A system and method based on ip message quintuple filtering strategy

Abstract

The invention provides a system and a method based on IP (Internet Protocol) message quintuple filtering strategy. The system comprises a quintuple FIFO (First-in, First-out), a DispatchFSM (Finite State Machine) arbitration module, HashFilters, a result collector module and an SRAM (Static Random Access Memory) access controller, wherein FIFO data storing quintuple is dispensed in a plurality of HashFilters through the DispatchFSM arbitration module; and the SRAM access controller reads the data from a plurality of Hash filters and conducts rule matching. The method comprises the following steps: a rule list set by a user is written into some address of QDR (Quad Data Rate) according to a certain algorithm through a PCIE (Peripheral Component Interface Express) interface at first, and when data is available in FIFO storing the quintuple, a group of data is read from the FIFO, rules stored in the QDR, which correspond to the data, are calculated according to the same algorithm through a tetrad and then extracted for comparison with the data, in case of successful matching, an action message in the rules is extracted and transmitted to a follow-up module, and a corresponding data packet is generated according to requirement of the user. By adopting the system and the method based on the filtering strategy, inner core resource can not be occupied too much, and the expenditure on system calling is reduced.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to a system and method based on IP message quintuple filtering strategy. Background technique [0002] The patent application with publication number CN101068229 is based on the Linux system platform, which realizes network content analysis and real-time monitoring. The purpose of filtering application layer information at the network layer is realized, and the network filter Netfilter framework is used to collect and filter data packets in the kernel state. It uses a lot of Linux kernel resources and increases the overhead caused by system calls. [0003] The invention adopts the FPGA to realize the strategy of filtering the source-destination IP address, source-destination port and protocol in the IP packet, which can liberate the CPU, thereby improving the performance of the host, enhancing the monitoring ability of the network, and ensuring the security of the networ...

AI Technical Summary

Problems solved by technology

It uses a lot of Linux kernel resources and increases the overhead caused by system calls

Images