Hash and tcam based combined packet classifier and method

Abstract

The application discloses a kind of combination packet classifier and method based on hash and TCAM, adopt the combination of imperfect hash classification module and TCAM classification module, the complement of imperfect hash classification and TCAM classification on input key value space is realized;Compared with the traditional TCAM packet classification solution based on, the application reduces hardware resource utilization, system power consumption;Compared with the packet classification solution based on perfect hash, the application reduces the design cost of hash function and the time complexity of generation process under the premise of guaranteeing the function of classifier.The application can consider low space resource consumption, low power consumption and low delay in the classification stage, saves design cost in the classifier generation stage, and reduces the time complexity of generation process;Meanwhile, the application can better balance different types of hardware resources on reconfigurable hardware platforms such as FPGA, and provides a new way of thinking for the design of classifier in network tasks such as firewall packet filtering and routing table lookup.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data packet classification in hardware firewall device, and particularly relates to a combined packet classifier and method based on hash and TCAM. BACKGROUND

[0002] Modern hardware firewall is an independent hardware designed for security between internal network and external network, also known as device firewall. In the hardware firewall, the input data packet needs to pass through the classifier to enter the next step of operation, and the possible classification result labels are, for example, discard, unpack, on-demand, broadcast, etc.

[0003] Suppose a key value set S (for example: a group of packet header data of firewall packets) contains n different key values key. The mathematical problem solved by packet classification is: input n different key values key, and output m integer results after passing through the packet classification module, where m will be smaller (for example: m = 3, 4). For example: mapping 1000 key values to 4 output labels: 0, 1, 2, 3.

[0004] The existing packet classification dedicated hardware solution mainly includes two types:

[0005] The first type: CAM / TCAM (content addressable memory).

[0006] TCAM (Ternary Content Addressable Memory: ternary content addressable memory) table lookup principle: through parallel comparison of data, find the corresponding matching TCAM table item, and output the position information of the table item to the RAM.

[0007] RAM (Random Access Memory): input is address information (for example: Figure 1 : 00, 01, 10, 11), and output is the data at the address corresponding position (for example: Figure 1 : A, B, C, D).

[0008] As shown in Figure 1 , when the input is 01101, the TCAM will simultaneously and in parallel compare each row of data with the input, and if a row matches the input 01101 (for example, the second row of the TCAM in the left graph of Figure 1 , X represents matching both 0 and 1, so 0110X matches 01101), the corresponding classification result (the second row of the RAM in the right graph of Figure 1 , the second row of the RAM in Figure 1 ) is found in the corresponding RAM position (the second row of the RAM in ) and output.

[0009] TCAM and RAM have special circuit implementation in computer hardware. The existing TCAM scheme can realize fast lookup of port by using parallelization advantage. But when the number of key values to be supported is large, the number of table entries to be compared in TCAM is also large, and hardware implementation will consume a large amount of storage resources and chip area. In addition, the parallelized lookup method will generate a large amount of power consumption in the circuit, and long-term use will cause power waste.

[0010] In order to solve the resource waste problem of TCAM scheme, there are three kinds of mainstream optimization schemes at present:

[0011] (1) The input key value set is optimized and trimmed. The existing method can mine the characteristics of input key value distribution (such as: prefix suffix information), effectively compress the number of required TCAM entries, but the compression effect is unstable, and the compression process consumes a large amount of calculation, which is not suitable for resource shortage and real-time requirement.

[0012] (2) Reduce the parallelization degree of lookup, that is, hierarchical lookup of TCAM. First, the previous part of the key value is looked up, and then the latter part of the key value is looked up after the matching result is obtained, which reduces the total storage overhead, and also reduces the fan-in and fan-out of each level of TCAM module, and can support higher clock frequency. The problem is that multi-level lookup will increase the lookup delay by several times, affecting the total data transmission bandwidth. In addition, the optimization effect of TCAM hardware resources is not obvious.

[0013] (3) Use the principle similar to Cache (cache) for lookup, that is, first use a smaller CAM to look up the key value that appears frequently, and if a cache miss (Miss) occurs, go to a larger CAM to look up. The problem is that the lookup time is not stable, sometimes fast and sometimes slow, and the storage resource consumption is not reduced compared with before.

[0014] In summary, the application of TCAM in packet classification still has many limiting factors (power consumption, area).

[0015] The second type is hash lookup table.

[0016] This scheme uses hash module + random memory, first hashes the input data packet header key value into a limited address space by using a hash function, and then accesses the random memory using the address to get the output result tag. In this scheme, in order to avoid the input key value conflict caused by the hash module, the perfect hash design method can be used to realize it.

[0017] The mathematical problem solved by the perfect hash is: input n different key values key, and output n different hash results v through the conversion of the perfect hash function, wherein v is an integer between 0 and (m-1), and n<=m. Note that 1 input key value is mapped to 1 hash result. As shown in Figure 2 Using the conflict-free feature of the perfect hash, the hash result can be used as an independent memory access address to access a random memory (RAM) to obtain the final classification result (out 1-outn).

[0018] In the hash lookup table scheme, the design of the perfect hash function is the key, and the generation algorithm of the perfect hash function aims to realize conflict-free hash mapping with less resources and in a shorter time. However, it is easier to reduce conflicts than to completely avoid hash conflicts. Using a more complex perfect hash function may result in longer lookup table time and additional hardware resource consumption, and the time and resource cost of constructing the perfect hash function is also greater.

[0019] As can be seen, the existing classification scheme cannot simultaneously consider low spatial resource consumption, low power consumption and low delay in the classification process of data packets. SUMMARY

[0020] To solve the above technical problems, the present application provides a combination packet classifier and method based on hash and TCAM, which can simultaneously consider low spatial resource consumption, low power consumption and low delay in the classification process of data packets, and can save design cost and reduce time complexity in the classifier generation stage.

[0021] To achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0022] A combination packet classifier based on hash and TCAM, comprising:

[0023] A TCAM classification module for classifying data packets and outputting TCAM classification results;

[0024] An imperfect hash classification module for classifying data packets that do not have matching items after TCAM classification in serial mode and outputting imperfect hash classification results; or for classifying data packets in parallel mode and outputting imperfect hash classification results;

[0025] A selector for selecting TCAM classification results and imperfect hash classification results in serial or parallel mode and outputting final classification results.

[0026] Further, the construction steps of the TCAM classification module and the imperfect hash classification module are as follows:

[0027] S1: determine the hash level of the current generation strategy and the system constraint condition;

[0028] S2: use the basic hash function to perform hierarchical hash on the input header set of the data packet;

[0029] S3: after reaching the hash level, use the TCAM compression algorithm to process the header set with hash conflict after hierarchical hash, to obtain the candidate TCAM classification module and the candidate imperfect hash classification module;

[0030] S4: verify whether the to-be-verified index of the current generation strategy meets the system constraint condition; if yes, output the candidate imperfect hash classification module and the candidate TCAM classification module to obtain the TCAM classification module and the imperfect hash classification module; otherwise, reselect the basic hash function or adjust the hash level, and repeat iteration until the to-be-verified index of the current generation strategy meets the system constraint condition, to obtain the TCAM classification module and the imperfect hash classification module.

[0031] Further, in S4, the to-be-verified index includes resource consumption and classification time.

[0032] Further, the matching line of the TCAM classification module is connected with the control end of the selector.

[0033] Further, the TCAM classification module includes a TCAM circuit, an address decoding circuit and a RAM circuit.

[0034] A combined packet classification method based on hash and TCAM, based on the above-mentioned combined packet classifier based on hash and TCAM, comprising:

[0035] In the serial mode, the data packet is classified by using the TCAM compression algorithm, if there is a matching item, the RAM of the corresponding TCAM classification module is accessed according to the matching item, and the TCAM classification result is output; otherwise, the data packet is classified by using the imperfect hash classification method, and the imperfect hash classification result is output;

[0036] In the parallel mode, the data packet is classified by using the TCAM compression algorithm and the imperfect hash classification method at the same time, to obtain the TCAM classification result and the imperfect hash classification result, the selector is used to select the TCAM classification result and the imperfect hash classification result, and the final classification result is output.

[0037] Further, the specific steps of the imperfect hash classification method include:

[0038] The first-level hash function is used to process the input key value of the data packet; whether there is a hash conflict is judged, if there is no hash conflict, the calculation result is output, and the output calculation result is calculated to obtain an imperfect hash classification result; otherwise, the input key value of the data packet is processed by the next-level hash until there is no hash conflict in the current level, and the calculation result is output, and the output calculation result is calculated to obtain an imperfect hash classification result.

[0039] Further, if there is no hash conflict, the output calculation result is the offset of the current level.

[0040] Further, the offset of the current level is input to the boundary value of the conflict array of all previous levels by the address calculation module, and the output address of the imperfect hash classification module is obtained by adding the boundary value, and the output address is used to access the corresponding RAM of the imperfect hash classification module to obtain the imperfect hash classification result.

[0041] Further, the RAM of the imperfect hash classification module adopts a single independent memory bank or multiple independent memory banks.

[0042] Compared with the prior art, the present application has the beneficial effects as follows:

[0043] The present application provides a combination packet classifier based on hash and TCAM, which combines the imperfect hash classification module with the TCAM classification module, realizes the complement of imperfect hash classification and TCAM classification in the input key value space, reduces the hardware resource utilization and system power consumption compared with the traditional TCAM-based packet classification solution, saves the design cost of the hash function and the time complexity of the generation process under the premise of ensuring the function of the classifier compared with the perfect hash-based packet classification solution. At the same time, the present application can better balance different types of hardware resources on the reconfigurable hardware platform such as FPGA, and provides a new idea for the design of the classifier in the network tasks such as firewall packet filtering and routing table lookup.

[0044] The present application also provides a combination packet classification method based on hash and TCAM, based on the above combination packet classifier based on hash and TCAM, in the classification process, first use the TCAM module to determine whether the header matches in the TCAM circuit, according to the matching result to decide to use the imperfect hash classification module or the TCAM classification module for classification, using the packet classification method, in the classification stage, low space resource consumption, low power consumption and low delay can be considered, in the classifier generation stage, the design cost can be saved, and the time complexity of the generation process is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The CAM / TCAM classifier principle diagram provided by the present application is shown in the figure;

[0046] Figure 2 A perfect hash function principle diagram provided by the present application;

[0047] Fig. 3(a) is a principle diagram of a hash and TCAM combined packet classification method in a serial mode provided by an embodiment of the present application;

[0048] Fig. 3(b) is a principle diagram of a hash and TCAM combined packet classification method in a parallel mode provided by an embodiment of the present application;

[0049] Figure 4 A principle diagram of an imperfect hash classification method provided by an embodiment of the present application;

[0050] Figure 5 A construction principle diagram of an imperfect hash classification module and a TCAM classification module provided by an embodiment of the present application;

[0051] Figure 6 A diagram of data packet classification by a hash and TCAM combined packet classifier provided by an embodiment of the present application;

[0052] Figure 7 A method flow chart of a hash and TCAM combined packet classification method in a serial mode provided by an embodiment of the present application;

[0053] Figure 8 A method flow chart of a hash and TCAM combined packet classification method in a parallel mode provided by an embodiment of the present application. DETAILED DESCRIPTION

[0054] The present application provides a hash and TCAM combined packet classifier, comprising: a TCAM classification module, used for classifying data packets and outputting a TCAM classification result; an imperfect hash classification module, used for classifying data packets which have no matching items after TCAM classification and outputting an imperfect hash classification result in a serial mode, or used for classifying data packets and outputting an imperfect hash classification result in a parallel mode; and a selector, used for selecting the TCAM classification result and the imperfect hash classification result in the serial or parallel mode, and outputting a final classification result; a matching line of the TCAM classification module is connected with a control end of the selector; and the TCAM classification module is composed of a TCAM circuit, an address decoding circuit and a RAM circuit.

[0055] Specifically, the present application further provides a construction method of a TCAM classification module and an imperfect hash classification module, and the specific construction steps are as follows:

[0056] S1: determining a hash order of a current generation strategy and system constraint conditions;

[0057] S2: Use a basic hash function to perform hierarchical hashing on the input header set of the data packet;

[0058] S3: After reaching the hash level, the TCAM compression algorithm is used to process the header set with hash collisions after hierarchical hashing, and candidate TCAM classification modules and candidate imperfect hash classification modules are obtained.

[0059] S4: Verify whether the indicators to be verified (resource consumption and classification time) of the current generation strategy meet the system constraints; if they do, output the candidate imperfect hash classification module and the candidate TCAM classification module to obtain the TCAM classification module and the imperfect hash classification module; otherwise, reselect the basic hash function or adjust the hash level, and repeat the iteration until the indicators to be verified of the current generation strategy meet the system constraints to obtain the TCAM classification module and the imperfect hash classification module.

[0060] This invention also provides a combined packet classification method based on hash and TCAM, which, based on the aforementioned combined packet classifier based on hash and TCAM, includes:

[0061] like Figure 7 As shown, in serial mode, the TCAM compression algorithm is used to classify data packets. If a data packet has a matching item, the RAM of the corresponding TCAM classification module is accessed according to the matching item, and the TCAM classification result is output. Otherwise, the imperfect hash classification method is used to classify the data packets, and the imperfect hash classification result is output.

[0062] like Figure 8 As shown, in parallel mode, the TCAM compression algorithm and the imperfect hash classification method are used to classify data packets simultaneously, obtaining TCAM classification results and imperfect hash classification results. A selector is used to select between the TCAM classification results and the imperfect hash classification results, and the final classification result is output.

[0063] The specific steps of the above imperfect hash classification method include:

[0064] The input key value of the data packet is processed using the first-level hash function; it is determined whether there is a hash collision. If there is no hash collision, the calculation result (the offset of the current level) is output. The address calculation module inputs the offset of the current level to the boundary value of the collision array of all previous levels and adds it to obtain the output address of the imperfect hash classification module. The RAM of the corresponding imperfect hash classification module is accessed using the output address to obtain the imperfect hash classification result.

[0065] If a hash collision occurs, the input key value of the data packet is processed by the next level hasher until there is no hash collision in the current level. The calculation result is then output, and the output calculation result is used to obtain the imperfect hash classification result.

[0066] The RAM of the imperfect hash classification module adopts a single independent memory bank or multiple independent memory banks, that is, the RAM module can be a single larger independent memory bank, or an independent RAM memory bank is allocated for the output of each level of hash.

[0067] Embodiments

[0068] The application will be further described below in conjunction with embodiments and drawings:

[0069] The existing packet classification method adopts the CAM / TCAM method and the perfect hash algorithm, and the above two packet classification methods have respective advantages. The CAM / TCAM method matches and searches in parallel, and the classification time is short, but the consumption of storage resources is large, which can cause the circuit area to be too large and the power consumption to be too high. The perfect hash method saves hardware resources, and if the hash function is customized, the search time can also be shortened. However, the design of the perfect hash function needs a large amount of work, and the generation stage needs to generate the corresponding perfect hash function according to the key value set with different distributions, and the generation logic is relatively complex. In actual hardware production, the overall resources, power consumption, and area constraints of the chip are relatively fixed. How to flexibly design the packet classification under the hard constraints needs to take the advantages of different methods and make up for the disadvantages. In view of the above problems, the embodiment provides a combined packet classifier and method based on hash and TCAM.

[0070] Specifically, the embodiment provides a combined packet classification method based on hash and TCAM, which is divided into a serial mode and a parallel mode.

[0071] In the serial mode, as shown in FIG. 3(a), after the data packet enters the classification module (packet classifier), TCAM classification is first performed, and information about whether there is a matching item is obtained according to the matching item in the TCAM. If there is a matching item, the corresponding RAM is accessed according to the matching item to obtain the final classification result (TCAM classification result); if there is no matching item, imperfect hash classification is performed on the data packet to obtain the final classification result (imperfect hash classification result).

[0072] In the parallel mode, as shown in FIG. 3(b), in order to reduce the delay of the classification process, after the data packet enters the classification module, TCAM classification and imperfect hash classification are simultaneously performed on two data paths to obtain two temporary classification results (i.e., TCAM classification result and imperfect hash classification result), and then the final classification result is output through a selector. The control end of the selector is connected with the matching line in the TCAM, and the selection logic is the same as that in the serial mode. The control signal led out by the TCAM classification module is 1-bit, which indicates that there is / there is not a matching item in the TCAM circuit for the current data packet header. The control signal can be obtained by performing logical AND operation on all TCAM circuit matching lines before the address decoding stage.

[0073] If the control signal is "1", it means that there is a matching item in TCAM, and the selector will output the TCAM classification result as the final classification result.

[0074] If the control signal is "0", it means that there is no matching item in TCAM, and the selector will output the imperfect hash classification result as the final classification result.

[0075] In this embodiment, the TCAM classification module comprises three parts: a TCAM circuit, an address decoding circuit, and a RAM circuit. For different hardware platforms, all three parts can be implemented using dedicated ASIC circuits or FPGAs, and there are also many existing TCAM compression algorithms available.

[0076] like Figure 4 As shown, this embodiment also provides an imperfect hash classification module and method. The imperfect hash classification module is designed with a multi-level hashing scheme, where each level of hash function is responsible for mapping a portion of the input key-value pairs to collision-free addresses. To distinguish whether the hash results at each level conflict, this embodiment uses a bit array to store collision information. The specific data processing flow is as follows:

[0077] After the input key-value pair enters the imperfect hash classification module, the first level of hashing is performed. Based on the bit array corresponding to the hash result, it is determined whether the result constitutes a hash collision in the current level (0 for collision, 1 for non-collision). If it is non-collision, the collision determination stage ends, and the output result is the offset of the current level. This result enters the address calculation module, where it is compared with the boundary values ​​(B1+B2+...B1) of the collision arrays of all previous levels. x-1 The sum of these values ​​yields the output address of the imperfect hash classification module. This output address is then used to access the corresponding RAM to obtain the final classification result. If the hash function of the current level (e.g., level x) causes a hash collision at this result, the input key continues to the next level of hashing. This process continues until the final level (level y) hash result is guaranteed to be collision-free by a software-generated algorithm, outputting the classification result corresponding to the final level y. Here, on a reconfigurable hardware platform (e.g., an FPGA platform), the RAM module can be a single, large, independent storage unit, or an independent RAM storage unit can be allocated for the output of each hash level.

[0078] The above design concept originates from the existing perfect hash algorithm BBHash. When the number of levels is sufficient and the hash function at each level is sufficiently complex, collision-free output results can be obtained. However, the more levels and the more complex the functions, the longer the classification time. Therefore, in this embodiment, the hash function at each level does not need to be complexly designed. For input key-value sets with different distributions, this embodiment aims to reduce the number of collision keys and values, and can simply select appropriate hash functions from a library.

[0079] Regarding the classifier generation method, in the embodiment, the selection of each level of hash function and the combination manner of different levels of hash function can be flexibly designed in combination with the number of remaining conflict key values and the implementation cost of required TCAM modules. In the parallel mode, each level of hash function can also be flexibly designed according to the classification time of the imperfect hash classification module and the classification time of the TCAM module.

[0080] The combined classifier design proposed in the embodiment aims to realize the complementarity of imperfect hash classification and TCAM classification in the input key value space. For part of the input key value set, 80-90% of the key values can be mapped without conflict by using a relatively simple hash function, and the remaining 10-20% of the key values often become a difficulty in the generation process of the perfect hash function, occupying a longer generation time and leading to a higher function design complexity. In the generation phase of the imperfect hash module, the imperfect hash module does not take no conflict as the only target, but also considers the conflict and the implementation cost. First, the imperfect hash function is used to solve the conflict problem of most key values, and then the TCAM scheme is used to generate the corresponding TCAM classification module for the remaining key values, as shown in FIG. 1. Figure 5 The construction principle of the imperfect hash classification module and the TCAM classification module, that is, the generation and control method process, is as follows:

[0081] The generation of the imperfect hash classification module needs to determine two aspects: the determination of the hash level number and the selection of each level of hash function. First, after the input table header set is determined, a basic hash function is selected for hierarchical hash. After the xth level of hash, the table header set still existing conflict is executed by the TCAM compression algorithm to obtain the candidate imperfect hash classification module and the TCAM classification module. Second, whether the resource consumption, classification time and other indicators of the current hash scheme meet the system design constraints is verified. If the constraints are met, the final classifier is obtained; if the constraints are not met, the generation strategy is adjusted, the basic hash function is reselected or the hash level number is adjusted, the hierarchical hash is executed, and the process is repeated until the system design constraints are met, and finally the imperfect hash classification module and the TCAM classification module are obtained.

[0082] The generation and control method of the above classifier, that is, facing the input data packet set, considers the implementation cost of the TCAM module and the execution time of the two modules in the process of generating the imperfect hash module, determines the hash level number and each level of hash function, simultaneously performs the TCAM compression, determines the size of the TCAM module and whether the system as a whole meets the design constraints (power consumption, area, etc.), and the determination process is repeated until the requirements are met.

[0083] The packet classification method provided by the embodiment is suitable for a network with a large number of nodes and a relatively stable topology. When the classification result corresponding to the packet header needs to be modified, the RAM in the imperfect hash classification module and the TCAM classification module can be directly written. When a small number of packet header mapping relationships need to be added or modified, the TCAM compression algorithm can be re-executed in the current classifier design, and the packet header to be added or modified can be added. When a large number of packet headers need to be modified, the generation process of the classifier needs to be re-executed according to the new packet header set.

[0084] As shown in Figure 6 The embodiment is designed for a 10,000 packet header set, each of which is 64-bit and contains source address, destination address, service type, life cycle, priority and other information. The output RAM contains a 2-bit classification result label, which can represent four packet operations. The classifier generation algorithm realizes the construction of the imperfect hash function and the construction of the TCAM module. Since the packet header set is limited, the basic operations of the hash function library use relatively simple addition, subtraction, multiplication, shifting and modulus operations. The imperfect hash classification module successfully maps 8164 headers to different addresses in the imperfect hash RAM, and the remaining 1836 headers are classified by the TCAM classification module.

[0085] The embodiment designs four-level hash functions, namely H1(), H2(), H3() and H4(). The H1() function can classify 3743 packets, the H2() function can classify 2362 packets, the H3() function can classify 1262 packets, and the H4() function can classify 797 packets. The RAM 1-4 in the imperfect hash classification module can use the same RAM body, and the corresponding minimum address space is 20977. The actual RAM can use a RAM with an address space of 32768. In the embodiment, the RAM modules in the imperfect hash classification module use four independent RAM bodies to support the access of hash results of different levels to the RAM. The output results of RAM1-4 are selected according to the conflict determination results. For the remaining 1836 packets, a TCAM circuit with a capacity of 2048x32-bit and an 11-bit address decoding circuit are constructed, and the address output accesses RAM0.

[0086] It can be seen that the combined packet classifier and method based on hash and TCAM provided in the embodiment combines the advantages of hash algorithm and TCAM compression algorithm, and compensates for the respective shortcomings. In the classifier generation stage, the input packet header set is first processed by using the imperfect hash and RAM mode, to solve the classification of most of the packets, and the TCAM module is used to classify the remaining header set with difficult-to-solve conflicts. In the classification stage, the TCAM module is used to determine whether the header is matched in the TCAM circuit, and the imperfect hash classification module or the TCAM classification module is used for classification according to the matching result.

[0087] Compared with the traditional TCAM-based packet classification solution, the embodiment reduces the hardware resource utilization and system power consumption. Compared with the perfect hash-based packet classification solution, the embodiment saves the design cost of the hash function and the time complexity of the generation process under the premise of ensuring the function of the classifier. The problems of excessive circuit area, excessive power consumption, and large time and resource cost of constructing a perfect hash function are effectively solved. Meanwhile, the application can better balance different types of hardware resources on the FPGA and other reconfigurable hardware platforms, and provide a new idea for the design of the classifier in network tasks such as firewall packet filtering and routing table lookup.

[0088] The above embodiment is only one of the implementation manners of the technical scheme of the application, and the scope of the application claimed by the application is not limited to the embodiment, but also includes any changes, substitutions and other implementation manners easily thought of by those skilled in the art within the technical scope disclosed by the application.

Claims

1. A hash and TCAM based combined packet classifier, characterized by, include: The TCAM classification module is used to classify data packets and output the TCAM classification results; The imperfect hash classification module is used in serial mode to classify data packets that do not have a match after TCAM classification and output the imperfect hash classification result. Or it can be used in parallel mode to classify data packets and output imperfect hash classification results; The selector is used to choose between TCAM classification results and imperfect hash classification results in serial or parallel mode, and outputs the final classification result. The construction steps of the TCAM classification module and the imperfect hash classification module are as follows: S1: Determine the hash level of the current generation strategy and the system constraints; S2: Use a basic hash function to perform hierarchical hashing on the input header set of the data packet; S3: After reaching the hash level, the TCAM compression algorithm is used to process the header set with hash collisions after hierarchical hashing, and candidate TCAM classification modules and candidate imperfect hash classification modules are obtained. S4: Verify whether the metrics to be verified in the current generation strategy meet the system constraints; If the conditions are met, the candidate imperfect hash classification module and the candidate TCAM classification module are output to obtain the TCAM classification module and the imperfect hash classification module. Otherwise, the basic hash function is reselected or the number of hash levels is adjusted, and the iteration is repeated until the verification index of the current generation strategy meets the system constraints, thus obtaining the TCAM classification module and the imperfect hash classification module.

2. The hash and TCAM based combined packet classifier of claim 1, wherein, In S4, the indicators to be verified include resource consumption and classification time.

3. The hash and TCAM based combined packet classifier of claim 1, wherein, The matching line of the TCAM classification module is connected to the control terminal of the selector.

4. The hash and TCAM based combined packet classifier of claim 1, wherein, The TCAM classification module includes a TCAM circuit, an address decoding circuit, and a RAM circuit.

5. A method of packet classification based on combination of hashing and TCAM, the packet classifier based on any one of claims 1-4, characterized in that, include: In serial mode, the TCAM compression algorithm is used to classify data packets. If a data packet has a matching item, the RAM of the corresponding TCAM classification module is accessed according to the matching item, and the TCAM classification result is output. Otherwise, the imperfect hash classification method is used to classify the data packets, and the imperfect hash classification results are output. In parallel mode, the TCAM compression algorithm and the imperfect hash classification method are used to classify data packets simultaneously, obtaining TCAM classification results and imperfect hash classification results. A selector is used to select between the TCAM classification results and the imperfect hash classification results, and the final classification result is output.

6. The method of claim 5, wherein, The specific steps of the imperfect hash classification method include: The first-level hash function processes the input key-value pairs of the data packets; it determines whether there is a hash collision. If there is no hash collision, the calculation result is output, and the output calculation result is used to obtain the imperfect hash classification result; otherwise, the next level hash function processes the input key-value pairs of the data packets until there is no hash collision at the current level, and the calculation result is output. The output calculation result is used to obtain the imperfect hash classification result.

7. The method of claim 6, wherein, If there is no hash collision, the output result is the offset of the current level.

8. The method of claim 7, wherein, The address calculation module inputs the offset of the current level to the boundary value of the collision array of all previous levels and adds it to obtain the output address of the imperfect hash classification module. The output address is then used to access the RAM of the corresponding imperfect hash classification module to obtain the imperfect hash classification result.

9. The method of claim 8, wherein, The RAM of the imperfect hash classification module can be a single independent memory or multiple independent memory.

Images