A message processing method and network security device

Abstract

The application provides a message processing method and a network security device, and relates to the technical field of network security. The method is applied to a field programmable gate array (FPGA) included in a network security device, and the network security device further includes a central processing unit (CPU). The FPGA receives a network message. The network message is subjected to copy processing to obtain a copy message. Target data used for calculating a checksum is extracted from the network message. The target data is processed by using a checksum superposition model to obtain a target checksum. The target checksum is compared with a checksum in the network message. A comparison result and the target checksum are encapsulated into the copy message and sent to the CPU. Thus, the problem of excessively high CPU usage caused by CPU calculation of the checksum is solved, and the residence time of the message in the CPU is reduced.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a message processing method and a network security device. Background Technology

[0002] Currently, network traffic can be filtered using a filtering network security device. For example, for an internal LAN, a filtering network security device can block terminals from accessing chat applications, entertainment websites, and other websites unrelated to work. Filtering network security devices are typically deployed between the client and server to filter network packets between them. Most filtering network security devices employ an architecture combining an FPGA (Field-Programmable Gate Array) and a CPU (Central Processing Unit). The FPGA is primarily responsible for receiving and sending packets, as well as communication with upstream network switching chips and downstream CPUs. The CPU is mainly responsible for packet parsing, session establishment, session matching, and packet filtering—tasks related to business operations.

[0003] Typically, when a CPU receives an input packet, its primary task is to calculate and verify the packet's checksum to ensure the packet's integrity and correctness during network transmission. During checksum calculation, for example, calculating the checksum of the Layer 3 header (such as the IPv4 header, which is 20 bytes long) requires 10 memory accesses and addition operations, thus consuming significant CPU resources. Furthermore, calculating the checksum of the Layer 4 header requires calculating the entire packet (up to approximately 1500 bytes), potentially requiring at least 750 memory accesses and addition operations. This not only significantly increases CPU utilization but also prolongs the packet's time in the CPU, thereby reducing the filtering performance of network security devices.

[0004] Therefore, how to solve the problem of excessive CPU utilization caused by CPU checksum calculation and how to reduce the time that packets stay in the CPU are among the technical issues worth considering. Summary of the Invention

[0005] In view of this, this application provides a message processing method and a network security device to solve the problem of excessive CPU utilization caused by CPU calculation of checksum.

[0006] Specifically, this application is implemented through the following technical solution:

[0007] According to a first aspect of this application, a message processing method is provided, applied in a field-programmable gate array (FPGA) included in a network security device, the network security device further including a central processing unit (CPU), the method comprising:

[0008] Receive network messages;

[0009] The network packets are copied to obtain copied packets;

[0010] Extract the target data for calculating the checksum from the network packets;

[0011] The target data is processed using a checksum overlay model to obtain the target checksum;

[0012] Compare the target checksum with the checksum in the copied message;

[0013] The comparison results and target checksum are encapsulated into the copy message and sent to the CPU.

[0014] According to a second aspect of this application, a network security device is provided, comprising: a field-programmable gate array (FPGA) and a central processing unit (CPU), wherein the FPGA includes:

[0015] The first communication module is used to receive network packets;

[0016] A checksum generation module is used to copy the network packets to obtain copied packets; extract target data for calculating checksums from the network packets; process the target data using a checksum overlay model to obtain a target checksum; compare the target checksum with the checksum in the copied packets; and encapsulate the comparison result and the target checksum into the copied packets.

[0017] The second communication module is used to send a copy message containing the comparison result and the target checksum to the CPU.

[0018] The beneficial effects of the embodiments of this application are as follows:

[0019] In the message processing method and network security device provided in this application embodiment, the checksum calculation is implemented inside the FPGA of the network security device, thereby reducing CPU utilization. Specifically, after receiving a network message, the FPGA copies the network message to obtain a copied message; it extracts target data for checksum calculation from the network message; it processes the extracted target data using a checksum overlay model to obtain a target checksum; then it compares the target checksum with the checksum in the network message; and it encapsulates the comparison result and the target checksum into the copied message and sends it to the CPU. Since the FPGA itself has a relatively high processing speed and is configured with checksum overlay models for different checksums, after extracting the target data, the target data can be directly overlaid using the checksum overlay model to obtain the target checksum, which is then sent to the CPU. Because the CPU does not need to calculate the checksum, this greatly reduces CPU utilization, thus solving the problem of excessive CPU utilization caused by checksum calculation. Simultaneously, it also shortens the time network messages spend in the CPU. Attached Figure Description

[0020] Figure 1 This is a structural diagram illustrating an application scenario of a network security device provided in an embodiment of this application;

[0021] Figure 2 This is a flowchart illustrating a message processing method provided in an embodiment of this application;

[0022] Figure 3 This is a schematic diagram of the operational logic for calculating the target checksum for three-layer verification, provided in an embodiment of this application.

[0023] Figure 4 This is a schematic diagram of the operational logic for calculating the target checksum for four-layer verification, provided in an embodiment of this application.

[0024] Figure 5 This is a schematic diagram of the structure of a network security device provided in an embodiment of this application;

[0025] Figure 6 This is a schematic diagram of the internal structure of a verification and generation module provided in an embodiment of this application;

[0026] Figure 7 This is a schematic diagram of the operation logic of the target checksum provided in the embodiments of this application. Detailed Implementation

[0027] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0028] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used herein are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the corresponding listed items.

[0029] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0030] The message processing method provided in this application will be described in detail below.

[0031] The network security equipment provided in this application can be applied to... Figure 1 Taking the application scenario shown as an example, firstly, when the client wants to access the server, the client stream will send a forward message to the network switching device. Then, the FPGA for network device security in this application will receive the forward message sent by the network switching device, and then use the message processing method provided in any embodiment of this application to generate a checksum for the forward message, and send the forward message to the CPU in the network device. After the CPU completes the business-related tasks of the corresponding forward message based on the checksum, it will feed back the forward message to the FPGA, and then the FPGA will reach the server through the network security device.

[0032] Similarly, when the server responds to the client, it sends a reverse message to the network switching device. Then, the FPGA in the network security device in this application receives the reverse message forwarded by the network security device. The FPGA internally generates a checksum of the reverse message by implementing the message processing method provided in any embodiment of this application, and then sends the checksum and the reverse message to the CPU. After the CPU completes business-related tasks such as session matching, it sends the reverse message to the FPGA, and the FPGA sends the reverse message to the client through the network switching device.

[0033] Based on the above description, see [link / reference]. Figure 2 , Figure 2 This is a flowchart of a message processing method provided in this application. This method can be applied to a field-programmable gate array (FPGA) included in a network security device, which also includes a central processing unit (CPU). When implementing the message processing method, the FPGA may include the following steps:

[0034] S201, Receive network messages.

[0035] In this step, the network packets received by the FPGA can be either forward packets sent from the client to the server through the network security device, or reverse packets sent from the server to the client through the network security device.

[0036] S202. The network packets are copied to obtain copied packets.

[0037] In this step, to facilitate checksum generation and message synchronization, this embodiment will copy the network message. This results in a single network message and its copy within the FPGA. One message is used to generate the checksum, and the other is used to buffer the message for synchronization after checksum generation. For ease of description, the following explanation will use the example of generating a checksum based on the network message and caching the copied message.

[0038] S203. Extract the target data for calculating the checksum from the network message.

[0039] In this step, the data required to calculate the checksum varies depending on the specific needs. Therefore, the target data can be extracted from the network packets according to the current requirements.

[0040] Specifically, the target data mentioned above can be data used for three-layer verification of messages, or data used for four-layer verification of messages, and so on.

[0041] S204. The target data is processed using a checksum overlay model to obtain the target checksum.

[0042] In this step, different checksums correspond to different checksum calculation methods. Therefore, when calculating the checksum, the corresponding checksum overlay model will be called to process the target data, thereby obtaining the corresponding target checksum.

[0043] S205. Compare the target checksum with the checksum in the copied message.

[0044] In this step, after obtaining the target checksum, the checksum carried in the copied message can be compared with the target checksum to obtain the comparison result.

[0045] S206. The comparison result and the target checksum are encapsulated into the copy message and sent to the CPU.

[0046] In this step, to facilitate CPU processing, the FPGA can encapsulate the comparison result and the target checksum into a copy message and send it to the CPU. For example, to reduce structural changes to the copy message, the comparison result and the target checksum can be encapsulated into a header information and then appended to the beginning of the copy message as the CPU header, thereby obtaining the processed copy message, which is then sent to the CPU.

[0047] By implementing the message processing method provided in this application, checksum calculation is performed internally within the FPGA. Specifically, after receiving a network message, the FPGA copies the network message to obtain a copied message; it extracts target data for checksum calculation from the network message; it processes the extracted target data using a checksum overlay model to obtain a target checksum; then it compares the target checksum with the checksum in the network message; and it encapsulates the comparison result and the target checksum into the copied message and sends it to the CPU. Since the FPGA itself has a high processing speed and is configured with checksum overlay models for different checksums, after extracting the target data, the target data can be directly overlaid using the checksum overlay model to obtain the target checksum, which is then sent to the CPU. Because the CPU does not need to calculate the checksum, this significantly reduces CPU utilization, thus solving the problem of excessive CPU utilization caused by checksum calculation. Simultaneously, it also shortens the time network messages spend in the CPU.

[0048] It should be noted that, to ensure the accurate generation of the checksum used for verification, this embodiment first clears the checksum in the network packet to zero before extracting the target data for verification calculation. Furthermore, when performing verification based on network packets, the calculation must be tailored to the specific scenario of the network security device. Different scenarios may require the same or different checksums, and even within the same scenario, the number of checksums required may vary. For ease of understanding, this embodiment provides the calculation process for calculating the checksum for Layer 3 verification and / or for calculating the checksum for Layer 4 verification.

[0049] Optionally, when it is necessary to calculate the checksum for Layer 3 verification of the message, the extracted target data is the Layer 3 header data of the message, which may be, but is not limited to, the IPv4 header of the network message. Based on this, step S104 can be executed according to the following process: group the target data to obtain several groups of first target sub-data, each group having the same bit width; sum the first target sub-data of adjacent groups to obtain several groups of second target sub-data; use the second target sub-data as new first target sub-data, and continue to sum the first target sub-data of adjacent groups to obtain several groups of second target sub-data, until a final group of second target sub-data is obtained, denoted as the third target sub-data; according to the bit width of the target checksum used for Layer 3 verification, divide the third target sub-data into a high number of bits of first data and a low number of bits of second data. The process involves: first data and second data, where the bit width of the second data is the same as the bit width of the target checksum used for layer 3 verification; summing the first and second data to obtain the fourth target sub-data; if the bit width of the fourth target sub-data is different from the bit width of the target checksum used for layer 3 verification, then the fourth target sub-data is treated as the third target sub-data, and the process continues to divide the third target sub-data into a first data with a high number of bits and a second data with a low number of bits according to the bit width of the target checksum, until a fourth target sub-data with the same bit width as the target checksum used for layer 3 verification is obtained; and the target checksum used for layer 3 verification is determined based on the fourth target sub-data with the same bit width as the target checksum.

[0050] Specifically, taking a target data length of 20 bytes for the three-layer checksum as an example, to obtain the target checksum for the three-layer checksum, the FPGA can send the target data into the three-layer checksum superposition model, thereby outputting the target checksum for the three-layer checksum. For ease of description, the checksum superposition model for the three-layer checksum can be denoted as the three-layer checksum superposition model, and the target checksum for the three-layer checksum can be denoted as the first checksum. Based on this, the three-layer checksum superposition model can perform superposition calculations on the target data according to the superposition principle of its model, thereby obtaining the first checksum.

[0051] Specifically, with Figure 3 The calculation process of the first checksum is illustrated using the superposition calculation method shown below. Figure 3 The three-layer checksum stacking model uses a 6-stage pipelined processing logic. Considering the potential for overflow during stacking calculations, the bit width of each stage can be configured. For example, the bit width of a stage prone to overflow can be set to one bit greater than the input bit width of the data to that stage. That is, assuming the input bit width to stage 1 is 16 bits, the bit width of stage 1 can be set to 17 bits, and the bit width of stage 2 can be set to 18 bits greater than the 17 bits input to stage 2. Furthermore, since the three-layer checksum stacking model is a group accumulation model, after accumulating to a certain level, there may be a situation where only one set of data remains. When this set of data is input to the next stage, the bit width of the next stage needs to be set based on the bit width of the first checksum to be calculated. For example… Figure 3 If the fourth stage outputs a set of data, then when proceeding to the fifth stage, the bit width of the fifth stage can be set according to the bit width of the first checksum. For example, assuming the checksum to be calculated has a bit width of 16 bits, to prevent overflow, the bit width of the fifth stage can be set to 16 + 1 = 17 bits. Furthermore, considering that this application involves calculating a checksum, the bit width of the output data of the last stage must be consistent with the bit width of the first checksum, i.e., refer to... Figure 3 As shown, the bit width of level 6 is set to be consistent with the bit width of the checksum, that is, set to 16 bits.

[0052] Based on this, the 20 bytes (160 bits) of target data are divided into 16-bit segments, resulting in 10 groups of first target sub-data with the same bit width (16 bits). Figure 3 The ten groups from group a0 to group a9 of level 0 are denoted as the first target sub-data obtained from the above division. These ten groups are then paired and fed into the level 1 overlay unit for summation, resulting in five groups of level 1 second target sub-data. (Reference) Figure 3As shown, groups a0 and a1 are input into the first-level superimposed data unit to obtain the second target sub-data of the first level. The superposition process of other groups is similar to that described above and will not be detailed here. Based on the above process, five groups of second target sub-data can be obtained, namely groups b0 to b4. Then, pairwise superposition calculations are performed again. At this time, groups b0 and b1 are superimposed, and groups b2 and b3 are superimposed, resulting in two superposition results of the second level. Since we have not yet obtained a second target sub-data with only one group, the superposition result obtained in this superposition calculation can still be recorded as the second target sub-data, i.e., the above-mentioned two groups of second target sub-data of the second level are obtained. In addition, since there are five groups of second target sub-data of the first level, which is an odd number, group b4 can be excluded from the superposition calculation when performing pairwise superposition calculations, and the second target sub-data of the second level can be obtained directly. For details, please refer to [reference needed]. Figure 3 As shown. Since the bit width of the second level is 18 bits, and the bit width of the second target sub-data in group b4 is 17 bits, the high bits of the second target sub-data in group b4 can be padded with 0s to obtain the target sub-data of the second level with the same bit width as the second level. It should be noted that if the above four groups of data are superimposed pairwise, and if the two superposition results do not overflow, but in order to obtain data with the same bit width as the second level, the high bits of the two superposition results can be padded with 0s respectively, thus obtaining three groups of second target sub-data of the second level.

[0053] It should be noted that the second target sub-data in group b4 can also be input into the overlay unit and then superimposed with 0 to obtain a superimposed result with the same bit width as the second level. Furthermore, Figure 3 This is just an example. When stacking, the order does not have to be followed. That is, the a0 group can be stacked with the a9 group, the a1 group can be stacked with the a2 group, and so on. The specific method can be determined according to the actual situation.

[0054] Based on the above superposition calculation, three sets of second-level target sub-data of the second stage are obtained, namely the second target sub-data of the c0th group to the c2th group. Then, the pairwise superposition calculation is continued, and the calculation process is similar to that described above, so it will not be described in detail here. This results in two sets of second-level target sub-data of the third stage, namely the second target sub-data of the d0th group and the d1th group. Then, the superposition calculation is continued to obtain a set of second target sub-data of the fourth stage (the e0th group). For ease of description, the second target sub-data of the e0th group is referred to as the third target sub-data. In order to obtain a first checksum (16 bits) with a bit width consistent with the bit width of the first checksum, since the bit width of the third target sub-data is 20 bits at this time, the third target sub-data can be divided into a first data with a high 4 bits and a second data with a low 16 bits. Then, the first data and the second data are superimposed to obtain the fourth target sub-data of the fifth stage (the f0th group). Since the superposition here is the superposition of 4 bits of data and 16 bits of data, the bit width of the fourth target sub-data of the fifth stage is ( Figure 3 The 17-bit data in the middle may not be consistent with the bit width of the first checksum. Therefore, this embodiment proposes to treat the fourth target sub-data as the new third target sub-data and continue to perform the division and superposition process, that is, combining... Figure 3 As shown, the fourth target sub-data (the new third target sub-data) of group f0 is divided into a first data with a high bit and a second data with a low bit of 16 bits. Then, the first data and the second data are superimposed. Since the high bit is only 1 bit, the superposition result of level 6 generally will not overflow. Therefore, the superposition result of level 6 is the fourth target sub-data with the same bit width (16 bits) as the first checksum, i.e., the fourth target sub-data of group g0. Then, the first checksum is determined based on the fourth target sub-data of group g0, i.e., the target checksum used for the three-layer checksum.

[0055] Specifically, taking the 20-bit third target sub-data of level 4 as 0100 0101 0110 0010 0001 as an example, the first data is 0100, and the second data is 0101 0110 0010 0001. The summation of the first and second data can be understood as padding the high-order bits of the first data with 0s to make them the same width as the second data. That is, it can be expressed as: 0101 0110 0010 0001 + 0000 0000 0000 0100 = 0101 0110 0010 0101, which gives the superposition result of level 5. It should be noted that in actual calculation, the high-order bits of the first data do not need to be padded with 0s. The first data can be directly used as the low 4 bits and superimposed with the second data to obtain the superposition result of level 5. In addition, since overflow may occur during the superposition calculation, the bit width of the 5th level will be set to 17 bits to avoid errors in the calculation results. Therefore, the high bits of the 16-bit superposition result obtained above need to be padded with 1 0 to obtain the fourth target sub-data of the 5th level.

[0056] Optionally, when determining the target checksum based on the fourth target sub-data whose bit width is consistent with the target checksum used for the three-layer check, the following process can be performed: the fourth target sub-data is inverted to obtain the target checksum used for the three-layer check.

[0057] Specifically, based on the calculation principle of checksums, Figure 3 The first checksum is obtained by inverting the 16-bit fourth target sub-data (data of group g0) calculated in the previous step, which is the target checksum used for layer 3 verification. Verification shows that calculating the layer 3 checksum of a message only requires a 6-clock delay. Taking an FPGA with an internal clock frequency of 250MHz as an example, this equates to 4ns per clock cycle. Using the checksum generation method for layer 3 verification provided in this embodiment, calculating the checksum only requires 24ns. Compared to current CPU-based checksum calculations, this significantly reduces the checksum generation time and lowers the CPU utilization rate caused by checksum calculations. Furthermore, since CPU-based checksum calculations are not required, the dwell time of network packets on the CPU is greatly reduced.

[0058] Thus, by adopting the aforementioned three-layer checksum stacking model, i.e., the multi-stage pipeline folding model, to calculate the checksum of the three layers of checksum in parallel, not only is the calculation speed high, but also, due to the parallel calculation method, it does not occupy too much of the FPGA's internal storage resources. This prevents network packets from staying in the FPGA for too long, and also avoids the problem of network packets staying in the CPU for too long. This further improves the processing speed of network packets in the entire network security device, that is, it improves the packet processing performance of the network security device.

[0059] Based on any of the above embodiments, when it is necessary to perform four-layer verification based on network packets, step S203 can be performed according to the following process: when it is necessary to perform four-layer verification on network packets, at least one target data is extracted from the network packets; wherein, one target data is determined based on the packet four-layer header data and pseudo-header data in the network packets, and the other target data is obtained based on the payload data in the network packets.

[0060] Specifically, the original checksum in the Layer 4 header data of the above message is cleared to zero. Then, the pseudo header data extracted from the network message and the Layer 4 header data of the message are encapsulated into a data packet. Then, the payload data of the network message is encapsulated into several data packets, thus obtaining each data packet. Generally, no more than 12 data packets can be obtained, and each data packet is a target data.

[0061] It is worth noting that, for ease of calculation, the bit width of each target data processed by the four-layer checksum overlay model is the same. When the bit widths of the divided target data are different, the high-order bits are padded with 0s to ensure that the bit width of the target data input to the four-layer checksum overlay model is the same. For example, the bit width can be set to 128 bytes. If the actual bit width of the obtained data packet is less than 128 bytes, 0s are padded to make the bit width of the data packet reach 128 bytes.

[0062] Furthermore, for ease of description, the checksum overlay model used for the four-layer check is denoted as the four-layer checksum overlay model, and the target checksum used for the four-layer check is denoted as the second checksum.

[0063] Based on this, when performing the second checksum calculation, step S204 can be executed according to the following process: For each target data, the target data is grouped to obtain several groups of first sub-data, with each group of first sub-data having the same bit width; the first sub-data of adjacent groups are summed to obtain several groups of second sub-data; the second sub-data is used as the new first sub-data, and the process of summing the first sub-data of adjacent groups is continued to obtain several groups of second sub-data, until two groups of second sub-data are finally obtained, which are denoted as the third sub-data and the fourth sub-data, respectively; the fifth sub-data of the other target data obtained in the previous calculation is obtained; the third sub-data and the fourth sub-data are expanded into first extended data and second extended data with the same bit width as the fifth sub-data; the first extended data, the second extended data, and the fifth sub-data are summed to obtain the fifth sub-data of the target data; based on the fifth sub-data of the target data, the target checksum for the four-layer check is determined.

[0064] Specifically, taking a target data set of 128 bytes as an example, this target data is input into a four-layer checksum overlay model, which then calculates the second checksum according to the aforementioned process. It should be noted that because a large amount of target data is required for the four-layer checksum calculation, the overlay result calculated based on the previous target data is fed back into the calculation of the overlay result for the next target data, until the last target data. The second checksum is then obtained based on the overlay result of the last target data, which will be explained in detail below.

[0065] Specifically, refer to Figure 4 The calculation process of the second checksum is illustrated using the superposition calculation method shown below. Figure 3 The four-layer checksum stacking model is also a six-stage pipelined processing model. Considering the possibility of overflow during stacking calculation, the bit width of each stage can be pre-set. For example, the bit width of the stage where overflow may occur can be set to one bit more than the bit width of the data input to that stage. That is, assuming the bit width of the data input to the first stage is 16 bits, the bit width of the first stage can be set to 17 bits, and the bit width of the second stage can be set to one bit more than the 17 bits input to the second stage, i.e., 18 bits. The bit width setting method for intermediate stages is similar to the above. Regarding the bit width setting of the last stage, considering that this application is to calculate the second checksum, the bit width of the output data of the last stage can be set to twice the bit width of the second checksum, i.e., refer to... Figure 4 As shown, assuming the bit width of the second checksum is 16 bits, the bit width of the 6th level can be set to 32 bits.

[0066] Based on this, each 128-byte target data is input into a four-layer checksum overlay model. This model then divides the target data into 64 groups of 2 bytes each, obtaining the first sub-data of each of the 64 groups, i.e., the first sub-data of groups a0 to a63 in level 0, with each group's first sub-data including 2 bytes of data. Then, the first sub-data of the 64 groups are overlaid pairwise, i.e., Figure 4 The first sub-data of group a0 and the first sub-data of group a1 are superimposed to obtain the second sub-data of group b0 in level 1, and so on. The first sub-data of group a62 and the first sub-data of group a63 are superimposed to obtain the second sub-data of group b31 in level 1. Then, the second sub-data of each group in level 1 are treated as new first sub-data, and the above superposition process is repeated to obtain the second sub-data of each group in level 2, and so on, until finally 2 groups of second sub-data are obtained. Figure 4 The second sub-data of group f0 and group f1 in level 5 are denoted as the third and fourth sub-data respectively for ease of description. To obtain a result with a bit width consistent with that of level 6, the third and fourth sub-data can be extended by padding the high-order bits with 0, thus obtaining the first and second extended data. (Refer to...) Figure 4 As shown, the third sub-data is expanded to obtain 32-bit first expanded data, and the fourth sub-data is expanded to obtain 32-bit second expanded data. To obtain the sixth-level superposition result of this target data, the superposition result calculated from the previous target data in the network packet is first obtained, i.e., the fifth sub-data of the other target data obtained in the previous calculation. Then, the fifth sub-data is superimposed with the first and second expanded data to obtain the fifth sub-data of the g0 group of the sixth level, i.e., the fifth sub-data of this target data, and the width of the obtained fifth sub-data is 32 bits. Based on the fifth sub-data of this target data, the second checksum is obtained. For ease of understanding, if the target data currently involved in the calculation is considered the second target data, then the fifth sub-data of the other target data obtained in the previous calculation is the fifth sub-data calculated based on the first target data.

[0067] It is worth noting that when calculating the fifth sub-data of the target data based on the first target data of the network packet, the initial value of the fifth sub-data calculated in the previous calculation process can be a set value, such as 0.

[0068] When a network packet is split into 12 data packets, corresponding to 12 target data, the fifth sub-data calculated based on the first target data will be fed back into the process of calculating the fifth sub-data of the second target data, thus obtaining the fifth sub-data of the second target data, and so on, until the fifth sub-data corresponding to the 12th target data needs to be calculated.

[0069] Based on this, the process of determining the target checksum for Layer 4 verification based on the fifth sub-data of the target data can be performed as follows: If the target data is the last data in the network packet used to process the target data using the checksum overlay model to obtain the target checksum, then according to the bit width of the target checksum for Layer 4 verification, the fifth sub-data is divided into a high number of third data bits and a low number of fourth data bits, wherein the bit width of the fourth data bits is the same as the bit width of the target checksum for Layer 4 verification; the third data bits and the fourth data bits are summed to obtain the sixth sub-data bits; if the bit width of the sixth sub-data bits is different from the bit width of the target checksum for Layer 4 verification, then the sixth sub-data bits are determined as the new fifth sub-data bits, and the step of dividing the fifth sub-data bits into a high number of third data bits and a low number of fourth data bits according to the bit width of the target checksum for Layer 4 verification continues until a sixth sub-data bits with the same bit width as the target checksum for Layer 4 verification is obtained; the sixth sub-data bits are inverted to obtain the target checksum for Layer 4 verification.

[0070] Specifically, it also means Figure 4 Taking this example, when calculating the fifth sub-data of the 12th target data (the last target data in the network packet), this fifth sub-data is 32 bits. Therefore, when calculating the second checksum based on this fifth sub-data, it can be first split into a high 16-bit third data and a low 16-bit fourth data. It should be noted that this splitting method is only one proposed method in this embodiment; other splitting methods can be used in actual applications, depending on the specific circumstances. Based on this, a sixth sub-data is obtained. If the bit width of the sixth sub-data is different from the bit width of the second checksum, the sixth sub-data can be treated as a new fifth sub-data, and the splitting process can continue. Since the sixth sub-data is obtained by superimposing two 16-bit data, the maximum bit width of the resulting sixth sub-data is 17 bits. At this point, the sixth sub-data can be treated as a new fifth sub-data, split into a 1-bit third data and a 16-bit fourth data, and then superimposed. Generally, the superposition result will not overflow, thus obtaining a sixth sub-data with a bit width consistent with the bit width of the second checksum. Then, the sixth sub-data is inverted to obtain the second checksum.

[0071] It is worth noting that if the target data is not the last data in the network message used to perform the step of processing the target data using the checksum overlay model to obtain the target checksum, then the fifth sub-data of the target data is temporarily stored as feedback when the next target data is used to calculate the second checksum.

[0072] Verification shows that for calculating the four-layer checksum of a packet, a single packet (with a length not exceeding 128 bytes) requires only 9 (8+1) clock cycles of delay, while the largest packet (with a length of 1500 bytes) requires only 21 (8+13) clock cycles of delay. Taking an FPGA with an internal clock frequency of 250MHz as an example, i.e., each clock cycle is 4ns, the checksum generation method for four-layer verification provided in this embodiment requires only 36ns to calculate the four-layer checksum of a single packet and 84ns to calculate the four-layer checksum of the largest packet. The overall delay is less than 100ns. Compared with the current method of calculating the four-layer checksum on the CPU (750 memory accesses and addition operations), this greatly saves the checksum generation time and reduces the occurrence of high CPU utilization due to checksum calculation. Moreover, since the CPU does not need to calculate the checksum, the dwell time of network packets on the CPU is greatly reduced.

[0073] It should be noted that during the above four-layer verification, the four-layer header data of the message can be, but is not limited to, TCP / UDP header data.

[0074] Thus, by adopting the aforementioned four-layer checksum stacking model, i.e., the multi-stage pipeline folding model, to calculate the checksum of the four layers of checksum in parallel, not only is the calculation speed high, but also, due to the parallel calculation method, it does not occupy too much of the FPGA's internal storage resources. This prevents network packets from staying in the FPGA for too long, and also avoids the problem of network packets staying in the CPU for too long. This further improves the processing speed of network packets in the entire network security device, that is, it improves the packet processing performance of the network security device.

[0075] It should be noted that when the FPGA calculates the first checksum and / or the second checksum, it will obtain the first comparison result of the first checksum and / or the second comparison result of the second checksum. The FPGA can then encapsulate the first checksum and its first comparison result, and / or the second checksum and its second comparison result, into a header and append it to the beginning of the copy message. Finally, the FPGA sends the concatenated copy message to the CPU. Upon receiving the copy message, the CPU, based on its message format, parses the first checksum and its first comparison result, and / or the second checksum and its second comparison result, from the header of the copy message. Based on the parsed information, the CPU performs processing on the copy message; for example, if the first comparison result is inconsistent, the copy message may be discarded.

[0076] It should be noted that when the network packet received by the FPGA does not require verification, it can be directly passed to the CPU so that the CPU can execute subsequent business processing based on the network packet.

[0077] Based on the same inventive concept, this application also provides a network security device, see reference. Figure 5 The diagram shows the structure of a network security device, which includes an FPGA and a central processing unit (CPU). The FPGA includes:

[0078] The first communication module 501 is used to receive network packets;

[0079] The checksum generation module 502 is used to copy the network packet to obtain a copied packet; extract target data for calculating the checksum from the network packet; process the target data using a checksum overlay model to obtain a target checksum; compare the target checksum with the checksum in the copied packet; and encapsulate the comparison result and the target checksum into the copied packet.

[0080] The second communication module 503 is used to send a copy message containing the comparison result and the target checksum to the CPU.

[0081] Specifically, after receiving a network packet, the first communication module 501 sends it to the checksum generation module 502. The checksum generation module 502 then copies the network packet to obtain a copied packet. It extracts the target data for calculating the checksum from this network packet, processes the extracted target data using a checksum overlay model to obtain the target checksum, compares the target checksum with the checksum in the network packet, and encapsulates the comparison result and the target checksum into the copied packet, sending it to the CPU via the second communication module 503. Since the FPGA itself has a high processing speed and is configured with checksum overlay models for different checksums, after extracting the target data, the target data can be directly overlaid using this checksum overlay model to obtain the target checksum, which is then sent to the CPU. Because the CPU does not need to calculate the checksum, this significantly reduces CPU utilization, solving the problem of excessive CPU utilization caused by checksum calculation. Simultaneously, it also shortens the time the network packet spends in the CPU.

[0082] Optionally, based on the above embodiments, the checksum generation module 502 in this embodiment includes a copy submodule, a synchronization submodule, an accumulation submodule, and an encapsulation submodule, referencing... Figure 6 As shown, where:

[0083] The replication submodule is used to replicate the network packets to obtain replicated packets; and send the replicated packets to the synchronization submodule; and send the network packets to the accumulation submodule.

[0084] The synchronization submodule is used to cache the copied messages;

[0085] The accumulation submodule is used to extract target data for calculating checksums from received network packets; process the target data using a checksum overlay model to obtain the target checksum; and compare the target checksum with the checksum in the network packet to obtain the comparison result.

[0086] An encapsulation submodule is used to obtain the replication message from the synchronization submodule and the target checksum and the comparison result from the accumulation submodule; and to encapsulate the comparison result and the target checksum into the replication message.

[0087] Specifically, the replication submodule receives the network packet input from the first communication module 501, then replicates it into two copies. One copy is output to the synchronization submodule, and the other is output to the accumulation submodule. For ease of description, we will use the example of outputting the replicated packet to the synchronization submodule and the network packet to the superposition submodule. The accumulation submodule obtains the target data from the network packet, then calculates the target checksum of the network packet and compares it with the checksum in the replicated packet. This accumulation submodule includes both three-layer and four-layer checksum superposition models. The synchronization module does not modify the content of the received replicated packet; it only buffers the replicated packet and ensures that the output of the target checksum from the accumulation submodule is synchronized with the timing of the output. Both are output to the encapsulation submodule. The encapsulation submodule encapsulates the target checksum and comparison result generated by the accumulation submodule into a 6-byte header, then appends it to the beginning of the replicated packet received from the synchronization packet as the CPU header. The resulting replicated packet is then sent to the CPU through the second communication module 503.

[0088] Specifically, the synchronization submodule and the accumulation submodule maintain synchronization using the following method: Both the synchronization and accumulation submodules have buffer queues to ensure synchronization. For ease of description, a first buffer queue is set up in the synchronization submodule, and a second buffer queue is set up in the accumulation submodule. The write and read rules for the first and second buffer queues are the same. Furthermore, since the replication submodule sends replication packets to the synchronization submodule and also sends network packets to the accumulation submodule, whenever the synchronization submodule receives a replication packet, it buffers that packet in the first buffer queue. For the accumulation submodule, after calculating the target checksum based on the received network packets, it writes the target checksum to the second buffer queue. In this way, when the read clock arrives, the synchronization submodule reads a copy message from the first buffer queue and sends it to the encapsulation submodule. At the same time, the accumulation submodule reads the target checksum from the second buffer queue and sends it to the encapsulation submodule. Since the write and read rules of the two buffer queues are the same, the synchronous transmission of the copy message and the corresponding checksum can be guaranteed.

[0089] Based on the above embodiments, in this embodiment, when it is necessary to perform Layer 3 verification on the network packet, the target data is the Layer 3 header data of the packet; the above-mentioned accumulation submodule is specifically used for:

[0090] The target data is grouped to obtain several groups of first target sub-data, and the bit width of the first target sub-data in each group is the same;

[0091] Summing the first target sub-data of two adjacent groups yields several groups of second target sub-data.

[0092] The second target sub-data is used as the new first target sub-data, and the process of summing the two adjacent groups of first target sub-data is continued to obtain several groups of second target sub-data, until a group of second target sub-data is finally obtained, which is denoted as the third target sub-data.

[0093] Based on the bit width of the target checksum used for the three-layer verification, the third target sub-data is divided into a first data with a high number of bits and a second data with a low number of bits, wherein the bit width of the second data is the same as the bit width of the target checksum used for the three-layer verification.

[0094] The first data and the second data are summed to obtain the fourth target sub-data;

[0095] If the bit width of the fourth target sub-data is not the same as the bit width of the target checksum used for three-layer verification, then the fourth target sub-data is treated as the third target sub-data, and the step of dividing the third target sub-data into a first data with a high number of bits and a second data with a low number of bits according to the bit width of the target checksum is continued until a fourth target sub-data with the same bit width as the target checksum used for three-layer verification is obtained.

[0096] The target checksum for the three-layer checksum is determined based on the fourth target sub-data whose bit width is consistent with that of the target checksum.

[0097] It should be noted that the generation of the target checksum for the three-layer verification described above can be found in the relevant descriptions in the corresponding method embodiments, and will not be described in detail here.

[0098] Furthermore, the aforementioned accumulation submodule is specifically used to invert the fourth target subdata to obtain the target checksum for the three-layer verification.

[0099] Specifically, in combination Figure 7 The structure shown is explained below. The checksum generation module 502 can internally be configured with a first-in-first-out (FIFO) denoted as FIFO1 for caching the target checksum used for Layer 3 verification. The generated fourth target sub-data is then cached in FIFO1. Thus, when calculating the Layer 3 checksum, this fourth target sub-data can be directly read from FIFO1 and inverted to obtain the target checksum. Based on this, the checksum in the corresponding replicated message can be obtained from the synchronization submodule. The comparison result between the generated target checksum and the obtained checksum is then determined, and the target checksum and comparison result are sent to the encapsulation submodule for concatenation. It should be noted that... Figure 7 The document does not include a diagram of the verification and comparison process; it is only an illustration.

[0100] Optionally, based on any of the above embodiments, in this embodiment, the above-mentioned accumulation submodule is specifically used to extract at least one target data from the network packet when it is necessary to perform four-layer verification on the network packet; wherein, one target data is determined based on the packet four-layer header data and pseudo-header data in the network packet, and the other target data is obtained based on the payload data in the network packet.

[0101] Based on this, the aforementioned accumulation submodule is specifically used for:

[0102] For each target data, the target data is grouped to obtain several groups of first sub-data, and the first sub-data of each group has the same bit width.

[0103] Summing the first sub-data of two adjacent groups yields several groups of second sub-data.

[0104] The second sub-data is used as the new first sub-data, and the process of summing the first sub-data of the two adjacent groups is continued to obtain several groups of second sub-data, until two groups of second sub-data are finally obtained, which are denoted as the third sub-data and the fourth sub-data respectively.

[0105] Obtain the fifth sub-data of the other target data obtained in the previous calculation;

[0106] The third and fourth sub-data are expanded into first and second extended data with the same bit width as the fifth sub-data;

[0107] The first extended data, the second extended data, and the fifth sub-data are summed to obtain the fifth sub-data of the target data.

[0108] Based on the fifth sub-data of the target data, determine the target checksum for the four-layer verification.

[0109] It should be noted that the specific process of calculating the target checksum for the four-layer verification by the above-mentioned accumulation submodule can be found in the relevant descriptions in the corresponding method embodiments, and will not be described in detail here.

[0110] Furthermore, the aforementioned accumulation submodule is specifically used for:

[0111] Based on the bit width of the target checksum used for the four-layer verification, the fifth sub-data is divided into a third data with a high number of bits and a fourth data with a low number of bits, wherein the bit width of the fourth data is the same as the bit width of the target checksum used for the four-layer verification.

[0112] The third and fourth data are summed to obtain the sixth sub-data.

[0113] If the bit width of the sixth sub-data is different from the bit width of the target checksum used for the four-layer check, then the sixth sub-data is determined as a new fifth sub-data, and the step of dividing the fifth sub-data into a high number of third data bits and a low number of fourth data bits according to the bit width of the target checksum used for the four-layer check continues until a sixth sub-data with the same bit width as the target checksum used for the four-layer check is obtained.

[0114] The sixth sub-data is inverted to obtain the target checksum used for the four-layer verification.

[0115] Specifically, it also combines Figure 7 The structure shown is explained below. The checksum generation module 502 can also be configured with a first-in-first-out (FIFO) denoted as FIFO2 for caching the target checksum for the fourth-level check. Then, when calculating the target checksum for the fourth-level check, the sixth sub-data can be read from FIFO2. Taking the sixth sub-data as 32 bits and the target checksum width as 16 bits as an example, since the width of the fifth sub-data is inconsistent with the width of the target checksum, the fifth sub-data can be split into a high 16-bit third data and a low 16-bit fourth data as described above. The third data and the fourth data are then summed to obtain the 17-bit sixth sub-data of level 7 (data of group h0). Since the width of the sixth sub-data obtained this time is still inconsistent with the width of the target checksum, the sixth sub-data is treated as a new fifth sub-data. This fifth sub-data is then further split to obtain a high 1-bit third data and a low 16-bit fourth data. The third data and the fourth data are then superimposed to obtain the sixth sub-data of level 8 with a width consistent with the 16-bit width of the target checksum (data of group i0). Finally, the sixth sub-data is inverted to obtain the target checksum used for the four-layer check.

[0116] Based on this, the checksum of the Layer 4 checksum in the corresponding replicated message can be obtained from the synchronization submodule. Then, the comparison result between the generated target checksum and the obtained checksum is determined, and the target checksum and comparison result are sent to the encapsulation submodule for concatenation. It should be noted that... Figure 7 The document does not include a diagram of the verification and comparison process; it is only an illustration.

[0117] It should be noted that the specific process of calculating the target checksum for the four-layer verification by the above-mentioned accumulation submodule can be found in the relevant descriptions in the corresponding method embodiments, and will not be described in detail here.

[0118] Based on any of the above embodiments, the first communication module 501 in this embodiment is specifically used to receive network packets through a high-speed communication interface. This high-speed communication interface can be, but is not limited to, a 100GE interface, etc. Specifically, the 100GE interface has built-in driver logic. When a network packet is received, the driver logic is called to convert the network packet into several fixed-length data packets. Since the length of an IP packet is between 46 and 1500 bytes, taking 128 bytes per data packet as an example, the driver logic of the 100GE interface can convert the network packet into data packets with a minimum of 1 and a maximum of approximately 12. Furthermore, driven by the FPGA clock, each data packet is transmitted in parallel; therefore, the checksum generation module 502 can receive the complete network packet.

[0119] Optionally, based on any of the above embodiments, the second communication module 503 in this embodiment is specifically used to send the copied packets to the CPU via the PCIe interface. Similar to the 100GE interface, the PCIe interface in this embodiment also has internal driver logic and performs format conversion. The conversion process is similar to that of the 100GE interface, and will not be described in detail here. After conversion, each data packet is sent to the CPU in parallel, so that the CPU receives a complete network packet.

[0120] Based on this, combined Figure 1 and Figure 5 Taking the scenario shown as an example, when the first communication module 501 in the network security device is implemented using a 100GE interface and the second communication module 503 is implemented using a PCIE interface, the forward message first flows from the client to the network switching device, and then enters the FPGA in the network security device through the 100GE interface. After the target checksum of the forward message is generated by the message processing method provided in any embodiment of this application inside the FPGA, it enters the CPU through the PCIE interface. After completing the session matching and other business-related tasks inside the CPU, it enters the FPGA through the PCIE interface, then enters the network switching device through the 100GE interface, and finally enters the server.

[0121] For reverse packets, the reverse packets first flow from the server to the network switching device, and then enter the FPGA in the network security device through the 100GE interface. After the target checksum of the reverse packets is generated by the packet processing method provided in any embodiment of this application inside the FPGA, it enters the CPU through the PCIe interface. After completing service-related tasks such as session matching inside the CPU, it enters the FPGA through the PCIe interface again, then enters the network switching device through the 100GE interface, and finally enters the client.

[0122] By providing a network security device with the above-mentioned structure, a multi-stage pipeline folding model is used to calculate checksums in parallel. This not only results in high calculation speed but also avoids consuming too much storage resources within the FPGA due to the parallel computing method. This prevents network packets from staying in the FPGA for too long, and also avoids the problem of network packets staying in the CPU for too long. This further improves the overall network security device's packet processing speed, thus enhancing the packet processing performance of the network security device.

[0123] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0124] The specific implementation process of the functions and roles of each unit / module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0125] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units / modules described as separate components may or may not be physically separate. The components shown as units / modules may or may not be physical units / modules, that is, they may be located in one place or distributed across multiple network units / modules. Some or all of the units / modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0126] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A message processing method, characterized in that, The method, applied in a network security device including a field-programmable gate array (FPGA) and a central processing unit (CPU), comprises: Receive network messages; The network packets are copied to obtain copied packets; Extract the target data for calculating the checksum from the network packets; The target data is processed using a checksum overlay model to obtain the target checksum; Compare the target checksum with the checksum in the copied message; The comparison result and the target checksum are encapsulated into the copy message and sent to the CPU; Extracting target data for calculating checksums from the network packets includes: When a four-layer verification is required for the network packet, at least one target data is extracted from the network packet; One of the target data is determined based on the layer 4 header data and pseudo header data in the network packet, while the other target data is obtained by dividing the payload data in the network packet. When the bit widths of the target data obtained from the division are different, the bit widths of the target data input to the four-layer verification and the superposition model are made the same by padding the high bits with 0. The FPGA is configured with checksum overlay models for different checksums; the step of processing the target data using the checksum overlay model to obtain the target checksum includes: calling the corresponding checksum overlay model to process the target data to obtain the corresponding target checksum.

2. The method according to claim 1, characterized in that, When a three-layer verification is required for the network packet, the target data is the three-layer header data of the packet; The target data is processed using a checksum overlay model to obtain the target checksum, including: The target data is grouped to obtain several groups of first target sub-data, and the bit width of the first target sub-data in each group is the same; Summing the first target sub-data of two adjacent groups yields several groups of second target sub-data. The second target sub-data is used as the new first target sub-data, and the process of summing the two adjacent groups of first target sub-data is continued to obtain several groups of second target sub-data, until a group of second target sub-data is finally obtained, which is denoted as the third target sub-data. Based on the bit width of the target checksum used for the three-layer verification, the third target sub-data is divided into a first data with a high number of bits and a second data with a low number of bits, wherein the bit width of the second data is the same as the bit width of the target checksum used for the three-layer verification. The first data and the second data are summed to obtain the fourth target sub-data; If the bit width of the fourth target sub-data is not the same as the bit width of the target checksum used for three-layer verification, then the fourth target sub-data is treated as the third target sub-data, and the step of dividing the third target sub-data into a first data with a high number of bits and a second data with a low number of bits according to the bit width of the target checksum is continued until a fourth target sub-data with the same bit width as the target checksum used for three-layer verification is obtained. The target checksum for the three-layer checksum is determined based on the fourth target sub-data whose bit width is consistent with that of the target checksum.

3. The method according to claim 2, characterized in that, The target checksum is determined based on the fourth target sub-data whose bit width is consistent with the target checksum used for the three-layer check, including: The fourth target sub-data is inverted to obtain the target checksum used for the three-layer verification.

4. The method according to claim 1, characterized in that, The target data is processed using a checksum overlay model to obtain the target checksum, including: For each target data, the target data is grouped to obtain several groups of first sub-data, and the first sub-data of each group has the same bit width. Summing the first sub-data of two adjacent groups yields several groups of second sub-data. The second sub-data is used as the new first sub-data, and the process of summing the first sub-data of the two adjacent groups is continued to obtain several groups of second sub-data, until two groups of second sub-data are finally obtained, which are denoted as the third sub-data and the fourth sub-data respectively. Obtain the fifth sub-data of the other target data obtained in the previous calculation; The third and fourth sub-data are expanded into first and second extended data with the same bit width as the fifth sub-data; The first extended data, the second extended data, and the fifth sub-data are summed to obtain the fifth sub-data of the target data. Based on the fifth sub-data of the target data, determine the target checksum for the four-layer verification.

5. The method according to claim 4, characterized in that, Based on the fifth sub-data of the target data, determine the target checksum for the four-layer verification, including: If the target data is the last data in the network packet used to perform the step of processing the target data using the checksum overlay model to obtain the target checksum, then according to the bit width of the target checksum used for the four-layer check, the fifth sub-data is divided into a third data with a high number of bits and a fourth data with a low number of bits, wherein the bit width of the fourth data is the same as the bit width of the target checksum used for the four-layer check. The third and fourth data are summed to obtain the sixth sub-data. If the bit width of the sixth sub-data is different from the bit width of the target checksum used for the four-layer check, then the sixth sub-data is determined as a new fifth sub-data, and the step of dividing the fifth sub-data into a high number of third data bits and a low number of fourth data bits according to the bit width of the target checksum used for the four-layer check continues until a sixth sub-data with the same bit width as the target checksum used for the four-layer check is obtained. The sixth sub-data is inverted to obtain the target checksum used for the four-layer verification.

6. A network security device, characterized in that, include: A Field Programmable Gate Array (FPGA) and a Central Processing Unit (CPU), wherein the FPGA includes: The first communication module is used to receive network packets; A checksum generation module is used to copy the network packets to obtain copied packets; extract target data for calculating checksums from the network packets; process the target data using a checksum overlay model to obtain a target checksum; compare the target checksum with the checksum in the copied packets; and encapsulate the comparison result and the target checksum into the copied packets. The second communication module is used to send a copy message containing the comparison result and the target checksum to the CPU; The checksum generation module includes an accumulation submodule, which is specifically used to extract at least one target data from the network packet when a four-layer check is required on the network packet. One of the target data is determined based on the layer 4 header data and pseudo header data in the network packet, while the other target data is obtained by dividing the payload data in the network packet. When the bit widths of the target data obtained from the division are different, the bit widths of the target data input to the four-layer verification and the superposition model are made the same by padding the high bits with 0. The FPGA is configured with checksum overlay models for different checksums; the step of processing the target data using the checksum overlay model to obtain the target checksum includes: calling the corresponding checksum overlay model to process the target data to obtain the corresponding target checksum.

7. The network security device according to claim 6, characterized in that, The checksum generation module includes a replication submodule, a synchronization submodule, and an encapsulation submodule, wherein: The replication submodule is used to replicate the network packets to obtain replicated packets; and send the replicated packets to the synchronization submodule; and send the network packets to the accumulation submodule. The synchronization submodule is used to cache the copied messages; The accumulation submodule is used to extract target data for calculating checksums from the received network packets; process the target data using a checksum overlay model to obtain a target checksum; and compare the target checksum with the checksum in the network packets to obtain a comparison result. The encapsulation submodule is used to obtain the replication message from the synchronization submodule and obtain the target checksum and the comparison result from the accumulation submodule; and encapsulate the comparison result and the target checksum into the replication message.

8. The network security device according to claim 7, characterized in that, When a Layer 3 checksum is required for the network packet, the target data is the Layer 3 header data of the packet; the accumulation submodule is specifically used for: The target data is grouped to obtain several groups of first target sub-data, and the bit width of the first target sub-data in each group is the same; Summing the first target sub-data of two adjacent groups yields several groups of second target sub-data. The second target sub-data is used as the new first target sub-data, and the process of summing the two adjacent groups of first target sub-data is continued to obtain several groups of second target sub-data, until a group of second target sub-data is finally obtained, which is denoted as the third target sub-data. Based on the bit width of the target checksum used for the three-layer verification, the third target sub-data is divided into a first data with a high number of bits and a second data with a low number of bits, wherein the bit width of the second data is the same as the bit width of the target checksum used for the three-layer verification. The first data and the second data are summed to obtain the fourth target sub-data; If the bit width of the fourth target sub-data is not the same as the bit width of the target checksum used for three-layer verification, then the fourth target sub-data is treated as the third target sub-data, and the step of dividing the third target sub-data into a first data with a high number of bits and a second data with a low number of bits according to the bit width of the target checksum is continued until a fourth target sub-data with the same bit width as the target checksum used for three-layer verification is obtained. The target checksum for the three-layer checksum is determined based on the fourth target sub-data whose bit width is consistent with that of the target checksum.

9. The network security device according to claim 8, characterized in that, The accumulation submodule is specifically used to invert the fourth target subdata to obtain the target checksum for the three-layer verification.

10. The network security device according to claim 6, characterized in that, The accumulation submodule is specifically used for: For each target data, the target data is grouped to obtain several groups of first sub-data, and the first sub-data of each group has the same bit width. Summing the first sub-data of two adjacent groups yields several groups of second sub-data. The second sub-data is used as the new first sub-data, and the process of summing the first sub-data of the two adjacent groups is continued to obtain several groups of second sub-data, until two groups of second sub-data are finally obtained, which are denoted as the third sub-data and the fourth sub-data respectively. Obtain the fifth sub-data of the other target data obtained in the previous calculation; The third and fourth sub-data are expanded into first and second extended data with the same bit width as the fifth sub-data; The first extended data, the second extended data, and the fifth sub-data are summed to obtain the fifth sub-data of the target data. Based on the fifth sub-data of the target data, determine the target checksum for the four-layer verification.

11. The network security device according to claim 10, characterized in that, The accumulation submodule is specifically used for: Based on the bit width of the target checksum used for the four-layer verification, the fifth sub-data is divided into a third data with a high number of bits and a fourth data with a low number of bits, wherein the bit width of the fourth data is the same as the bit width of the target checksum used for the four-layer verification. The third and fourth data are summed to obtain the sixth sub-data. If the bit width of the sixth sub-data is different from the bit width of the target checksum used for the four-layer check, then the sixth sub-data is determined as a new fifth sub-data, and the step of dividing the fifth sub-data into a high number of third data bits and a low number of fourth data bits according to the bit width of the target checksum used for the four-layer check continues until a sixth sub-data with the same bit width as the target checksum used for the four-layer check is obtained. The sixth sub-data is inverted to obtain the target checksum used for the four-layer verification.

12. The network security device according to claim 6, characterized in that, The first communication module is specifically used to receive network packets through a high-speed communication interface.

13. The network security device according to claim 6, characterized in that, The second communication module is specifically used to send copy messages to the CPU via the PCIe interface.

Images