A high-speed query method for firewall session link table based on hardware HASH algorithm

Abstract

The present invention belongs to the field of network security application scenarios and relates to a high-speed query method for a firewall session link table based on a hardware HASH algorithm. A high-speed query method for a firewall session link table based on a hardware HASH algorithm is characterized in that it includes a five-tuple, wherein the five-tuple includes a source IP, a source port, a destination IP, a destination port, and a protocol number, and a HASH algorithm is performed on the five-tuple. Through the HASH algorithm of the present application, session link table conflicts can be greatly reduced and the efficiency of link table queries can be improved. A HASH index allocation method based on the HASH algorithm reasonably distributes a large number of session link tables in a hardware memory, facilitates the query of the session connection table, and ensures that the firewall device can establish up to 1 million session links.

Description

Technical Field

[0001] The present invention belongs to the field of network security application scenarios and relates to a high-speed query method for a firewall session link table based on a hardware HASH algorithm. Background Art

[0002] In the field of network security application scenarios, due to the continuous improvement of network performance requirements, the demand for hardware-based firewalls is increasing.

[0003] In the related technology, the current firewall session link table query method is mostly only applicable to software. The HASH algorithm and the query rules of the session link table are complex, and the 128-bit five-tuple key information needs to be compressed into a 24-bit index number. The compressed index number has a large conflict and is difficult to implement in hardware, which makes it difficult to establish the session link table. The greater the number of session links established, the more difficult it is to hit the hardware query, which causes the performance of the security device to be greatly reduced, making it difficult to meet the rapid development of network security acceleration equipment.

[0004] Therefore, it is necessary to develop a HASH algorithm with low HASH conflict and a high-speed query method for the session link table that is applicable to both software and hardware, so as to ensure the performance of the firewall device. Summary of the Invention

[0005] To solve the above problems, the present invention provides a HASH algorithm and a high-speed query method for a session link table with low HASH conflict and applicable to both software and hardware.

[0006] A high-speed query method for a firewall session link table based on a hardware HASH algorithm comprises a quintuple, wherein the quintuple comprises a source IP address, a source port, a destination IP address, a destination port, and a protocol number. The steps of performing a HASH algorithm on the quintuple are as follows: S1, first defining 2048 unsigned random numbers and forming them into an unsigned static two-dimensional array with 8 rows and 256 columns; S2, performing a first operation on the source IP address, the source port, the destination IP address, and the destination port to obtain a 32-bit unsigned number number1; S3, performing a second operation on the protocol number and number1 to obtain a 32-bit unsigned number number2; S4, performing a third operation on the source IP address and number2 to obtain a 32-bit unsigned number number3; S5, performing a fourth operation on the destination port and number3 to obtain a 32-bit unsigned number number4; S6, performing a fifth operation on the destination IP address and number4 to obtain a 32-bit unsigned number number5; and S7, performing a sixth operation on the source port and number5 to obtain a 24-bit unsigned number, which is the final hash value.

[0007] Furthermore, the step S2 is specifically as follows: S201, combining the lower 16 bits of the 32-bit source IP address and the 16-bit source port number into a new 32-bit number num1; S202, combining the lower 16 bits of the 32-bit destination IP and the 16-bit destination port number into a new 32-bit number num2; S203, performing an XOR operation on num1 and num2 to obtain num3; S204, shifting num3 right by 8 bits and performing a bitwise AND operation with 0xff to obtain a 0-255 number num4; S205, taking out the 32-bit unsigned number num5 corresponding to num4 from the first row of the static two-dimensional array in S1; S206, performing a bitwise AND operation on num3 and 0xff to obtain a 0-255 number num6; S207, taking out the 32-bit unsigned number num7 corresponding to num6 from the second row of the static two-dimensional array in S1; S208, shifting num3 right by 16 bits to obtain num8; S209, combining num5 and num7 And num8 performs an XOR operation to obtain a 32-bit unsigned number number1.

[0008] Furthermore, the step S3 is specifically as follows: S301, performing an XOR operation on the protocol number and number1 to obtain num1; S302, performing a bitwise AND operation on num1 and 0xff to obtain num2; S303, taking out the 32-bit unsigned number num3 corresponding to num2 in the first row of the static two-dimensional array; S304, shifting num1 right by 8 bits to obtain num4; S305, performing an XOR operation on num3 and num4 to obtain number2.

[0009] Furthermore, the step S4 is specifically as follows: S401, performing an XOR operation on the source IP address in the quintuple and number2 to obtain num1; S402, performing a bitwise AND operation on num1 and 0xff to obtain num2; S403, shifting num1 right by 8 bits and performing a bitwise AND operation on 0xff to obtain num3; S404, taking out the 32-bit unsigned number num4 corresponding to num2 from the fourth row of the static two-dimensional array; S405, taking out the 32-bit unsigned number num5 corresponding to num3 from the third row of the static two-dimensional array; S406, performing an XOR operation on num4 and num5. After the calculation, num6 is obtained; S407, num1 is shifted right by 16 bits to obtain num7; S408, num7 is bitwise ANDed with 0xff to obtain num8; S409, num7 is shifted right by 8 bits and then bitwise ANDed with 0xff to obtain num9; S410, the 32-bit unsigned number num10 corresponding to num8 is taken out from the second row of the static two-dimensional array; S412, the 32-bit unsigned number num11 corresponding to num9 is taken out from the first row of the static two-dimensional array; S413, num6, num9 and num11 are XORed to obtain Number3.

[0010] Furthermore, the step S5 is specifically as follows: S501, performing an XOR operation on the destination port in the quintuple and Number3 to obtain num1; S502, performing a bitwise AND operation on num1 and 0xff to obtain num2; S503, shifting num1 right by 8 bits and performing a bitwise AND operation on num1 and 0xff to obtain num3; S504, taking out the 32-bit unsigned number num4 corresponding to num2 in the second row of the static two-dimensional array; S505, taking out the 32-bit unsigned number num5 corresponding to num3 in the first row of the static two-dimensional array; S506, shifting num1 right by 16 bits to obtain num6; S501, finally performing an XOR operation on num4, num5 and num6 to obtain number4.

[0011] Furthermore, the step S6 is specifically as follows: S601, performing an XOR operation on the destination IP address in the quintuple and number4 to obtain num1; S602, performing a bitwise AND operation on num1 and 0xff to obtain num2; S603, shifting num1 right by 8 bits and performing a bitwise AND operation on 0xff to obtain num3; S604, taking out the 32-bit unsigned number num4 corresponding to num2 from the fourth row of the static two-dimensional array; S605, taking out the 32-bit unsigned number num5 corresponding to num3 from the third row of the static two-dimensional array; S606, performing an XOR operation on num4 and num5. After the calculation, we get num6; S607, shift num1 right by 16 bits to get num7; S608, perform a bitwise AND operation on Num7 and 0xff to get num8; S609, shift num7 right by 8 bits and perform a bitwise AND operation on it with 0xff to get num9; S610, take out the 32-bit unsigned number num10 corresponding to num8 in the second row of the static two-dimensional array; S611, take out the 32-bit unsigned number num11 corresponding to num9 in the first row of the static two-dimensional array; S612, perform an XOR operation on num6, num9 and num11 to get Number5.

[0012] Furthermore, step S7 is specifically as follows: S701, performing an XOR operation on the source port in the quintuple and Number5 to obtain num1; S702, performing a bitwise AND operation on Num1 and 0xff to obtain num2; S703, shifting num1 right by 8 bits and performing a bitwise AND operation on 0xff to obtain num3; S704, taking out the 32-bit unsigned number num4 corresponding to num2 in the second row of the static two-dimensional array; S705, taking out the 32-bit unsigned number num5 corresponding to num3 in the first row of the static two-dimensional array; S706, shifting num1 right by 16 bits to obtain num6; S707, finally performing an XOR operation on num4, num5 and num6 to obtain num7; S708, performing a modulo operation on num7 with 2 to the power of 24 to obtain the final hash value.

[0013] Furthermore, the system includes software, hardware, and an external storage unit. The software sends the HASH index and table entries of the session link table to the hardware, and the hardware writes the received link table entries into the external storage unit.

[0014] The present invention has the following beneficial effects: The HASH algorithm of this application can significantly reduce session link table conflicts and improve link table query efficiency. A HASH index allocation method based on the HASH algorithm rationally distributes a large number of session link tables in hardware memory, facilitating session link table queries and ensuring that firewall devices can establish up to 1 million session links. This reduces hardware implementation difficulty, hardware resource utilization, and network message processing jitter, while ensuring high-speed session link table query performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 The present invention proposes a flowchart of a high-speed query method for a firewall session link table based on a hardware HASH algorithm;

[0016] Figure 2 The present invention provides a flowchart of step S2 of a high-speed query method for a firewall session link table based on a hardware HASH algorithm;

[0017] Figure 3 The present invention provides a flowchart of step S3 of a high-speed query method for a firewall session link table based on a hardware HASH algorithm;

[0018] Figure 4 The present invention provides a flowchart of step S4 of a high-speed query method for a firewall session link table based on a hardware HASH algorithm;

[0019] Figure 5 The present invention provides a flowchart of step S5 of a high-speed query method for a firewall session link table based on a hardware HASH algorithm;

[0020] Figure 6 The present invention provides a flowchart of step S6 of a high-speed query method for a firewall session link table based on a hardware HASH algorithm;

[0021] Figure 7 The present invention provides a flowchart of step S7 of a high-speed query method for a firewall session link table based on a hardware HASH algorithm;

[0022] Figure 8 The overall block diagram of the link table entry access method based on HASH index of the firewall session link table high-speed query method based on hardware HASH algorithm proposed by the present invention;

[0023] Figure 9The present invention proposes a flowchart of a HASH allocation method when software issues link table entries in a high-speed query method for a firewall session link table based on a hardware HASH algorithm;

[0024] Figure 10 The present invention proposes a high-speed query method for the firewall session link table based on the hardware HASH algorithm, which is a flow chart of the FPGA high-speed query mechanism;

[0025] Figure 11 This is a schematic diagram of the HASH algorithm simulation results of the firewall session link table high-speed query method based on the hardware HASH algorithm proposed in the present invention;

[0026] Figure 12 The present invention proposes a high-speed query method for the firewall session link table based on the hardware HASH algorithm, which shows the statistical graph of the number of hashes distributed within the unit space. DETAILED DESCRIPTION

[0027] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided solely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, apparatus, device, method, or computer program product. Therefore, the present disclosure may be implemented in the following forms: entirely in hardware, entirely in software (including firmware, resident software, microcode, etc.), or in a combination of hardware and software.

[0029] The symbols in this embodiment are explained as follows: “ ^ ” is the exclusive OR operator; “ >> ” is the right shift; “<<” is the left shift; “ & ” is the AND operator; “ | ” is the OR operator; “sip” is the source IP address; “dip” is the destination IP address; “sport” is the source port number; “dport” is the destination port number; “proto” is the protocol number; “Array[8]

[256] ” is a two-dimensional array with 8 rows and 256 columns; “hash” is the hash value finally obtained by the algorithm;

[0030] Example 1

[0031] In order to solve the problems that most of the existing firewall session link table query methods are only applicable to software and the HASH algorithm and session link table query rules are complicated, a hash algorithm is proposed.

[0032] like Figure 1 As shown, a high-speed query method for a firewall session link table based on a hardware HASH algorithm includes a quintuple, wherein the quintuple includes a source IP, a source port, a destination IP, a destination port, and a protocol number. The steps of performing a HASH algorithm on the quintuple are as follows: S1, first defining 2048 unsigned random numbers and forming them into an unsigned static two-dimensional array of 8 rows and 256 columns; S2, performing a first operation on the source IP, source port, destination IP, and destination port to obtain a 32-bit unsigned number number1; S3, performing a second operation on the protocol number and number1 to obtain a 32-bit unsigned number number2; S4, performing a third operation on the source IP and number2 to obtain a 32-bit unsigned number number3; S5, performing a fourth operation on the destination port and number3 to obtain a 32-bit unsigned number number4; S6, performing a fifth operation on the destination IP and number4 to obtain a 32-bit unsigned number number5; S7, performing a sixth operation on the source port and number5 to obtain a 24-bit unsigned number, which is the final hash value;

[0033] like Figure 2 As shown, the step S2 is specifically as follows: S201, combining the lower 16 bits of the 32-bit source IP address and the 16-bit source port number into a new 32-bit number num1; S202, combining the lower 16 bits of the 32-bit destination IP and the 16-bit destination port number into a new 32-bit number num2; S203, performing an XOR operation on num1 and num2 to obtain num3; S204, shifting num3 right by 8 bits and performing a bitwise AND operation with 0xff to obtain a 0-255 number num4; S205, taking out the 32-bit unsigned number num5 corresponding to num4 from the first row of the static two-dimensional array in S1; S206, performing a bitwise AND operation on num3 and 0xff to obtain a 0-255 number num6; S207, taking out the 32-bit unsigned number num7 corresponding to num6 from the second row of the static two-dimensional array in S1; S208, shifting num3 right by 16 bits to obtain num8; S209, combining num5 and num7 And num8 performs an XOR operation to obtain a 32-bit unsigned number number1.

[0034] like Figure 3 As shown, the step S3 is specifically as follows: S301, performing an XOR operation on the protocol number and number1 to obtain num1; S302, performing a bitwise AND operation on num1 and 0xff to obtain num2; S303, taking out the 32-bit unsigned number num3 corresponding to num2 in the first row of the static two-dimensional array; S304, shifting num1 right by 8 bits to obtain num4; S305, performing an XOR operation on num3 and num4 to obtain number2.

[0035] like Figure 4 As shown, the step S4 is specifically as follows: S401, performing an XOR operation on the source IP address in the quintuple and number2 to obtain num1; S402, performing a bitwise AND operation on num1 and 0xff to obtain num2; S403, shifting num1 right by 8 bits and performing a bitwise AND operation on 0xff to obtain num3; S404, taking out the 32-bit unsigned number num4 corresponding to num2 in the fourth row of the static two-dimensional array; S405, taking out the 32-bit unsigned number num5 corresponding to num3 in the third row of the static two-dimensional array; S406, performing an XOR operation on num4 and num5. Then get num6; S407, shift num1 right by 16 bits to get num7; S408, perform a bitwise AND operation on num7 and 0xff to get num8; S409, shift num7 right by 8 bits and perform a bitwise AND operation on 0xff to get num9; S410, take out the 32-bit unsigned number num10 corresponding to num8 in the second row of the static two-dimensional array; S412, take out the 32-bit unsigned number num11 corresponding to num9 in the first row of the static two-dimensional array; S413, perform an XOR operation on num6, num9 and num11 to get Number3.

[0036] like Figure 5 As shown, the step S5 is specifically as follows: S501, performing an XOR operation on the destination port in the quintuple and Number3 to obtain num1; S502, performing a bitwise AND operation on num1 and 0xff to obtain num2; S503, shifting num1 right by 8 bits and performing a bitwise AND operation on num1 and 0xff to obtain num3; S504, taking out the 32-bit unsigned number num4 corresponding to num2 in the second row of the static two-dimensional array; S505, taking out the 32-bit unsigned number num5 corresponding to num3 in the first row of the static two-dimensional array; S506, shifting num1 right by 16 bits to obtain num6; S501, finally performing an XOR operation on num4, num5 and num6 to obtain number4.

[0037] like Figure 6As shown, the step S6 is specifically as follows: S601, performing an XOR operation on the destination IP address in the quintuple and number4 to obtain num1; S602, performing a bitwise AND operation on num1 and 0xff to obtain num2; S603, shifting num1 right by 8 bits and performing a bitwise AND operation on 0xff to obtain num3; S604, taking out the 32-bit unsigned number num4 corresponding to num2 in the fourth row of the static two-dimensional array; S605, taking out the 32-bit unsigned number num5 corresponding to num3 in the third row of the static two-dimensional array; S606, performing an XOR operation on num4 and num5. Then get num6; S607, shift num1 right by 16 bits to get num7; S608, perform bitwise AND operation on Num7 and 0xff to get num8; S609, shift num7 right by 8 bits and perform bitwise AND operation on 0xff to get num9; S610, take out the 32-bit unsigned number num10 corresponding to num8 in the second row of the static two-dimensional array; S611, take out the 32-bit unsigned number num11 corresponding to num9 in the first row of the static two-dimensional array; S612, perform XOR operation on num6, num9 and num11 to get Number5.

[0038] like Figure 7 As shown, step S7 is specifically as follows: S701, performing an XOR operation on the source port in the quintuple and Number5 to obtain num1; S702, performing a bitwise AND operation on Num1 and 0xff to obtain num2; S703, shifting num1 right by 8 bits and performing a bitwise AND operation on 0xff to obtain num3; S704, taking out the 32-bit unsigned number num4 corresponding to num2 in the second row of the static two-dimensional array; S705, taking out the 32-bit unsigned number num5 corresponding to num3 in the first row of the static two-dimensional array; S706, shifting num1 right by 16 bits to obtain num6; S707, finally performing an XOR operation on num4, num5 and num6 to obtain num7; S708, performing a modulo operation on num7 with 2 to the power of 24 to obtain the final hash value.

[0039] This hash algorithm can significantly reduce session connection table conflicts and improve the efficiency of link table queries.

[0040] like Figure 11 As shown in the figure, this figure shows the simulation results of the HASH algorithm on the five-tuple data in the simulated real network scenario.

[0041] A simulation of 1 million session connections formed by 2 million traffic flows in a real scenario was conducted. A hash value was generated for each traffic flow. The 2 million hash data were almost evenly distributed in the 2 to 24 power space. The number of hash values ​​with no conflicts was as high as 1.936 million, accounting for 96.83%. The number of hash values ​​with one conflict was approximately 58,000, accounting for 2.91%. The number of hash values ​​with 2 to 5 conflicts was approximately 5,000, accounting for 0.26%. The proportion of hash values ​​with more than 5 conflicts was 0.

[0042] like Figure 12 As shown in the figure, this figure is a statistical chart of the number of hashes distributed in a unit space, with 1000 adjacent spaces as units. From this figure, we can clearly see that in the application scenario of network security equipment, in 2 to the power of 24 spaces, the number of hashes distributed in each adjacent 1000 spaces is relatively uniform.

[0043] In summary, by simulating data from an actual network environment, the HASH result conflicts simulated by the HASH algorithm in the present invention can be basically controlled within a range of less than or equal to 5, and the evenly distributed hashing effect is obvious.

[0044] Example 2

[0045] like Figure 8 As shown, based on the above hash algorithm, this embodiment proposes a link table entry access method based on HASH index, including software, hardware and an external storage unit. The software sends the HASH index and table entries of the session link table to the hardware, and the hardware writes the received link table entries into the external storage unit.

[0046] The software sends the HASH index and table entries of the session connection table to the hardware. When a network message is received, the hardware obtains the index based on the five-tuple information of the network message through the HASH algorithm consistent with the software and queries the corresponding session connection table.

[0047] like Figure 9 As shown, based on the HASH algorithm in the present invention, most of the HASH conflicts are less than or equal to 5. Therefore, after the software performs the HASH algorithm on the session link table, if the HASH index is compared with the "FPGA index number list" maintained by the software

[0048] If there is no conflict in the HASH index of the link, the index is directly used and sent to the hardware;

[0049] When the HASH index of the link conflicts, the HASH value is incremented by 1 and compared with the "FPGA index number list" maintained by the software until there is no conflict. Then the index value is sent to the hardware.

[0050] Since the HASH algorithm in the present invention can ensure that most HASH conflicts of network messages are limited to less than 5, when the HASH index conflicts, the self-imposed limit is less than or equal to 5. When it is greater than 5, the link table is not sent to the hardware.

[0051] Since the HASH algorithm of the present invention has low conflicts and the software maintains the HASH index, it is limited to only sending session link tables with conflicts less than or equal to 5. Therefore, the FPGA can use a method of querying 5 session link tables for each network message and comparing these 5 table entries in turn to determine whether the session connection table is hit.

[0052] This method can achieve consistent session connection table query latency for each message, thereby reducing message forwarding jitter;

[0053] This method can significantly reduce the difficulty of implementing hardware querying the session connection table without affecting the efficiency of querying the session connection table, thereby achieving high-speed querying of the session connection table.

[0054] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A high-speed query method for a firewall session link table based on a hardware HASH algorithm, characterized in that: The five-tuple includes the source IP, source port, destination IP, destination port, and protocol number. The steps of performing the HASH algorithm on the five-tuple are as follows: S1, first define 2048 unsigned random numbers and form them into an unsigned static two-dimensional array of 8 rows and 256 columns; S2, perform the first operation on the source IP, source port, destination IP and destination port to obtain a 32-bit unsigned number number1; S3, perform a second operation on the protocol number and number1 to obtain a 32-bit unsigned number number2; S4, perform a third operation on the source IP and number2 to obtain a 32-bit unsigned number number3; S5, perform the fourth operation on the destination port and number3 to obtain a 32-bit unsigned number number4; S6, perform the fifth operation on the destination IP and number4 to obtain a 32-bit unsigned number number5; S7, perform the sixth operation on the source port and number5 to obtain a 24-bit unsigned number, which is the final hash value; The step S2 is specifically as follows: S201, combines the lower 16 bits of the 32-bit source IP address and the 16-bit source port number into a new 32-bit number num1; S202, combine the lower 16 bits of the 32-bit destination IP address and the 16-bit destination port number into a new 32-bit number num2; S203, perform XOR operation on num1 and num2 to obtain num3; S204, shift num3 right by 8 bits and perform a bitwise AND operation with 0xff to obtain a number num4 between 0 and 255; S205, extract the 32-bit unsigned number num5 corresponding to num4 from the first row of the static two-dimensional array in S1; S206, perform a bitwise AND operation on num3 and 0xff to obtain a 0-255 number num6; S207, extract the 32-bit unsigned number num7 corresponding to num6 from the second row of the static two-dimensional array in S1; S208, shift num3 right by 16 bits to obtain num8; S209, perform an XOR operation on num5, num7, and num8 to obtain a 32-bit unsigned number number1.

2. The method for high-speed query of firewall session link table based on hardware HASH algorithm according to claim 1 is characterized in that: The step S3 is specifically as follows: S301, perform XOR operation on the protocol number and number1 to obtain num1; S302, perform bitwise AND operation on num1 and 0xff to obtain num2; S303, extract the 32-bit unsigned number num3 corresponding to num2 from the first row of the static two-dimensional array; S304, shift num1 right by 8 bits to obtain num4; S305, perform an XOR operation on num3 and num4 to obtain number2.

3. The method for high-speed query of firewall session link table based on hardware HASH algorithm according to claim 2, characterized in that: The step S4 is specifically as follows: S401, perform an XOR operation on the source IP address in the quintuple and number2 to obtain num1; S402, perform a bitwise AND operation on num1 and 0xff to obtain num2; S403, shift num1 right by 8 bits and perform a bitwise AND operation with 0xff to obtain num3; S404, extract the 32-bit unsigned number num4 corresponding to num2 from the fourth row of the static two-dimensional array; S405, extract the 32-bit unsigned number num5 corresponding to num3 from the third row of the static two-dimensional array; S406, perform an XOR operation on num4 and num5 to obtain num6; S407, shift num1 right by 16 bits to obtain num7; S408, perform a bitwise AND operation on num7 and 0xff to obtain num8; S409, shift num7 right by 8 bits and perform a bitwise AND operation with 0xff to obtain num9; S410, extract the 32-bit unsigned number num10 corresponding to num8 from the second row of the static two-dimensional array; S412, extract the 32-bit unsigned number num11 corresponding to num9 from the first row of the static two-dimensional array; S413, perform an XOR operation on num6, num9, and num11 to obtain Number3.

4. The method for high-speed querying of a firewall session link table based on a hardware HASH algorithm according to claim 3, characterized in that: The step S5 is specifically as follows: S501, the destination port in the quintuple is XORed with Number3 to obtain num1; S502, perform bitwise AND operation on num1 and 0xff to obtain num2; S503, shift num1 right by 8 bits and perform a bitwise AND operation with 0xff to obtain num3; S504, take out the 32-bit unsigned number num4 corresponding to num2 in the second row of the static two-dimensional array; S505, take out the 32-bit unsigned number num5 corresponding to num3 in the first row of the static two-dimensional array; S506, shift num1 right by 16 bits to obtain num6; S501, finally XOR the three numbers num4, num5 and num6 to obtain number4.

5. The method for high-speed querying of a firewall session link table based on a hardware HASH algorithm according to claim 4, characterized in that: The step S6 is specifically as follows: S601, perform an XOR operation on the destination IP address in the quintuple and number4 to obtain num1; S602, perform a bitwise AND operation on num1 and 0xff to obtain num2; S603, shift num1 right by 8 bits and perform a bitwise AND operation with 0xff to obtain num3; S604, extract the 32-bit unsigned number num4 corresponding to num2 from the fourth row of the static two-dimensional array; S605, extract the 32-bit unsigned number num5 corresponding to num3 from the third row of the static two-dimensional array; S606, perform an XOR operation on num4 and num5 to obtain num6; S607, shift num1 right by 16 bits to obtain num7; S608, perform a bitwise AND operation on Num7 and 0xff to obtain num8; S609, shift num7 right by 8 bits and perform a bitwise AND operation with 0xff to obtain num9; S610, extract the 32-bit unsigned number num10 corresponding to num8 from the second row of the static two-dimensional array; S611, extract the 32-bit unsigned number num11 corresponding to num9 from the first row of the static two-dimensional array; S612, perform an XOR operation on num6, num9, and num11 to obtain Number5.

6. The method for high-speed querying of a firewall session link table based on a hardware HASH algorithm according to claim 5, characterized in that: The step S7 is specifically as follows: S701, perform an XOR operation on the source port in the quintuple and Number5 to obtain num1; S702, perform a bitwise AND operation on Num1 and 0xff to obtain num2; S703, shift num1 right by 8 bits and perform a bitwise AND operation with 0xff to obtain num3; S704, extract the 32-bit unsigned number num4 corresponding to num2 from the second row of the static two-dimensional array; S705, extract the 32-bit unsigned number num5 corresponding to num3 from the first row of the static two-dimensional array; S706, shift num1 right by 16 bits to obtain num6; S707, finally perform XOR operation on num4, num5 and num6 to obtain num7; S708 , performing a modulo operation on num7 with 2 raised to the power of 24 to obtain a final hash value.

Images