WO2024171404A1

WO2024171404A1 - Dynamic entry management system, dynamic entry management method, and dynamic entry management program

Info

Publication number: WO2024171404A1
Application number: PCT/JP2023/005583
Authority: WO
Inventors: 浩輝加納; 伸也河野; 琴美高橋; 克真宮本
Original assignee: 日本電信電話株式会社
Priority date: 2023-02-16
Filing date: 2023-02-16
Publication date: 2024-08-22

Abstract

In the present invention, a networking system includes a packet processing unit and a small free port management table. The packet processing unit receives a packet. The packet processing unit determines whether the received packet corresponds to an existing flow. Upon determining that the received packet does not correspond to an existing flow, the packet processing unit starts a new flow corresponding to the received packet. The packet processing unit acquires a first port number not being used by an existing session from the small free port management table, which includes a plurality of entries corresponding to some of a plurality of available port numbers. The small free port management table is arranged on a hardware accelerator. The packet processing unit allocates the first port number to the new flow.

Description

Dynamic entry management system, dynamic entry management method, and dynamic entry management program

The present disclosure relates to a dynamic entry management system, a dynamic entry management method, and a dynamic entry management program.

NFV (Network Functions Virtualization) is a method for implementing the functions of network devices as software on a virtualization foundation that consists of general-purpose servers. The NFV method makes it possible to consolidate physical devices. Therefore, NFV can reduce capital expenses. NFV is already being used in a variety of services.

In NFV, network packets are processed by the CPU (Central Processing Unit).

Against the backdrop of increasing traffic, operators (e.g., Internet service providers) are considering ways to improve the performance of general-purpose servers. One solution being considered is to offload the transfer processing in the NFV to a hardware accelerator.

However, the above prior art may make it difficult to reduce the amount of hardware accelerator resources used for dynamic entry management.

The present disclosure provides a dynamic entry management system, a dynamic entry management method, and a dynamic entry management program that can reduce the amount of hardware accelerator resources used for dynamic entry management.

In one aspect of the present disclosure, the dynamic entry management system includes a receiving unit that receives a packet, a first determination unit that determines whether the packet received by the receiving unit corresponds to an existing flow, an initiation unit that starts a new flow corresponding to the received packet in response to determining that the received packet does not correspond to an existing flow, a first acquisition unit that acquires a first port number that is not used by an existing session from a small table that includes multiple entries corresponding to some of a plurality of available port numbers, the small table being located on a hardware accelerator, and an allocation unit that assigns the first port number to the new flow.

The dynamic entry management system can reduce the amount of hardware accelerator resources used for dynamic entry management.

FIG. 1 shows a table summarizing the characteristics of the NAPT methodology implemented in a hardware manner. FIG. 2A shows one approach to NAPT implemented in a hardware manner. FIG. 2B illustrates one approach to NAPT implemented in a hardware manner. FIG. 3A shows another approach to NAPT implemented in a hardware manner. FIG. 3B shows another approach to NAPT implemented in a hardware manner. FIG. 4 is a block diagram of an example environment for session management. FIG. 5A illustrates an overview of one dynamic entry management process according to the present disclosure. FIG. 5B illustrates an overview of one dynamic entry management process according to the present disclosure. FIG. 6 is a block diagram of an example configuration of a networking system according to the present disclosure. FIG. 7A is a sequence diagram showing an example of a process for transferring packets while suppressing consumption of hardware resources. FIG. 7B is a sequence diagram showing an example of a process for transferring packets while suppressing consumption of hardware resources. FIG. 8 is a sequence diagram showing an example of a process for updating free ports by polling hardware. FIG. 9 is a sequence diagram showing an example of a process for updating free ports by pushing to software. FIG. 10 shows an example of the hardware configuration of a computer.

Several embodiments of the present disclosure are described in the accompanying drawings and in the following description. However, the present invention is not limited to these embodiments. The various features of these embodiments may be combined in various ways, provided that the features are not mutually inconsistent. Like reference numerals refer to like elements.

〔table of contents〕
The following explanation is divided into nine sections:
1. Introduction 2. Environment for Session Management 3. Overview of Dynamic Entry Management Processing 4. Configuration of Networking System 5. Details of Dynamic Entry Management Processing 6. Effects 7. Hardware Configuration 8. Summary of the Embodiment 9. Addendum

1. Introduction
A networking system manages dynamic sessions, such as Network Address and Port Translation (NAPT). The implementation of NAPT requires two tables: (1) a free port management table and (2) a session management table.

Figure 1 shows Table 10, which summarizes the characteristics of the NAPT methodology implemented in a hardware manner.

The free port management table manages free ports. The port numbers used for NAPT include port numbers that are not used in other sessions. A port identified by an unused port number is called a free port. A session refers to a logical communication path between communication devices.

The session management table manages port-based sessions using NAPT. In particular, the session management table manages the relationship between the 5-tuple of an established session and the translated port number.

The schematic diagram of table 10 shows where each table is located when NAPT processing is implemented in hardware.

In some cases, the free port management table is managed in hardware. In other cases, the free port management table is managed in software. The two cases have different issues. The session management table is managed in hardware.

2A and 2B show NAPT method 20, which is an example of one NAPT method implemented in a hardware manner. NAPT method 20 corresponds to the case where the free port management table is maintained in hardware.

In NAPT method 20, all tables required to realize NAPT are placed in hardware. The networking system must manage two tables in hardware. However, the size of these tables is equal to the number of flows that are expected to be accommodated in the networking system. Therefore, the size of these tables is large. Note that a flow is a series of packets with the same attributes.

The challenge with NAPT method 20 is that it consumes a lot of hardware resources. The advantage of NAPT method 20 is that all packets are folded back by hardware. NAPT method 20 has good performance. Packet order reversal does not occur.

FIGS. 3A and 3B show NAPT method 30, which is an example of another NAPT method implemented in a hardware manner. NAPT method 30 corresponds to the case where the free port management table is maintained in software.

In NAPT method 30, the free port management table is managed by the software. New flows are sent to the software, which performs operations such as port allocation and packet rewriting.

NAPT method 30 manages one of the tables by software. Therefore, NAPT method 30 can save hardware resources. This is an advantage of NAPT method 30.

One issue with NAPT method 30 is that the software must process all packets in the same flow that arrive before the new session information registration is complete. If many packets arrive rapidly, the software performance cannot keep up with the packet processing. For example, CPU performance becomes a bottleneck. Another issue with NAPT method 30 is that the packets start to be folded back by the hardware the moment the new session information registration is completed. This can cause the order of packets forwarded to the software just before the new session information registration is completed to be reversed.

To solve the above problems, the networking system according to the present disclosure performs one or more dynamic entry management processes described below.

2. Environment for session management
First, the environment for session management will be described with reference to FIG.

FIG. 4 is a block diagram of environment 1, which is an example of an environment for session management. As shown in FIG. 4, environment 1 includes networking system 100 and network 200. Networking system 100 is an example of a dynamic entry management system.

The networking system 100 is a system that provides network functions. The networking system 100 has a function for managing dynamic sessions such as NAPT. In particular, the networking system 100 offloads functions related to NAPT to a hardware accelerator. As described below, the networking system 100 performs processing for managing dynamic entries on the hardware accelerator. In this specification, such processing is referred to as a dynamic entry management processing. An overview of one dynamic entry management processing is provided in Section 3. Various dynamic entry management processing is then described in detail in Section 5.

Networking system 100 includes one or more computers, such as one or more servers. Networking system 100 includes a hardware accelerator. An example configuration of networking system 100 is described in Section 4.

Network 200 is a network such as a LAN (Local Area Network), a WAN (Wide Area Network), or the Internet.

3. Overview of Dynamic Entry Management Processing
An overview of one dynamic entry management process will now be described with reference to Figures 5A and 5B. Note that this overview is not intended to limit the invention or the embodiments described in the following sections.

5A and 5B collectively show overview 40, which is an overview of one dynamic entry management process according to the present disclosure.

As shown in FIG. 5A, the networking system 100 is implemented by a general-purpose server. The general-purpose server has software 41 (NFV) and a hardware accelerator 42.

Software 41 processes the packets in a software manner. The term "software manner" refers to processing performed by a general purpose processor (e.g., a CPU), whereas the term "hardware manner" refers to processing performed by a custom integrated circuit, such as a Field Programmable Gate Array (FPGA).

The networking system 100 offloads NAPT processing to the hardware accelerator 42.

Referring to FIG. 5B, the networking system 100 has two types of free port management tables. One is free port management table 43. The other is free port management table 44.

The free port management table 43 manages the usage and availability of the entire port space. The free port management table 43 is located in the software 41. The table management unit 46 of the networking system 100 manages the free port management table 43. The free port management table 43 has entries for the entire allocatable port space. Note that while a row indicates the location where data is stored, an entry (a data column in the table) indicates the data itself.

The free port management table 44 holds and manages a small number of free port numbers. For example, the number of free port numbers held is 10 percent of the expected number of flows to be accommodated. The free port management table 44 is placed in the hardware accelerator 42. The packet processing unit 47 of the networking system 100 manages the free port management table 44. The table size of the free port management table 44 can be adjusted according to the amount of hardware resources.

The session management table 45 is located in the hardware accelerator 42. The session management table 45 has the same number of entries as there are active sessions.

When a new flow arrives at the networking system 100, the packet processing unit 47 refers to the free port management table 44. The packet processing unit 47 determines the port number to be used.

The table management unit 46 keeps the free port management table 44 up to date. Initially, the packet processing unit 47 registers some port numbers listed in the free port management table 43 in the free port management table 44.

The networking system 100 can arrange tables with the minimum number of entries required according to the amount of hardware resources. This allows the networking system 100 to reduce the amount of hardware resources consumed.

Furthermore, all packets are folded back by hardware. Therefore, packet reordering does not occur in networking system 100.

4. Networking System Configuration
Next, an example of the configuration of the networking system 100 will be described with reference to FIG.

FIG. 6 is a block diagram of an example of the configuration of a networking system 100 according to the present disclosure. As shown in FIG. 6, the networking system 100 includes a communication unit 110, a control unit 120, and a storage unit 130. The networking system 100 may include an input unit (e.g., a keyboard, a mouse) that accepts input from an administrator of the networking system 100. The networking system 100 may also include an output unit (e.g., a liquid crystal display, an organic EL (Electro Luminescence) display) that displays information to the administrator.

(Communication unit 110)
The communication unit 110 is implemented by a network device such as a network interface card (NIC). The communication unit 110 is connected to the network 200 by wire or wirelessly. The communication unit 110 can transmit and receive data to and from the communication device via the network 200.

(Control unit 120)
The control unit 120 is implemented by a data processing device and various programs stored in a storage device. The data processing device is, for example, a processor such as a CPU, a micro processing unit (MPU), or a general purpose graphic processing unit (GPGPU). The control unit 120 can be implemented as a controller for controlling multiple operations of the networking system 100. For example, when one or more processors execute a program (multiple instructions) by using a random access memory (RAM) as a working area, the one or more processors perform multiple operations.

The control unit 120 can receive input data for the dynamic entry management process from an external device. The control unit 120 can store data such as the input data, data used in the dynamic entry management process, and output data of the dynamic entry management process in the memory unit 130. The control unit 120 can obtain such data from the memory unit 130 as necessary.

(Memory unit 130)
The storage unit 130 is implemented by a RAM, a semiconductor memory such as a flash memory, a magnetic disk such as a hard disk, or an optical disk. The storage unit 130 can store various programs and various data.

As shown in FIG. 6, the control unit 120 includes a table management unit 121 and a packet processing unit 122. The table management unit 121 is an example of a second determination unit, a second acquisition unit, and a registration unit. The table management unit 121 corresponds to the table management unit 46 described above with reference to FIG. 5B. The packet processing unit 122 is an example of a receiving unit, a first determination unit, a starting unit, a first acquisition unit, and an allocation unit. The packet processing unit 122 corresponds to the packet processing unit 47 described above with reference to FIG. 5B.

As shown in FIG. 6, the memory unit 130 includes a large free port management table 131, a small free port management table 132, and a session management table 133. The large free port management table 131 is an example of a large table. The small free port management table 132 is an example of a small table and a deletion unit. The large free port management table 131, the small free port management table 132, and the session management table 133 correspond to the free port management table 43, the free port management table 44, and the session management table 45, respectively, described above with reference to FIG. 5B.

5. Details of Dynamic Entry Management Processing
One dynamic entry management process is outlined above with reference to Figures 5A and 5B. Various dynamic entry management processes are described in detail in this section using sequence diagrams and flow charts.

Examples of dynamic entry management processes include the following three processes: (1) a process for forwarding packets while minimizing hardware resource consumption; (2) a process for updating free ports by polling the hardware; and (3) a process for updating free ports by pushing to the software.

FIGS. 7A and 7B are sequence diagrams showing process P100, which is an example of a process for transferring packets while minimizing hardware resource consumption.

Communication device A transfers the packet to the packet processing unit 122 (step S101).

The packet processing unit 122 extracts the header information from the packet (step S102).

The packet processing unit 122 refers to the session management table 133 (step S103).

If the flow information is registered in the session management table 133, the packet processing unit 122 obtains the session information from the session management table 133 (step S104).

If the flow information is not registered in the session management table 133, the packet processing unit 122 refers to the smallest available port management table 132 (step S105).

The packet processing unit 122 obtains the free port number from the small free port management table 132 (step S106).

The small free port management table 132 deletes the entry for the port that is in use (step S107).

The packet processing unit 122 registers the new session information in the session management table 133 (step S108).

The packet processing unit 122 rewrites the packet (step S109).

The packet processing unit 122 forwards the packet to communication device B (step S110).

As described above with reference to Figures 7A and 7B, for a new flow, the packet processing unit 122 refers to the small free port management table 132, determines the port number, and then forwards the packet. When the packet processing unit 122 determines the port number to be assigned to the new flow, the small free port management table 132 deletes the entry from its own table.

FIG. 8 is a sequence diagram showing process P200, which is an example of a process for updating available ports by polling the hardware.

The table management unit 121 obtains information from the small free port management table 132 (step S201).

The table management unit 121 determines whether the small free port management table 132 is free (step S202).

If the small free port management table 132 is free (step S202: Yes), the table management unit 121 obtains a free port from the large free port management table 131 (step S203).

The table management unit 121 registers the entry in the small free port management table 132 (step S204).

If the small free port management table 132 is not free (step S202: No), the table management unit 121 performs step S201 again.

As described above with reference to FIG. 8, the table management unit 121 running on software periodically polls the table information in the small free port management table 132. When an entry in the small free port management table 132 becomes vacant, the table management unit 121 assigns a port to the new flow (a vacancy occurs when an entry is deleted). The table management unit 121 obtains an unused port number from the large free port management table 131, and then writes the obtained port number to the small free port management table 132. The port numbers written to the small free port management table 132 are managed by checking the "Use" box in the large free port management table 131.

FIG. 9 is a sequence diagram showing process P300, which is an example of a process for updating free ports by pushing to software.

The table management unit 121 receives a request for a new entry (step S301).

The table management unit 121 obtains the free ports from the large free port management table 131 (step S302).

The table management unit 121 registers the entry in the small free port management table 132 (step S303).

As described above with reference to FIG. 9, when a vacancy occurs in one of its entries, the small free port management table 132 sends a request for a new entry to the table management unit 121. The table management unit 121 obtains an unused port number from the large free port management table 131, and then writes the obtained port number into the small free port management table 132. The port number written into the small free port management table 132 is managed by checking the "Use" box in the large free port management table 131.

Note that if there are no more free ports in the large free port management table 131, port numbers will no longer be replenished in the small free port management table 132. If the networking system 100 receives a new session when there are no available port numbers in the small free port management table 132, the packet will be dropped.

A session in which no communication has occurred for a certain period of time is deleted from the session management table 133. At that time, the table management unit 121 removes the check from the "Use" box for the corresponding port number in the large free port management table 131. The table management unit 121 manages the corresponding port number as an unused port.

6. Effects
In the networking system 100, only a small free port management table is provided on the hardware side. Therefore, the networking system 100 reduces the consumption of hardware resources. Furthermore, since all traffic is turned back by the hardware, the networking system 100 can prevent the reduction of processing performance and the occurrence of packet order reversal.

7. Hardware Configuration
10 is a diagram showing an example of a hardware configuration of a computer 1000. The systems and methods described in this specification are implemented by the computer 1000, for example.

Computer 1000 is an example of a computer that implements networking system 100 by executing a program. Computer 1000 has memory 1010 and CPU 1020. Computer 1000 also has hard disk drive interface 1030, disk drive interface 1040, serial port interface 1050, video adapter 1060, and network interface 1070. These components are connected by bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium (e.g., a magnetic disk or an optical disk) can be inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

The hard disk drive 1090 stores an OS 1091, an application program 1092, a program module 1093, and program data 1094. The program executed by the computer 1000 defines multiple operations of the networking system 100. This program may be implemented as a program module 1093 written in code executable by the computer 1000. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, the hard disk drive 1090 stores a program module 1093 for executing processing similar to the functions of the components of the networking system 100. The hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

The hard disk drive 1090 can store a dynamic entry management program for dynamic entry management processing. The hard disk drive 1090 may store a computer program product including a dynamic entry management program (a plurality of instructions). When executed, the dynamic entry management program performs one or more methods, such as those described above.

The setting data used in the various processes described above can be implemented as program data 1094. The setting data is stored, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 loads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary. The CPU 1020 then performs the various processes described above.

The program module 1093 and program data 1094 may be stored in a removable storage medium instead of the hard disk drive 1090. The CPU 1020 may load the program module 1093 and program data 1094 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected to the computer 1000 via a network (LAN, WAN, etc.). In this case, the CPU 1020 may load the program module 1093 and program data 1094 via the network interface 1070.

8. Summary of the embodiment
As described above, the networking system 100 includes a packet processor 122 and a small free port management table 132. In at least one embodiment, the packet processor 122 receives a packet. The packet processor 122 determines whether the received packet corresponds to an existing flow. In response to determining that the received packet does not correspond to an existing flow, the packet processor 122 starts a new flow corresponding to the received packet. The packet processor 122 obtains a first port number that is not used by an existing session from the small free port management table 132, which includes a plurality of entries corresponding to a portion of a plurality of available port numbers. The small free port management table 132 is disposed on a hardware accelerator. The packet processor 122 assigns the first port number to the new flow.

In some embodiments, in response to assigning the first port number to a new flow, the small free port management table 132 deletes the entry corresponding to the first port number from the small free port management table 132.

In some embodiments, the first port number is used for NAPT.

As described above, the networking system 100 includes a table management unit 121 and a large free port management table 131. In at least one embodiment, the table management unit 121 determines whether the small free port management table 132 is free. In response to determining that the small free port management table 132 is free, a second port number that is not being used by an existing session is obtained from the large free port management table 131, which includes multiple entries corresponding to all available multiple port numbers. The table management unit 121 registers the entry corresponding to the second port number in the small free port management table 132.

In some embodiments, the table management unit 121 obtains the second port number from the large free port management table 131 in response to deleting the entry corresponding to the obtained first port number from the small free port management table 132.

In some embodiments, the large free port management table 131 is implemented as software running on a general-purpose processor.

9. Addendum
Finally, the above description is supplemented with other embodiments. Various embodiments have been described above with reference to the drawings. These embodiments are exemplary, and the above description is not intended to limit the present disclosure to these embodiments. The features described in this specification can be realized in various ways, including modifications and improvements based on the knowledge of those skilled in the art.

(Various variations)
In this specification, some processes have been described as being performed automatically. Some of these processes may be performed manually. Some other processes have been described as being performed manually. All or part of these other processes may be performed automatically using known methods.

Various implementations of the networking system 100 are described herein or shown in the drawings. Some implementations relate to information that includes various data, data processing procedures, specific names, or parameters. Such implementations may be modified in any way unless otherwise specified. For example, the various data are not limited to the data shown in the drawings.

The components of the systems and devices are shown in the drawings. The illustrated components conceptually represent the functions of the systems and devices. The components are not necessarily physically configured as shown in the drawings. The components may be integrated or distributed, and the specific forms of the systems and devices are not limited to those shown in the drawings. All or part of the systems and devices may be functionally or physically integrated or distributed depending on various loads and usage conditions.

(Terms expressing components)
The terms module, section, -er suffix or -or suffix may be read as unit, means, circuit, etc. For example, a communication module, a control module, and a storage module may be read as a communication unit, a control unit, and a storage unit, respectively.

(Configuration of the control unit)
The configuration of the control unit 120 shown in Fig. 6 is illustrative, and the data processing described with respect to a particular unit does not necessarily have to be performed by that particular unit. For example, the table management unit 121 may perform the data processing described with respect to the packet processing unit 122. The control unit 120 may also include other units not shown in Fig. 6. The other units may perform the data processing described with respect to the control unit 120.

(Data Processing Device)
The data processing device described with respect to the control unit 120 is not limited to the specific hardware described above. The data processing device may be, for example, various computers or integrated circuits such as an ASIC (Application Specific Integrated Circuit), an FPGA, or a GPGPU (General Purpose Graphic Processing Unit).

REFERENCE SIGNS LIST 1 Environment 100 Networking system 110 Communication unit 120 Control unit 121 Table management unit 122 Packet processing unit 130 Storage unit 131 Large free port management table 132 Small free port management table 133 Session management table 200 Network

Claims

A receiving unit for receiving a packet;
a first determination unit that determines whether a packet received by the receiving unit corresponds to an existing flow;
an initiator for initiating a new flow corresponding to the received packet in response to determining that the received packet does not correspond to an existing flow;
a first acquisition unit that acquires a first port number that is not being used by an existing session from a small table that includes a plurality of entries corresponding to a portion of a plurality of available port numbers, the small table being located on a hardware accelerator;
an allocation unit that allocates the first port number to the new flow.
The dynamic entry management system according to claim 1 , further comprising a deletion unit configured to delete an entry corresponding to the first port number from the small table in response to the allocation of the first port number to the new flow.
The dynamic entry management system according to claim 1 , wherein the first port number is used for NAPT (Network Address and Port Translation).
a second determination unit that determines whether the small table is vacant;
a second acquisition unit that acquires a second port number that is not being used by an existing session from a large table that includes a plurality of entries corresponding to all of the available port numbers in response to determining that the small table is available;
The dynamic entry management system according to claim 1 , further comprising: a registration unit that registers an entry corresponding to the second port number in the small table.
The dynamic entry management system according to claim 4 , wherein the second acquisition unit acquires the second port number from the large table in response to deleting an entry corresponding to the acquired first port number from the small table.
The dynamic entry management system of claim 4, wherein the large table is implemented as software running on a general purpose processor.
1. A computer implemented method for dynamic entry management, comprising:
a receiving step of receiving a packet;
a first determination step of determining whether the packet received by the receiving step corresponds to an existing flow;
in response to determining that the received packet does not correspond to an existing flow, initiating a new flow corresponding to the received packet;
a first obtaining step of obtaining a first port number not used by an existing session from a sub-table including a plurality of entries corresponding to a portion of a plurality of possible available port numbers, the sub-table being located on a hardware accelerator;
an allocating step of allocating the first port number to the new flow.
A dynamic entry management program for causing a computer to function as a dynamic entry management system according to any one of claims 1 to 6.