A hardware-assisted acceleration method and device for network flow

Abstract

The present invention discloses a method and device for hardware-assisted acceleration of network flows, wherein the method includes the following steps: when a network card device is connected, collecting the network flow rule set supported by the network card device and updating the network flow rule list; when a data packet is generated and triggers a network flow, hierarchically matching the network flow with a priority matching list, a priority processing list, and a network flow rule list, and determining a first action not supported by the network card device and a second action supported by the network card device based on the matching result; executing the first action to complete the modification of the data packet, and reordering and combining the second action to generate a merged network flow; unloading the modified data packet and the merged network flow to the network card device so that the network card device can execute the second action. The present invention achieves hardware-assisted acceleration through a hybrid offloading solution combining software and hardware, thereby improving flexibility while ensuring performance, and improving the matching efficiency of network flows.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing, and in particular to a hardware-assisted acceleration method and device for network flow, a computing device, and a computer storage medium. Background Art

[0002] The booming development of cloud computing has led to explosive growth in data. Improving network performance and quality is a major challenge facing cloud service providers. User-mode DPDK and kernel-mode XDP / eBPF are common solutions. Both achieve performance improvements by preempting available host resources, but this is not optimal for cloud service providers. With increasing performance demands, PCIe data passthrough technologies, such as SR-IOV, have emerged. By bypassing the host CPU and kernel / memory, this solution significantly improves data exchange efficiency, bringing virtual network performance close to that of a lossless physical network.

[0003] Currently, SmartNICs can implement flow control and data exchange management through network flow offloading, building on SR-IOV transparent transmission technology. However, network flow offloading is a rule-based offloading technology, requiring advanced hardware and software adaptation and development. Every rule in a network flow must be supported by the SmartNIC; otherwise, the entire network flow processing logic cannot be offloaded, significantly reducing network flow offload efficiency and packet forwarding performance.

[0004] While existing technologies can address performance issues associated with software processing of Ethernet packets through hardware offload, rule sets often need to be adjusted as services increase and requirements change. Since hardware's operating logic and supported functions generally cannot be altered after leaving the factory, existing technologies suffer from the following drawbacks: 1. In an already operational virtualized network environment, as service scenarios expand and change, an increasing number of rule sets become unavailable for offloading. 2. Each network flow contains multiple rules. If any rule is not supported by the physical network interface card (NIC), the NIC will forward the entire flow to the host for processing. Therefore, if a rule cannot be offloaded, all network flows using that rule cannot be offloaded. 3. As the TCP / IP model indicates, packet information is layered. Processing a single data connection requires the sequential processing of multiple, dependent network flows. If a rule is not supported by hardware, all network flows associated with the connection using that rule cannot be offloaded and must be forwarded to the host for processing. For example, a typical Ethernet packet modification action is a collection of modification rules. For example, link layer SMAC / DMAC modification, IP layer SIP / DIP modification, transport layer SPORT / DPORT modification, and message checksum modification. If the network card only supports one or two of these, it means that all modifications to the entire message processing must be performed in software. Summary of the Invention

[0005] In view of the above problems, the present invention is proposed to provide a method and apparatus for hardware-assisted acceleration of network flows, a computing device, and a computer storage medium that overcome the above problems or at least partially solve the above problems.

[0006] According to one aspect of the present invention, a method for hardware-assisted acceleration of network flows is provided, comprising the following steps:

[0007] When a network card device is connected, a network flow rule set supported by the network card device is collected, and a network flow rule list is updated according to the collected network flow rule set;

[0008] When a data packet is generated and triggers a network flow, the network flow is hierarchically matched with a priority matching list, a priority processing list, and a network flow rule list, and a first action not supported by the network card device and a second action supported by the network card device are determined according to the hierarchical matching results; wherein the priority matching list is used to store some network flow rules supported by the network card device, and the priority processing list is used to store network flow rules not supported by the network card device;

[0009] Executing a first action not supported by the network card device to complete the modification of the data packet, and reordering and combining second actions supported by the network card device to generate a merged network flow;

[0010] Unloading the modified data packet and the merged network flow to the network card device so that the network card device performs the second action.

[0011] Furthermore, when a data packet is generated and triggers a network flow, hierarchically matching the network flow with the priority matching list, the priority processing list, and the network flow rule list, and determining a first action not supported by the network card device and a second action supported by the network card device according to the hierarchical matching results includes the following steps:

[0012] When a data packet is generated and triggers a network flow, the network flow is matched against the priority matching list or priority processing list at the first level;

[0013] If there is a network flow that fails the first-level matching, the network flow is matched against the network flow rule list at the second level.

[0014] A first action not supported by the network card device and a second action supported by the network card device are determined according to the hierarchical matching result.

[0015] Furthermore, when a data packet is generated and triggers a network flow, the network flow is hierarchically matched with the priority matching list, the priority processing list, and the network flow rule list, and after determining the first action not supported by the network card device and the second action supported by the network card device according to the hierarchical matching results, the method further includes the following steps:

[0016] After the network flow matching is completed, the priority of each network flow rule corresponding to the network flow is adjusted, and the priority matching list and priority processing list are updated according to the priority of each network flow rule.

[0017] Furthermore, when a data packet is generated and triggers a network flow, the network flow is hierarchically matched with the priority matching list, the priority processing list, and the network flow rule list, and after determining the first action not supported by the network card device and the second action supported by the network card device according to the hierarchical matching results, the method further includes the following steps:

[0018] Generate a corresponding hardware adaptation flag parameter according to the second action supported by the network card device.

[0019] Furthermore, executing the first action not supported by the network card device, completing the modification of the data packet, and reordering and combining the second actions supported by the network card device to generate a merged network flow includes the following steps:

[0020] The first action not supported by the network card device is executed according to the hardware adaptation flag parameter to complete the modification of the data packet; the second action supported by the network card device is skipped, and the second actions supported by the network card device are reordered and combined to generate a merged network flow.

[0021] Furthermore, when skipping the execution of the second action supported by the network card device, the second action supported by the network card device is marked at the same time.

[0022] Furthermore, before unloading the modified data packet and the merged network flow to the network card device so that the network card device performs the second action, the method further includes the following steps:

[0023] Determine whether there are any remaining actions besides the first action that has been executed and the second action that has been marked. If so, perform hierarchical matching on the network flows corresponding to the remaining actions again with the priority matching list, the priority processing list and the network flow rule list, and determine the first action that is not supported by the network card device and the second action that is supported by the network card device among the remaining actions based on the hierarchical matching results; execute the first action that is not supported by the network card device, complete the modification of the data packet, mark the second action that is supported by the network card device and reorder and combine the second actions that are supported by the network card device to generate a merged network flow.

[0024] According to another aspect of the present invention, there is provided a hardware-assisted acceleration device for network flow, comprising:

[0025] The hardware adaptation module is used to collect the network flow rule set supported by the network card device when the network card device is connected, and update the network flow rule list according to the collected network flow rule set;

[0026] A multi-table priority query algorithm module is used to, when a data packet is generated and triggers a network flow, perform hierarchical matching on the network flow with a priority matching list, a priority processing list, and a network flow rule list, and determine a first action not supported by the network card device and a second action supported by the network card device based on the hierarchical matching results; wherein the priority matching list is used to store some network flow rules supported by the network card device, and the priority processing list is used to store network flow rules not supported by the network card device;

[0027] An action execution module is used to execute a first action not supported by the network card device, complete the modification of the data packet, and reorder and combine the second action supported by the network card device to generate a merged network flow; and unload the modified data packet and the merged network flow to the network card device so that the network card device can execute the second action.

[0028] According to another aspect of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0029] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to any of the above-mentioned hardware-assisted acceleration methods for network flows.

[0030] According to another aspect of the present invention, a computer storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables a processor to perform operations corresponding to any of the hardware-assisted acceleration methods for network flows described above.

[0031] According to a hardware-assisted acceleration method for network flow of the present invention, the method has the following beneficial effects:

[0032] When the network card device does not fully support the rule set, the present invention implements hardware-assisted acceleration through a hybrid offloading solution combining software and hardware, thereby improving flexibility while ensuring performance and increasing the matching efficiency of network flows.

[0033] The present invention can bring performance benefits and hardware compatibility improvements to cloud service providers, and has broad technical applicability and good economic benefits.

[0034] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0036] Figure 1-2 A schematic diagram illustrating a process flow of a hardware-assisted acceleration method for network flows provided by an embodiment of the present invention is shown;

[0037] Figure 3 A schematic diagram showing a flow chart of a hardware-assisted acceleration method for network flows provided by a specific embodiment of the present invention;

[0038] Figure 4 A schematic diagram of the structure of a hardware-assisted acceleration device for network flows provided by an embodiment of the present invention is shown;

[0039] Figure 5 A schematic structural diagram of a computing device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0040] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0041] like Figure 1-2 As shown, it shows a flowchart of a hardware-assisted acceleration method for network flow according to an embodiment of the present invention, which is applied to a computing device. The computing device includes: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to a hardware-assisted acceleration method for network flow. Figure 1-2 As shown, the method includes the following steps:

[0042] Step 110: When the network card device is connected, the network flow rule set supported by the network card device is collected, and the network flow rule list is updated according to the collected network flow rule set; the network flow rule list here stores all network flow rules supported by the network card device;

[0043] When a network card device is connected, the system actively searches for the message actions supported by the network card device through the hardware adapter module, obtains the network flow rule set supported by the network card device based on the message actions supported by the network card device, and then updates the network flow rule set supported by the network card device to the network flow rule list;

[0044] Step 120: When a data packet is generated and triggers a network flow, the network flow is hierarchically matched with the priority matching list, the priority processing list, and the network flow rule list, and a first action not supported by the network card device and a second action supported by the network card device are determined based on the hierarchical matching results; wherein the priority matching list is used to store some network flow rules supported by the network card device, and the priority processing list is used to store network flow rules not supported by the network card device;

[0045] The hierarchical matching of network flows is implemented through a multi-table priority query algorithm module. Hierarchical matching can determine which actions can be completed in the network card and which actions need to be completed in the software, so as to facilitate the determination of the first action that the network card device does not support and the second action that the network card device supports based on the hierarchical matching results; the priority matching list and the network flow rule list are both used to store the network flow rules supported by the network card device. The difference is that the priority matching list stores some of the network flow rules supported by the network card device, while the network flow rule list stores all the network flow rules supported by the network card device. Therefore, the number of network flow rules in the priority matching list is much smaller than the number of network flow rules in the network flow rule list;

[0046] When the host communicates with the outside world, it generates a data packet with a specified protocol header, and then passes the data packet to the system for further processing. The system performs routine processing operations such as modifying the TCP / UDP header, IP header, MAC header, and Vx LAN encapsulation.

[0047] Step 130: Execute the first action not supported by the network card device, complete the modification of the data packet, and reorder and combine the second action supported by the network card device to generate a merged network flow; and unload the modified data packet and the merged network flow to the network card device so that the network card device can execute the second action; after the network card device receives the modified data packet and the merged network flow, it completes subsequent processing of the data packet according to the unloaded network flow; after all actions of the data packet are completed, the data packet is sent out from the network port.

[0048] like Figure 3As shown, when the network card device is connected to the system, the system collects the network flow rule set supported by the network card device as {Rule 3, Rule 4, Rule 6, Rule 9}, and the updated network flow rule list obtained based on the collected network flow rule set is {Rule 3, Rule 4, Rule 5, Rule 6, Rule 7, Rule 8, Rule 9}; when a data packet is generated and triggers a network flow, the actions in the data packet include P1, P2, P3 and P4, and the network flow triggered by the action in the data packet is hierarchically matched with the priority matching list, the priority processing list and the network flow rule list, and the network flow corresponding to the actions P1 and P2 is matched to the priority processing list, and the network flow corresponding to the actions P3 and P4 is matched to the priority matching list. According to the matching result, the actions P1 and P4 can be determined. 2 is the first action not supported by the network card device, and actions P3 and P4 are the second actions supported by the network card device; therefore, the first actions P1 and P2 not supported by the network card device are processed by the system. After processing the first actions P1 and P2, the system completes the modification of the data packet, and reorders and combines the second actions P3 and P4 supported by the network card device to generate a merged network flow; finally, the system unloads the modified data packet and the merged network flow to the network card device, thereby facilitating the network card device to execute the second actions P3 and P4 it supports; by dividing the actions into the first action and the second action, the network flow supported by the network card is processed by the network card, and the network flow not supported by the network card is processed by the software. On the premise of realizing hardware-assisted acceleration, it is better adapted to various types of network cards and improves flexibility.

[0049] In an optional manner, when a data packet is generated and triggers a network flow, hierarchically matching the network flow with a priority matching list, a priority processing list, and a network flow rule list, and determining a first action not supported by the network card device and a second action supported by the network card device based on the hierarchical matching results includes the following steps:

[0050] When a data packet is generated and a network flow is triggered, the network flow is matched against the priority matching list or the priority processing list at the first level;

[0051] If there is a network flow that fails the first-level matching, the network flow and the network flow rule list are subjected to a second-level universal matching;

[0052] A first action not supported by the network card device and a second action supported by the network card device are determined according to the hierarchical matching result.

[0053] In this method, since the network flow rules in the priority matching list and the priority processing list are fewer than the network flow rules in the network flow rule list, performing the first-level matching first can reduce the matching time.

[0054] In an optional manner, when a data packet is generated and triggers a network flow, the network flow is hierarchically matched with the priority matching list, the priority processing list, and the network flow rule list, and after determining the first action not supported by the network card device and the second action supported by the network card device according to the hierarchical matching results, the hardware-assisted acceleration method further includes the following steps:

[0055] After all network flows are matched, the priority of the network flow rules corresponding to the network flows is adjusted, and the priority matching list and priority processing list are updated according to the priority of each network flow rule.

[0056] In this optional method, adjusting the priority of the network flow rules corresponding to the network flow means adding one to the priority of the network flow rules corresponding to the network flow. In the subsequent first-level matching of the network flow, the matching is based on the updated priority matching list and priority processing list, thereby speeding up the matching progress.

[0057] In an optional manner, when a data packet is generated and triggers a network flow, the network flow is hierarchically matched with the priority matching list, the priority processing list, and the network flow rule list, and after determining the first action not supported by the network card device and the second action supported by the network card device according to the hierarchical matching results, the auxiliary acceleration method further includes:

[0058] Generate a corresponding hardware adaptation flag parameter according to the second action supported by the network card device.

[0059] In this optional manner, a hardware adaptation flag parameter is generated to facilitate determining whether the action to be performed is the first action or the second action based on the hardware adaptation flag parameter.

[0060] In an optional manner, executing the first action not supported by the network card device to complete the modification of the data packet, and reordering and combining the second actions supported by the network card device to generate a merged network flow includes the following steps:

[0061] A first action not supported by the network card device is executed based on the hardware adaptation flag parameter to complete the modification of the data packet; a second action supported by the network card device is skipped, and the second actions supported by the network card device are reordered and combined to generate a merged network flow. When skipping the second action supported by the network card device, the second action supported by the network card device is simultaneously marked. If the action to be executed is determined to be the second action supported by the network card device based on the hardware adaptation flag parameter, the action to be executed is marked.

[0062] By marking the second action, the marked action can be skipped during action execution. In addition, it can be determined whether there are any unmarked and unexecuted actions before the network flow is unloaded to the network card device.

[0063] In an optional manner, before unloading the modified data packet and the merged network flow to the network card device so that the network card device performs the second action, the method further includes the following steps:

[0064] Determine whether there are any remaining actions besides the first action that has been executed and the second action that has been marked. If so, perform hierarchical matching on the network flows corresponding to the remaining actions again with the priority matching list, the priority processing list and the network flow rule list, and determine the first action that is not supported by the network card device and the second action that is supported by the network card device among the remaining actions based on the hierarchical matching results; execute the first action that is not supported by the network card device, complete the modification of the data packet, mark the second action that is supported by the network card device and reorder and combine the second actions that are supported by the network card device to generate a merged network flow.

[0065] When the network card is inserted into the present invention, the software actively collects the network flow rule list supported by the network card device and updates it to the network flow rule list of the software.

[0066] The present invention adopts a strategy that combines multiple tables and hierarchical matching to perform a first-level fast match on network flow rules from the two directions of actions supported and unsupported by the network card device, and performs a second-level universal match on network flows that fail to match, and dynamically adjusts the priorities of the rules in the priority matching list and the priority processing list, thereby improving the matching efficiency of the network flow.

[0067] When processing data packets, the present invention dynamically modifies and recombines the data packets and network flows according to the hierarchical matching results, and processes the parts of the network flow that are not supported by the network card and the parts that are supported by the network card by software and hardware respectively, achieving a hybrid offloading effect of software and hardware collaboration and improving the efficiency of hardware-assisted acceleration.

[0068] Figure 4 FIG. 1 is a schematic diagram showing a hardware-assisted acceleration device for network flow according to an embodiment of the present invention. Figure 4 As shown, the device includes a hardware adaptation module 310, a multi-table priority query algorithm module 320 and an action execution module 330, wherein:

[0069] The hardware adaptation module 310 is used to collect the network flow rule set supported by the network card device when the network card device is connected, and update the network flow rule list according to the collected network flow rule set;

[0070] The multi-table priority query algorithm module 320 is configured to, when a data packet is generated and triggers a network flow, perform hierarchical matching on the network flow against a priority matching list, a priority processing list, and a network flow rule list, and determine, based on the hierarchical matching results, a first action not supported by the network card device and a second action supported by the network card device; wherein the priority matching list is configured to store some network flow rules supported by the network card device, and the priority processing list is configured to store network flow rules not supported by the network card device;

[0071] The action execution module 330 is used to execute the first action not supported by the network card device, complete the modification of the data packet, and reorder and combine the second action supported by the network card device to generate a merged network flow; and unload the modified data packet and the merged network flow to the network card device so that the network card device can execute the second action.

[0072] In an optional manner, when a data packet is generated and triggers a network flow, the multi-table priority query algorithm module 320 hierarchically matches the network flow with the priority matching list, the priority processing list, and the network flow rule list, and determines, based on the hierarchical matching results, a first action not supported by the network card device and a second action supported by the network card device, including the following steps:

[0073] When a data packet is generated and a network flow is triggered, the multi-table priority query algorithm module 320 is triggered to perform a first-level match between the network flow and the priority matching list or the priority processing list;

[0074] If there is a network flow that fails the first-level matching, the multi-table priority query algorithm module 320 is triggered to perform a second-level universal matching between the network flow and the network flow rule list;

[0075] The multi-table priority query algorithm module 320 determines a first action that is not supported by the network card device and a second action that is supported by the network card device according to the hierarchical matching result.

[0076] In an optional manner, when a data packet is generated and triggers a network flow, the multi-table priority query algorithm module 320 hierarchically matches the network flow with the priority matching list, the priority processing list, and the network flow rule list, and after determining the first action not supported by the network card device and the second action supported by the network card device based on the hierarchical matching results, further performs the following operations:

[0077] When the network flow matching is completed, the multi-table priority query algorithm module 320 is triggered to adjust the priority of the network flow rule corresponding to the network flow, and update the priority matching list and the priority processing list according to the priority of each network flow rule.

[0078] In an optional manner, after the multi-table priority query algorithm module 320 hierarchically matches the network flow with the priority matching list, the priority processing list, and the network flow rule list, and determines the first action not supported by the network card device and the second action supported by the network card device based on the hierarchical matching results, the multi-table priority query algorithm module 320 further performs the following operations:

[0079] Generate a corresponding hardware adaptation flag parameter according to the second action supported by the network card device.

[0080] In an optional manner, the action execution module 330 executes the first action not supported by the network card device to complete the modification of the data packet, and reorders and combines the second actions supported by the network card device to generate a merged network flow, including the following steps:

[0081] The action execution module 330 executes a first action not supported by the network card device based on the hardware adaptation flag parameter, completing the modification of the data packet. Simultaneously, the action execution module 330 skips executing a second action supported by the network card device and reorders and combines the second actions supported by the network card device to generate a merged network flow. When the action execution module 330 skips executing the second action supported by the network card device, the second action supported by the network card device is simultaneously marked. If the action to be executed is determined to be a second action supported by the network card device based on the hardware adaptation flag parameter, the action to be executed is marked.

[0082] In this optional manner, if the action execution module 330 determines that the action to be executed is the second action supported by the network card device, the action execution module 330 is triggered to mark the action to be executed.

[0083] In an optional manner, before the action execution module 330 unloads the modified data packet and the merged network flow to the network card device so that the network card device can execute the second action, the action execution module 330 further performs the following operations:

[0084] Determine whether there are any remaining actions besides the first action that has been executed and the second action that has been marked. If so, trigger the multi-table priority query algorithm module 320 to perform hierarchical matching on the network flows corresponding to the remaining actions with the priority matching list, the priority processing list and the network flow rule list again, and determine the first action that is not supported by the network card device and the second action that is supported by the network card device among the remaining actions according to the hierarchical matching results; then trigger the action execution module 330 to execute the first action that is not supported by the network card device, complete the modification of the data packet, mark the second action supported by the network card device and reorder and combine the second actions supported by the network card device to generate a merged network flow.

[0085] When the network card is inserted into the present invention, the hardware adaptation module 310 actively collects the network flow rule list supported by the network card device and updates it to the network flow rule list of the software.

[0086] The multi-table priority query algorithm module 320 of the present invention adopts a strategy that combines multiple tables and hierarchical matching, performs a first-level fast match on network flow rules from the two directions of actions supported and unsupported by the network card device, and performs a second-level general match on network flows that fail to match, and dynamically adjusts the priorities of the rules in the priority matching list and the priority processing list, thereby improving the matching efficiency of the network flow.

[0087] When processing data packets, the present invention dynamically modifies and recombines the data packets and network flows based on the hierarchical matching results, and processes the parts of the network flow that are not supported by the network card and the parts that are supported by the network card by software and hardware respectively, achieving a hybrid offloading effect of software and hardware collaboration and improving the efficiency of hardware-assisted acceleration.

[0088] An embodiment of the present invention provides a non-volatile computer storage medium storing at least one executable instruction. The computer executable instruction can execute a hardware-assisted acceleration method for a network flow in any of the above method embodiments.

[0089] Figure 5 A schematic structural diagram of an embodiment of a computing device of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the computing device.

[0090] like Figure 5 As shown, the computing device may include: a processor 402 , a communications interface 404 , a memory 406 , and a communication bus 408 .

[0091] Processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408. Communication interface 404 is used to communicate with other devices, such as clients or other server network elements. Processor 402 is used to execute program 410, which may specifically perform the steps described in the embodiment of a hardware-assisted network flow acceleration method for a computing device.

[0092] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0093] Processor 402 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in the hardware-assisted network flow acceleration device may be processors of the same type, such as one or more CPUs, or processors of different types, such as one or more CPUs and one or more ASICs.

[0094] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0095] The program 410 may be specifically configured to enable the processor 402 to execute a hardware-assisted acceleration method for a network flow in any of the above method embodiments.

[0096] The algorithm or demonstration provided herein are not inherently relevant to any particular computer, virtual system or other equipment. Various general-purpose systems may also be used together with the teachings based on this. According to the above description, it is apparent that the structure required for constructing this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0097] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0098] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims that follow the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the invention.

[0099] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0100] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0101] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It will be appreciated by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components according to an embodiment of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing a part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0102] It should be noted that the above embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by a person skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments should not be understood as limiting the order of execution unless otherwise specified.

Claims

1. A hardware-assisted acceleration method for network flow, characterized in that: The steps include: When a network card device is connected, a network flow rule set supported by the network card device is collected, and a network flow rule list is updated according to the collected network flow rule set; When a data packet is generated and triggers a network flow, the network flow is hierarchically matched with a priority matching list, a priority processing list, and a network flow rule list, and a first action not supported by the network card device and a second action supported by the network card device are determined according to the hierarchical matching results; wherein the priority matching list is used to store some network flow rules supported by the network card device, and the priority processing list is used to store network flow rules not supported by the network card device; Executing a first action not supported by the network card device to complete the modification of the data packet, and reordering and combining second actions supported by the network card device to generate a merged network flow; Unloading the modified data packet and the merged network flow to the network card device so that the network card device performs the second action.

2. The method according to claim 1, characterized in that When a data packet is generated and triggers a network flow, hierarchically matching the network flow with the priority matching list, the priority processing list, and the network flow rule list, and determining a first action not supported by the network card device and a second action supported by the network card device according to the hierarchical matching results comprises the following steps: When a data packet is generated and triggers a network flow, the network flow is matched against the priority matching list or priority processing list at the first level; If there is a network flow that fails the first-level matching, the network flow is matched against the network flow rule list at the second level. A first action not supported by the network card device and a second action supported by the network card device are determined according to the hierarchical matching result.

3. The method according to claim 2, characterized in that When a data packet is generated and triggers a network flow, the network flow is hierarchically matched with the priority matching list, the priority processing list, and the network flow rule list, and a first action not supported by the network card device and a second action supported by the network card device are determined according to the hierarchical matching results. The method further comprises the following steps: After the network flow matching is completed, the priority of each network flow rule corresponding to the network flow is adjusted, and the priority matching list and priority processing list are updated according to the priority of each network flow rule.

4. The method according to claim 2, characterized in that When a data packet is generated and triggers a network flow, the network flow is hierarchically matched with the priority matching list, the priority processing list, and the network flow rule list, and a first action not supported by the network card device and a second action supported by the network card device are determined according to the hierarchical matching results. The method further comprises the following steps: Generate a corresponding hardware adaptation flag parameter according to the second action supported by the network card device.

5. The method according to claim 4, characterized in that The step of executing the first action not supported by the network card device, completing the modification of the data packet, and reordering and combining the second actions supported by the network card device to generate a merged network flow comprises the following steps: The first action not supported by the network card device is executed according to the hardware adaptation flag parameter to complete the modification of the data packet; the second action supported by the network card device is skipped, and the second actions supported by the network card device are reordered and combined to generate a merged network flow.

6. The method according to claim 5, characterized in that When skipping the execution of the second action supported by the network card device, the second action supported by the network card device is marked at the same time.

7. The method according to claim 6, characterized in that Before unloading the modified data packet and the merged network flow to the network card device so that the network card device performs the second action, the method further includes the following steps: Determine whether there are any remaining actions besides the first action that has been executed and the second action that has been marked. If so, perform hierarchical matching on the network flows corresponding to the remaining actions again with the priority matching list, the priority processing list and the network flow rule list, and determine the first action that is not supported by the network card device and the second action that is supported by the network card device among the remaining actions based on the hierarchical matching results; execute the first action that is not supported by the network card device, complete the modification of the data packet, mark the second action that is supported by the network card device and reorder and combine the second actions that are supported by the network card device to generate a merged network flow.

8. A hardware-assisted acceleration device for network flow, characterized in that: include: The hardware adaptation module is used to collect the network flow rule set supported by the network card device when the network card device is connected, and update the network flow rule list according to the collected network flow rule set; A multi-table priority query algorithm module is used to, when a data packet is generated and triggers a network flow, perform hierarchical matching on the network flow with a priority matching list, a priority processing list, and a network flow rule list, and determine a first action not supported by the network card device and a second action supported by the network card device based on the hierarchical matching results; wherein the priority matching list is used to store some network flow rules supported by the network card device, and the priority processing list is used to store network flow rules not supported by the network card device; An action execution module is used to execute a first action not supported by the network card device, complete the modification of the data packet, and reorder and combine the second action supported by the network card device to generate a merged network flow; and unload the modified data packet and the merged network flow to the network card device so that the network card device can execute the second action.

9. A computing device comprising: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the hardware-assisted acceleration method for network flow according to any one of claims 1 to 7.

10. A computer storage medium, wherein the storage medium stores at least one executable instruction, wherein the executable instruction enables a processor to perform operations corresponding to the hardware-assisted acceleration method for network flows according to any one of claims 1 to 7.

Images