A method and device for keyword matching during flow classification

Abstract

The present invention relates to the field of communication technology, and in particular to a method and device for keyword matching during flow classification. It mainly includes: forming a two-dimensional lookup table structure with keywords that need to be matched, each table item corresponds to a keyword type and has a unique table number, the number of rows and columns of the two-dimensional lookup table structure corresponds to the number of keyword types, the first row is a cascade of all keyword types, and each subsequent row removes the first table item of the previous row in turn; obtaining the keyword in the data packet, and matching the corresponding table item in the two-dimensional lookup table structure column by column in each row or matching the corresponding table item and the borrowed table item at the same time; when the table item and / or the borrowed table item corresponding to the keyword is hit, the subsequent execution action is determined by the behavior table corresponding to the keyword until the search is completed. The present invention speeds up the matching speed as much as possible in the scenario where multiple keywords are randomly combined and matched, and saves storage resources for the table items.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and device for keyword matching during flow classification. Background Art

[0002] With the rapid development of network technology, network-based applications are becoming more numerous and increasingly complex. Traffic identification and classification can provide network management functions such as quality of service, traffic management, and security. Traffic classification is based on the content of the packet header, extracting keywords and matching them with pre-set rules. If a match is found, arbitration is performed based on priority, and the corresponding action is executed.

[0003] A common method for traffic classification is to combine all required keywords into a set by configuring whether to enable or disable them, and then perform a hash lookup. Using hash matching to search flows increases the number of keywords required for traffic classification, leading to increasing hash conflicts. As the number of keyword types increases and the interval between packets decreases, even to the point where there are only two packets per packet, this table lookup method becomes inflexible and struggles to support the diverse keyword combinations required.

[0004] The traditional approach to addressing these issues is to linearly combine various keywords into multiple groups of combined keywords, and then determine whether a keyword in each group is valid based on the configuration. The disadvantages of this approach are: 1) As the number of keyword types increases, the bit width of the combined keywords increases, leading to an increasing number of invalid keywords in each combination, increasing hash collisions and wasting resources; 2) it cannot meet the needs of any combination of keywords. 3) it may be that resources for one combination are insufficient, while resources for another combination are wasted.

[0005] In view of this, how to overcome the defects of the existing technology and solve the problem of inflexible table lookup caused by the large number of keyword types in the existing flow classification scenario is a problem to be solved in this technical field. Summary of the Invention

[0006] In view of the above defects or improvement needs of the prior art, the present invention solves the problem of inflexible table lookup caused by the large variety of keywords in the existing flow classification scenario.

[0007] The embodiment of the present invention adopts the following technical solutions:

[0008] In the first aspect, the present invention provides a method for keyword matching during flow classification, specifically: the keywords to be matched are organized into a two-dimensional lookup table structure, each table item corresponds to a keyword type and has a unique table number, the number of rows and columns of the two-dimensional lookup table structure corresponds to the number of keyword types, the first row is a cascade of all keyword types, and each subsequent row removes the first table item of the previous row in turn; the keyword in the data packet is obtained, and each row is matched backward column by column with the corresponding table item in the two-dimensional lookup table structure, or the corresponding table item and the borrowed table item are matched at the same time; when the table item and / or the borrowed table item corresponding to the keyword is hit, the subsequent execution action is determined by the behavior table corresponding to the keyword until the search is completed.

[0009] Preferably, the keywords that need to be matched are organized into a two-dimensional lookup table structure, specifically including: all keywords that need to be matched are cascaded and arranged in order of bit width from small to large and priority from high to low, and each group of keywords is a table item in the first row in turn; starting from the second row, each row removes the first group of keywords in the previous row in turn, until there is only one group of keywords in the last row.

[0010] Preferably, the keywords that need to be matched are organized into a two-dimensional lookup table structure, which also includes: when a new keyword is added, the new keyword is inserted into the corresponding position of each row according to the bit width from small to large and the priority from high to low, and the corresponding number of rows is increased according to the number and position of the new keywords; when a keyword is deleted, the corresponding table entry is deleted in each row, and the corresponding number of rows is deleted.

[0011] Preferably, each row is matched backward column by column with the corresponding table items in the two-dimensional lookup table structure, or the corresponding table items and the borrowed table items are matched simultaneously, specifically including: according to the keyword order corresponding to the table items in each row, starting from the first table item in each row, the hash value of the keyword corresponding to the current table item is calculated, and the table items are matched and searched according to the hash value; according to the behavior table item hit by the lookup result, it is determined whether the next level search needs to borrow the table items, and the corresponding table items and the borrowed table items are searched synchronously.

[0012] Preferably, judging whether the next level search needs to borrow table items based on the behavior table items hit by the table lookup results also includes: borrowing from table items corresponding to keywords that are larger or equal to the keyword bit width of the current search. If the bit width of a keyword is smaller than the preset bit width lower limit, the corresponding table item will not be borrowed by other table items.

[0013] Preferably, each row matches the corresponding table items in the two-dimensional lookup table structure backward column by column or matches the corresponding table items and the borrowed table items at the same time, and also includes: for each table item, the keyword content that needs to be matched is: {table number, {table number hit by the previous stage, slot number hit by the previous stage, previous stage hash value}, keyword of this search}; when the table item used for matching is a borrowed table, the table number is the original table number of the keyword of this search.

[0014] Preferably, the keyword content to be matched further includes: normalizing {the table number hit by the previous stage, the slot number hit by the previous stage, and the previous stage hash value}, and using the maximum required bit width as the bit width after normalization.

[0015] Preferably, each row matches the corresponding table entries and borrowed table entries in the two-dimensional table lookup structure column by column in reverse order, further comprising: the maximum number of times each table entry is borrowed is the number of beats required to process a data packet minus one.

[0016] Preferably, the subsequent action is determined by the behavior table corresponding to the keyword, specifically including: when the keyword hits multiple table entries at the same time, determining the final table lookup result according to the priority in the behavior table entries.

[0017] On the other hand, the present invention provides a device for keyword matching during flow classification, specifically comprising: at least one processor and a memory, the at least one processor and the memory being connected via a data bus, the memory storing instructions that can be executed by at least one processor, and after the instructions are executed by the processor, being used to complete the method for keyword matching during flow classification in the first aspect.

[0018] Compared with the prior art, the beneficial effects of the embodiments of the present invention are: providing a flexible serial cascade flow classification method, using a trapezoidal serial cascade method to realize arbitrary combinations of various keywords, and at the same time realizing resource borrowing between table items by assigning table numbers to each table and matching table numbers. It can also reduce hash conflicts by borrowing resources and increasing slot numbers or table item depths as the cascade increases, speeding up the matching speed as much as possible in scenarios where multiple keywords are randomly combined and matched, and saving storage resources for table items. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort.

[0020] Figure 1 A flow chart of a method for keyword matching during flow classification provided by an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of a two-dimensional lookup table structure used in an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of a 4-slot hash lookup table entry used in an embodiment of the present invention;

[0023] Figure 4A schematic diagram of a two-dimensional lookup table structure obtained after serial sorting in an embodiment of the present invention;

[0024] Figure 5 A behavior expression used in the embodiments of the present invention;

[0025] Figure 6 A schematic diagram of a search sequence for keyword matching during flow classification provided by an embodiment of the present invention;

[0026] Figure 7 A schematic diagram of a search sequence for keyword matching during another flow classification according to an embodiment of the present invention;

[0027] Figure 8 A schematic diagram of a search sequence for keyword matching during another flow classification according to an embodiment of the present invention;

[0028] Figure 9 A schematic diagram of a keyword matching result obtained in an embodiment of the present invention;

[0029] Figure 10 A schematic diagram of the structure of a device for keyword matching during flow classification provided by an embodiment of the present invention;

[0030] The accompanying drawings are numerals as follows:

[0031] 11: Processor; 12: Memory. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0033] The present invention is an architecture of a specific functional system. Therefore, the specific embodiments mainly illustrate the functional logical relationship between the various structural modules, and do not limit the specific software and hardware implementation methods.

[0034] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other. The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0035] Example 1:

[0036] As network applications become increasingly complex, management becomes more refined, and network speeds increase, the requirements for traffic classification are becoming increasingly stringent. Furthermore, as applications become more flexible and diverse, the types of traffic classifications are increasing, and the required resources are also changing, making it difficult to determine the specific amount of resources to allocate.

[0037] The existing multi-keyword search method is to select whether a keyword is enabled based on the configuration and match each combination separately.

[0038] Taking four keywords A, B, C, and D as an example, four configuration options need to be provided, such as: 1) A+B; 2) A+C; 3) A+B+C; 4) A+B+C+D.

[0039] Because it's uncertain which fields will be configured, the keyword table's bit width needs to be designed to be the sum of the bit widths of the four keywords A+B+C+D, which wastes resources. To maximize resource sharing, in the scenario where one packet is sent in two beats, resources are divided into two tables. Each beat searches both tables once, meaning two searches per beat, and four searches per packet in two beats. However, resources cannot be shared between the two tables.

[0040] If you want to support more keyword combinations, you need to divide resources into more tables. The table item width is still the sum of all keyword bit widths, resulting in resource waste. At the same time, resources between tables cannot be shared, which may cause resource waste in some tables and insufficient resources in some table items. The more combinations there are, the more obvious this situation is.

[0041] like Figure 1 As shown, the specific steps of the keyword matching method during flow classification provided by the embodiment of the present invention are as follows.

[0042] Step 101: Keywords to be matched are organized into a two-dimensional lookup table structure.

[0043] In order to improve the search efficiency of multiple keywords, the solution provided in this embodiment serially concatenates the hash lookup table entries corresponding to all keywords to form a two-dimensional lookup table structure similar to a trapezoid. Each entry in the two-dimensional lookup table structure corresponds to a keyword type and has a unique table number. The number of rows and columns in the two-dimensional lookup table structure corresponds to the number of keyword types. The first row is a concatenation of all keyword types, and each subsequent row removes the first entry in the previous row in turn. When performing a keyword matching search, multiple entries can be searched synchronously in each beat. After the above arrangement, the entries in each column correspond to all keyword type combinations. By searching backward column by column according to the two-dimensional lookup table structure, all possible keyword combinations can be quickly matched.

[0044] Take three keywords A, B, and C as an example, the composition is as follows Figure 2The two-dimensional lookup table structure shown. Among them, A1 corresponds to keyword A, B1 and B2 correspond to keyword B, and C1, C2 and C3 correspond to keyword C. The first step is to synchronously search the A1, B1, and C1 tables, the second step is to synchronously search the B2 and C2 tables, and the third step is to search the C3 table. Each table has two situations: hit and miss. It can cover A, B, and C hits individually, A+B cascade hits, A+C cascade hits (implying that A+B has a higher priority than A+C), B+C cascade hits, A+B+C cascade hits, and all keywords miss, a total of 8 situations, which can meet the needs of A, B, and C separate searches, as well as A+B, A+C, B+C, and A+B+C combined searches.

[0045] Since different keyword combinations need to be matched in a cascade manner, in this embodiment, each table entry corresponds to a behavior table. When a keyword matches a table entry, the content of the corresponding entry in the corresponding behavior table is read as the result of the table lookup, and the next action is performed according to the behavior in the behavior table.

[0046] When performing keyword matching, in order to reduce the depth of the table, you can use the hash value as the search index, and compress the keyword into a hash value index to reduce the bit width. However, using the hash value as the index may cause hash conflicts. In order to avoid hash conflicts, multiple slots are allocated to each keyword in the table item, and each slot corresponds to a hash value of a keyword to avoid the situation where the hash values ​​of multiple keywords are the same. When matching, when the keyword is consistent with the keyword corresponding to a slot in the table item, the keyword hits the slot, that is, the keyword is found in the table item. The specific number of slots is determined according to actual needs. In the method provided in this embodiment, in order to avoid the table item being too deep, table item borrowing can also be used instead of directly increasing the depth of the original table. The depth of each table item is determined according to the bit width of the keyword. Assuming that the bit width of the keyword is N, the depth is 2 N The maximum number of keywords that each table entry can actually hold is the table depth * the number of slots. Considering that the hash collision will be greater as the number of cascades increases, the number of slots or the depth of the table entry can be appropriately increased according to the compression ratio and actual needs, or the number of slots and the depth can be increased at the same time. Figure 3 The figure shows a schematic diagram of a 4-slot hash lookup table entry in a specific instance. In the figure, each slot represents a hash value, and each slot with the same serial number corresponds to a keyword. The specific number of slots for each keyword is determined by the keyword bit width.

[0047] Step 102: Obtain keywords in the data packet, and match each row and column by column with corresponding entries in the two-dimensional lookup table structure, or match corresponding entries and borrowed entries simultaneously.

[0048] Once the two-dimensional lookup table entries are organized, they can be searched sequentially. Each column's entries can be searched synchronously within a single shot, allowing for continued search or borrowing. Specifically, starting with the first entry in each row, the hash value of the keyword corresponding to the current entry is calculated, and the entry is matched against the hash value. The behavior entry hit by the lookup result determines whether the next level of search requires borrowing, and the corresponding entry and borrowed entry are searched synchronously.

[0049] In the method provided by this embodiment, resources can be saved by borrowing entries. In step 101, a unique table number is assigned to each entry. When borrowing, the key to be searched is determined by the table number to avoid confusion caused by borrowing.

[0050] exist Figure 2 In the two-dimensional lookup table structure shown, the first step is to search the A1, B1, and C1 tables simultaneously, the second step is to search the B2 and C2 tables, and the third step is to search the C3 table. The A1 table has two situations: a hit and a miss. If it hits, A-hash is used as the specific calculated value, otherwise the configured value (0) is used instead. If the B2 table hits, B-hash is used as the previous hash value in the key to search the C3 table, otherwise A-hash is used to search the C3 table, and so on. For the case of more than 3 keys, the columns are stacked backward and downward in sequence until all keywords and all table items are matched, that is, the search and matching of all possible keyword combinations are completed.

[0051] In actual implementation, Figure 2 In the two-dimensional lookup table structure of three keywords shown, the implementation of various keyword combinations is explained as follows.

[0052] 1) A, B, C: Perform a separate table lookup for each keyword by directly searching the A1, B1, and C1 entries;

[0053] 2) A+B: If A1 table hits, search B2 table;

[0054] 3) B+C: If A1 is not hit and B2 is hit, search C3; or if B1 is hit, search C2. The resources between these two groups do not conflict with each other and can be shared.

[0055] 4) A+C: When A1 hits and B2 does not hit, search the C3 table; in a specific implementation, the priority of A+B and A+C can be determined by the order of table entries. When B is sorted before C, according to the table lookup order, A+B has a higher priority than A+C.

[0056] 5) A+B+C: In the case that A1 and B2 hit, look for C3.

[0057] Through the above process, the search and matching of the three keyword combinations 8 can be completed through only three searches, which significantly improves the search efficiency in the case of multiple keyword combinations.

[0058] Step 103: When the table entry corresponding to the keyword and / or the borrowed table entry is hit, the subsequent action to be performed is determined through the behavior table corresponding to the keyword until the search is completed.

[0059] During the matching process in step 103, when a keyword is found, the corresponding behavior table determines the priority of the search result and whether to stop the cascade search. The behavior table requires a behavior for each keyword, and the specific behavior is determined based on requirements and resource allocation. In the method provided in this embodiment, subsequent behaviors can be set as needed: stop the search, continue the backward search, use the borrow table search, etc.

[0060] When the resources of a certain table item are tight, in order to complete the search of a set of keyword combinations in the same beat, resources can be borrowed from other table items. The previous hit module determines the table number to be borrowed through the behavior table, and simultaneously searches the table that should be searched and the borrowed table. The keyword content that needs to be matched remains unchanged, and the keyword for this search is uniquely associated based on the first table number in the keyword content. When judging the matching results, the table that should be searched is used as the search result of the keyword corresponding table. If only the borrowed table is hit, it is also considered that the keyword of this search hits the original table item, and the behavior after the borrowed table is hit is consistent with the original table item.

[0061] To avoid reverse borrowing, only borrow from keywords with a larger or equal bit width than the keyword being searched. For example, if there are two keywords B and C, and the bit width of the keyword B is larger than that of C, then the C table can borrow from the B table.

[0062] During the actual matching process, the original table and the borrowed table are searched simultaneously. After the search is complete, multiple tables may be hit. Therefore, a priority level must be configured for all behavior entries to arbitrate the results. If multiple tables are hit, the final result is determined based on the priority level in the entry.

[0063] After steps 101 to 103 provided in this embodiment, keywords are serially connected to form two-dimensional lookup table entries to comprehensively cover any combination of multiple keywords, and resources can be saved by borrowing entries.

[0064] In step 101, in order to make the arrangement order of each row of table entries consistent with the priority order of keywords, in the specific implementation, the keywords with high priority are placed in front. On the other hand, the greater the bit width, the greater the possibility of hash collisions. In order to reduce hash collisions, keywords with the same priority have smaller bit widths placed in front. Furthermore, for keywords with larger bit widths, hash collisions can be further reduced by increasing the depth of the table entries or widening the number of slots, thereby saving resources as a whole. Specifically, all keywords to be matched can be cascaded and arranged in order from small to large bit width and from high to low priority, with each group of keywords serving as a table entry in the first row in turn. Starting from the second row, the first group of keywords of the previous row is removed from each row in turn until there is only one group of keywords in the last row.

[0065] Furthermore, in actual implementation scenarios, the number and type of keywords may change. When the keywords change, the keywords need to be arranged in the above order to complete the organization of the two-dimensional lookup table. When new keywords are added, the new keywords are inserted into the corresponding positions of each row according to the bit width from small to large and the priority from high to low, and the corresponding number of rows is increased according to the number and position of the new keywords; when the keywords are deleted, the corresponding table entries are deleted in each row, and the corresponding number of rows are deleted. In this way, the keyword combination can be adjusted quickly and conveniently, making the setting adjustment more flexible and able to adapt to business changes more flexibly.

[0066] When matching, in order to facilitate cascade matching and table item borrowing, when performing a matching search in step 102, for each table item, the keyword (Key) content that needs to be matched is: {table number, {table number hit by the previous stage, slot number hit by the previous stage, hash value of the previous stage}, keyword of this search}. The table number indicates the table number corresponding to the keyword, and uniquely identifies which keyword is being searched this time. In order to avoid confusion or conflicts caused by borrowing, when the table item used for matching is a borrowing table, the table number is the original table number of the keyword being searched this time, rather than the borrowed table number. Before the first search or the previous stage is not hit, all previous stage information defaults to 0 or a certain configuration value. {table number hit by the previous stage, slot number hit by the previous stage, hash value of the previous stage}: a unique identifier of the previous search result, the table number hit by the previous stage indicates the table of the previous cascade, the slot number hit by the previous stage is a number of the hash slot number hit by the previous stage, which distinguishes the search results of different slots and reduces hash conflicts in subsequent table lookups. When searching for a keyword alone, the table number is the table number corresponding to itself. Since it is a direct search and there is no cascade of the previous level, all values ​​of {the table number hit by the previous level, the slot number hit by the previous level, and the hash value of the previous level} are 0. When a table item is borrowed, all values ​​of the key remain unchanged. Figure 3In the table structure shown, the entry corresponding to this keyword type contains four slots, indicating that the entry can accommodate four matching keyword contents. These slots are slots 0, 1, 2, and 3, and the slots are numbered binary 3'h00, 3'h01, 3'h10, and 3'h11, respectively. Assuming that the hit is slot 1, the number used in subsequent searches is 3'h01, which uniquely identifies this slot number for this entry.

[0067] In this embodiment, when table entry resources are limited, there's no need to expand the table entry itself. Instead, resource usage is reduced through table entry borrowing. In this embodiment, resource borrowing is achieved using a uniquely identified table number. When matching a keyword, the table number must also be matched, and the actual key to be matched is determined by the table number. This is achieved by setting a flag in the behavior entry for each table, indicating the table that needs to be borrowed for the next level of table lookup. For example, if no borrowing is required, the flag value is 0; if borrowing is required, the flag value is the borrowed table number.

[0068] In actual implementation, when two or more beats are used to process a data packet, the key is borrowed from the table entry corresponding to the key with a larger or equal bit width than the key currently being searched. Figure 2 In the scenario, the following borrowing situations may exist: 1) C table items can borrow from each other; 2) B table items can borrow from each other; 3) If the key bit width of C is less than or equal to B, then C can borrow B's table. Take C3 borrowing B2's key as an example, that is, while searching the C3 table, it is also necessary to search the B2 table item. If the B2 table is hit, it is considered that the C Key is hit. If a hit occurs, the corresponding behavior table index and behavior table are also borrowed synchronously, that is, the C3 table uses the behavior table item corresponding to the B2 table, and the index is the index when the B2 table is normally hit. On the other hand, if the bit width of a keyword is less than the preset bit width lower limit, it can be considered to use the keyword index directly, and the corresponding table item will not be borrowed by other table items. At the same time, since a table item cannot be queried twice in the same beat, the synchronously searched tables do not borrow from each other, and wrong-beat borrowing is required.

[0069] Furthermore, because the number of slots or depths of table entries vary, to support table entry borrowing, {the table number hit by the previous stage, the slot number hit by the previous stage, and the previous stage hash value} are normalized, with the maximum required bit width used as the normalized bit width. For example, when the number of table entries is N, each table is represented by binary uniqueness, the table number remains unchanged, and the slot number and previous stage hash value are normalized using the maximum bit width. If the bit width is smaller, the high bits are padded with zeros.

[0070] Furthermore, in this embodiment, the contents of Bn, Cn, and Dn are different in themselves, and may have the same content format when borrowing table items. However, in addition to the special direct search table, in order for table items to be able to borrow from each other, in addition to the different keywords for this or newly added searches, the content formats in all table items can also be normalized.

[0071] When borrowing table entries, a table can be borrowed from several tables, depending on the number of times a table can be queried for a packet. Because a table entry cannot be queried twice in the same beat, the maximum number of times each table entry can be borrowed is the number of beats it takes to process a packet minus one. When two beats process a packet, each table entry can only be borrowed from one table due to its own table lookup. If N (N >= 2) beats process a packet, it can be borrowed from N-1 tables.

[0072] The keyword matching method during flow classification provided in this embodiment designs a serial cascade flow classification method with a ladder-like structure. When searching and matching, it quickly and fully covers any combination of various keywords, and realizes table item borrowing by matching table numbers, saving table item storage resources; by matching table numbers and numbers, hash conflicts can also be reduced by borrowing resources and increasing slot numbers or table item depths as the cascade increases. It can be applied to low, medium and high-speed packet processing scenarios at the same time, and realizes fast matching when multiple keyword combinations are used.

[0073] Example 2:

[0074] Based on the keyword matching method for flow classification provided in Example 1, in different specific application scenarios, it can also be supplemented and adjusted according to different usage requirements or actual scenarios. In this embodiment, an example in a specific scenario is provided, and the implementation can be completed according to the method provided in Example 1 with reference to the example in this embodiment. The following is only one possible implementation method. In the specific implementation, it can be combined with the existing implementation method according to actual conditions without conflict, or the specific implementation process can be adjusted. The specific numerical values ​​in this embodiment are a set of available values ​​in a specific scenario provided for the convenience of description. In the specific implementation process, each numerical value is determined according to actual needs and business characteristics.

[0075] In the specific scenario of this embodiment, four keywords A, B, C, and D are used as examples for specific description. Keyword A is a 7-bit port number, keyword B is a 12-bit VLAN ID (Virtual Local Area Network Identity), keyword C is a 3-bit VLAN Class of Service (COS), and keyword D is a 16-bit Ethernet type.

[0076] First, according to step 101, the table entries corresponding to the four keywords are concatenated into a two-dimensional lookup table structure. Specifically, the first row contains all corresponding table entries for all four keywords. The priority between the keywords is determined based on actual business needs and takes into account the keyword bit width. Ports are searched by default and therefore have the highest priority. In the business scenario of this embodiment, VLAN has a higher priority than Ethernet type. In the keyword combination of this embodiment, considering that in actual applications, VLAN COS is bound to VLAN ID and VLAN ID is generally searched before VLAN COS, VLAN ID is sorted before VLAN COS. After sorting by priority, the table entries in the first row are: Port - VLAN ID - VLAN COS - Ethernet type.

[0077] For each subsequent row, remove the first entry from the previous row. The second row's entry is: VLAN ID - VLAN COS - Ethernet type. The third row's entry is: VLAN COS - Ethernet type. The fourth row's entry is: Ethernet type. Because VLAN COS does not appear alone, to reduce table lookups, the serial table starting with VLAN COS in row 3 is further discarded.

[0078] Perform the above Figure 4 shown.

[0079] The two-dimensional lookup table contains 8 entries, so 3 bits are used to uniquely identify a table. The binary values ​​of the table numbers are: 000, 001, 010, 011, 100, 101, 110, 111, corresponding to decimal 0-7 respectively.

[0080] For each table entry, you also need to determine the number and width of hash slots for each table. The specific number and width of slots are determined based on actual business needs.

[0081] 1) Table 0 is a direct lookup table with a depth of 128;

[0082] 2) Table 1 uses a 4-slot table with a depth of 512;

[0083] 3) Table 2 uses an 8-slot, 1K-deep table;

[0084] 4) Table 3 uses an 8-slot, 2K-deep table;

[0085] 5) Table 4 uses a 4-slot, 256-deep table;

[0086] 6) Table 5 uses a 4-slot table with a depth of 512;

[0087] 7) Table 6 uses an 8-slot, 1K-deep table;

[0088] 8) Table 7 uses a 4-slot table with a depth of 256.

[0089] To facilitate table entry borrowing, the key structure of {previous table number, previous slot number, and previous hash value} is normalized. The table number is kept consistent with the unique identifier table number (3 bits), the slot number is kept consistent with the maximum slot width of 8 (3 bits), and the previous hash value is 11 bits, depending on actual needs. For tables with insufficient bit width, the high-order bits of each parameter are padded with 0s.

[0090] According to Figure 5 The behavior table shown determines the bit width of the borrowed entry number and the lookup result priority in the behavior entry content. The bit width of the entry number is consistent with the table number bit width, which is 3 bits. The bit width of the lookup result priority is set to 3 bits based on the number of entries 8.

[0091] In the scenario of this embodiment, one data packet is processed every two beats, so the maximum number of times an entry can be borrowed is one.

[0092] According to step 102, a matching search is performed on the keyword in the data packet. In the high-speed scenario where one data packet is processed in two beats in this embodiment, the search timing is as follows: Figure 6 As shown, Clock represents the timing of the reference clock, the pkt_vld line represents the timing of the data packet decoding process, pkt represents the timing of the data packet, and the last four lines represent the timing of the table entry search, and the numbers represent the table numbers of the searches. The first beat synchronously searches Table 0, Table 4, and Table 7; the second beat synchronously searches Table 1 and Table 5; the third beat synchronously searches Table 2 and Table 6, and the fourth beat synchronously searches Table 3. According to the method of this embodiment, only four beats are needed to complete the search of 8 keyword combinations, and the existing search timing will not be changed, which improves the search efficiency and is easy to integrate with the existing system. In other scenarios, when the processing timing is 4 beats to process a data packet, the timing diagram is as follows Figure 7 When the processing sequence is 4 beats to process a data packet, the timing diagram is as follows. Figure 8 As shown, Figure 7 and Figure 8 The comparison of 2_6_find_en line shows that Figure 8 Since Table 3 borrows from Table 6, the total processing time of Table 2 and Table 6 doubles, but it is carried out in parallel with the search of Table 3, so the overall search time does not increase. Figure 6-Figure 8 It can be seen that the method provided in Example 1 can be applied to low, medium, and high rate flow classification scenarios. In specific implementation scenarios, the processing sequence can be adjusted according to actual needs.

[0093] For data packet 1 in this embodiment, the keyword matching is as follows Figure 9The second column in the figure shows the contents of the keyword table, and the third through ninth columns show the contents of the behavior table corresponding to the keyword table after the hit search. According to step 103, in accordance with the aforementioned matching search method and timing, combined with the actions in the behavior table, the specific search process for each keyword and keyword combination in data packet 1 is as follows.

[0094] 1) Find the first row of the serial cascade table starting with the port:

[0095] a) Lookup table 0: Directly use port to lookup table 0. The port lookup result is valid. The lower level does not need to borrow the table. The priority is 0, and continue to lookup table 1.

[0096] b) Lookup Table 1: The information in the previous-level Table 0 is represented by {3'h0,3'h0,port}. The newly added keyword is VLANID. The calculated hash value is V1-hash, which is used to look up Table 1. The lookup result is valid, and the slot number hit is 2. The lower level does not need to borrow the table, and the priority is 3. The search continues to Table 2.

[0097] c) Lookup Table 2: The information in the previous-level Table 1 is represented by {3'h1, 3'h2, V1-hash}. The newly added keyword is VLAN COS. The calculated hash value is C1-hash, which is used to look up Table 2. The lookup result is valid, and the matching slot is 6. The next level needs to borrow Table 6, which has a priority of 5. The search continues to Table 3.

[0098] d) Simultaneously search Table 3 and the borrowed Table 6: {3'h2, 3'h6, C1-hash} represents the information in the previous Table 2. The newly added keyword is the Ethernet type, and the search keyword content is {3'h3, {3'h2, 3'h6, C1-hash}, Ethernet type}. The calculated hash result is E1-hash, and the hash value E1-hash is used to search Tables 3 and 6. The result of the Table 6 search is invalid, while the result of the Table 3 search is valid. The corresponding behavior table in Table 3 has a priority of 7, and the stop search indicator is 1, successfully completing this port-based serial cascade search.

[0099] 2) Find the second row of the serial cascade table starting with the VLAN ID:

[0100] a) Lookup Table 4: All previous information is 0. The search keyword is the VLAN ID. The calculated hash value V2-hash is directly used to lookup Table 4. The lookup result is valid, and the hit slot number is 1. The lower level does not need to borrow the table, the priority is 2, and the search continues to Table 5.

[0101] b) Lookup Table 5: The information in the previous Table 4 is represented by {3'h4,3'h1,V2-hash}. The newly added keyword is VLAN COS. The calculated hash value is C2-hash, which is used to look up Table 5. The lookup result is valid, the priority is 4, and the stop search indicator is 1. This terminates the serial cascade search starting with the VLAN ID, eliminating the need to look up Table 6.

[0102] 3) Find the third row of the Ethernet type table separately:

[0103] a) Lookup Table 7: All previous information is 0. The search keyword is Ethernet type. The calculated hash value E2-hash is directly used to lookup Table 7. The lookup result is valid, the priority is 1, and the stop search indicator is 1, completing this search normally.

[0104] After searching all table entries and keywords, the search results are arbitrated, and traffic classification is completed based on the matching keywords or keyword combinations. In this process, by comparing valid search results, the result of searching Table 3 using Table 6 is given the highest priority. This result is used as the final search result, completing the traffic classification operation. Subsequent packet processing is performed based on this traffic classification result.

[0105] This embodiment is based on the first embodiment. In a specific example, the serial cascade search flow classification is completed, covering all combinations of various keywords. The advantage is more obvious in scenarios with more keywords and keyword combinations, and reduces hash conflicts caused by too many keyword combinations or too many entries. At the same time, by borrowing between entries, resources are saved and resource utilization is improved.

[0106] Example 3:

[0107] Based on the method for keyword matching during flow classification provided in the above embodiments 1 and 2, the present invention also provides a device for keyword matching during flow classification that can be used to implement the above method, such as Figure 10 , is a schematic diagram of the device architecture of an embodiment of the present invention. The device for keyword matching during flow classification in this embodiment includes one or more processors 11 and a memory 12. This device can be implemented in the form of an integrated circuit, a single chip microcomputer or a system on a chip, and is widely applicable to packet and broadband access chip circuit design. In the field of communication technology, where network applications are flexible and management is sophisticated, the function of flow classification in multi-keyword scenarios can be quickly and effectively completed. Among them, Figure 10 A processor 11 is taken as an example.

[0108] The processor 11 and the memory 12 may be connected via a bus or other means. Figure 10 The bus connection is taken as an example.

[0109] The memory 12, as a non-volatile computer-readable storage medium for the keyword matching method during flow classification, can be used to store non-volatile software programs, non-volatile computer executable programs, and modules, such as the keyword matching method during flow classification in Examples 1 and 2. The processor 11 executes the various functional applications and data processing of the apparatus for keyword matching during flow classification by running the non-volatile software programs, instructions, and modules stored in the memory 12, thereby implementing the keyword matching method during flow classification in Examples 1 and 2.

[0110] The memory 12 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state memory device. In some embodiments, the memory 12 may optionally include a memory remotely located relative to the processor 11, and such remote memory may be connected to the processor 11 via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0111] The program instructions / modules are stored in the memory 12. When executed by one or more processors 11, the method for keyword matching during flow classification in the above-mentioned embodiments 1 to 2 is executed. For example, the method described above is executed. Figure 1 The steps shown, or Figure 6-Figure 8 The various timings shown.

[0112] Those skilled in the art will understand that all or part of the steps in the various methods of the embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), a disk or an optical disk, etc.

[0113] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for keyword matching during flow classification, characterized by: The keywords to be matched are organized into a two-dimensional lookup table structure. Each table entry corresponds to a keyword type and has a unique table number. The number of rows and columns in the two-dimensional lookup table structure corresponds to the number of keyword types. The first row is a concatenation of all keyword types. The first table entry of the previous row is removed from each subsequent row. Obtain the keyword in the data packet, and match each row and column by column with the corresponding entry in the two-dimensional lookup table structure, or match the corresponding entry and the borrowed entry simultaneously; When the table entry corresponding to the keyword and / or the borrowed table entry is hit, the subsequent actions to be performed are determined by the behavior table corresponding to the keyword until the search is completed; The keywords to be matched are formed into a two-dimensional lookup table structure, specifically including: All keywords to be matched are concatenated and arranged in order of bit width from small to large and priority from high to low. Each group of keywords is an entry in the first row. Starting from the second line, the first group of keywords of the previous line is removed in each line in turn until the last line has only one group of keywords.

2. The method for keyword matching during flow classification according to claim 1, characterized in that: The keywords to be matched are formed into a two-dimensional lookup table structure, further comprising: When adding new keywords, insert the new keywords into the corresponding positions of each row according to the bit width from small to large and the priority from high to low, and increase the number of rows according to the number and position of the new keywords; When deleting a keyword, delete the corresponding entry in each row and the corresponding number of rows.

3. The method for keyword matching during flow classification according to claim 1, characterized in that: The step of matching each row sequentially and backwardly column by column with a corresponding entry in the two-dimensional lookup table structure or matching the corresponding entry and the borrowed entry simultaneously includes: According to the keyword order corresponding to each row of table entries, starting from the first table entry in each row, the hash value of the keyword corresponding to the current table entry is calculated, and the table entry is matched based on the hash value; According to the behavior table entry hit by the table lookup result, it is determined whether the next level search needs to borrow the table entry, and the corresponding table entry and the borrowed table entry are searched simultaneously.

4. The method for keyword matching during flow classification according to claim 3, characterized in that: The step of determining whether a next-level search requires entry borrowing based on the behavior entry hit by the table lookup result further includes: Borrow from the table entries corresponding to the keywords with a width greater than or equal to that of the keyword being searched. If the width of a keyword is less than the preset lower limit of the width, the corresponding table entry will not be borrowed by other table entries.

5. The method for keyword matching during flow classification according to claim 1, characterized in that: Each row is matched sequentially and column by column in the two-dimensional lookup table structure with a corresponding table entry or a corresponding table entry and a borrowed table entry at the same time, further comprising: For each table entry, the keyword content that needs to be matched is: {table number, {table number hit by the previous level, slot number hit by the previous level, previous level hash value}, keyword for this search}; When the table entry used for matching is a borrowed table, the table number is the original table number of the search keyword.

6. The method for keyword matching during flow classification according to claim 5, characterized in that: The keyword content that needs to be matched also includes: Normalize {the table number hit by the previous stage, the slot number hit by the previous stage, and the previous stage hash value}, and use the maximum required bit width as the bit width after normalization.

7. The method for keyword matching during flow classification according to claim 1, characterized in that: Each row is matched sequentially backward column by column with corresponding entries and borrowed entries in the two-dimensional lookup table structure, further comprising: The maximum number of times each table entry is borrowed is the number of times a data packet is processed minus one.

8. The method for keyword matching during flow classification according to claim 1, characterized in that: The subsequent actions to be performed are determined by the behavior table corresponding to the keyword, specifically including: When a keyword hits multiple table entries at the same time, the final table lookup result is determined based on the priority in the behavior table entry.

9. A device for keyword matching during flow classification, characterized by: The method comprises at least one processor and a memory, wherein the at least one processor and the memory are connected via a data bus, and the memory stores instructions that can be executed by the at least one processor, and after being executed by the processor, the instructions are used to complete the method for keyword matching during flow classification according to any one of claims 1 to 8.

Images