれる各フィールドに関する第２のフィールド値に基づいて、当該受信パケットが、前記ルール情報に登録されているルールと一致するか否かを識別し、得られた識別結果を出力する制御部とを備え、
    　前記制御部は、前記受信パケットのヘッダから抽出した第２のフィールド値に関する第２のハッシュ値を演算し、前記ルール情報に登録されている任意のルールに基づいて、当該ルールの特定フィールドと対応するフィールドの前記第２のハッシュ値から、前記受信パケットに固有の第２の識別キー情報を演算し、前記ルール情報に登録されている前記第１のフィールド値から演算した、当該ルールに固有の第１の識別キー情報を前記第２の識別キー情報と比較し、得られた比較結果に応じて前記識別結果を出力する
    　ことを特徴とするパケット識別装置。     For each rule for identifying a packet, a storage unit for storing rule information in which a first field value for a specific field included in the header of the packet is registered as a matching condition of the rule.
    Based on the second field value for each field included in the header of the received received packet, it is identified whether or not the received packet matches the rule registered in the rule information, and the obtained identification result is obtained. Equipped with a control unit that outputs
    The control unit calculates a second hash value for the second field value extracted from the header of the received packet, and corresponds to a specific field of the rule based on an arbitrary rule registered in the rule information. The second identification key information unique to the received packet is calculated from the second hash value of the field to be used, and is calculated from the first field value registered in the rule information, which is unique to the rule. A packet identification device characterized in that the first identification key information is compared with the second identification key information, and the identification result is output according to the obtained comparison result.
  2. 　請求項１に記載のパケット識別装置において、
    　前記ルール情報は、前記ルールごとに、前記ヘッダに含まれる各フィールドが前記特定フィールドであるか否かを示す特定フィールド情報を記憶し、
    　前記制御部は、前記ルール情報に登録されている、前記任意のルールに関する特定フィールド情報に基づいて、前記受信パケットに固有の第２の識別キー情報を演算する
    ことを特徴とするパケット識別装置。     In the packet identification device according to claim 1,
    The rule information stores specific field information indicating whether or not each field included in the header is the specific field for each rule.
    The control unit is a packet identification device, characterized in that it calculates a second identification key information unique to the received packet based on the specific field information related to the arbitrary rule registered in the rule information.
  3. 　請求項２に記載のパケット識別装置において、
    　前記ルール情報は、前記ルールのうち、前記特定フィールドが同一であるルールをグループとして記憶するとともに、これらグループごとに前記特定フィールド情報を記憶し、
    　前記制御部は、前記ルール情報に登録されている任意のグループごとに、当該グループの特定フィールド情報に基づいて前記第２の識別キー情報を演算し、前記任意のグループに属する各ルールに関する第１の識別キー情報を、前記任意のグループに関する第２の識別キー情報と比較する
    　ことを特徴とするパケット識別装置。     In the packet identification device according to claim 2,
    The rule information stores the rules in which the specific fields are the same among the rules as a group, and stores the specific field information for each of these groups.
    The control unit calculates the second identification key information for each arbitrary group registered in the rule information based on the specific field information of the group, and the first rule regarding each rule belonging to the arbitrary group. The packet identification device, characterized in that the identification key information of the above is compared with the second identification key information regarding the arbitrary group.
  4. 　請求項１に記載のパケット識別装置において、
    　前記ルール情報は、前記ルールごとに、前記ヘッダに含まれる各フィールドが前記特定フィールドであるか否かを示す特定フィールド情報を記憶し、
    　前記制御部は、
    　前記受信パケットのヘッダを解析して、前記ヘッダに含まれる各フィールドに関する前記第２のフィールド値を抽出するように構成されたヘッダ解析部と、
    　前記ヘッダ解析部で抽出された前記第２のフィールド値ごとに前記第２のハッシュ値を演算するように構成されたハッシュ演算部と、
    　前記任意のルールの特定フィールド情報に基づいて、前記ハッシュ演算部で得られた前記第２のハッシュ値のうちから、前記特定フィールドと対応するフィールドの第２のハッシュ値を選択するように構成されたフィールド選択部と、
    　前記フィールド選択部で選択された前記第２のハッシュ値から、前記第２の識別キー情報を演算する識別キー演算部と、
    　前記任意のルールの特定フィールドに関する第１のフィールド値ごとに第１のハッシュ値を演算し、これら第１のハッシュ値から前記第１の識別キー情報を演算するルール演算部と、
    　前記第１の識別キー情報と前記第２の識別キー情報とを比較して得られた比較結果に基づいて、前記識別結果を出力するように構成された比較判定部と
    　を備えることを特徴とするパケット識別装置。     In the packet identification device according to claim 1,
    The rule information stores specific field information indicating whether or not each field included in the header is the specific field for each rule.
    The control unit
    A header analysis unit configured to analyze the header of the received packet and extract the second field value for each field included in the header.
    A hash calculation unit configured to calculate the second hash value for each of the second field values extracted by the header analysis unit, and a hash calculation unit.
    It is configured to select the second hash value of the field corresponding to the specific field from the second hash value obtained by the hash calculation unit based on the specific field information of the arbitrary rule. Field selection section and
    An identification key calculation unit that calculates the second identification key information from the second hash value selected by the field selection unit.
    A rule calculation unit that calculates a first hash value for each first field value related to a specific field of the arbitrary rule and calculates the first identification key information from these first hash values.
    It is characterized by including a comparison determination unit configured to output the identification result based on the comparison result obtained by comparing the first identification key information and the second identification key information. Packet identification device.
  5. 　請求項４に記載のパケット識別装置において、
    　前記ルール情報は、前記ルールのうち、前記特定フィールドが同一であるルールをグループとして記憶するとともに、これらグループごとに前記特定フィールド情報を記憶し、
    　前記フィールド選択部は、前記ルール情報に登録されている任意のグループの特定フィールド情報に基づいて、前記ハッシュ演算部で得られた前記第２のハッシュ値のうちから、前記特定フィールドと対応するフィールドの第２のハッシュ値を選択し、
    　前記識別キー演算部は、前記フィールド選択部で選択された前記第２のハッシュ値から、前記任意のグループに関する第２の識別キー情報を演算し、
    　前記比較判定部は、前記任意のグループに属する各ルールに関する第１の識別キー情報を、前記任意のグループに関する第２の識別キー情報と比較する
    　ことを特徴とするパケット識別装置。     In the packet identification device according to claim 4,
    The rule information stores the rules in which the specific fields are the same among the rules as a group, and stores the specific field information for each of these groups.
    The field selection unit is a field corresponding to the specific field from among the second hash values obtained by the hash calculation unit based on the specific field information of an arbitrary group registered in the rule information. Select the second hash value of
    The identification key calculation unit calculates the second identification key information regarding the arbitrary group from the second hash value selected by the field selection unit.
    The comparison determination unit is a packet identification device that compares the first identification key information for each rule belonging to the arbitrary group with the second identification key information for the arbitrary group.
  6. 　請求項４または請求項５に記載のパケット識別装置において、
    　前記ルール情報は、前記ルールごとに、前記ルール演算部で予め演算された前記第１の識別キー情報を記憶し、
    　前記比較判定部は、前記ルール情報に含まれる前記任意のルールに関する第１の識別キー情報と前記第２の識別キー情報とを比較する
    　ことを特徴とするパケット識別装置。     In the packet identification device according to claim 4 or 5.
    The rule information stores the first identification key information calculated in advance by the rule calculation unit for each rule.
    The comparison determination unit is a packet identification device for comparing the first identification key information regarding the arbitrary rule included in the rule information with the second identification key information.
  7. 　パケットを識別するためのルールごとに、当該ルールの一致条件として前記パケットのヘッダに含まれる特定フィールドに関する第１のフィールド値が登録されているルール情報を記憶する記憶部と、受信した受信パケットのヘッダに含まれる各フィールドに関する第２のフィールド値に基づいて、当該受信パケットが、前記ルール情報に登録されているルールと一致するか否かを識別し、得られた識別結果を出力する制御部とを備えるパケット識別装置で用いられるパケット識別方法であって、
    　前記制御部が、前記受信パケットのヘッダから抽出した第２のフィールド値に関する第２のハッシュ値を演算するステップと、
    　前記制御部が、前記ルール情報に登録されている任意のルールに基づいて、当該ルールの特定フィールドと対応するフィールドの前記第２のハッシュ値から、前記受信パケットに固有の第２の識別キー情報を演算するステップと、
    　前記制御部が、前記ルール情報に登録されている前記第１のフィールド値から演算した、当該ルールに固有の第１の識別キー情報を前記第２の識別キー情報と比較し、得られた比較結果に応じて前記識別結果を出力するステップと
    　を備えることを特徴とするパケット識別方法。     For each rule for identifying a packet, a storage unit for storing rule information in which a first field value for a specific field included in the header of the packet is registered as a matching condition of the rule, and a storage unit for receiving received packets. A control unit that identifies whether or not the received packet matches the rule registered in the rule information based on the second field value for each field included in the header, and outputs the obtained identification result. It is a packet identification method used in a packet identification device provided with and.
    A step in which the control unit calculates a second hash value for a second field value extracted from the header of the received packet, and
    Based on an arbitrary rule registered in the rule information, the control unit uses the second hash value of the field corresponding to the specific field of the rule to obtain the second identification key information unique to the received packet. And the steps to calculate
    The control unit compares the first identification key information peculiar to the rule calculated from the first field value registered in the rule information with the second identification key information, and the comparison obtained. A packet identification method comprising a step of outputting the identification result according to the result.
  8. 　請求項７に記載のパケット識別方法を、コンピュータに実行させるためのパケット識別プログラム。 A packet identification program for causing a computer to execute the packet identification method according to claim 7.
PCT/JP2020/019596 2020-05-18 2020-05-18 Packet identification device, packet identification method, and packet identification program WO2021234765A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/JP2020/019596 WO2021234765A1 (en) 2020-05-18 2020-05-18 Packet identification device, packet identification method, and packet identification program
JP2022523748A JP7359299B2 (en) 2020-05-18 2020-05-18 Packet identification device, packet identification method, and packet identification program

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2020/019596 WO2021234765A1 (en) 2020-05-18 2020-05-18 Packet identification device, packet identification method, and packet identification program

Publications (1)

Publication Number Publication Date
WO2021234765A1 true WO2021234765A1 (en) 2021-11-25

Family

ID=78708224

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2020/019596 WO2021234765A1 (en) 2020-05-18 2020-05-18 Packet identification device, packet identification method, and packet identification program

Country Status (2)

Country Link
JP (1) JP7359299B2 (en)
WO (1) WO2021234765A1 (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005507212A (en) * 2001-10-22 2005-03-10 サン・マイクロシステムズ・インコーポレーテッド Method and apparatus for packet classification
US20060209725A1 (en) * 2005-03-10 2006-09-21 Nec Laboratories America, Inc. Information Retrieval Architecture for Packet Classification
JP2007509535A (en) * 2003-10-20 2007-04-12 インテル・コーポレーション Method and apparatus for two-stage packet classification using optimal filter matching and transport level sharing
JP2020010190A (en) * 2018-07-09 2020-01-16 日本電信電話株式会社 Network load distribution device and method

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005507212A (en) * 2001-10-22 2005-03-10 サン・マイクロシステムズ・インコーポレーテッド Method and apparatus for packet classification
JP2007509535A (en) * 2003-10-20 2007-04-12 インテル・コーポレーション Method and apparatus for two-stage packet classification using optimal filter matching and transport level sharing
US20060209725A1 (en) * 2005-03-10 2006-09-21 Nec Laboratories America, Inc. Information Retrieval Architecture for Packet Classification
JP2020010190A (en) * 2018-07-09 2020-01-16 日本電信電話株式会社 Network load distribution device and method

Also Published As

Publication number Publication date
JPWO2021234765A1 (en) 2021-11-25
JP7359299B2 (en) 2023-10-11

Similar Documents

Publication Publication Date Title
JP4547342B2 (en) Network control apparatus, control system, and control method
JP4626811B2 (en) Port hopping detection system, port hopping detection device, port hopping detection method, and program
US8638793B1 (en) Enhanced parsing and classification in a packet processor
US20180367431A1 (en) Heavy network flow detection method and software-defined networking switch
US20210185153A1 (en) Hybrid Fixed/Programmable Header Parser for Network Devices
US11184283B2 (en) Service function chaining congestion tracking
US20170063696A1 (en) Data packet flow rule field range of an application specific integrated circuit
US11218395B2 (en) Latency monitoring for network devices
US20170302577A1 (en) Forwarding port assignment for data packet
US20180167337A1 (en) Application of network flow rule action based on packet counter
CN110741610B (en) Port expander with local switching
WO2021234765A1 (en) Packet identification device, packet identification method, and packet identification program
KR101984478B1 (en) Method and apparatus for determining data transfer path by using dynamic network traffic analysis based on software defined networking
US20230052252A1 (en) Network device that utilizes tcam configured to output multiple match indices
WO2021001879A1 (en) Traffic monitoring device, and traffic monitoring method
WO2021171526A1 (en) Addition device, addition method, and addition program
Pacífico et al. Bloomtime: space-efficient stateful tracking of time-dependent network performance metrics
WO2022049751A1 (en) Number-of-connections measuring device, method, and program
US11831524B2 (en) Network monitoring device and connection counting method
WO2015136585A1 (en) Control apparatus, control method and control program
US10484304B2 (en) Determining actions to be immediately performed on a network packet with an application specific integrated circuit
WO2022111596A1 (en) Data stream measurement method and apparatus
US20230156035A1 (en) METHOD AND APPARATUS FOR DETECTING DDoS ATTACKS
JP4112590B2 (en) Method and system for estimating different number N key
US20170264545A1 (en) Packet processing apparatus and table selection method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20936298

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022523748

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20936298

Country of ref document: EP

Kind code of ref document: A1