Flow table management method, device, equipment and computer-readable storage medium

Abstract

The embodiment of the present invention discloses a flow table management method, apparatus, device and computer-readable storage medium. The method includes: obtaining a keyword of a data flow; searching for a matching field of the data flow in a first storage module based on the keyword, and if a matching field of the data flow is found, obtaining the flow information of the data flow in the matching field; obtaining the flow table state structure in a second storage module based on the address of the flow table state structure corresponding to the matching field in the flow information. After finding the matching field, the flow table state structure can be obtained based on the one-to-one correspondence between the matching field and the flow table state structure, thereby saving the search process for the flow table state structure and improving the search efficiency. If it is determined that the flow table state structure meets the aging condition, the flow table state structure in the second storage module is aged, and the matching field corresponding to the flow table state structure in the first storage module is deleted, thereby improving the processing efficiency of the flow table.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a flow table management method, apparatus, device, and computer-readable storage medium. Background Art

[0002] Flow tables are crucial components of applications such as switches, data flow forwarding, and Ethernet access networks. They store, forward, and search data flows. A flow table has a complete lifecycle, from creation to termination. Flow table management enables operations such as adding, modifying, and aging flow tables. Due to limited flow table storage space, if one or more fields in a flow table have not been matched, the flow table must be aged.

[0003] In the prior art, the matching field and the flow table state structure are stored together, the flow table is searched and matched through the matching field, and the flow table is aged through the flow table state structure, thereby simplifying the flow table management.

[0004] However, storing the matching field and the flow table state structure together increases the flow table read and write length when searching, matching, and aging the flow table, thereby reducing the flow table processing efficiency. Summary of the Invention

[0005] Embodiments of the present invention provide a flow table management method, apparatus, device, and computer-readable storage medium. These methods utilize a first storage module and a second storage module to store corresponding flow table components, namely, matching fields and flow table status structures. After a matching field is found, the flow table status structure can be retrieved based on the one-to-one correspondence. This separation of the flow table search process and the aging process allows for selective aging, reducing data processing and improving flow table processing efficiency.

[0006] The technical solution of the embodiment of the present invention is achieved as follows:

[0007] In a first aspect, an embodiment of the present invention provides a flow table management method, the method comprising: obtaining a keyword of a data flow; searching for a matching field of the data flow in a first storage module based on the keyword, and if the matching field is found, obtaining flow information of the data flow in the matching field; obtaining a flow table status structure in a second storage module based on the address of the flow table status structure corresponding to the matching field in the flow information; wherein the first storage module stores the address of the matching field of the data flow, which corresponds one-to-one to the address of the flow table status structure storing the data flow in the second storage module; if it is determined that the flow table status structure meets the aging condition, the flow table status structure in the second storage module is aged, and the matching field in the first storage module is deleted.

[0008] In a second aspect, an embodiment of the present invention provides a flow table management device, which includes: an acquisition module for acquiring a keyword of a data flow; a search and matching module for searching a matching field of the data flow in a first storage module based on the keyword, and obtaining flow information of the data flow in the matching field if the matching field is found; the acquisition module is also used to acquire a flow table status structure in a second storage module based on the address of the flow table status structure corresponding to the matching field in the flow information; wherein the first storage module stores the address of the matching field of the data flow, which corresponds one-to-one to the address of the flow table status structure storing the data flow in the second storage module; an aging module for aging the flow table status structure in the second storage module and deleting the matching field in the first storage module if it is determined that the flow table status structure meets the aging conditions.

[0009] In a third aspect, an embodiment of the present invention provides a flow table management device, which includes a memory for storing executable instructions and a processor for implementing the above-mentioned flow table management method when executing the executable instructions stored in the memory.

[0010] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having executable instructions stored thereon, which are used to implement the above-mentioned flow table management method when executed by a processor.

[0011] Embodiments of the present invention provide a flow table management method, apparatus, device, and computer-readable storage medium. According to the solution provided by the embodiments of the present invention, a keyword for a data flow is obtained; based on the keyword, a matching field for the data flow is searched in a first storage module. If a matching field for the data flow is found, flow information for the data flow in the matching field is obtained; and based on the address of the flow table state structure corresponding to the matching field in the flow information, a flow table state structure is obtained in a second storage module. The first storage module stores the address of the matching field for the data flow, which corresponds one-to-one with the address of the flow table state structure for the data flow stored in the second storage module. Storing the matching field and the flow table state structure in the first storage module and the second storage module, respectively, reduces the number of fields stored in each storage module and increases the number of fields that can be stored in the flow table. After finding the matching field, the flow table state structure is obtained based on the one-to-one correspondence, saving the process of searching the flow table state structure and improving the efficiency of searching the flow table state structure for the data flow. If the flow table state structure is determined to meet the aging condition, the flow table state structure in the second storage module is aged, and the matching field corresponding to the flow table state structure in the first storage module is deleted. The embodiment of the present invention stores the corresponding flow table parts respectively through the first storage module and the second storage module, separates the flow table search process and the aging process, and selectively performs the aging process based on the judgment result of whether the flow table status structure meets the aging conditions, thereby avoiding repeated reading and writing processes and reducing the data processing volume of the flow table search process and the aging process. That is, the flow table management process is divided into two stages to reduce the data processing volume of a single stage, thereby improving the processing efficiency of the flow table. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A flowchart of optional steps of a flow table management method provided by an embodiment of the present invention;

[0013] Figure 2 A flowchart of optional steps of another flow table management method provided by an embodiment of the present invention;

[0014] Figure 3 A flowchart of optional steps of another flow table management method provided in an embodiment of the present invention;

[0015] Figure 4 A schematic diagram of an optional structure of a flow table management device provided by an embodiment of the present invention;

[0016] Figure 5 An optional structural diagram of another flow table management device provided by an embodiment of the present invention;

[0017] Figure 6 A schematic diagram of the structure of a flow table management device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. It should be understood that some of the embodiments described here are only used to explain the technical solutions of the present invention and are not used to limit the technical scope of the present invention.

[0019] In order to better understand the flow table management method provided in the embodiment of the present invention, the flow table of the data flow is first explained before introducing the technical solution of the embodiment of the present invention.

[0020] The table entries of the flow table corresponding to the data flow may include fields such as match field, priority, counter, instruction, and timeout. The match field is the information of the data flow itself, such as the source Media Access Control Address (MAC), destination MAC, source Internet Protocol (IP) address, destination IP address, and related fields. The match field is used to search and match the flow table corresponding to the data flow. Fields such as priority, counter, timeout, and instruction are used for flow table state aging, that is, the aging of the flow table state structure and match field.

[0021] In the related art, the matching field and the flow table status structure are stored together, and the five-tuple information and the aging information of the flow table are stored together, where the five-tuple information includes the MAC address, IP address, port number, Ethernet header and IP protocol. In other words, the flow table search and matching process and the aging process are concentrated in one module, which simplifies the management of the flow table. However, due to the limited storage space of the flow table, the method of storing the matching field and the flow table status structure together limits the storage capacity of the flow table. In addition, for the search, matching and aging processes of the flow table, the flow table read and write length is relatively long, which reduces the processing speed and also reduces the processing efficiency of data flows such as the first packet, storage packet, and management packet that do not require flow table status query.

[0022] The embodiment of the present invention provides a flow table management method, such as Figure 1 As shown, Figure 1 A flow chart of a flow table management method provided in an embodiment of the present invention includes the following steps:

[0023] S101. Obtain keywords of a data stream.

[0024] In the embodiments of the present invention, data streams may include audio streams, video streams, and regular text streams. For each data stream, a flow table stores relevant information about the data stream, and data stream aging is achieved by deleting the flow table. The most basic elements of a data flow table include the source IP address, source port, destination IP address, destination port, and transport layer protocol. Transport layer protocols include the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP).

[0025] In the embodiment of the present invention, the keyword refers to the key information of the data stream, which is used to find a match and may include IP protocol, Ethernet header, source IP address, destination IP address, source port number, destination port number, source Mac and destination Mac. The content of the above keywords can also be understood as five-tuple information.

[0026] S102: Searching for a matching field of the data flow in the first storage module according to the keyword, and if a matching field is found, obtaining flow information of the data flow in the matching field.

[0027] The flow table includes a match field and a flow table state structure. The match field is used for flow table search and matching. The match field includes keywords and results. Keywords can be understood as information about the data flow itself, such as the source Mac, destination Mac, source IP address, and destination IP address. The result is the flow information corresponding to the data flow. The flow information includes the data flow action (for example, deletion, modification, etc.), the data flow port information (for example, which port the data flow flows from), and the address of the flow table state structure corresponding to the match field.

[0028] In an embodiment of the present invention, the matching field is stored in a first storage module. Exemplarily, the first storage module may be a chip that can be used to store data. Because the first storage module corresponding to the matching field stores the data stream's keywords, when a data stream arrives, the matching field can be searched based on the data stream's keywords, and further, the flow information of the data stream can be obtained based on the matching field.

[0029] If a matching field can be found, it indicates that the first storage module stores relevant data of the flow table corresponding to the data flow, that is, the data flow is not a new data flow, and the flow information of the data flow can be obtained according to the matching field.

[0030] S103: Obtain the flow table state structure in the second storage module according to the address of the flow table state structure corresponding to the matching field in the flow information.

[0031] In an embodiment of the present invention, the matching field and the flow table status structure are stored in the first storage module and the second storage module respectively. The first storage module and the second storage module respectively store the corresponding flow table parts, namely the matching field and the flow table status structure, so that the fields stored in a single storage module become smaller. Compared with the solution of uniformly storing the matching field and the flow table status structure in the flow table, the number of fields that can be stored in a single storage module is increased.

[0032] Because the address of the matching field stored in the first storage module for the data flow has a one-to-one correspondence with the address of the flow table state structure stored in the second storage module for the data flow, after finding the matching field, the address of the flow table state structure can be obtained based on the one-to-one correspondence, thereby obtaining the flow table state structure. This saves the process of searching the flow table state structure and improves the efficiency of searching the flow table state structure for the data flow.

[0033] The flow table state structure is used to manage the flow table, including: valid bit (vaild), TCP flow / UDP flow (type), flow state information of TCP flow (state), timestamp (timestamp), busy bit (dirty), parity bit (parity), aging mode (track_mode), packet count (packet_count) and byte count (byte_count).

[0034] In some embodiments, when obtaining the flow table status structure in S103, it can be achieved in the following way: according to the address of the flow table status structure corresponding to the matching field in the flow information, the initial flow table status structure is searched in the second storage module; according to the flow status information of the data flow in the flow information, the initial flow table status structure is updated to obtain the flow table status structure.

[0035] In this example, the initial flow table state structure is first found in the second storage module. The initial flow table state structure is the flow table state structure before the data flow flows in. Since the data flow flows in again, the initial flow table state structure of the data flow needs to be updated to obtain the flow table state structure, and then the flow table state structure is judged whether it meets the aging conditions, thereby improving the accuracy of the judgment result.

[0036] S104: If it is determined that the flow table state structure meets the aging condition, the flow table state structure in the second storage module is aged, and the matching field in the first storage module is deleted.

[0037] In the embodiment of the present invention, steps S101-S103 are the flow table search process, and S104 is the flow table aging process, thereby separating the flow table search process from the aging process. The flow table status structure is searched by matching fields. If the flow table status structure meets the aging conditions, the flow table status structure in the second storage module is aged, and the matching fields in the first storage module are deleted, thus implementing the flow table aging process. Based on the determination of whether the flow table status structure meets the aging conditions, the aging process is selectively performed, avoiding repeated read and write processes, reducing the amount of data processing during the flow table search and aging processes, and thus improving flow table processing efficiency.

[0038] According to the solution provided by an embodiment of the present invention, a keyword for a data flow is obtained; based on the keyword, a matching field for the data flow is searched in a first storage module. If a matching field for the data flow is found, flow information for the data flow in the matching field is obtained; and based on the address of the flow table state structure corresponding to the matching field in the flow information, a flow table state structure is obtained in a second storage module. The address of the matching field for the data flow stored in the first storage module corresponds one-to-one with the address of the flow table state structure for the data flow stored in the second storage module. Storing the matching field and the flow table state structure in the first storage module and the second storage module, respectively, reduces the number of fields stored in a single storage module and increases the number of fields that can be stored in the flow table. After finding the matching field, the flow table state structure is obtained based on the one-to-one corresponding address, thus saving the process of searching the flow table state structure and improving the efficiency of searching the flow table state structure for the data flow. If the flow table state structure is determined to meet the aging condition, the flow table state structure in the second storage module is aged, and the matching field corresponding to the flow table state structure in the first storage module is deleted. The embodiment of the present invention stores the corresponding flow table parts respectively through the first storage module and the second storage module, separates the flow table search process and the aging process, and selectively performs the aging process based on the judgment result of whether the flow table status structure meets the aging conditions, thereby avoiding repeated reading and writing processes and reducing the data processing volume of the flow table search process and the aging process. That is, the flow table management process is divided into two stages to reduce the data processing volume of a single stage, thereby improving the processing efficiency of the flow table.

[0039] In some embodiments, if the matching field of the data flow is not found in S102, the flow table management method also includes the following steps: inputting the data flow into the control module; the control module sends the matching field of the data flow to the first storage module, and sends the flow table status structure of the data flow to the second storage module; the control module adds fields to the first storage module and the second storage module respectively, so that the address of the matching field stored in the first storage module corresponds one-to-one to the address of the flow table status structure stored in the second storage module.

[0040] If the matching field of the data flow is not found, it means that the data flow has no corresponding flow table, and the data flow is a new data flow. There is no relevant information of the data flow in the first storage module and the second storage module. Therefore, the embodiment of the present invention flows the data flow into the control module, and the control module learns the flow table. The learning process may include: sending the matching field of the data flow to the first storage module, and sending the flow table status structure of the data flow to the second storage module. In addition, the control module also adds fields to the first storage module and the second storage module respectively, so that the address of the matching field stored in the first storage module corresponds one-to-one with the address of the flow table status structure stored in the second storage module. So that after the matching field is found in the first storage module, the address of the flow table status structure can be obtained, thereby obtaining the flow table status structure and improving the search efficiency of the flow table status structure of the data flow.

[0041] In some embodiments, when determining whether the flow table state structure meets the aging condition in the above S104, it can be implemented through the following two examples.

[0042] In the first example, the existence time of the flow table state structure is counted according to the creation timestamp of the flow table state structure to obtain a count value; if the count value is greater than a first preset time period, the flow table state structure meets the aging condition.

[0043] In this example, a fixed amount of time is preset, namely, a first preset time period. When the timestamp count of the flow table state structure reaches this amount of time, it indicates that the flow table state structure meets the aging condition.

[0044] The first preset time period can be appropriately set by those skilled in the art based on actual needs, and can reasonably limit the existence time of the flow table state structure, such as 30 seconds, 120 seconds, and 300 seconds. For example, the time period can be determined by analyzing and selecting from a large number of time periods, and this embodiment of the present invention does not limit this.

[0045] In the second example, the packet length of the data flow is obtained; based on the packet length of the data flow, the packet count or byte count of the data flow is performed; if the packet count or byte count does not increase within the second preset time period, the flow table state structure meets the aging condition.

[0046] In this example, a fixed amount of time is pre-set, namely the second preset time period. The packet count or byte count does not increase within the second preset time period, indicating that no relevant information of the data flow has flowed in for a period of time, that is, the flow table state structure meets the aging conditions.

[0047] In this example, you can select the packet counting mode (ie, packet_count) or the byte counting mode (ie, byte_count) to determine whether the flow table state structure meets the aging conditions.

[0048] The second preset time period can be appropriately set by those skilled in the art according to actual needs, as long as reasonable restrictions can be placed on packet counting or byte counting of the data stream, such as 10s, 60s, and 90s.

[0049] It should be noted that when judging whether the flow table status structure meets the aging conditions, the aging conditions can be judged according to any one of the above examples, or it can be a combination of the above two examples, that is, when the count value is greater than the first preset time period and the packet count or byte count does not increase within the second preset time period, the flow table status structure meets the aging conditions, and this embodiment of the present invention does not limit this.

[0050] In an embodiment of the present invention, by judging whether the existence time of the flow table status structure is greater than a first preset time period, and / or judging whether the packet count or the byte count increases within a second preset time period, and then judging whether the flow table status structure meets the aging condition, judging whether the flow table occupies unnecessary storage space from aspects such as the existence period of the data flow and the update of the data flow, the accuracy of the judgment result is improved.

[0051] In some embodiments, before the above S104, the flow table management method further includes a process of determining whether the flow table state structure meets the aging condition, which can be implemented through the following S201-S205. Among them, S202 is a determination process for UDP flow, and S203-S205 is a determination process for TCP flow. Figure 2 As shown, Figure 2 A flowchart of optional steps of another flow table management method provided by an embodiment of the present invention.

[0052] S201: Acquire associated data of a data stream, where the associated data stores a stream type of the data stream, including UDP stream and TCP stream.

[0053] Data streams carry a stream type, which is used to distinguish between TCP and UDP streams. The stream type is parsed and stored in the stream's metadata. When a data stream arrives, its metadata is retrieved to determine its stream type.

[0054] S202: If the flow type of the data flow is a UDP flow, directly determine whether the flow table state structure of the UDP flow meets the aging condition.

[0055] Since there is no state migration for UDP streams, it is possible to directly determine whether the flow table state structure of the UDP stream meets the aging conditions. The specific determination methods may include: determining whether the existence time of the flow table state structure of the UDP stream is greater than a first preset time period, and / or determining whether the packet count or byte count of the flow table state structure of the UDP stream increases within a second preset time period, and then determining whether the flow table state structure of the UDP stream meets the aging conditions.

[0056] S203: If the flow type of the data flow is a TCP flow, obtain the flow state information of the TCP flow.

[0057] The flow table state structure sets state flags for TCP flows to facilitate the management of TCP flows. The state flags correspond to modifying the flow state information (state) in the flow table state structure. The flow state information (state) can represent the connection state of the TCP flow. The state flags in the embodiment of the present invention include: a synchronization flag (SYN) for establishing a connection, an acknowledgment flag (ACK) for responding to a connection, an end flag (FIN) for closing a connection, and a reset flag (RST) for resetting a connection. The flow state information (state) of the TCP flow can be controlled based on the state flags. It is understandable that the state flags can also include a flag (PSH) for immediately transmitting a data packet to an application instead of queuing it in a buffer, and a flag (UGR) for urging the intermediate layer device to process data as quickly as possible, etc., and this embodiment of the present invention does not limit this.

[0058] Since the flow type of TCP and UDP flows has been determined in the previous parsing stage and stored in the data flow's metadata, if the flow type is TCP, the TCP flow's metadata includes TCP status flags, including SYN, ACK, FIN, and RST. In other words, the flow state information of the TCP flow can be obtained based on the metadata.

[0059] S204: The control module updates the flow table state structure of the TCP flow according to the flow state information of the TCP flow and the TCP state field in the flow table state structure of the TCP flow to obtain an updated flow table state structure of the TCP flow.

[0060] S205: Determine whether the updated flow table state structure of the TCP flow meets the aging condition.

[0061] Most data streams are based on the TCP or UDP protocols. TCP streams are subject to retransmissions and duplicate ACKs, so different services need to be differentiated to achieve personalized management of different stream types. However, related technologies do not manage the connection status (i.e., flow state information) of TCP and UDP streams, nor do they manage TCP state transitions, reducing system reliability and processing efficiency.

[0062] The embodiments of the present invention distinguish different data flows based on flow type, enabling personalized management of data flows of different flow types, thereby improving system reliability and processing efficiency. After obtaining the flow state information of a TCP flow, the control module updates the flow table state structure of the TCP flow based on the flow state information of the TCP flow and the TCP state field in the flow table state structure of the TCP flow, thereby obtaining an updated flow table state structure for the TCP flow. The updated flow table state structure of the TCP flow is then used to determine whether the aging condition is met, thereby improving the accuracy of the judgment result.

[0063] In some embodiments, the above S204 can be implemented in the following manner: when the control module modifies the valid bit in the TCP status field to a high level, the busy bit of the flow table status structure of the TCP flow is pulled high; according to the flow status information of the TCP flow, the flow table status structure of the TCP flow is updated according to the operation type to obtain the updated flow table status structure of the TCP flow, and after the update is completed, the busy bit of the updated flow table status structure of the TCP flow is pulled low; wherein, the operation type includes read operation and write operation, when the operation type is a read operation, the flow table status structure of the TCP flow is output to the control module; when the operation type is a write operation, the control module updates the timestamp and flow status of the flow table status structure of the TCP flow according to the timestamp control bit in the flow status information of the TCP flow and the new status of the TCP flow.

[0064] The present invention adds a TCP status field to the flow table state structure. The TCP status field is used to update and age TCP flows. When modifying the flow table state structure of a TCP flow, the TCP status field includes a valid bit (vaild), the structure address of the flow table state structure (index), a timestamp control bit (dis_tstamp_update_wdata), the new state of the TCP flow (new_state_wdata), and the operation type (operation).

[0065] In the embodiment of the present invention, the high level is 1 and the low level is 0 as an example for explanation. When the valid bit (vaild) in the TCP status field is 1, it indicates that the control module is updating the flow table status structure. When the valid bit (vaild) in the TCP status field is 0, it indicates that the control module is not performing relevant operations on the flow table status structure.

[0066] In this example, when the control module changes the valid bit (vaild) in the TCP status field to 1, the busy bit (dirty) of the flow table status structure of the TCP flow is pulled high. Then, the corresponding flow table status structure is extracted according to the structure address (index), and the corresponding operation is performed according to the operation type (operation) to obtain the updated flow table status structure of the TCP flow. After completing the corresponding operation, the busy bit (dirty) is pulled low to complete the update process of the TCP flow. Among them, if the operation type is a read operation, the flow table status structure of the TCP flow is read and the flow table status structure of the TCP flow is output to the control module; if the operation type is a write operation, the timestamp (timestamp) and flow status information (state) in the flow table status structure are updated according to the timestamp control bit (dis_tstamp_update_wdata) and the new state of the TCP flow (new_state_wdata).

[0067] The embodiment of the present invention updates the flow table state structure of the TCP flow through the operation type to obtain the updated flow table state structure of the TCP flow, thereby improving the real-time and accuracy of the flow table state structure, so as to facilitate subsequent aging processing of the updated flow table state structure and realize flexible management of the flow table state structure.

[0068] In some embodiments, when the flow type of the data flow is a TCP flow, determining whether the flow table state structure of the TCP flow meets the aging condition can also be implemented through the following two examples.

[0069] In the first example, the status flag of the TCP stream is obtained from the in-band data. The status flag of the TCP stream is used to control the flow state information of the TCP stream. The state transition of the TCP stream is determined based on the status flag of the TCP stream. If the state transition of the TCP stream is in the sending completion state, the TCP stream meets the aging condition.

[0070] In the second example, based on the various states in the status flag of the TCP flow, it is detected whether the TCP flow is always in the SYN state; if the TCP flow is always in the SYN state, then when SYN is pulled high, when the packet count in the flow table state structure of the TCP flow is greater than the preset parameter, the TCP flow meets the aging condition.

[0071] In one case, if the same TCP flow remains in the SYN state, it indicates that the TCP flow is in a faulty state, for example, suffering from a SYN flood attack. For example, a SYN flood attack can be a DoS (Denial of Service) or DDoS (Distributed Denial of Service) attack. This attack exploits TCP protocol flaws by sending a large number of forged TCP connection requests, using a spoofed IP address to send a massive first handshake packet (SYN packet) requesting a connection. The attacked server responds with a second handshake packet (SYN+ACK packet). However, because the other party's IP address is spoofed, the other party never receives the packet and does not respond to the third handshake packet. This causes the attacked server to maintain a large number of "half-connected" connections in the SYN_RECV state and to retry the second handshake packet a default of five times, filling up the TCP waiting connection queue, exhausting storage resources, and preventing normal requests from connecting. Therefore, it is necessary to combine the SYN and packet count (packet_count) in the flow state information to implement state management for TCP flows. Exemplarily, when SYN is pulled high, when the packet count in the flow table state structure of the TCP flow is greater than a preset parameter, the TCP flow meets the aging condition, and thus the TCP flow is aged.

[0072] In another case, if the state transition of the TCP flow is in the Send Complete (RSN) state, it indicates that a failure occurs in the TCP flow, and the TCP flow meets the aging condition, so the TCP flow is aged.

[0073] In an embodiment of the present invention, when the flow type of the data flow is a TCP flow, the state migration of the TCP flow can be obtained according to the flow state information (state) of the TCP flow. According to the state migration, TCP flows in certain states can be selectively unloaded, thereby realizing flexible management of the TCP flow.

[0074] It should be noted that for TCP flows, TCP flows have state changes. Whether a TCP flow meets the aging condition can be judged not only by the above two examples; it can also be judged by judging whether the count value is greater than the first preset time period to judge whether the TCP flow meets the aging condition; it can also be judged by judging whether the packet count or byte count increases within the second preset time period to judge whether the TCP flow meets the aging condition. In other words, as long as the TCP flow meets at least one of the following conditions: the state transition of the TCP flow is in the sending completion state, the packet count in the flow table state structure of the TCP flow is greater than the preset parameter, the count value is greater than the first preset time period, and the packet count or byte count does not increase within the second preset time period, it can be judged that the TCP flow meets the aging condition. This embodiment of the present invention does not limit this.

[0075] In some embodiments, the aging of the flow table status structure in the second storage module and the deletion of the matching fields in the first storage module in the above S104 can be achieved in the following manner. According to the aging mode corresponding to the data flow, the flow table status structure in the second storage module is aged, and the matching fields in the first storage module are deleted; wherein, the aging mode includes hardware aging and software aging. When the aging mode is hardware aging, the flow table status structure in the second storage module is automatically aged, and the matching fields in the first storage module are deleted; when the aging mode is software aging, an aging command issued by the control module is received, and the flow table status structure in the second storage module is aged according to the aging command, and the matching fields in the first storage module are deleted.

[0076] The hardware aging mode is to automatically age the flow table status structure in the second storage module when the flow table status structure meets the aging conditions, and delete the corresponding matching field in the first storage module that is matched. The hardware aging mode can be used for regular data flows or unimportant data flows.

[0077] The software aging mode is an aging command issued by the upper-layer software of the control module. The aging command can be modified by the user according to actual needs to achieve flexible management of the TCP flow. When the flow table status structure meets the aging conditions, it is also necessary to receive an aging command, so that the flow table status structure in the second storage module is aged according to the aging command, and the corresponding matching field in the first storage module is deleted. The software aging mode can meet the personalized needs of users. Aging commands are added for data flows that users care about, that is, important data flows. Users can use aging commands to achieve flexible management of certain data flows.

[0078] The embodiment of the present invention sets different aging modes. When the flow table status structure meets the conditions, the flow table status structure in the second storage module is aged, and the corresponding matching field in the first storage module is deleted, thereby completing the aging process of the data flow and realizing efficient management of the data flow.

[0079] The following describes an exemplary application of an embodiment of the present invention in a practical application scenario.

[0080] The flow table management method provided in the embodiment of the present invention can be applied to smart network cards to achieve high-speed forwarding of network data. Figure 3 As shown, Figure 3 This is an optional structural diagram of a flow table management device provided by an embodiment of the present invention. The flow table management device provided by an embodiment of the present invention includes a control module and a data flow management module.

[0081] The control module is used to send the corresponding matching fields and flow table status structure to the two storage modules in the data flow management module. The control module also modifies the flow table status structure of the TCP flow based on the flow status information of the TCP flow. The upper layer software of the control module ( Figure 3 (As shown in the configuration module) An aging command can also be sent to the aging module to perform aging processing on the flow table through the aging command.

[0082] The data flow management module manages the flow table, dividing it into two fields: the match field and the flow table status structure. These fields are stored in storage module 1 and storage module 2, respectively. The data flow management module is divided into two modules based on management functions: the match search module and the aging module. Data from the match search module is stored in storage module 1, while data from the aging module is stored in storage module 2. This is explained below.

[0083] The match field in storage module 1 includes the data flow's keywords and result. Keywords refer to key information about the data flow and are used to find matches. Keywords include the IP protocol, Ethernet header (also understood as the Ethernet type), source IP address, destination IP address, source port number, destination port number, source MAC, and destination MAC. Result is the flow information corresponding to the data flow, which includes the data flow's action and port information. As shown in Table 1, Table 1 provides an exemplary keyword content for an embodiment of the present invention.

[0084] Table 1

[0085] IP protocol Ethernet Type Source IP address Destination IP address Source port number Destination port number Source Mac Destination Mac

[0086] The flow table status structure in the storage module 2 is used to manage the flow table. The flow table status structure includes a valid bit (vaild), a TCP stream / UDP stream (type), a flow status information of the TCP stream (state), a timestamp (timestamp), a busy bit (dirty), a parity bit (parity), an aging mode (track_mode), a packet count (packet_count), and a byte count (byte_count). It should be noted that the parity bit (partiy) is a check bit for the flow table status structure. Each time the flow table status structure is read, the parity bit (partiy) is recalculated and the check bit comparison is performed to see if it is correct. If it is correct, the flow table status structure is read. As shown in Table 2, Table 2 provides an exemplary flow table status structure content for an embodiment of the present invention.

[0087] Table 2

[0088] vaild type state timestamp dirty parity track_mode packet_count byte_count cookies

[0089] The search and matching module is used to search for matches. For example, the five-tuple information of the data stream to be forwarded is used as the index key (i.e., keyword) to search in the matching field in the storage module 1 to find the corresponding result. If not found, the data stream is sent to the control module. The control module learns the data stream, generates a corresponding flow table, sends the flow table to the data stream management module, and then searches, matches, and forwards the data stream again. If the corresponding result is found, the information related to the aging operation of the data stream is sent to the aging module as a search request, and the control module updates the flow table status structure in the storage module 2. The aging module is used to age the flow table status structure in the storage module 2 and delete the corresponding matching field in the storage module 1.

[0090] The aging modes of the aging module include hardware aging and software aging, which can be flexibly and efficiently applied to a variety of scenarios. By switching the flag bit of the aging mode (track_mode), the switching of different aging modes can be achieved. Two examples are listed here to illustrate the aging process. Example 1: When the user requires hardware aging, a fixed amount of time is pre-set. When the timestamp count of the flow table status structure reaches this amount of time, the hardware automatically ages the flow table status structure of the data flow and deletes the corresponding matching field in the search match. Example 2: When the user chooses software aging, when the packet count (packet_count) or byte count (byte_count) of the data flow does not increase within a certain amount of time, the upper-layer software (i.e. Figure 3 The configuration module in the aging command is issued to delete the flow table state structure and matching field of the data flow through the aging command. It should be noted that the rules for judging whether the aging conditions are met in the above example 1 and example 2 can be interchangeable, or the rules for judging whether the aging conditions are met in the above two examples can be combined, and the embodiment of the present invention does not limit this. The embodiment of the present invention improves the processing efficiency of the flow table in a targeted manner by optimizing the aging process and meeting the different needs of users through different aging modes.

[0091] The flow table management method provided by an embodiment of the present invention divides a flow table into matching fields and a flow table state structure, storing and processing them separately. This improves flow table storage capacity and system flexibility. Since the matching fields and the flow table state structure are stored in two separate storage modules, the number of fields required to be stored in a single storage module is reduced, thereby increasing the number of fields that can be stored in the flow table. Furthermore, the embodiment of the present invention uses a control module to add fields to the two storage modules, creating a one-to-one correspondence between the storage locations of the two types of fields in the storage modules. After the search and match module completes a data flow search and match using keywords, it reads the data flow result to obtain the data flow's flow information. Based on the address of the matching field in the flow information, the address of the flow table state structure corresponding to the matching field is obtained, thereby obtaining the corresponding flow table state structure, eliminating the need to search the flow table state structure. If no matching field is found during the search and match process, indicating that the data flow is new, the data flow is directly input into the control module for flow table learning, eliminating the need for flow table aging, effectively improving data flow processing efficiency.

[0092] In some embodiments, embodiments of the present invention further differentiate between flow tables for TCP and UDP flows for different flow types. For example, for TCP flows, the flow table state structure sets state flags for the TCP flows. During the aging process, the flow state information of the TCP flows is obtained through the state flags of the TCP flows, facilitating the management of the TCP flows. Combined with the upper-layer software of the control module, the aging process of the TCP flows is completed flexibly and efficiently, thereby improving the reliability of the system. Furthermore, for TCP flows, the control module also performs operations such as reading, writing, modifying, and refreshing the flow table state structure.

[0093] Exemplarily, in order to perform state control on the TCP stream, after searching for a match, the stream type (type) of the data stream is input as a parameter into the aging module to distinguish whether it is a TCP stream or a UDP stream. If the stream type (type) is a UDP stream, the aging module directly queries whether it is aged according to the aging rules. If the stream type (type) is a TCP stream, after searching for a match, the status flags (flags) of the TCP stream are input into the aging module. After searching for a match, the valid bit (vaild) is input into the aging module, and is used to raise the busy bit (dirty) of the flow table status structure when the control module modifies the valid bit (vaild) in the TCP status field of the aging module to 1. After searching for a match, the packet length (plength) of the data stream is input into the aging module for byte counting of the data stream. After searching for a match, the structure address (index) of the flow table status is input into the aging module to extract the flow table status structure. After a match is found, some metadata related to the data flow is input into the aging module. This metadata can be customized by the user and is used to manage the flow table for the data flow, facilitating subsequent upgrades and maintenance of the flow table. Table 3 provides an example of the field content of the match found and input into the aging module according to an embodiment of the present invention.

[0094] Table 3

[0095] vaild Index plength type flags metadata

[0096] The above-mentioned TCP flow status flags correspond to the modified flow state information (state) in the flow table state structure. The TCP flow status flags (flags) include: SYN, ACK, FIN, RST. As shown in Table 4, Table 4 provides an exemplary TCP status field content according to an embodiment of the present invention.

[0097] Table 4

[0098] SYN ACK FIN RST

[0099] For example, since the stream type (type) of the TCP stream and the UDP stream has been determined in the previous parsing stage and stored in the metadata of the data stream. The metadata of the TCP stream contains the status flags of the TCP stream, i.e., SYN, ACK, FIN, and RST. There is a state machine inside the logic, so the flow state information (state) of the TCP stream can be controlled according to the status flags. The flow state information of the TCP stream can be obtained according to the metadata, and the state migration of the TCP stream can be obtained according to the flow state information (state) of the TCP stream. According to the state migration, the TCP streams in certain states can be selectively unloaded. That is, for the TCP stream, not only can the TCP stream be aged by hardware aging or software aging, but also can be aged according to the state migration of the TCP stream, thereby realizing flexible management of the TCP stream. The UDP stream does not have state migration, and only needs to be aged by hardware aging or software aging according to the aging mode.

[0100] For example, regarding the state control of a TCP flow, the various states of the TCP flow can be combined to detect whether the TCP flow is in a failure stage. For example, when the same TCP flow is always in the SYN state, it indicates that the TCP flow is in a failure stage, for example, it has suffered a flood attack (SYN Flood). Therefore, it is necessary to combine the SYN bit and the packet count (packet_count) in the flow state information to implement the state management of the TCP flow. For example, when the SYN bit is high, when the packet count in the flow table state structure of the TCP flow is greater than a preset parameter, it indicates that the TCP flow meets the aging condition, and the TCP flow is then aged.

[0101] In addition, the embodiment of the present invention can also combine the flow state information of the TCP flow to perform more state management on the TCP flow. For example, the connection of the TCP flow requires a handshake process and requires real-time state update. In order to speed up the update process of the TCP flow, the embodiment of the present invention will input the TCP flow that needs state update into the control module, and through the control module and the upper layer software (i.e. Figure 3The configuration module in the TCP flow updates the status of the TCP flow. For example, when the TCP flow is in the FIN state, whether to close the TCP flow also needs to be synchronized with the status of the TCP flow of the upper-layer software. It can also be understood that if a TCP flow is to be closed, the TCP flow of the upper-layer software needs to be in the closed (close) state first, indicating that the reception is completed and the TCP flow is no longer needed. The control module rewrites the flow state information (state) of the TCP flow, changes the flow table state structure of the TCP flow, and the upper-layer software synchronously changes the flow table state structure of the TCP flow. When the TCP flow repeats the ACK state, the TCP in the upper-layer software uses the sequence number and confirmation number of the message header to receive and reassemble the valid data in the order of transmission.

[0102] In an embodiment of the present invention, during the aging process of a request sent by a control module, fields of a flow table state structure are updated. Each flow table entry includes a new TCP flow state (new_state_wdata) and a timestamp control bit (dis_tstamp_update_wdata). The timestamp control bit (dis_tstamp_update_wdata) is used to indicate whether the timestamp in the flow table state structure should be updated.

[0103] For TCP flows, an embodiment of the present invention adds a TCP status field to the flow table state structure to achieve timely updating and aging of TCP flows. Exemplarily, if the flow type of the data flow is a TCP flow, the aging module obtains the flow table state structure of the TCP flow according to the structure address (index) of the flow table state structure, and obtains the flow state information of the TCP flow, wherein the flow state information includes the new state of the TCP flow (new_state_wdata), the timestamp control bit (dis_tstamp_update_wdata) and the timestamp (timestamp) in the flow table state structure. The control module modifies the flow table state structure of the TCP flow according to the flow state information of the TCP flow and the TCP status field in the flow table state structure of the TCP flow corresponding to the aging module, and obtains the updated flow table state structure of the TCP flow.

[0104] In the embodiment of the present invention, when modifying the flow table state structure of a TCP flow, the TCP state field includes: a valid bit (vaild), the structure address of the flow table state structure (index), a timestamp control bit (dis_tstamp_update_wdata), the new state of the TCP flow (new_state_wdata), and the operation type (operation). As shown in Table 5, Table 5 provides an exemplary embodiment of the present invention. The TCP state field content of the control module management aging module is shown in Table 5.

[0105] Table 5

[0106] vaild Index dis_tstamp_update_wdata new_state_wdata operation

[0107] The upper-layer software of the control module can perform operations on the state of the TCP flow, including read, write, and refresh operations. For example, if the operation type is a read operation, the flow table state structure of the TCP flow is read and the flow table state structure of the TCP flow is output to the control module; if the operation type is a write operation, the timestamp (timestamp) and flow state information (state) in the flow table state structure are updated according to the timestamp control bit (dis_tstamp_update_wdata) and the new state of the TCP flow (new_state_wdata).

[0108] Based on the above description of the flow table management device, the embodiment of the present invention further provides a flow table management method. The flow table management method may include S401-S404, such as Figure 4 As shown, Figure 4 A flowchart of optional steps of another flow table management method provided by an embodiment of the present invention.

[0109] S401. The control module sends the matching field of the flow table to the storage module 1 of the search and match module, and sends the flow state structure of the flow table to the storage module 2 of the aging module. The storage addresses in the storage module 1 and the storage module 2 correspond one to one.

[0110] S402, the search and matching module uses the five-tuple information of the data flow as the index key (i.e., keyword), searches for the matching field corresponding to the index key in the storage module 1, obtains the flow information result of the data flow, and transfers the flow status information and address information index to the aging module.

[0111] S403: If no matching field is found, the data stream is sent to the control module for data stream learning.

[0112] The control module sends the flow table to the data flow management module, that is, executing S401.

[0113] S404: If a matching field is found, the aging module updates the flow state structure on the corresponding address information index according to the flow state information input by the search matching module, and performs aging processing according to the parameters of the flow state structure. Figure 3 The configuration module) reads, writes, modifies and refreshes the flow state structure and TCP state field through the control module.

[0114] It should be noted that Figure 4In the above description, a new data flow is used as an example. If the data flow is not a new data flow, S402 and S404 can be executed without executing S401 and S403. This embodiment of the present invention does not limit this.

[0115] The upper-layer software in S404 reads, writes, modifies, and refreshes the flow state structure and TCP state field through the control module. This can be understood as the data flow management module accessing the flow state information (state) of the TCP flow in the flow table state structure. This can be achieved in the following ways:

[0116] 1. When the control module modifies the valid bit (vaild) in the TCP status field of the aging module to 1, the busy bit (dirty) of the flow table status structure is pulled high.

[0117] 2. Extract the corresponding flow table state structure based on the corresponding address information index, and perform the corresponding operation according to the operation category of operation. If the operation category is a read operation, the flow table state structure is output to the control module; if the operation category is a write operation, the timestamp (timestamp) and flow state information (state) in the flow table state structure are updated according to the timestamp control bit (dis_tstamp_update_wdata) and the new state of the TCP flow (new_state_wdata). That is, the upper-layer software of the control module updates the timestamp (timestamp) and state flags (flags) of the TCP flow in the flow table state structure.

[0118] 3. After completing the corresponding operation, pull the busy bit (dirty) of the flow table status structure low.

[0119] The above access process is to modify the field content of the aging module by the control module, thereby completing the TCP stream update process. As shown in Table 6, Table 6 provides an exemplary control module to modify the field content of the aging module according to an embodiment of the present invention.

[0120] Table 6

[0121] vaild Index wdata operation

[0122] The embodiment of the present invention separates the flow table search process from the aging process, and divides it into two storage modules to store the corresponding flow table parts respectively, thereby reducing the data processing volume of the two processes and improving the data flow search and matching process. The aging process can also be selectively performed based on the judgment result of the aging condition, thereby reducing unnecessary reading and writing of the aging state and improving the processing efficiency of the flow table. Moreover, by optimizing the aging process and meeting the different needs of users through the aging mode, the processing efficiency of the flow table is improved in a targeted manner. The embodiment of the present invention is directed to the flow table of TCP flow and UDP flow. During the aging process, the flow status information of the TCP flow is obtained through the status flag of the TCP flow, and the aging process of the TCP flow is completed in combination with the upper-layer software of the control module, thereby improving the reliability and processing efficiency of the system.

[0123] In order to implement the flow table management method of the embodiment of the present invention, the embodiment of the present invention also provides a flow table management device, such as Figure 5 As shown, Figure 5 An optional structural diagram of another flow table management device provided for an embodiment of the present invention, the device 50 includes: an acquisition module 501, used to obtain a keyword of a data flow; a search and matching module 502, used to search for a matching field of the data flow in a first storage module according to the keyword, and if the matching field is found, obtain the flow information of the data flow in the matching field; the acquisition module 501 is also used to obtain a flow table status structure in a second storage module according to the address of the flow table status structure corresponding to the matching field in the flow information; wherein the first storage module stores the address of the matching field of the data flow, which corresponds one-to-one to the address of the flow table status structure of the data flow stored in the second storage module; an aging module 503 is used to age the flow table status structure in the second storage module and delete the matching field in the first storage module if it is determined that the flow table status structure meets the aging conditions.

[0124] In some embodiments, the aging module 503 is also used to count the existence time of the flow table state structure according to the creation timestamp of the flow table state structure to obtain a count value; if the count value is greater than a first preset time period, the flow table state structure meets the aging condition; and / or, obtain the packet length of the data flow; based on the packet length of the data flow, perform packet counting or byte counting on the data flow; if the packet count or the byte count does not increase within a second preset time period, the flow table state structure meets the aging condition.

[0125] In some embodiments, the flow table management device 50 also includes a control module, and the acquisition module 501 is also used to obtain the accompanying data of the data flow, and the accompanying data stores the flow type of the data flow, and the flow type includes UDP flow and TCP flow; the aging module 503 is also used to directly determine whether the flow table status structure of the UDP flow meets the aging conditions if the flow type of the data flow is UDP flow; the acquisition module 501 is also used to obtain the flow status information of the TCP flow if the flow type of the data flow is TCP flow; the control module updates the flow table status structure of the TCP flow according to the flow status information of the TCP flow and the TCP status field in the flow table status structure of the TCP flow to obtain the updated flow table status structure of the TCP flow; the aging module 503 is also used to determine whether the updated flow table status structure of the TCP flow meets the aging conditions.

[0126] In some embodiments, the flow table management device 50 also includes a data flow management module. When the control module modifies the valid bit in the TCP status field to a high level, the data flow management module is used to pull up the busy bit of the flow table status structure of the TCP flow. The control module is used to update the flow table status structure of the TCP flow according to the flow status information of the TCP flow and the operation type to obtain the updated flow table status structure of the TCP flow, and after the update is completed, pull down the busy bit of the updated flow table status structure of the TCP flow; wherein, the operation type includes read operation and write operation, when the operation type is the read operation, the data flow management module is used to output the flow table status structure of the TCP flow to the control module; when the operation type is the write operation, the control module updates the timestamp and flow status of the flow table status structure of the TCP flow according to the timestamp control bit in the flow status information of the TCP flow and the new status of the TCP flow.

[0127] In some embodiments, the flow type of the data flow is a TCP flow, and the aging module 503 is further used to obtain the status flag of the TCP flow in the accompanying data, and the status flag of the TCP flow is used to control the flow state information of the TCP flow; according to the status flag of the TCP flow, the state migration of the TCP flow is determined; if the state migration of the TCP flow is in the sending completion state, the TCP flow meets the aging condition; or, according to each state in the status flag of the TCP flow, detect whether the TCP flow is always in the SYN state; if the TCP flow is always in the SYN state, then when the SYN is pulled high, when the packet count in the flow table state structure of the TCP flow is greater than a preset parameter, the TCP flow meets the aging condition.

[0128] In some embodiments, the aging module 503 is also used to age the flow table status structure in the second storage module and delete the matching field in the first storage module according to the aging mode corresponding to the data flow; wherein the aging mode includes hardware aging and software aging. When the aging mode is hardware aging, the flow table status structure in the second storage module is automatically aged, and the matching field in the first storage module is deleted; when the aging mode is software aging, the aging command issued by the control module is received, and the flow table status structure in the second storage module is aged according to the aging command, and the matching field in the first storage module is deleted.

[0129] In some embodiments, the search and matching module 502 is also used to input the data flow into the control module if the matching field of the data flow is not found; the control module sends the matching field of the data flow to the first storage module, and sends the flow table status structure of the data flow to the second storage module; the control module adds fields to the first storage module and the second storage module respectively, so that the first storage module stores the address of the matching field, which corresponds one-to-one to the address of the flow table status structure stored in the second storage module.

[0130] It should be noted that the flow table management device provided in the above embodiment only uses the division of the above program modules as an example to illustrate when performing flow table management. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the flow table management device provided in the above embodiment and the flow table management method embodiment belong to the same concept. The specific implementation process and beneficial effects are detailed in the method embodiment and will not be repeated here. For technical details not disclosed in the embodiment of this device, please refer to the description of the method embodiment of the present invention for understanding.

[0131] In an embodiment of the present invention, Figure 6 This is a schematic diagram of the structure of the flow table management device proposed in an embodiment of the present invention. Figure 6 As shown, the device 60 proposed in an embodiment of the present invention may also include a processor 601 and a memory 602 storing executable instructions of the processor 601. In some embodiments, the flow table management device 60 may also include a communication interface 603 and a bus 604 for connecting the processor 601, the memory 602 and the communication interface 603.

[0132] In an embodiment of the present invention, the processor 601 may be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller, and a microprocessor. It is understood that for different devices, the electronic device used to implement the above-mentioned processor function may also be other, and the embodiment of the present invention does not specifically limit this.

[0133] In the embodiment of the present invention, the bus 604 is used to connect the communication interface 603, the processor 601 and the memory 602, and to facilitate mutual communication between these devices.

[0134] In an embodiment of the present invention, the above-mentioned processor 601 is used to obtain a keyword of a data flow; based on the keyword, search for a matching field of the data flow in a first storage module, and if the matching field is found, obtain the flow information of the data flow in the matching field; based on the address of the flow table status structure corresponding to the matching field in the flow information, obtain the flow table status structure in a second storage module; wherein, the first storage module stores the address of the matching field of the data flow, which corresponds one-to-one to the address of the flow table status structure storing the data flow in the second storage module; if it is determined that the flow table status structure meets the aging condition, the flow table status structure in the second storage module is aged, and the matching field in the first storage module is deleted.

[0135] The memory 602 in the flow table management device 60 can be connected to the processor 601. The memory 602 is used to store executable program code and data. The program code includes computer operating instructions. The memory 602 may include high-speed RAM memory, and may also include non-volatile memory, for example, at least two disk memories. In actual applications, the above-mentioned memory 602 can be a volatile memory (volatile memory), such as random-access memory (Random-Access Memory, RAM); or a non-volatile memory (non-volatile memory), such as read-only memory (Read-Only Memory, ROM), flash memory (flash memory), hard disk drive (HDD) or solid-state drive (SSD); or a combination of the above-mentioned types of memory, and provides instructions and data to the processor 601.

[0136] In addition, the functional modules in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or software functional modules.

[0137] If the integrated unit is implemented in the form of a software functional module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment, or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the method of this embodiment. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0138] An embodiment of the present invention provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the flow table management method as described in any of the above embodiments is implemented.

[0139] Exemplarily, the program instructions corresponding to a flow table management method in this embodiment can be stored on a storage medium such as a CD, a hard disk, or a USB flash drive. When the program instructions corresponding to a flow table management method in the storage medium are read or executed by an electronic device, the flow table management method described in any of the above embodiments can be implemented.

[0140] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) containing computer-usable program code.

[0141] The present invention is described with reference to implementation flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the flowcharts. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which is implemented in the implementation flow diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process described in the flowchart. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0144] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention.

Claims

1. A flow table management method, characterized in that: The method comprises: Get the keyword of the data stream; Searching for a matching field of the data flow in the first storage module according to the keyword, and if the matching field is found, obtaining flow information of the data flow in the matching field; Obtaining a flow table state structure in a second storage module according to the address of the flow table state structure corresponding to the matching field in the flow information; wherein the address of the matching field of the data flow stored in the first storage module corresponds one-to-one to the address of the flow table state structure of the data flow stored in the second storage module; If it is determined that the flow table state structure meets the aging condition, the flow table state structure in the second storage module is aged, and the matching field in the first storage module is deleted.

2. The method according to claim 1, characterized in that The determining that the flow table state structure meets the aging condition includes: Counting the existence time of the flow table state structure according to the creation timestamp of the flow table state structure to obtain a count value; If the count value is greater than a first preset time period, the flow table state structure meets the aging condition; and / or, Obtaining the packet length of the data stream; Performing packet counting or byte counting on the data stream according to the packet length of the data stream; If the packet count or the byte count does not increase within the second preset time period, the flow table state structure meets the aging condition.

3. The method according to claim 1 or 2, characterized in that Before determining that the flow table state structure meets the aging condition, the method further includes: Acquire associated data of the data stream, wherein the associated data stores a stream type of the data stream, the stream type including a UDP stream and a TCP stream; If the flow type of the data flow is a UDP flow, directly determining whether the flow table state structure of the UDP flow meets the aging condition; If the flow type of the data flow is a TCP flow, obtaining flow state information of the TCP flow; The control module updates the flow table state structure of the TCP flow according to the flow state information of the TCP flow and the TCP state field in the flow table state structure of the TCP flow to obtain an updated flow table state structure of the TCP flow; Determine whether the updated flow table state structure of the TCP flow meets the aging condition.

4. The method according to claim 3, characterized in that The control module updates the flow table state structure of the TCP flow according to the flow state information of the TCP flow and the TCP state field in the flow table state structure of the TCP flow to obtain an updated flow table state structure of the TCP flow, including: When the control module modifies the valid bit in the TCP status field to a high level, the busy bit of the flow table status structure of the TCP flow is pulled high; According to the flow state information of the TCP flow, the flow table state structure of the TCP flow is updated according to the operation type to obtain the updated flow table state structure of the TCP flow, and after the update is completed, the busy bit of the updated flow table state structure of the TCP flow is lowered; Among them, the operation type includes read operation and write operation. When the operation type is the read operation, the flow table status structure of the TCP flow is output to the control module; when the operation type is the write operation, the control module updates the timestamp and flow status of the flow table status structure of the TCP flow according to the timestamp control bit in the flow status information of the TCP flow and the new status of the TCP flow.

5. The method according to claim 3, characterized in that The flow type of the data flow is a TCP flow, and determining that the flow table state structure meets the aging condition includes: Acquire a status flag of the TCP stream from the associated data, where the status flag of the TCP stream is used to control flow state information of the TCP stream; Determine the state transition of the TCP stream according to the state flag of the TCP stream; If the state transition of the TCP flow is in the sending completion state, the TCP flow meets the aging condition; or, Detecting whether the TCP flow is always in the SYN state according to each state in the state flag bit of the TCP flow; If the TCP flow is always in the SYN state, then when the SYN is pulled high, when the packet count in the flow table state structure of the TCP flow is greater than a preset parameter, the TCP flow meets the aging condition.

6. The method according to claim 1 or 2, characterized in that The aging of the flow table state structure in the second storage module and the deleting of the matching field in the first storage module include: aging the flow table state structure in the second storage module according to an aging mode corresponding to the data flow, and deleting the matching field in the first storage module; Among them, the aging mode includes hardware aging and software aging. When the aging mode is hardware aging, the flow table status structure in the second storage module is automatically aged, and the matching field in the first storage module is deleted; when the aging mode is software aging, the aging command issued by the control module is received, and the flow table status structure in the second storage module is aged according to the aging command, and the matching field in the first storage module is deleted.

7. The method according to claim 1 or 2, characterized in that The method further comprises: If no matching field of the data stream is found, the data stream is input to a control module; The control module sends the matching field of the data flow to the first storage module, and sends the flow table state structure of the data flow to the second storage module; The control module adds fields to the first storage module and the second storage module respectively, so that the address of the matching field stored in the first storage module corresponds one-to-one to the address of the flow table state structure stored in the second storage module.

8. A flow table management device, characterized in that: The device comprises: Acquisition module, used to obtain keywords of data stream; a search and matching module, configured to search for a matching field of the data flow in the first storage module according to the keyword, and if the matching field is found, obtain flow information of the data flow in the matching field; The acquisition module is further configured to acquire a flow table state structure in a second storage module according to the address of the flow table state structure corresponding to the matching field in the flow information; wherein the address of the matching field of the data flow stored in the first storage module corresponds one-to-one to the address of the flow table state structure of the data flow stored in the second storage module; An aging module is configured to age the flow table state structure in the second storage module and delete the matching field in the first storage module if it is determined that the flow table state structure meets an aging condition.

9. A flow table management device, characterized in that: The device includes a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, the steps in the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that Executable instructions are stored thereon, which are used to implement the method described in any one of claims 1 to 7 when executed by a processor.

Images