SSLVPN implementation method based on DPDK and VPP

Abstract

The invention discloses an SSLVPN implementation method based on a DPDK and a VPP. The method comprises the steps that a DPDK zero-copy operation environment is constructed; the memory is pre-allocated, a memory block required when the system reaches the maximum concurrency is obtained, and a network data packet is stored in the memory block; a scheduling strategy between the CPU core and the multi-queue network card is set, the scheduling strategy is distributed according to streams, session data streams are identified according to feature information of a network data packet, and it is ensured that the same session data stream is distributed to a receiving queue, the CPU core and a working thread of the same queue network card; the independent working threads are used for processing data receiving, processing and forwarding in the independent queue network card, the independent working threads are created based on the VPP, and processing of network data packets by all the working threads is completed in a VPP user mode protocol stack. According to the invention, the performance advantages of the multi-core processor are fully exerted, and the real-time processing of the SSL connection in the high-speed network environment is satisfied by utilizing the parallel processing technology based on the DPDK zero copy technology and the VPP user mode protocol stack.

Description

technical field [0001] The present invention specifically relates to a method for realizing SSLVPN based on DPDK and VPP. Background technique [0002] With the development of network communication technology, the promotion and construction of 5G and ubiquitous Internet of Things, and the exponential growth of business usage, it is possible to meet the needs of hundreds of thousands to millions of ubiquitous Internet of Things sensing layer terminals with safe, reliable and real-time access. Access to the power information network poses new challenges to the performance of SSLVPN gateway network security products. The traditional SSLVPN implementation method has the following defects: [0003] Local failure. The processing of an SSL packet may span multiple CPU cores, cache invalidation, and NUMA unfriendly. An SSL packet may be interrupted on CPU0, the kernel mode is processed on CPU1, and the user mode is processed on CPU2. This spans multiple cores, resulting in locali...

AI Technical Summary

Problems solved by technology

In the Linux kernel protocol stack, this time-consuming even accounts for half of the entire processing flow of the data packet.

[0006] It can be seen that the traditional SSLVPN implementation method faces problems such as high packet loss rate, large delay, and high system load in a high-speed network environment, and cannot meet the real-time processing of SSL (Secure Sockets Layer) connections in a high-speed network environment.

Images