IP quintuple table lookup method and device

Abstract

The present invention provides an IP five-tuple table lookup method and device, the method comprising: obtaining an IP five-tuple of a data frame, obtaining a first group of key values ​​and a second group of key values ​​according to the IP five-tuple; obtaining a first group of search key values ​​and information corresponding to the first search key values ​​in the first group of tables according to the first group of key values; obtaining a second group of search key values ​​according to the information and the second group of key values, obtaining a corresponding NAPT index according to the second group of search key values; searching the second group of tables again according to the NAPT index, and obtaining a conversion result corresponding to the second group of key values. Through the present invention, the same IP five-tuples that do not need to be converted are grouped into one group, and the ones that are in a conversion relationship with each other are grouped into one group, and the two groups are then looked up in turn, which significantly reduces the table entry resources required for IP five-tuple table lookup.

Description

Technical Field

[0001] The present invention relates to the field of IP (Internal Protocol) communication technology, and in particular to an IP quintuple table lookup method and device. Background Art

[0002] At present, home gateway devices have been widely used in broadband access networks. As the core of home network access, home gateways need to provide broadband access services for multiple terminals in the home network (including laptops, mobile phones, IoT terminals, etc.). Due to the limitation of IP address resources, especially the limitation of IPv4 (Internet Protocol version 4) address resources, the number of IP addresses allocated to home gateways is limited, so home gateways need to support NAPT (Network Address Port Translation) function. At the same time, with the increase in customer demand, the number of terminals and TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) connections that home gateways need to support at the same time continues to increase. At present, standard equipment already needs to support tens of thousands of connections. In order to support the simultaneous access of multiple terminals and multiple applications, home gateways need to support a large number of sessions, which leads to an increasing scale of corresponding IP five-tuple lookup tables, an increasing number of table entry resources required, and an increase in equipment costs. Summary of the invention

[0003] The main purpose of the present invention is to provide an IP five-tuple table lookup method and device, aiming to solve the problem in the prior art that the IP five-tuple table lookup is large in scale, requires many table entry resources, and leads to high equipment cost.

[0004] In a first aspect, the present invention provides an IP quintuple table lookup method, comprising the following steps:

[0005] Obtain an IP quintuple of a data frame, group the elements in the IP quintuple that are the same as the elements in the IP quintuple of the opposite data frame connected to the same connection as the data frame and that do not need to be converted, to obtain a first group of key values, group the elements in the IP quintuple that are in a conversion relationship with the elements in the IP quintuple of the opposite data frame connected to the same connection as the data frame and that are in a conversion relationship with each other, to obtain a second group of key values;

[0006] Obtain a first group of search key values ​​according to the first group of key values, search a first group table according to the first group of search key values, determine matching entries of the first group of search key values ​​in the first group table, and obtain information corresponding to the first search key values ​​according to the matching entries;

[0007] Obtain a second group of search key values ​​according to the information and the second group of key values, search a second group of tables according to the second group of search key values, determine matching entries of the second group of search key values ​​in the second group of tables, and obtain a NAPT index corresponding to the matching entry;

[0008] The second group of tables is searched again according to the NAPT index to obtain conversion results corresponding to the second group of key values.

[0009] Optionally, the first group of key values ​​includes:

[0010] Destination IP address, Layer 4 destination port number, and TCP / UDP protocol type indication of the uplink data frame;

[0011] The second group of key values ​​includes: a source IP address and a layer-4 source port number of an uplink data frame;

[0012] Or, the first group of key values ​​includes: a source IP address, a layer-4 source port number, and a TCP / UDP protocol type indication of a downlink data frame;

[0013] The second group of key values ​​includes: a destination IP address and a layer-4 destination port number of a downlink data frame.

[0014] Optionally, the step of obtaining a first group of search key values ​​according to the first group of key values, and searching a first group of tables according to the first group of search key values ​​includes:

[0015] When using the TCAM table entry to perform an IP five-tuple table lookup, using the first group of key values ​​as the first group of lookup key values ​​to search the first group of key value table;

[0016] Or, when a hash table entry is used to perform an IP five-tuple lookup, the first group of key values ​​is used as the first group of search key values, a hash function is called to calculate a hash index of the first group of search key values, and the hash index of the first group of search key values ​​is used to search the first group of tables.

[0017] Optionally, the step of searching a first group table according to the first group of search key values, determining a matching entry of the first group of search key values ​​in the first group of table, and obtaining information corresponding to the first search key value according to the matching entry includes:

[0018] The first group table is searched according to the first group search key value, a matching entry of the first group search key value in the first group table is determined, and a mapping index corresponding to the matching entry is used as information corresponding to the first search key value.

[0019] Optional, the maximum number of connections supported by the gateway is 2 16 right.

[0020] Optionally, the step of searching a first group table according to the first group of search key values, determining a matching entry of the first group of search key values ​​in the first group of table, and obtaining information corresponding to the first search key value according to the matching entry further includes:

[0021] The first group table is searched according to the first group search key value to determine a matching entry of the first group search key value in the first group table, and the address of the matching entry in the first group table is used as information corresponding to the first group search key value.

[0022] Optional, the maximum number of connections supported by the gateway is 2 24 right.

[0023] Optionally, after the step of determining the matching entry of the second group of search key values ​​in the second group table and obtaining the NAPT index corresponding to the matching entry, the method further includes:

[0024] The timestamp in the matching entry is updated.

[0025] Optionally, the steps of obtaining a second group of search key values ​​according to the information and the second group of key values, searching a second group of tables according to the second group of search key values, determining matching entries of the second group of search key values ​​in the second group of tables, and obtaining a NAPT index corresponding to the matching entry include:

[0026] When the TCAM table entry is used to perform an IP five-tuple table lookup, the information and the second group of key values ​​are used as the second group of lookup key values, a second group of key value table included in the second group of tables is searched according to the second group of lookup key values, a matching entry of the second group of lookup key values ​​in the second group of key value table is determined, and a second group of behavior table included in the second group of tables is searched according to the address of the matching entry in the second group of key value table to obtain a NAPT index corresponding to the matching entry;

[0027] Or, when a hash table item is used to perform an IP five-tuple lookup, the information and the second group of key values ​​are used as the second group of search key values, a hash function is called to calculate a hash index of the second group of search key values, the second group of tables is searched according to the hash index, matching entries of the second group of search key values ​​in the second group of tables are determined, and a NAPT index is obtained from the matching entries.

[0028] In a second aspect, the present invention further provides an IP five-tuple table lookup device, the IP five-tuple table lookup device comprising:

[0029] A grouping module: used for obtaining an IP quintuple of a data frame, grouping the elements in the IP quintuple that are the same as the elements in the IP quintuple of the opposite data frame connected to the same data frame and that do not need to be converted into one group, to obtain a first group of key values, and grouping the elements in the IP quintuple that are in a conversion relationship with the elements in the IP quintuple of the opposite data frame connected to the same data frame into one group, to obtain a second group of key values;

[0030] A first search module: used for obtaining a first group of search key values ​​according to the first group of key values, searching a first group table according to the first group of search key values, determining matching entries of the first group of search key values ​​in the first group table, and obtaining information corresponding to the first search key values ​​according to the matching entries;

[0031] A second search module: used for obtaining a second group of search key values ​​according to the information and the second group of key values, searching a second group of tables according to the second group of search key values, determining matching entries of the second group of search key values ​​in the second group of tables, and obtaining NAPT indexes corresponding to the matching entries;

[0032] The acquisition module is used to search the second group of tables again according to the NAPT index to obtain the conversion results corresponding to the second group of key values.

[0033] In the present invention, an IP quintuple of a data frame is obtained, and the elements in the IP quintuple that are the same as the elements contained in the IP quintuple of the opposite data frame with the same connection as the data frame and do not need to be converted are grouped together to obtain a first group of key values, and the elements in the IP quintuple that are in a conversion relationship with the elements contained in the IP quintuple of the opposite data frame with the same connection as the data frame are grouped together to obtain a second group of key values; a first group of search key values ​​is obtained according to the first group of key values, a first group of tables is searched according to the first group of search key values, matching entries of the first group of search key values ​​in the first group of tables are determined, and information corresponding to the first search key values ​​is obtained according to the matching entries; a second group of search key values ​​is obtained according to the information and the second group of key values, a second group of tables is searched according to the second group of search key values, matching entries of the second group of search key values ​​in the second group of tables are determined, and a NAPT index corresponding to the matching entry is obtained; and a second group of tables is searched again according to the NAPT index to obtain a conversion result corresponding to the second group of key values. Through the present invention, instead of directly using the IP quintuple to look up the table, the same IP quintuples that do not need to be converted are first divided into one group, and the ones that are in a conversion relationship with each other are divided into another group, and the two groups are then looked up in the table in sequence, which significantly reduces the table entry resources required for the IP quintuple lookup. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of a flow chart of an embodiment of an IP quintuple lookup method of the present invention;

[0035] Figure 2 A schematic diagram of a table lookup method of a first embodiment of the present invention when a TCAM table entry is used to perform an IP quintuple table lookup;

[0036] Figure 3 A schematic diagram of a table lookup method of a first embodiment of the present invention when a hash table entry is used to perform an IP quintuple table lookup;

[0037] Figure 4 A schematic diagram of a table lookup method of a second embodiment of the present invention when a TCAM table entry is used to perform an IP quintuple table lookup;

[0038] Figure 5 A schematic diagram of a table lookup method of a second embodiment of the present invention when a hash table entry is used to perform an IP quintuple table lookup;

[0039] Figure 6 It is a schematic diagram of the configuration of some table items of the first group of key-value tables and the first group of behavior tables in the table lookup method schematic diagram of the first embodiment when the IP five-tuple table lookup is performed using TCAM table items in the IP five-tuple table lookup method of the present invention;

[0040] Figure 7 It is a schematic diagram of the configuration of some table items of the second group of key-value tables and the second group of behavior tables in the table lookup method schematic diagram of the first embodiment when the IP five-tuple table lookup is performed using TCAM table items in the IP five-tuple table lookup method of the present invention;

[0041] Figure 8 It is a schematic diagram of the configuration of some table entries of the first group of tables in the schematic diagram of the table lookup method of the second embodiment when the IP five-tuple table lookup method of the present invention uses TCAM table entries to perform IP five-tuple table lookup;

[0042] Fig. 9 It is a schematic diagram of the configuration of some table items of the second group of key-value tables and the second group of behavior tables in the schematic diagram of the table lookup method of the second embodiment when the IP five-tuple table lookup is performed using TCAM table items in the IP five-tuple table lookup method of the present invention;

[0043] Fig.10 It is a functional module diagram of an embodiment of an IP 5-tuple table lookup device of the present invention.

[0044] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0046] In a first aspect, an embodiment of the present invention provides an IP quintuple table lookup method.

[0047] In one embodiment, referring to Figure 1 , Figure 1 FIG. 1 is a flow chart of an embodiment of an IP quintuple lookup method of the present invention. Figure 1 As shown, the IP quintuple table lookup method includes the following steps:

[0048] S10: Obtain an IP quintuple of the data frame, group the elements in the IP quintuple that are the same as the elements in the IP quintuple of the opposite data frame connected to the same data frame and do not need to be converted, to obtain a first group of key values, and group the elements in the IP quintuple that are in a conversion relationship with the elements in the IP quintuple of the opposite data frame connected to the same data frame and obtain a second group of key values;

[0049] In this embodiment, the IP quintuple includes: source IP address, destination IP address, TCP / UDP protocol type, layer-4 source port number, and layer-4 destination port number. If the acquired data frame is an uplink data frame, the opposite data frame of the same connection is a downlink data frame; if the acquired data frame is a downlink data frame, the opposite data frame of the same connection is an uplink data frame. When performing NAPT conversion, the uplink data frame and the downlink data frame are symmetrical. In the same connection, the destination IP address and layer-4 destination port number of the uplink data frame are the same as the source IP address and layer-4 source port number of the downlink data frame. In the same connection, the source IP address and layer-4 source port number of the uplink data frame and the destination IP address and layer-4 destination port number of the downlink data frame are in a conversion relationship with each other.

[0050] Furthermore, in one embodiment, the first set of key values ​​includes:

[0051] Destination IP address, Layer 4 destination port number, and TCP / UDP protocol type indication of the uplink data frame;

[0052] The second group of key values ​​includes: a source IP address and a layer-4 source port number of an uplink data frame;

[0053] Or, the first group of key values ​​includes: a source IP address, a layer-4 source port number, and a TCP / UDP protocol type indication of a downlink data frame;

[0054] The second group of key values ​​includes: a destination IP address and a layer-4 destination port number of a downlink data frame.

[0055] In this embodiment, the source IP address of the IP quintuple is recorded as sip, the layer-4 source port number is recorded as sport, the destination IP address is recorded as dip, and the layer-4 destination port number is recorded as dport. The first group of key values ​​is recorded as {ip_t1, port_t1, tcp / udp}, ip_t1 is the destination IP address of the uplink data frame or the source IP address of the downlink data frame, port_t1 is the layer-4 destination port number of the uplink data frame or the layer-4 source port number of the downlink data frame. tcp / udp is the protocol type, 0 represents the TCP protocol type, and 1 represents the UDP protocol type. The second group of key values ​​is recorded as {ip_t2, port_t2}, ip_t2 is the source IP address of the uplink data frame or the destination IP address of the downlink data frame, and port_t2 is the layer-4 source port number of the uplink data frame or the layer-4 destination port number of the downlink data frame.

[0056] Specifically, if the IP quintuple of the uplink data frame is {192.168.1.12, 10.10.10.9, 0, 1002, 2000}, where 192.168.1.12 is the source IP address, 10.10.10.9 is the destination IP address, 0 is the TCP protocol type, 1002 is the layer 4 source port number, and 2000 is the layer 4 destination port number, then the first group of key values ​​is {10.10.10.9, 2000, 0}, and the second group of key values ​​is {192.168.1.12, 1002}.

[0057] If the IP quintuple of the downlink data frame contains the elements {10.10.10.9, 10.10.20.5, 0, 2000, 3002}, where 10.10.10.9 is the source IP address, 10.10.20.5 is the destination IP address, 0 is the TCP protocol type, 2000 is the layer 4 source port number, and 3002 is the layer 4 destination port number. Then the first group of key values ​​is {10.10.10.9, 2000, 0}, and the second group of key values ​​is {10.10.20.5, 3002}. It is easy to imagine that the parameters in this embodiment are for reference only and are not limited here.

[0058] S20: Obtain a first group of search key values ​​according to the first group of key values, search a first group table according to the first group of search key values, determine matching entries of the first group of search key values ​​in the first group table, and obtain information corresponding to the first search key values ​​according to the matching entries;

[0059] In this embodiment, the first group of search key values ​​is the first group of key values. The first group of tables is searched according to the first group of search key values, a matching entry of the first group of search key values ​​in the first group of tables is determined, and a mapping index corresponding to the matching entry is used as the information corresponding to the first search key value or an address of the matching entry in the first group of tables is used as the information corresponding to the first group of search key values. When the number of connections between the terminal and TCP / UDP is N pairs, the first group of tables includes 0 to N-1 matching entries.

[0060] Further, in one embodiment, the step of obtaining a first group of search key values ​​according to the first group of key values, and searching a first group of tables according to the first group of search key values ​​includes:

[0061] When using the TCAM table entry to perform an IP five-tuple table lookup, using the first group of key values ​​as the first group of lookup key values ​​to search the first group of key value table;

[0062] Or, when a hash table entry is used to perform an IP five-tuple lookup, the first group of key values ​​is used as the first group of search key values, a hash function is called to calculate a hash index of the first group of search key values, and the hash index of the first group of search key values ​​is used to search the first group of tables.

[0063] In this embodiment, refer to Figure 6 , Figure 6 This is a schematic diagram of the configuration of some entries in the first group of key-value tables and the first group of behavior tables in the first embodiment of the table lookup method of the present invention when using TCAM table entries to perform IP five-tuple table lookup. Figure 6 As shown, if the first group of key values ​​is {10.10.10.9, 2000, 0}, then the first group of search key values ​​is {10.10.10.9, 2000, 0}. When TCAM table items are used to perform IP five-tuple table lookup, the first group of key value tables included in the first group of tables are searched according to the first group of search key values ​​being {10.10.10.9, 2000, 0}. When hash table items are used to perform IP five-tuple table lookup, the first group of tables are searched according to the hash index whose first group of search key values ​​is {10.10.10.9, 2000, 0}. Among them, TCAM is a full-word matching table that only processes key values ​​but not behaviors, so the key value part of the entry is placed in TCAM and the behavior is placed in RAM, so the TCAM table items are divided into key value tables and behavior tables. HASH can process key values ​​and behaviors separately, so it does not need to be divided into key value tables and behavior tables. It is easy to think that the parameters in this embodiment are for reference only and are not limited here.

[0064] Further, in one embodiment, the steps of searching a first group table according to the first group of search key values, determining a matching entry of the first group of search key values ​​in the first group table, and obtaining information corresponding to the first search key value according to the matching entry include:

[0065] The first group table is searched according to the first group search key value, a matching entry of the first group search key value in the first group table is determined, and a mapping index corresponding to the matching entry is used as information corresponding to the first search key value.

[0066] In this embodiment, refer to Figure 2 , Figure 2 FIG. 1 is a schematic diagram of a table lookup method of a first embodiment of the present invention when a TCAM table entry is used to perform an IP five-tuple table lookup. Figure 2 As shown, the uplink data frame searches the first group of key value tables included in the first group of tables according to the first group of search key values ​​{dip, dport, tcp / udp}, determines the matching entries of the first group of search key values ​​in the first group of key value tables, and then searches the first group of behavior tables included in the first group of tables according to the addresses of the matching entries in the first group of key value tables, obtains the mapping index field_id of the address in the first group of behavior tables, and uses the mapping index as the information corresponding to the first search key value.

[0067] Specifically, continue to refer to Figure 6 If the first group search key value is {10.10.10.9, 2000, 0}, the first group key value table included in the first group table is searched according to the first group search key value, and the matching entry of the first group search key value in the first group key value table is determined, for example, the matching entry is the second entry. The first group behavior table included in the first group table is searched according to the address of the matching entry in the first group key value table, that is, the second entry of the first group behavior table is searched. If the mapping index field_id in the second entry of the first group behavior table is 3, the mapping index field_id 3 is used as the information corresponding to the first search key value.

[0068] Further, the downlink data frame searches the first group of key value tables included in the first group of tables according to the first group of search key values ​​{sip, sport, tcp / udp}, determines the matching entry of the first group of search key values ​​in the first group of key value tables, and then searches the first group of behavior tables included in the first group of tables according to the address of the matching entry in the first group of key value tables to obtain the mapping index field_id corresponding to the first group of search key values. The mapping index is used as the information corresponding to the first search key value, wherein when the first group of search key values ​​searches the first group of key value tables included in the first group of tables, the mapping relationship between the first group of search key values ​​and the first group of key value tables included in the first group of tables is not fixed, thereby improving the flexibility of the first group of search key values ​​when searching the first group of tables.

[0069] Figure 2In the table, ip_t1 is the destination IP address of the uplink data frame or the source IP address of the downlink data frame, and port_t1 is the Layer 4 destination port number of the uplink data frame or the Layer 4 source port number of the downlink data frame. tcp / udp is the protocol type, 0 indicates the TCP protocol type, and 1 indicates the UDP protocol type. valid is a flag bit. When valid is 0, the entry content is invalid. When valid is 1, the entry content is valid. field_id is the mapping index corresponding to the first group of search key values. ip_t2 is the source IP address of the uplink data frame or the destination IP address of the downlink data frame, and port_t2 is the Layer 4 source port number of the uplink data frame or the Layer 4 destination port number of the downlink data frame. napt_idx is the NAPT index, flow_idx is the flow index, and time_stamp is the timestamp.

[0070] In another embodiment, referring to Figure 3 , Figure 3 Schematic diagram of the table lookup method of the first embodiment when the IP five-tuple table lookup method of the present invention uses a hash table entry to perform IP five-tuple table lookup. Figure 3 As shown, the uplink data frame searches the first group of tables according to the hash index of the first group of search key values ​​{dip, dport, tcp / udp}, determines the matching entries of the first group of search key values ​​in the first group of tables, obtains the mapping index field_id of the first group of search key values ​​from the matching entries, and uses the mapping index as the information corresponding to the first search key value.

[0071] Furthermore, the downlink data frame searches the first group of tables according to the hash index of the first group of search key values ​​{sip, sport, tcp / udp}, determines the matching entries of the first group of search key values ​​in the first group of tables, obtains the mapping index field_id of the first group of search key values ​​of the downlink data frame from the matching entries, and uses the mapping index as the information corresponding to the first search key value.

[0072] Figure 3 In the table, ip_t1 is the destination IP address of the uplink data frame or the source IP address of the downlink data frame, and port_t1 is the Layer 4 destination port number of the uplink data frame or the Layer 4 source port number of the downlink data frame. tcp / udp is the protocol type, 0 indicates the TCP protocol type, and 1 indicates the UDP protocol type. valid is a flag bit. When valid is 0, the entry content is valid, and when valid is 1, the entry content is invalid. field_id is the mapping index corresponding to the first group of search key values. ip_t2 is the source IP address of the uplink data frame or the destination IP address of the downlink data frame, and port_t2 is the Layer 4 source port number of the uplink data frame or the Layer 4 destination port number of the downlink data frame. napt_idx is the NAPT index, flow_idx is the flow index, and time_stamp is the timestamp.

[0073] Furthermore, in one embodiment, the maximum number of connections supported by the gateway is 2 16 right.

[0074] In this embodiment, when the number of connections between the terminal and TCP / UDP is N pairs, the key value of the traditional five-tuple is {valid, sip, sport, dip, dport, tcp / udp}, where valid is an entry validity indication, sip is the source IP address, sport is the layer-4 source port number, dip is the destination IP address, dport is the layer-4 destination port number, tcp / udp is the layer-4 protocol type, 0 indicates the TCP protocol type, and 1 indicates the UDP protocol type. Among them, the valid key value bit width is 1 bit, the sip key value bit width is 32 bits, the sport key value bit width is 16 bits, the dip key value bit width is 32 bits, the dport key value bit width is 16 bits, and the tcp / udp key value bit width is 1 bit, so the traditional five-tuple key value bit width is 98 bits, and 2N entries are required to store the related behaviors of N pairs of connections. The table entry resources required for table lookup are 98 bits×2N. In the same connection, the destination IP address and Layer 4 destination port number of the uplink data frame are the same as the source IP address and Layer 4 source port number of the downlink data frame. The first set of tables only needs N entries to store the relevant mapping of N pairs of connection numbers, and the second set of tables needs 2N entries to store the conversion behavior of N pairs of connections. Figure 2 and Figure 3As shown, the key value of the first group of tables is {valid, ip_t1, port_t1, tcp / udp, field_id}, where valid is an entry validity indication, ip_t1 is the destination IP address of the uplink data frame or the source IP address of the downlink data frame, port_t1 is the layer 4 destination port number of the uplink data frame or the layer 4 source port number of the downlink data frame, tcp / udp is the layer 4 protocol type, 0 represents the TCP protocol type, 1 represents the UDP protocol type, and field_id is the mapping behavior result of the first group of tables, which can represent any matching entry from 0 to N-1 matching entries. Among them, the valid key value bit width is 1 bit, the ip_t1 key value bit width is 32 bits, the port_t1 key value bit width is 16 bits, the tcp / udp key value bit width is 1 bit, and the field_id key value bit width is (log2 N) bits, so the key value bit width of the first group of tables is (50+log2 N) bits, and the required table entry resources are (50+log2 N) bits×N. The key value of the second group of tables is {valid, field_id, ip_t2, port_t2}, where valid is an entry validity indication, field_id is the mapping behavior result of the first group of tables, ip_t2 is the source IP address of the uplink data frame or the destination IP address of the downlink data frame, and port_t2 is the four-layer source port number of the uplink data frame or the four-layer destination port number of the downlink data frame. Among them, the valid key value bit width is 1 bit, the field_id key value bit width is (log2 N) bits, the ip_t2 key value bit width is 32 bits, and the port_t2 key value bit width is 16 bits, so the key value bit width of the second group of tables is (49+log2 N) bits, and the required table entry resources are (49+log2 N) bits×2N. By calculating the difference between the table entry resources required for the traditional five-tuple table lookup and the table entry resources required for the five-tuple table lookup of the present invention, 98bit×2N-((50+log2N)bit×N+(49+log2N)bit×2N)=(48-3log2N)bit×N, it can be seen that the maximum number of connections supported by the gateway is less than 2 16 When the difference is a positive number, the present invention can save the table entry resources required for IP quintuple table lookup.

[0075] Furthermore, {napt_idx, flow_idx} in the second set of tables is a behavior index, time_stamp is a timestamp, and {napt_idx, flow_idx, time_stamp} is not optimized, so the difference calculation between the table entry resources required for the traditional five-tuple table lookup and the table entry resources required for the five-tuple table lookup of the present invention is not included.

[0076] Further, in one embodiment, the step of searching a first group table according to the first group of search key values, determining a matching entry of the first group of search key values ​​in the first group table, and obtaining information corresponding to the first search key value according to the matching entry further includes:

[0077] The first group table is searched according to the first group search key value to determine a matching entry of the first group search key value in the first group table, and the address of the matching entry in the first group table is used as information corresponding to the first group search key value.

[0078] In this embodiment, refer to Figure 4 , Figure 4 FIG. 2 is a schematic diagram of a table lookup method of a second embodiment of the present invention when a TCAM table entry is used to perform an IP five-tuple table lookup. Figure 4 As shown, the uplink data frame searches the first group of tables according to the first group of search key values ​​{dip, dport, tcp / udp}, determines the matching entries of the first group of search key values ​​in the first group of tables, obtains the addresses of the matching entries in the first group of tables, uses the address as the value of the mapping index field_id, and uses the mapping index as the information corresponding to the first search key value.

[0079] Specifically, refer to Figure 8 , Figure 8 This is a schematic diagram of the configuration of some table entries in the first group of tables in the second embodiment of the table lookup method of the present invention when using TCAM table entries to perform IP five-tuple table lookup. Figure 8 As shown, if the first group search key value is {10.10.10.9, 2000, 0}, the first group table is searched according to the first group search key value to determine the matching entry of the first group search key value in the first group table. For example, if the address of the matching entry in the first group table is the address of the second entry, the address 2 of the second entry is used as the value of the mapping index field_id, and the mapping index is used as the information corresponding to the first group search key value.

[0080] Furthermore, the downlink data frame searches the first group of tables according to the first group of search key values ​​{sip, sport, tcp / udp}, determines the matching entries of the first group of search key values ​​in the first group of tables, obtains the addresses of the matching entries in the first group of tables, uses the address as the value of the mapping index field_id, and uses the mapping index as the information corresponding to the first search key value.

[0081] Figure 4In the table, ip_t1 is the destination IP address of the uplink data frame or the source IP address of the downlink data frame, and port_t1 is the Layer 4 destination port number of the uplink data frame or the Layer 4 source port number of the downlink data frame. tcp / udp is the protocol type, 0 indicates the TCP protocol type, and 1 indicates the UDP protocol type. valid is a flag bit. When valid is 0, the entry content is invalid. When valid is 1, the entry content is valid. The value of the mapping index field_id is the address of the matching entry corresponding to the first group of search key values ​​in the first group of tables. ip_t2 is the source IP address of the uplink data frame or the destination IP address of the downlink data frame, and port_t2 is the Layer 4 source port number of the uplink data frame or the Layer 4 destination port number of the downlink data frame. napt_idx is the NAPT index, flow_idx is the flow index, and time_stamp is the timestamp.

[0082] In another embodiment, referring to Figure 5 , Figure 5 Schematic diagram of the table lookup method of the second embodiment of the present invention when the hash table entry is used to perform IP five-tuple table lookup. Figure 5 As shown, the first group of tables is searched according to the hash index of the first group of search key values ​​{dip, dport, tcp / udp}, the matching entries of the first group of search key values ​​in the first group of tables are determined, the addresses of the matching entries in the first group of tables are obtained, the address is used as the value of the mapping index field_id, and the mapping index is used as the information corresponding to the first search key value.

[0083] Furthermore, the uplink data frame searches the first group of tables according to the hash index of the first group of search key values ​​{sip, sport, tcp / udp}, determines the matching entries of the first group of search key values ​​in the first group of tables, obtains the addresses of the matching entries in the first group of tables, uses the address as the value of the mapping index field_id, and uses the mapping index as the information corresponding to the first search key value.

[0084] Figure 5In the table, ip_t1 is the destination IP address of the uplink data frame or the source IP address of the downlink data frame, and port_t1 is the Layer 4 destination port number of the uplink data frame or the Layer 4 source port number of the downlink data frame. tcp / udp is the protocol type, 0 indicates the TCP protocol type, and 1 indicates the UDP protocol type. valid is a flag bit. When valid is 0, the entry content is invalid. When valid is 1, the entry content is valid. The value of the mapping index field_id is the address of the matching entry corresponding to the first group of search key values ​​in the first group of tables. ip_t2 is the source IP address of the uplink data frame or the destination IP address of the downlink data frame, and port_t2 is the Layer 4 source port number of the uplink data frame or the Layer 4 destination port number of the downlink data frame. napt_idx is the NAPT index, flow_idx is the flow index, and time_stamp is the timestamp.

[0085] Furthermore, in one embodiment, the maximum number of connections supported by the gateway is 2 24 right.

[0086] In this embodiment, the mapping relationship between the first set of search key values ​​and field_id is fixed, and the field_id stored in the first set of tables is omitted. Figure 4 As shown in the figure, the first set of tables uses TCAM to store key values, which has valid information, so there is no need to store valid information again. Figure 4 The key value of the first set of tables in is {ip_t1, port_t1, tcp / udp}, and the required table entry resources are 49 bits × N. Figure 5 As shown, the first set of tables is stored in RAM and needs to store valid data. Figure 5 The key value of the first group of tables is {valid, ip_t1, port_t1, tcp / udp}, and the required table entry resources are 50 bits × N. Figure 4 and Figure 5The key values ​​of the second group of tables in the table are all {valid, field_id, ip_t2, port_t2}, and the required table entry resources are (49+log2 N)bit×2N. The steps for calculating the required table entry resources are the same as those in step S20. When TCAM table entries are used for quintuple table lookup, the difference in table entry resources required for the traditional quintuple table lookup and the quintuple table lookup of the present invention is calculated to be 98bit×2N-(49bit×N+(49+log2 N)bit×2N)=(49-2log2 N)bit×N. When hash table entries are used for quintuple table lookup, the difference in table entry resources required for the traditional quintuple table lookup and the quintuple table lookup of the present invention is calculated to be 98bit×2N-(50bit×N+(49+log2 N)bit×2N)=(48-2log2 N)bit×N. It can be seen from the calculation results that when N is less than 2 24 , the difference between using TCAM table entries for five-tuple lookup and using hash table entries for five-tuple lookup is positive, that is, the maximum number of connections supported by the gateway is less than 2 24 In this embodiment, although the mapping relationship between the first set of search key values ​​and field_id is fixed, which reduces flexibility, it can further save resources.

[0087] S30: Obtain a second group of search key values ​​according to the information and the second group of key values, search a second group of tables according to the second group of search key values, determine matching entries of the second group of search key values ​​in the second group of tables, and obtain a NAPT index corresponding to the matching entry;

[0088] In this embodiment, according to the mapping index field_id obtained in step S20, if the obtained data frame is an uplink data frame, the second group of search key values ​​includes: mapping index field_id, source IP address sip and four-layer source port number sport, and the second group of tables is searched according to the second group of search key values ​​{field_id, sip, sport}, the matching entries of the second group of search key values ​​in the second group of tables are determined, and the NAPT index napt_idx corresponding to the matching entries is obtained.

[0089] Alternatively, if the acquired data frame is a downlink data frame, the second group of search key values ​​includes: mapping index field_id, destination IP address dip and Layer 4 destination port number dport, and the second group of tables is searched according to the second group of search key values, a matching entry of the second group of search key values ​​in the second group of tables is determined, and the NAPT index napt_idx corresponding to the matching entry is obtained. When the number of connections between the terminal and TCP / UDP is N pairs, the second group of tables includes 0 to 2N-1 matching entries.

[0090] Furthermore, in one embodiment, step S30 includes:

[0091] Step S301, when using the TCAM table entry to perform IP quintuple table lookup, use the information and the second group of key values ​​as the second group of lookup key values, search the second group of key value table included in the second group of tables according to the second group of lookup key values, determine the matching entry of the second group of lookup key values ​​in the second group of key value tables, search the second group of behavior table included in the second group of tables according to the address of the matching entry in the second group of key value tables, and obtain the NAPT index corresponding to the matching entry;

[0092] In this embodiment, when the TCAM table entry is used to perform an IP five-tuple lookup, if the value of the mapping index field_id obtained in step S20 is obtained from the matching entry of the first group of search key values ​​in the first group of tables, then continue to refer to Figure 2 If the acquired data frame is an uplink data frame, the second group of search key values ​​includes: mapping index field_id, source IP address sip and layer-4 source port number sport. According to the second group of search key values ​​{field_id, sip, sport}, the second group of key value tables included in the second group of tables are searched to determine the matching entries of the second group of search key values ​​in the second group of key value tables. Then, according to the address of the matching entry in the second group of key value tables, the second group of behavior tables are searched to obtain the NAPT index napt_idx of the address in the second group of behavior tables, and the NAPT index is used as the NAPT index corresponding to the matching entry.

[0093] Specifically, refer to Figure 7 , Figure 7 This is a schematic diagram of the configuration of some entries in the second group of key value tables and the second group of behavior tables in the first embodiment of the table lookup method of the present invention when using TCAM table entries to perform IP five-tuple table lookup. Figure 7 As shown, if the second group key value of the uplink data frame is {192.168.1.12, 1002}, the obtained mapping index field_id is 3. The second group search key value {3, 192.168.1.12, 1002} is obtained according to the mapping index field_id and the second group key value. The second group key value table is searched according to the second group search key value, and the matching entry of the second group search key value in the second group key value table is determined, for example, the matching entry is the 4th entry. The second group behavior table is searched according to the address of the matching entry in the second group key value table, that is, the 4th entry of the second group behavior table is searched. If the NAPT index napt_idx in the 4th entry of the second group behavior table is 5, the NAPT index napt_idx of 5 is used as the NAPT index corresponding to the matching entry.

[0094] Further, if the acquired data frame is a downlink data frame, the second group of search key values ​​include: mapping index field_id, destination IP address dip and four-layer destination port number dport, and the second group of key value tables included in the second group of tables are searched according to the second group of search key values ​​{field_id, dip, dport} to determine the matching entries of the second group of search key values ​​in the second group of key value tables, and then the second group of behavior tables are searched according to the address of the matching entry in the second group of key value tables to obtain the NAPT index napt_idx of the address in the second group of behavior tables, and the NAPT index is used as the NAPT index corresponding to the matching entry.

[0095] In another embodiment, when the value of the mapping index field_id obtained in step S20 is obtained according to the address of the matching entry of the first set of search key values ​​in the first set of tables, continue to refer to Figure 4 If the acquired data frame is an uplink data frame, the second group of search key values ​​includes: source IP address sip and layer 4 source port number sport and mapping index field_id. According to the second group of search key values ​​{field_id, sip, sport}, the second group of key value tables included in the second group of tables are searched to determine the matching entry of the second group of search key values ​​in the second group of key value tables, and then the second group of behavior tables are searched according to the address of the matching entry in the second group of key value tables to obtain the NAPT index napt_idx of the address in the second group of behavior tables, and the NAPT index is used as the NAPT index corresponding to the matching entry of the second group of search key values ​​in the second group of key value tables.

[0096] Specifically, refer to Fig. 9 , Fig. 9 This is a schematic diagram of the configuration of some entries in the second group of key value tables and the second group of behavior tables in the second embodiment of the table lookup method when using TCAM table entries to perform IP five-tuple table lookup in the IP five-tuple table lookup method of the present invention. Fig. 9 As shown, if the second group key value of the uplink data frame is {192.168.1.12, 1002}, the obtained mapping index field_id is 2. The second group search key value {2, 192.168.1.12, 1002} is obtained according to the mapping index field_id and the second group key value. The second group key value table is searched according to the second group search key value, and the matching entry of the second group search key value in the second group key value table is determined, for example, the matching entry is the 4th entry. The second group behavior table is searched according to the address of the matching entry in the second group key value table, that is, the 4th entry of the second group behavior table is searched. If the NAPT index napt_idx in the 4th entry of the second group behavior table is 5, the NAPT index napt_idx of 5 is used as the NAPT index corresponding to the matching entry of the second group search key value in the second group key value table.

[0097] Further, if the acquired data frame is a downlink data frame, the second group of search key values ​​include: the destination IP address dip and the four-layer destination port number dport and the mapping index field_id, and the second group of key value tables included in the second group of tables are searched according to the second group of search key values ​​{field_id, dip, dport} to determine the matching entry of the second group of search key values ​​of the downlink data frame in the second group of key value tables, and the second group of behavior tables are searched according to the address of the matching entry in the second group of key value tables to obtain the NAPT index napt_idx of the address in the second group of behavior tables, and the NAPT index is used as the NAPT index corresponding to the matching entry of the second group of search key values ​​in the second group of key value tables.

[0098] Or, step S302, when a hash table item is used to perform an IP five-tuple lookup, the information and the second group of key values ​​are used as the second group of search key values, a hash function is called to calculate a hash index of the second group of search key values, the second group of tables is searched according to the hash index, matching entries of the second group of search key values ​​in the second group of tables are determined, and a NAPT index is obtained from the matching entries.

[0099] In this embodiment, when a hash table entry is used to perform an IP five-tuple lookup, if the value of the mapping index field_id in step S20 is obtained from a matching entry in the first set of lookup key values ​​in the first set of tables, then continue to refer to Figure 3 If the acquired data frame is an uplink data frame, the second group of search key values ​​includes the second group of key values ​​{sip, sport} and the mapping index field_id. The second group of tables is searched according to the hash index of the second group of search key values, the matching entries of the second group of search key values ​​in the second group of tables are obtained, and the NAPT index napt_idx corresponding to the second group of search key values ​​is obtained from the matching entries of the second group of search key values ​​in the second group of tables.

[0100] Further, if the acquired data frame is a downlink data frame, the second group of search key values ​​includes the second group of key values ​​{dip, dport} and the mapping index field_id. The second group of tables is searched according to the hash index of the second group of search key values, the matching entries of the second group of search key values ​​in the second group of tables are obtained, and the NAPT index napt_idx corresponding to the second group of search key values ​​is obtained from the matching entries of the second group of search key values ​​in the second group of tables.

[0101] In another embodiment, if the value of the mapping index field_id obtained in step S20 is obtained according to the address of the matching entry of the first set of search key values ​​in the first set of tables, continue to refer to Figure 5If the acquired data frame is an uplink data frame, the second group of search key values ​​includes the second group of key values ​​{sip, sport} and the mapping index field_id. The second group of tables is searched according to the hash index of the second group of search key values, the matching entries of the second group of search key values ​​in the second group of tables are obtained, and the NAPT index napt_idx corresponding to the second group of search key values ​​is obtained from the matching entries of the second group of search key values ​​in the second group of tables.

[0102] Further, if the acquired data frame is a downlink data frame, the second group of search key values ​​includes the second group of key values ​​{dip, dport} and the mapping index field_id. The second group of tables is searched according to the hash index of the second group of search key values, the matching entries of the second group of search key values ​​in the second group of tables are obtained, and the NAPT index napt_idx corresponding to the second group of search key values ​​is obtained from the matching entries of the second group of search key values ​​in the second group of tables.

[0103] S40: searching the second group table again according to the NAPT index to obtain conversion results corresponding to the second group of key values.

[0104] In this embodiment, continue to refer to Figure 2 , if the NAPT index obtained in step S30 is the NAPT index napt_idx corresponding to the second group of search key values ​​{field_id, sip, sport}, then the second group of tables is searched again according to the NAPT index napt_idx to obtain the conversion result {ip_t2_1, port_t2_1} corresponding to the second group of key values. ip_t2_1 is the new source IP address, and port_t2_1 is the new layer-4 source port number. Specifically, as described in step S30, the obtained NAPT index napt_idx is 5, and the second group of key value tables included in the second group of tables are searched again according to the NAPT index napt_idx to obtain the 5th matching entry in the second group of key value tables. The 5th matching entry in the second group of key value tables is the conversion result {10.10.20.5, 3002} corresponding to the second group of key values ​​in the second group of key value tables. 10.10.20.5 is the new source IP address, and 3002 is the new layer-4 source port number. Further, if the NAPT index obtained in step S30 is the NAPT index napt_idx corresponding to the second group of search key values ​​{field_id, dip, dport}, the second group of tables is searched again according to the NAPT index napt_idx to obtain the conversion result {ip_t2_2, port_t2_2} corresponding to the second group of key values. ip_t2_2 is the new destination IP address, and port_t2_2 is the new layer 4 destination port number.

[0105] Figure 3 , Figure 4 , Figure 5How to get the conversion result Figure 2 It is easy to imagine that the parameters in this embodiment are for reference only and are not intended to be limiting.

[0106] In this embodiment, an IP quintuple of a data frame is obtained, and the elements in the IP quintuple that are the same as the elements in the IP quintuple of the opposite data frame connected to the same data frame and do not need to be converted are grouped together to obtain a first group of key values, and the elements in the IP quintuple that are in a conversion relationship with the elements in the IP quintuple of the opposite data frame connected to the same data frame are grouped together to obtain a second group of key values; a first group of search key values ​​are obtained according to the first group of key values, a first group of tables are searched according to the first group of search key values, matching entries of the first group of search key values ​​in the first group of tables are determined, and information corresponding to the first search key values ​​is obtained according to the matching entries; a second group of search key values ​​are obtained according to the information and the second group of key values, a second group of tables are searched according to the second group of search key values, matching entries of the second group of search key values ​​in the second group of tables are determined, and a NAPT index corresponding to the matching entry is obtained; and a second group of tables are searched again according to the NAPT index to obtain a conversion result corresponding to the second group of key values. Through this embodiment, the IP quintuple is not directly used for table lookup. Instead, the same IP quintuples that do not need to be converted are first divided into one group, and the ones that are in a conversion relationship with each other are divided into another group. The two groups are then looked up in the table in sequence, which significantly reduces the table entry resources required for IP quintuple table lookup.

[0107] Furthermore, in one embodiment, after the step of determining the matching entry of the second group of search key values ​​in the second group table and obtaining the NAPT index corresponding to the matching entry, the method further includes:

[0108] The timestamp in the matching entry is updated.

[0109] In this embodiment, the timestamp of the corresponding matching entry of the second group of search key values ​​in the second group of tables is updated to the current timestamp to prevent the entry from being cleared after aging. Further, the hardware periodically scans the second group of tables, and determines whether the aging time threshold is reached based on the difference between the timestamp scanned by the hardware periodicity and the current timestamp. When the aging time threshold is reached, the valid of the second group of tables is cleared to 0, that is, aging and deletion. Further, the software periodically scans the second group of tables to achieve synchronization of soft and hard table entries. At the same time, the first group of tables is maintained. When all the second group of tables corresponding to the first group of tables are deleted due to aging, the software deletes the corresponding table entries of the first group of tables.

[0110] In a third aspect, an embodiment of the present invention further provides an IP quintuple table lookup device.

[0111] In one embodiment, referring to Fig.10 , Fig.10Schematic diagram of the functional modules of an embodiment of an IP five-tuple table lookup device of the present invention. Fig.10 As shown, the IP five-tuple table lookup device includes:

[0112] Grouping module 10: used to obtain the IP quintuple of the data frame, group the elements in the IP quintuple that are the same as the elements in the IP quintuple of the opposite data frame connected to the same data frame and do not need to be converted, to obtain a first group of key values, and group the elements in the IP quintuple that are in a conversion relationship with the elements in the IP quintuple of the opposite data frame connected to the same data frame and obtain a second group of key values;

[0113] A first search module 20 is configured to obtain a first group of search key values ​​according to the first group of key values, search a first group table according to the first group of search key values, determine matching entries of the first group of search key values ​​in the first group table, and obtain information corresponding to the first search key values ​​according to the matching entries;

[0114] A second search module 30 is configured to obtain a second group of search key values ​​according to the information and the second group of key values, search a second group of tables according to the second group of search key values, determine matching entries of the second group of search key values ​​in the second group of tables, and obtain a NAPT index corresponding to the matching entry;

[0115] The acquisition module 40 is configured to search the second set of tables again according to the NAPT index to acquire the conversion results corresponding to the second set of key values.

[0116] Furthermore, in one embodiment, the first set of key values ​​includes:

[0117] Destination IP address, Layer 4 destination port number, and TCP / UDP protocol type indication of the uplink data frame;

[0118] The second group of key values ​​includes: a source IP address and a layer-4 source port number of an uplink data frame;

[0119] Or, the first group of key values ​​includes: a source IP address, a layer-4 source port number, and a TCP / UDP protocol type indication of a downlink data frame;

[0120] The second group of key values ​​includes: a destination IP address and a layer-4 destination port number of a downlink data frame.

[0121] Furthermore, in one embodiment, the first search module 20 is further configured to:

[0122] When using the TCAM table entry to perform an IP five-tuple table lookup, using the first group of key values ​​as the first group of lookup key values ​​to search the first group of key value table;

[0123] Or, when a hash table entry is used to perform an IP five-tuple lookup, the first group of key values ​​is used as the first group of search key values, a hash function is called to calculate a hash index of the first group of search key values, and the hash index of the first group of search key values ​​is used to search the first group of tables.

[0124] Furthermore, in one embodiment, the first search module 20 is further configured to:

[0125] The first group table is searched according to the first group search key value, a matching entry of the first group search key value in the first group table is determined, and a mapping index corresponding to the matching entry is used as information corresponding to the first search key value.

[0126] Furthermore, in one embodiment, the maximum number of connections supported by the gateway is 2 16 right

[0127] Furthermore, in one embodiment, the first search module 20 is further configured to:

[0128] The first group table is searched according to the first group search key value to determine a matching entry of the first group search key value in the first group table, and the address of the matching entry in the first group table is used as information corresponding to the first group search key value.

[0129] Furthermore, in one embodiment, the maximum number of connections supported by the gateway is 2 24 right.

[0130] Furthermore, in one embodiment, the IP 5-tuple table lookup device further includes an update module, which is specifically used to:

[0131] The timestamp in the matching entry is updated.

[0132] Furthermore, in one embodiment, the second search module 30 is specifically configured to:

[0133] When the TCAM table entry is used to perform an IP five-tuple table lookup, the information and the second group of key values ​​are used as the second group of lookup key values, a second group of key value table included in the second group of tables is searched according to the second group of lookup key values, it is determined that the second group of lookup key values ​​match an entry in the second group of key value table, a second group of behavior table included in the second group of tables is searched according to the address of the matching entry in the second group of key value table, and a NAPT index in the matching entry is obtained;

[0134] Or, when a hash table item is used to perform an IP five-tuple lookup, the information and the second group of key values ​​are used as the second group of search key values, a hash function is called to calculate a hash index of the second group of search key values, the second group of tables is searched according to the hash index, matching entries of the second group of search key values ​​in the second group of tables are determined, and a NAPT index is obtained from the matching entries.

[0135] Among them, the functional implementation of each module in the above-mentioned IP 5-tuple table lookup device corresponds to the various steps in the above-mentioned IP 5-tuple table lookup method embodiment, and its functions and implementation processes are no longer repeated here.

[0136] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0137] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0138] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present invention.

[0139] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for looking up an IP quintuple table, characterized in that: The IP quintuple table lookup method comprises: Obtain an IP quintuple of a data frame, group the elements in the IP quintuple that are the same as the elements in the IP quintuple of the opposite data frame connected to the same connection as the data frame and that do not need to be converted, to obtain a first group of key values, group the elements in the IP quintuple that are in a conversion relationship with the elements in the IP quintuple of the opposite data frame connected to the same connection as the data frame and that are in a conversion relationship with each other, to obtain a second group of key values; Obtain a first group of search key values ​​according to the first group of key values, search a first group table according to the first group of search key values, determine matching entries of the first group of search key values ​​in the first group table, and obtain information corresponding to the first group of search key values ​​according to the matching entries; Obtain a second group of search key values ​​according to the information corresponding to the first group of search key values ​​and the second group of key values, search a second group of tables according to the second group of search key values, determine matching entries of the second group of search key values ​​in the second group of tables, and obtain a NAPT index corresponding to the matching entry; Search the second group of tables again according to the NAPT index to obtain conversion results corresponding to the second group of key values; The first set of key values ​​includes: Destination IP address, Layer 4 destination port number, and TCP / UDP protocol type indication of the uplink data frame; The second group of key values ​​includes: a source IP address and a layer-4 source port number of an uplink data frame; Or, the first group of key values ​​includes: a source IP address, a layer-4 source port number, and a TCP / UDP protocol type indication of a downlink data frame; The second group of key values ​​includes: a destination IP address and a layer-4 destination port number of a downlink data frame.

2. The IP quintuple table lookup method according to claim 1, characterized in that: The step of obtaining a first group of search key values ​​according to the first group of key values, and searching a first group of tables according to the first group of search key values ​​comprises: When using the TCAM table entry to perform an IP five-tuple table lookup, using the first group of key values ​​as the first group of lookup key values ​​to search the first group of key value table; Or, when a hash table entry is used to perform an IP five-tuple lookup, the first group of key values ​​is used as the first group of search key values, a hash function is called to calculate a hash index of the first group of search key values, and the hash index of the first group of search key values ​​is used to search the first group of tables.

3. The IP quintuple table lookup method according to claim 1, characterized in that: The step of searching the first group table according to the first group of search key values, determining matching entries of the first group of search key values ​​in the first group table, and obtaining information corresponding to the first group of search key values ​​according to the matching entries comprises: The first group table is searched according to the first group of search key values ​​to determine a matching entry of the first group of search key values ​​in the first group table, and a mapping index corresponding to the matching entry is used as information corresponding to the first group of search key values.

4. The IP quintuple table lookup method as claimed in claim 3, characterized in that: The maximum number of connections supported by the gateway is right.

5. The IP quintuple table lookup method according to claim 1, wherein: The step of searching the first group table according to the first group of search key values, determining matching entries of the first group of search key values ​​in the first group table, and obtaining information corresponding to the first group of search key values ​​according to the matching entries further includes: The first group table is searched according to the first group search key value to determine a matching entry of the first group search key value in the first group table, and the address of the matching entry in the first group table is used as information corresponding to the first group search key value.

6. The IP quintuple table lookup method as claimed in claim 5, characterized in that: The maximum number of connections supported by the gateway is right.

7. The IP quintuple table lookup method according to claim 1, characterized in that: After the step of determining the matching entry of the second group of search key values ​​in the second group table and obtaining the NAPT index corresponding to the matching entry, the method further includes: The timestamp in the matching entry is updated.

8. The IP quintuple table lookup method according to claim 1, characterized in that: The steps of obtaining a second group of search key values ​​according to the information corresponding to the first group of search key values ​​and the second group of key values, searching a second group of tables according to the second group of search key values, determining matching entries of the second group of search key values ​​in the second group of tables, and obtaining a NAPT index corresponding to the matching entry include: When the TCAM table entry is used to perform an IP five-tuple table lookup, the information corresponding to the first group of lookup key values ​​and the second group of key values ​​are used as the second group of lookup key values, and the second group of key value tables included in the second group of tables are searched according to the second group of lookup key values ​​to determine a matching entry of the second group of lookup key values ​​in the second group of key value tables, and the second group of behavior tables included in the second group of tables are searched according to the address of the matching entry in the second group of key value tables to obtain a NAPT index corresponding to the matching entry; Or, when a hash table item is used to perform an IP five-tuple lookup, the information corresponding to the first group of search key values ​​and the second group of key values ​​are used as the second group of search key values, and a hash function is called to calculate a hash index of the second group of search key values. The second group of tables is searched according to the hash index, and matching entries of the second group of search key values ​​in the second group of tables are determined, and the NAPT index is obtained from the matching entries.

9. An IP five-tuple table lookup device, characterized in that: The IP quintuple table lookup device comprises: A grouping module: used for obtaining an IP quintuple of a data frame, grouping the elements in the IP quintuple that are the same as the elements in the IP quintuple of the opposite data frame connected to the same data frame and that do not need to be converted into one group, to obtain a first group of key values, and grouping the elements in the IP quintuple that are in a conversion relationship with the elements in the IP quintuple of the opposite data frame connected to the same data frame into one group, to obtain a second group of key values; A first search module: used for obtaining a first group of search key values ​​according to the first group of key values, searching a first group table according to the first group of search key values, determining matching entries of the first group of search key values ​​in the first group table, and obtaining information corresponding to the first group of search key values ​​according to the matching entries; A second search module: used for obtaining a second group of search key values ​​according to the information corresponding to the first group of search key values ​​and the second group of key values, searching a second group of tables according to the second group of search key values, determining matching entries of the second group of search key values ​​in the second group of tables, and obtaining NAPT indexes corresponding to the matching entries; Acquisition module: used for searching the second group table again according to the NAPT index to obtain the conversion result corresponding to the second group of key values; The first set of key values ​​includes: Destination IP address, Layer 4 destination port number, and TCP / UDP protocol type indication of the uplink data frame; The second group of key values ​​includes: a source IP address and a layer-4 source port number of an uplink data frame; Or, the first group of key values ​​includes: a source IP address, a layer-4 source port number, and a TCP / UDP protocol type indication of a downlink data frame; The second group of key values ​​includes: a destination IP address and a layer-4 destination port number of a downlink data frame.

Images