A multi-level flow table matching method and device based on Bloom filter

Abstract

The present invention discloses a multi-level flow table matching method and device based on Bloom filter. The method comprises the following steps: obtaining a data frame of a computer network data flow to be matched, extracting key fields from the data frame to obtain the value of the key field; inputting the values ​​of matching keywords corresponding to each level of the flow table into a preset counting Bloom filter in order of priority from high to low for detection, until the detection is passed; matching the values ​​of matching keywords corresponding to the flow table that passes the detection with a preset multi-bucket hash table based on DDR, and outputting the matching result; the device comprises a frame processing module, a serial matching module, a counting Bloom filter and a DDR memory; the present invention adopts a DDR memory to store the multi-bucket hash table, thereby increasing the flow table scale supported by the matching circuit; adopting a Bloom filter when matching flow table items, thereby reducing the number of accesses to the off-chip DDR storage and improving the matching speed of the data frame.

Description

Technical Field

[0001] The present invention relates to the field of power electronics technology, and in particular to a multi-level flow table matching method and device based on a Bloom filter. Background Art

[0002] UAV cluster switching nodes need to use flow table matching circuits to perform operations such as data frame discarding and forwarding. Traditional flow table matching circuits use a single DDR memory to store multi-level flow tables. Although traditional flow table matching circuits can maintain large-scale flow tables, multiple random accesses to the DDR memory are required for each match, which is not conducive to improving the matching rate. Summary of the invention

[0003] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a multi-level flow table matching method and device based on Bloom filter to solve the technical problem of low matching rate of traditional flow table matching circuits.

[0004] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0005] In a first aspect, the present invention provides a multi-level flow table matching method based on a Bloom filter, comprising:

[0006] Acquire a data frame of a computer network data stream to be matched, and extract key fields from the data frame to obtain values ​​of the key fields;

[0007] Based on the preset multi-level flow table, the values ​​of the matching keywords corresponding to the flow tables at each level are input into the preset counting Bloom filter in order of priority from high to low for detection until the detection passes;

[0008] The value of the matching keyword corresponding to the detected flow table is matched with the preset DDR-based multi-bucket hash table, and the matching result is output.

[0009] Optionally, if the value of the matching keyword corresponding to the flow table with the lowest priority still fails to pass the detection after being input into the preset counting Bloom filter, the output matching result is all 0.

[0010] Optionally, the presetting process of the multi-level flow table includes:

[0011] Set the number of flow tables, key fields of each level of flow tables, and priorities of each level of flow tables according to application requirements;

[0012] Extract corresponding values ​​from the values ​​of the extracted key fields according to the key fields that are set for the flow tables at all levels;

[0013] The matching keywords corresponding to the flow tables at each level are obtained by concatenating the priorities and key fields corresponding to the flow tables at each level.

[0014] Optionally, the key fields are matching fields in the OpenFlow 1.0 specification, including: inbound port, source MAC, destination MAC, Ethernet type, VLAN ID, VLAN priority, source IP address, destination IP address, IP protocol, IP TOS service type, TCP / UDP source port, TCP / UDP destination port.

[0015] Optionally, the preset process of the counting Bloom filter and the DDR-based multi-bucket hash table includes:

[0016] Concatenate the matching keyword corresponding to the flow table and the value of the corresponding action into a flow table entry;

[0017] Calculate a corresponding hash value of the matching keyword corresponding to the flow table by using a hash function, and add 1 to the value of the corresponding counter counter in the counting Bloom filter according to the hash value corresponding to the matching keyword;

[0018] The flow table entry is calculated with a hash function to correspond to a hash value, the hash value corresponding to the flow table entry is used as an address, and the flow table entry is stored in the DDR-based multi-bucket hash table.

[0019] Optionally, the preset process of the counting Bloom filter and the DDR-based multi-bucket hash table further includes:

[0020] Obtaining a matching keyword and a flow table entry corresponding to the flow table to be deleted, and recording them as a matching keyword to be deleted and a flow table entry to be deleted;

[0021] Calculate the corresponding hash value of the to-be-deleted matching keyword by using a hash function, and reduce the value of the corresponding counter counter in the counting Bloom filter by 1 according to the hash value corresponding to the to-be-deleted matching keyword;

[0022] The flow table entry to be deleted is used to calculate a corresponding hash value using a hash function, the hash value corresponding to the flow table entry to be deleted is used as an address, and the flow table entry to be deleted is deleted from the DDR-based multi-bucket hash table.

[0023] Optionally, the matching result is a value of an action corresponding to the matching keyword detected by a counting Bloom filter.

[0024] In a second aspect, the present invention provides a multi-level flow table matching device based on a Bloom filter, comprising a frame processing module, a serial matching module, a counting Bloom filter and a DDR memory;

[0025] The frame processing module is connected to the serial matching module, and is used to obtain a data frame of a computer network data stream to be matched, extract key fields from the data frame to obtain a value of the key field, and input the value into the serial matching module;

[0026] The serial matching module is connected to the counting Bloom filter, and based on the preset multi-level flow table, the values ​​of the matching keywords corresponding to the flow tables at each level are input into the preset counting Bloom filter in order of priority from high to low for detection until the detection passes;

[0027] The serial matching module is connected to the DDR memory, and is used to match the value of the matching keyword corresponding to the detected flow table with the DDR-based multi-bucket hash table preset in the DDR memory, and output the matching result.

[0028] Optionally, if the value of the matching keyword corresponding to the flow table with the lowest priority still fails to pass the detection after being input into the preset counting Bloom filter, the serial matching module outputs a matching result of all 0s.

[0029] Optionally, the multi-level flow table matching device also includes a first FIFO module, a second FIFO module, a third FIFO module and a DDR controller. The frame processing module is connected to the serial matching module through the first FIFO module, the serial matching module is connected to the DDR memory through the second FIFO module and the DDR controller, and the serial matching module outputs the matching result through the third FIFO module.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] The present invention provides a multi-level flow table matching method and device based on Bloom filter. (1) Based on shared storage, the number of flow table levels can be dynamically adjusted according to network application requirements while hardware resources remain unchanged, the priorities of flow tables at each level can be flexibly configured, and the matching tuples can be flexibly defined to meet the diverse needs of different services and different users; (2) Before the keyword tuple is matched, it is first detected by the counting Bloom filter, which can reduce the number of accesses to the FPGA off-chip DDR storage and improve the matching speed; (3)

[0032] The flow table entries are stored in the FPGA off-chip DDR storage, supporting the storage of large-scale flow table entries. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flowchart of a multi-level flow table matching method based on Bloom filter provided by an embodiment of the present invention;

[0034] Figure 2It is a schematic diagram for demonstrating a multi-level flow table matching method based on Bloom filter provided by an embodiment of the present invention;

[0035] Figure 3 It is a structural schematic diagram of a multi-level flow table matching device based on Bloom filter provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0037] Embodiment 1:

[0038] like Figure 1-2 As shown, an embodiment of the present invention provides a multi-level flow table matching method based on Bloom filter, comprising the following steps:

[0039] Step 1: obtaining a data frame of a computer network data stream to be matched, and extracting key fields from the data frame to obtain values ​​of the key fields;

[0040] Taking the communication data stream of the drone cluster switching node as an example, each data frame in the communication data stream is used as the data frame to be matched. A frame is a protocol data unit of the data link layer, which includes two parts: a frame header and a data part; specifically, in this embodiment, the types of key fields are the 12 fields matched in the OpenFlow 1.0 specification, including: inbound port, source MAC, destination MAC, Ethernet type, VLAN ID, VLAN priority, source IP address, destination IP address, IP protocol, IP TOS service type, TCP / UDP source port, TCP / UDP destination port.

[0041] Step 2: Based on the preset multi-level flow table, the values ​​of the matching keywords corresponding to the flow tables at each level are input into the preset counting Bloom filter in order of priority from high to low for detection until the detection passes; when the output of the Bloom filter is 1, the detection passes, and when the output is 0, the detection fails;

[0042] If the value of the matching keyword corresponding to the flow table of the lowest priority still fails to pass the detection after being input into the preset counting Bloom filter, the output matching result is all 0.

[0043] (i) The counting Bloom filter expands each bit of the standard Bloom filter bit array into a counter. When an element is inserted, the corresponding K (K is the number of hash functions) counter values ​​are increased by 1, and when an element is deleted, the corresponding K counter values ​​are decreased by 1.

[0044] (ii) When searching, if the values ​​of the K counters corresponding to the searched element are not 0, it means that the element is in the set with a high probability. If at least one of the K counters corresponding to the searched element is 0, then the element is definitely not in the set.

[0045] (iii) If the number of bits of the counter is too large, more resources will be occupied, resulting in a huge waste of space. Selecting a suitable size of the counter is extremely critical to the performance of the counting Bloom filter. In the present invention, the number of bits of the counter is 4 bits.

[0046] The presetting process of the multi-level flow table includes:

[0047] According to application requirements (such as if you want the device to implement firewall functions or load balancer functions, etc.), set the number of flow tables, the key fields that flow tables at each level focus on, and the priorities of flow tables at each level; extract corresponding values ​​from the values ​​of the extracted key fields according to the key fields that flow tables at each level focus on; concatenate the priorities and key fields corresponding to flow tables at each level to obtain matching keywords corresponding to flow tables at each level.

[0048] For example, the key fields concerned by flow table 1 are destination IP address and source IP address; the key fields concerned by flow table 2 are destination IP address, source IP address, destination port and source port; here, if it is stipulated that the flow table with more key fields has a higher priority, then the priority of flow table 1 is lower than the priority of flow table 2.

[0049] Step 3: Match the value of the matching keyword corresponding to the detected flow table with the preset DDR-based multi-bucket hash table, and output the matching result.

[0050] The preset process of the counting Bloom filter and the DDR-based multi-bucket hash table includes:

[0051] Step S101, concatenate the matching keyword corresponding to the flow table and the value of the corresponding action (including forwarding, discarding, copying, rewriting the selected field, etc.) into a flow table entry;

[0052] Step S102: Calculate a corresponding hash value of the matching keyword corresponding to the flow table using a hash function, and add 1 to the value of the corresponding counter counter in the counting Bloom filter according to the hash value corresponding to the matching keyword;

[0053] Step S103: Calculate the corresponding hash value of the flow table entry using a hash function, use the hash value corresponding to the flow table entry as an address, and store the flow table entry in the DDR-based multi-bucket hash table.

[0054] The preset process of the counting Bloom filter and the DDR-based multi-bucket hash table also includes:

[0055] Step S201: Obtain a matching keyword and a flow table entry corresponding to the flow table to be deleted, and record them as the matching keyword to be deleted and the flow table entry to be deleted;

[0056] Step S202: Calculate the corresponding hash value of the to-be-deleted matching keyword by using a hash function, and reduce the value of the corresponding counter counter in the counting Bloom filter by 1 according to the hash value corresponding to the to-be-deleted matching keyword;

[0057] Step S203: Calculate the corresponding hash value of the flow table entry to be deleted by using a hash function, use the hash value corresponding to the flow table entry to be deleted as the address, and delete the flow table entry to be deleted from the DDR-based multi-bucket hash table (ie, set it to zero).

[0058] Steps S102-S103 are to add the counting Bloom filter and the multi-bucket hash table based on DDR, and steps S202-S203 are to delete the counting Bloom filter and the multi-bucket hash table based on DDR, and the operation is flexible and convenient.

[0059] The matching result is a value of an action corresponding to the matching keyword detected by a counting Bloom filter.

[0060] In summary, the present invention performs Bloom filtering detection before matching the keyword tuple to be matched, which reduces the number of storage access times when using DDR to implement large-scale multi-level flow tables and improves the matching speed; the priority of each level of flow tables can be flexibly configured according to network application requirements, and the tuple to be matched can be flexibly defined to meet the diverse needs of different services and different users; the flow table items are stored in the DDR storage outside the FPGA chip, supporting the storage of large-scale flow table items, and better meeting the growing needs of drone networks.

[0061] Embodiment 2:

[0062] like Figure 3 As shown, an embodiment of the present invention provides a multi-level flow table matching device based on a Bloom filter, including a frame processing module, a serial matching module, a counting Bloom filter and a DDR memory;

[0063] The frame processing module is connected to the serial matching module, and is used to obtain a data frame of a computer network data stream to be matched, extract key fields from the data frame to obtain a value of the key field, and input the value into the serial matching module;

[0064] The serial matching module is connected to the counting Bloom filter, and based on the preset multi-level flow table, the values ​​of the matching keywords corresponding to the flow tables at each level are input into the preset counting Bloom filter in order of priority from high to low for detection until the detection passes; if the value of the matching keyword corresponding to the flow table with the lowest priority is input into the preset counting Bloom filter and still fails to pass the detection, the serial matching module outputs a matching result of all 0s;

[0065] The serial matching module is connected to the DDR memory, and is used to match the value of the matching keyword corresponding to the detected flow table with the DDR-based multi-bucket hash table preset in the DDR memory, and output the matching result.

[0066] Specifically, the multi-level flow table matching device also includes a first FIFO module, a second FIFO module, a third FIFO module and a DDR controller. The frame processing module is connected to the serial matching module through the first FIFO module, and the serial matching module is connected to the DDR memory through the second FIFO module and the DDR controller. The serial matching module outputs the matching result through the third FIFO module.

[0067] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems, or computer program products.

[0068] The present invention may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0069] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0070] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0071] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0072] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A multi-level flow table matching method based on Bloom filter, characterized in that: include: Acquire a data frame of a computer network data stream to be matched, and extract key fields from the data frame to obtain values ​​of the key fields; Based on the preset multi-level flow table, the values ​​of the matching keywords corresponding to the flow tables at each level are input into the preset counting Bloom filter in order of priority from high to low for detection until the detection passes; Matching the value of the matching keyword corresponding to the detected flow table with the preset DDR-based multi-bucket hash table, and outputting the matching result; The presetting process of the multi-level flow table includes: Set the number of flow tables, key fields of each level of flow tables, and priorities of each level of flow tables according to application requirements; Extract corresponding values ​​from the values ​​of the extracted key fields according to the key fields that are set for the flow tables at all levels; The matching keywords corresponding to the flow tables at each level are obtained by concatenating the priority and key field numbers corresponding to the flow tables at each level; The preset process of the counting Bloom filter and the DDR-based multi-bucket hash table includes: Concatenate the matching keyword corresponding to the flow table and the value of the corresponding action into a flow table entry; Calculate a corresponding hash value of the matching keyword corresponding to the flow table by using a hash function, and add 1 to the value of the corresponding counter counter in the counting Bloom filter according to the hash value corresponding to the matching keyword; Calculate the corresponding hash value of the flow table entry by using a hash function, use the hash value corresponding to the flow table entry as the address, and store the flow table entry in the DDR-based multi-bucket hash table; The preset process of the counting Bloom filter and the DDR-based multi-bucket hash table also includes: Obtaining a matching keyword and a flow table entry corresponding to the flow table to be deleted, and recording them as a matching keyword to be deleted and a flow table entry to be deleted; Calculate the corresponding hash value of the to-be-deleted matching keyword by using a hash function, and reduce the value of the corresponding counter counter in the counting Bloom filter by 1 according to the hash value corresponding to the to-be-deleted matching keyword; The flow table entry to be deleted is used to calculate a corresponding hash value using a hash function, the hash value corresponding to the flow table entry to be deleted is used as an address, and the flow table entry to be deleted is deleted from the DDR-based multi-bucket hash table.

2. The multi-level flow table matching method based on Bloom filter according to claim 1 is characterized in that: If the value of the matching keyword corresponding to the flow table of the lowest priority still fails to pass the detection after being input into the preset counting Bloom filter, the output matching result is all 0.

3. The multi-level flow table matching method based on Bloom filter according to claim 1 is characterized in that: The key fields are the fields matched in the OpenFlow 1.0 specification, including: ingress port, source MAC, destination MAC, Ethernet type, VLAN ID, VLAN priority, source IP address, destination IP address, IP protocol, IP TOS service type, TCP / UDP source port, TCP / UDP destination port.

4. The multi-level flow table matching method based on Bloom filter according to claim 1 is characterized in that: The matching result is a value of an action corresponding to the matching keyword detected by a counting Bloom filter.

5. A multi-level flow table matching device based on Bloom filter, characterized in that: It includes a frame processing module, a serial matching module, a counting Bloom filter and a DDR memory; The frame processing module is connected to the serial matching module, and is used to obtain a data frame of a computer network data stream to be matched, extract key fields from the data frame to obtain a value of the key field, and input the value into the serial matching module; The serial matching module is connected to the counting Bloom filter, and based on the preset multi-level flow table, the values ​​of the matching keywords corresponding to the flow tables at each level are input into the preset counting Bloom filter in order of priority from high to low for detection until the detection passes; wherein the preset process of the multi-level flow table includes: setting the number of flow tables, the key fields concerned by the flow tables at each level, and the priorities of the flow tables at each level according to application requirements; extracting corresponding values ​​from the values ​​of the extracted key fields according to the set key fields concerned by the flow tables at each level; splicing the priorities corresponding to the flow tables at each level and the numbers of the key fields to obtain the matching keywords corresponding to the flow tables at each level; The serial matching module is connected to the DDR memory, and is used to match the value of the matching keyword corresponding to the detected flow table with the DDR-based multi-bucket hash table preset in the DDR memory, and output a matching result, wherein the preset process of the counting Bloom filter and the DDR-based multi-bucket hash table includes: Concatenate the matching keyword corresponding to the flow table and the value of the corresponding action into a flow table entry; Calculate a corresponding hash value of the matching keyword corresponding to the flow table by using a hash function, and add 1 to the value of the corresponding counter counter in the counting Bloom filter according to the hash value corresponding to the matching keyword; Calculate the corresponding hash value of the flow table entry by using a hash function, use the hash value corresponding to the flow table entry as the address, and store the flow table entry in the DDR-based multi-bucket hash table; The preset process of the counting Bloom filter and the DDR-based multi-bucket hash table also includes: Obtaining a matching keyword and a flow table entry corresponding to the flow table to be deleted, and recording them as a matching keyword to be deleted and a flow table entry to be deleted; Calculate the corresponding hash value of the to-be-deleted matching keyword by using a hash function, and reduce the value of the corresponding counter counter in the counting Bloom filter by 1 according to the hash value corresponding to the to-be-deleted matching keyword; The flow table entry to be deleted is used to calculate a corresponding hash value using a hash function, the hash value corresponding to the flow table entry to be deleted is used as an address, and the flow table entry to be deleted is deleted from the DDR-based multi-bucket hash table.

6. The multi-level flow table matching device based on Bloom filter according to claim 5, characterized in that: If the value of the matching keyword corresponding to the flow table of the lowest priority still fails to pass the detection after being input into the preset counting Bloom filter, the serial matching module outputs a matching result of all 0s.

7. The multi-level flow table matching device based on Bloom filter according to claim 5, characterized in that: The multi-level flow table matching device also includes a first FIFO module, a second FIFO module, a third FIFO module and a DDR controller. The frame processing module is connected to the serial matching module through the first FIFO module, the serial matching module is connected to the DDR memory through the second FIFO module and the DDR controller, and the serial matching module outputs the matching result through the third FIFO module.

Images