Large-scale hybrid strategy implementation method, device and equipment

Abstract

The invention discloses a method, a device and equipment for realizing a large-scale hybrid strategy. The method comprises the following steps of: receiving a message and analyzing the message to extract a field representing a data stream feature; generating intermediate state information according to an entry number, a port attribute and the field obtained through analysis, and obtaining a label through table look-up operation; fields, intermediate state information and labels of the messages are combined according to strategy rules defined by different storage blocks and compared with strategy entries in the storage blocks; and implementing a corresponding processing behavior on the message according to a comparison result. According to the method, parallel searching and processing behaviors of large-scale mixed policies can be realized, the method is suitable for more than hundreds of thousands of policy routing deployment and access control lists of various matching field combinations, and high-power-consumption and high-cost TCAM (Ternary Content Addressable Memory) storage can be avoided.

Description

Technical Field

[0001] The present invention relates to the field of networks, and in particular, to a method, apparatus, and device for implementing a large-scale hybrid policy. Background Art

[0002] The data center has an ACL (Access Control List) rule processor. To implement various hybrid policies, it is necessary to rely on the flexible mask matching ability of TCAM. However, TCAM has high power consumption and large area, and the capacity of the typical switch chip pipeline TCAM can only support less than 10,000 policies.

[0003] Using CAM and SRAM can support hundreds of thousands of exact matching policies, but cannot support parallel search for hybrid rules. Therefore, finding a method to use low-power storage to implement parallel search for hundreds of thousands of hybrid rules is of great significance for implementing the behavior defined by the policy entries for packets. Summary of the Invention

[0004] Aiming at the above problems, the purpose of the embodiments of the present invention is to provide a method, apparatus, and device for implementing a large-scale hybrid policy to improve the above problems.

[0005] The embodiments of the present invention provide a method for implementing a large-scale hybrid policy, which includes the following steps:

[0006] Receive a packet and parse it to extract the fields representing the characteristics of the data stream;

[0007] Generate intermediate state information according to the ingress number, port attributes, and the fields obtained by parsing, and obtain a label through a table lookup operation;

[0008] Combine the fields carried by the packet, the intermediate state information, and the label according to the policy rules defined by different storage blocks, and compare them with the policy entries in the storage blocks;

[0009] Perform corresponding processing actions on the packet according to the comparison result.

[0010] Preferably, the fields representing the characteristics of the data stream include five-tuple information, ingress interface, virtual local area network number, TCP Flag, and user-defined fields, where the user-defined fields are defined by specifying a starting point plus an offset value.

[0011] Preferably, the label includes an interface label, a layer 2 label, and a layer 3 label, where the interface label represents a list of ingress ports, the layer 2 label represents the source MAC address or destination MAC address of a certain layer 2 forwarding domain, and the layer 3 label represents the source IP address or destination IP address of a certain tenant network.

[0012] Preferably, the look-up table operation is implemented based on a hash algorithm or a flexible longest prefix look-up table.

[0013] Preferably, the matching policy is defined in units of storage blocks, and different storage blocks use different field combinations, that is, different policies. The same message is searched in multiple storage blocks in parallel, and when entries in multiple storage blocks are hit, the final behavior result is selected according to the priority.

[0014] Preferably, the parallel search mechanism is implemented by a hardware circuit, where each storage block is equipped with an independent comparator and a mask circuit, and the mask circuit is used to support flexible field matching.

[0015] Preferably, the corresponding processing behaviors include counting, rate limiting, discarding, forwarding, copying, and message modification of the message.

[0016] An embodiment of the present invention also provides a large-scale hybrid policy implementation device, which includes:

[0017] A field extraction unit, configured to receive a message and parse it to extract fields representing the characteristics of the data stream;

[0018] A label acquisition unit, configured to generate intermediate state information according to the entry number, port attribute, and the parsed fields, and obtain a label through a look-up table operation;

[0019] A comparison unit, configured to combine the fields, intermediate state information, and label carried by the message according to the policy rules defined by different storage blocks and compare them with the policy entries in the storage blocks;

[0020] A behavior implementation unit, configured to implement corresponding processing behaviors on the message according to the comparison result.

[0021] An embodiment of the present invention also provides a large-scale hybrid policy implementation device, which includes a memory and a processor. The memory stores a computer program, and the computer program can be executed by the processor to implement the large-scale hybrid policy implementation method as described above.

[0022] In summary, the present invention solves the problems of limited storage resources and high processing delay in the prior art through an innovative label mechanism and parallel search technology, and provides an efficient and economical solution for the implementation of large-scale hybrid policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the present invention, the drawings required for the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0024] Figure 1 It is a schematic flowchart of the method for implementing a large-scale hybrid strategy provided by the first embodiment of the present invention.

[0025] Figure 2 It is a schematic structural diagram of the device for implementing a large-scale hybrid strategy provided by the second embodiment of the present invention. Detailed implementation manners

[0026] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0027] Please refer to Figure 1 , the first embodiment of the present invention provides a method for implementing a large-scale hybrid strategy, which can be executed by a large-scale hybrid strategy implementation device (hereinafter referred to as the implementation device), and particularly, by one or more processors in the implementation device to implement the following method:

[0028] S101, receive a packet and parse it to extract fields representing the characteristics of the data stream.

[0029] In this embodiment, after receiving the packet, the packet is parsed according to the Ethernet frame and IP packet formats to extract fields representing the characteristics of the data stream. The fields include five-tuple information (source address, destination address, source port number, destination port number, protocol number), ingress interface, virtual local area network number (VLAN), TCP Flag, and user-defined fields. The user-defined fields are defined by specifying a starting point plus an offset value. For example, starting from the fourth-layer starting point and offsetting 2 bytes backward to extract the destination port number of the UDP packet.

[0030] Furthermore, the parsing process further includes a verification operation on specific fields in the packet to ensure the integrity and accuracy of the extracted fields.

[0031] S102, generate intermediate state information according to the ingress number, port attributes, and the fields obtained by parsing, and obtain a label through a table lookup operation.

[0032] In this embodiment, intermediate state information such as a Layer 2 forwarding domain and a Layer 3 Virtual Routing and Forwarding (VRF) is generated based on the ingress number, port attributes, and parsed message fields. Further, the following labels are obtained through a table lookup operation: an interface label, a Layer 2 label, and a Layer 3 label. The interface label represents a list of ingress ports; the Layer 2 label represents a source MAC address or a destination MAC address of a certain Layer 2 forwarding domain; the Layer 3 label represents a source IP address or a destination IP address of a certain tenant network (VRF). Among them, the table lookup operation can be implemented based on a hash algorithm or a flexible longest prefix table lookup, and the present invention does not make specific limitations.

[0033] Specifically, labels are used to map long fields to short fields, thereby reducing the width of policy entries in the storage block. For example, a VRF of more than a dozen bits and a 128-bit IPv6 address are mapped to a short label. In addition, multiple IP addresses with the same service requirements can be mapped to the same label, further reducing the storage resource occupancy.

[0034] S103, Combine the fields carried in the message, the intermediate state information, and the labels according to the policy rules defined in different storage blocks, and compare them with the policy entries in the storage block.

[0035] In this embodiment, the fields carried in the message, the intermediate state information, and the labels are combined according to the policy rules defined in different storage blocks, and compared with the policy entries in the storage block. Each storage block supports different field combinations. For example, storage block 1 only matches the source IP address; storage block 2 matches the destination IP label; storage block 3 matches the ingress interface plus the five-tuple information.

[0036] Specifically, the same message can be searched in multiple storage blocks in parallel to reduce the processing delay. When entries in multiple storage blocks are hit, the final action result is selected according to the priority. If the action results conflict (such as redirecting to different ports), the entry with the higher priority prevails; for non-conflicting actions (such as counting), each entry can be executed independently.

[0037] Further, the parallel search mechanism is implemented by a hardware circuit, where each storage block is equipped with an independent comparator and a mask circuit. The mask circuit is used to support flexible field matching without relying on a high-power-consuming TCAM (Triple-Content Addressable Memory). In addition, all entries in the storage block use the same field combination to simplify the hardware design.

[0038] S104, Perform corresponding processing actions on the message according to the comparison result.

[0039] In this embodiment, the processing actions may include counting, rate limiting, discarding, redirecting, copying, message modification, and Quality of Service (QoS) guarantee.

[0040] In particular, the packet modification operation is implemented by a hardware acceleration module to ensure low-latency processing. For example, for operations that require modifying packet header fields, dedicated registers are used to directly overwrite the original fields without reconstructing the entire packet.

[0041] Compared with the prior art, the present embodiment has at least the following beneficial effects:

[0042] 1. By introducing a tag mechanism and parallel search technology, the occupation of storage resources is significantly reduced, avoiding the problems of high power consumption and high cost of traditional TCAMs. Specifically, the tag mechanism maps long fields to short fields and supports many-to-one mapping, greatly reducing the number of policy entries in the storage block.

[0043] 2. The flexibility and scalability of the present invention are demonstrated, supporting policy rules with various field combinations and allowing dynamic adjustment of the matching logic according to actual needs. For example, in network security devices, complex access control list (ACL) functions can be achieved by dynamically updating the policy entries in the storage block.

[0044] 3. The present invention is applicable to various scenarios, including but not limited to data center switching chips, network security devices, policy routing deployments, and other network devices or systems that require efficient policy matching. In data center switching chips, the present invention can quickly process large-scale hybrid policies to meet the requirements of high-performance networks; in network security devices, the present invention can implement complex access control list functions to ensure network security.

[0045] In summary, the present invention solves the problems of limited storage resources and high processing latency in the prior art through an innovative tag mechanism and parallel search technology, providing an efficient and economical solution for the implementation of large-scale hybrid policies.

[0046] Please refer to Figure 2 , the second embodiment of the present invention also provides a large-scale hybrid policy implementation device, which includes:

[0047] A field extraction unit 210, configured to receive a packet and parse it to extract fields representing the characteristics of the data stream;

[0048] A tag acquisition unit 220, configured to generate intermediate state information according to the ingress number, port attribute, and the parsed fields and obtain tags through a table lookup operation;

[0049] A comparison unit 230, configured to combine the fields, intermediate state information, and tags carried by the packet according to the policy rules defined in different storage blocks and compare them with the policy entries in the storage block;

[0050] The behavior execution unit 240 is configured to perform corresponding processing behaviors on the message according to the comparison result.

[0051] The third embodiment of the present invention further provides a large-scale hybrid strategy implementation device, which includes a memory and a processor. A computer program is stored in the memory and can be executed by the processor to implement the large-scale hybrid strategy implementation method as described above.

[0052] In several embodiments provided by the embodiments of the present invention, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device and method embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of devices, methods, and computer program products according to multiple embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0053] In addition, the functional modules in each embodiment of the present invention may be integrated together to form an independent part, or each module may exist alone, or two or more modules may be integrated to form an independent part.

[0054] When the above-mentioned functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, an electronic device, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs. It should be noted that in this article, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such a process, method, article, or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of another identical element in the process, method, article, or device including the said element.

[0055] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the", and "said" used in the embodiments of the present invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0056] It should be understood that the term "and / or" used herein is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this article generally represents an "or" relationship between the associated objects before and after.

[0057] Depending on the context, the word "if" as used herein can be interpreted as "when", "while", "in response to determining", or "in response to detecting". Similarly, depending on the context, the phrase "if determined" or "if detecting (stated condition or event)" can be interpreted as "when determined", "in response to determining", "when detecting (stated condition or event)", or "in response to detecting (stated condition or event)".

[0058] The "first / second" mentioned in the embodiments is only used to distinguish similar objects and does not represent a specific order for the objects. It can be understood that the "first / second" can be interchanged in a specific order or sequence when permitted. It should be understood that the objects distinguished by the "first / second" can be interchanged under appropriate circumstances so that the embodiments described herein can be implemented in an order other than those illustrated or described herein.

[0059] The foregoing is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A large-scale hybrid strategy implementation method, characterized in that: The following steps are involved: Receive the message and parse it to extract the fields representing the characteristics of the data stream; Generate intermediate state information according to the entry number, port attributes and the fields obtained by parsing and obtain the label through table lookup operation; Combine the message's fields, intermediate state information, and labels according to the policy rules defined in different storage blocks and compare them with the policy entries in the storage blocks; The message is processed accordingly according to the comparison result.

2. The large-scale hybrid strategy implementation method according to claim 1, characterized in that: The fields representing the characteristics of the data stream include five-tuple information, ingress interface, virtual local area network number, TCP Flag and user-defined fields, wherein the user-defined fields are defined by specifying a starting point plus an offset value.

3. The large-scale hybrid strategy implementation method according to claim 1, characterized in that: The label includes an interface label, a layer 2 label and a layer 3 label, wherein the interface label represents a list of inbound ports, the layer 2 label represents a source MAC address or a destination MAC address of a layer 2 forwarding domain, and the layer 3 label represents a source IP address or a destination IP address of a tenant network.

4. The large-scale hybrid strategy implementation method according to claim 1, characterized in that: The table lookup operation is implemented based on a hash algorithm or a flexible longest prefix table lookup.

5. The large-scale hybrid strategy implementation as claimed in claim 1, characterized in that: The matching strategy is defined in units of storage blocks. Different storage blocks use different field combinations, that is, different strategies. The same message is searched in parallel in multiple storage blocks at the same time. When the entries in multiple storage blocks are hit, the final behavior result is selected according to the priority.

6. The large-scale hybrid strategy implementation method according to claim 5, characterized in that: The parallel search mechanism is implemented through hardware circuits, where each storage block is equipped with an independent comparator and mask circuit, and the mask circuit is used to support flexible field matching.

7. The large-scale hybrid strategy implementation method as described in claim 1, wherein the corresponding processing behaviors include counting, rate limiting, discarding, forwarding, copying, and message modification.

8. A large-scale hybrid strategy implementation device, characterized in that: include: A field extraction unit, used for receiving and parsing a message to extract a field representing a feature of a data stream; A label acquisition unit, used to generate intermediate state information according to the entry number, port attributes and the fields obtained by parsing and acquire the label through a table lookup operation; A comparison unit, used to combine the fields, intermediate state information and labels of the message according to the policy rules defined in different storage blocks and compare them with the policy entries in the storage blocks; The behavior implementation unit is used to implement corresponding processing behavior on the message according to the comparison result.

9. A large-scale hybrid strategy implementation device, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement the large-scale hybrid strategy implementation method as described in any one of claims 1 to 7.

Images