Data packet identification method, system and terminal based on double hash value

Abstract

The present application provides a data packet identification method, system and terminal based on double hash values, which generates two hash values ​​of the flow key to be identified by using two different hash functions to perform hash operations on the flow key to be identified; and uses the generated first hash value as an index to search the pre-constructed hash entry table to obtain a matching target hash bucket; then, according to the second hash value, performs a CAM search operation on multiple hash entries of the target hash bucket to obtain one or more matching target hash entries; according to each target hash entry, obtains one or more flow keys corresponding thereto, and selects the target flow keys that match the flow key to be identified. Since the probability that the first hash values ​​and the second hash values ​​of multiple flow keys are equal is very low, the present application can effectively reduce the number of table lookups for flow keys, thereby effectively improving the efficiency of data packet identification and processing, and reducing the error rate.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a data packet identification method, system and terminal based on double hash values. Background Art

[0002] The network switching device is used to connect multiple network devices and forward data. It can receive data streams through multiple input ports and check the flow key of each data packet in the data stream to determine the flow group to which each data packet belongs. The specific technical solution is to convert each flow key into a shorter hash value based on a hash function, and use the hash value as an index of the hash entry table to find the flow key, and then use the flow key to find the flow key content table and its associated action information or export information table, etc., to finally implement the preset processing flow for each data packet and output it through the designated output port.

[0003] However, when converting the stream key into a hash value based on a hash function, multiple different stream keys may be converted into the same hash value, affecting the final table lookup efficiency and the efficiency of processing each data packet; when the sample size of the input data packet and the flow group is large, it will seriously affect the efficiency of network switching equipment data or network processing data. Summary of the invention

[0004] In view of the shortcomings of the prior art described above, the purpose of the present application is to provide a data packet identification method, system and terminal based on double hash values, which is used to solve the problem in the prior art that when converting a stream key into a hash value based on a hash function, multiple stream keys are easily converted into the same hash value, thereby affecting the efficiency of data packet identification and processing.

[0005] To achieve the above-mentioned purpose and other related purposes, the first aspect of the present application provides a data packet identification method based on double hash values, and the data packet identification method based on double hash values ​​includes: extracting information used to characterize the identity of a data flow in a data packet to be identified, and obtaining a flow key to be identified; using a first hash function and a second hash function to perform hash operations on the flow key to be identified, respectively, to generate a first hash value and a second hash value of the flow key to be identified; according to the first hash value, searching a pre-constructed hash entry table to obtain a matching target hash bucket, and performing a CAM search operation on multiple hash entries in the target hash bucket according to the second hash value to obtain one or more matching target hash entries; according to each target hash entry, obtaining one or more flow keys corresponding thereto, and screening the target flow keys that match the flow key to be identified, determining the processing flow information of the data packet to be identified, so as to execute the corresponding processing flow on the data packet to be identified.

[0006] In some embodiments of the first aspect of the present application, a method for constructing the hash entry table includes: using the first hash function and the second hash function to perform hash operations on the flow keys of multiple data packets in turn, generating a first hash value and a second hash value for each flow key; constructing a hash entry table; wherein the hash entry table includes multiple hash buckets, each hash bucket includes multiple hash entries; each hash entry includes a flag bit; screening each flow key with the same first hash value, and storing the second hash value of each flow key in each hash entry of the same hash bucket, respectively, and using the first hash value as the index of the hash bucket; traversing each hash entry, and storing the Internet protocol type of the flow key corresponding to the second hash value stored in it in turn in its flag bit to point to a newly created flow key content table of the corresponding type; wherein the flow key content table includes multiple flow key entries corresponding to each hash entry in the hash entry table, and each flow key entry is used to store processing flow information of each flow key and each data packet.

[0007] In some embodiments of the first aspect of the present application, according to each target hash entry, one or more flow keys corresponding thereto are obtained, and the target flow keys matching the flow keys to be identified are screened therefrom, and the method for determining the processing flow information of the data packet to be identified includes: according to the flag bit of each target hash entry, the corresponding flow key content table is obtained, and according to each target hash entry, the corresponding flow key entries are obtained to perform a CAM search operation, screen the target flow keys matching the flow keys to be identified, and further determine the processing flow information of the data packet to be identified.

[0008] In some embodiments of the first aspect of the present application, the calculation formula for the number of hash buckets is: ; Wherein, N is the number of hash buckets in the hash entry table, and n is the bit width of the first hash value.

[0009] In some embodiments of the first aspect of the present application, a method for performing a CAM search operation on multiple hash entries in the target hash bucket according to the second hash value includes: when searching the target hash bucket but not obtaining a target hash entry that matches the second hash value, determining whether the target hash bucket also includes an idle hash entry; if the target hash bucket still includes an idle hash entry, storing the second hash value of the flow key to be identified in an idle hash entry of the target hash bucket, and learning the flow key to be identified into the flow key content table; if the target hash bucket does not include an idle hash entry, selecting an aged hash entry of the target hash bucket to release for storing the second hash value of the flow key to be identified, and learning the flow key to be identified into the flow key content table; wherein, the method for learning the flow key to be identified into the flow key content table includes: generating processing flow information of the data packet to be identified, and storing the flow key to be identified and the processing flow information in the corresponding idle flow key entry of the corresponding flow key content table.

[0010] In some embodiments of the first aspect of the present application, the method of selecting an aged hash entry of the target hash bucket for release includes: obtaining all hash entries of the target hash bucket; obtaining the corresponding flow key content table according to the flag bit of each hash entry, and obtaining the processing flow information of each data packet according to each hash entry; obtaining the number of flow key matches of each data packet according to the processing flow information of each data packet, and screening the data packets and their flow keys with the least number of flow key matches, and selecting the hash entry storing the second hash value of the flow key as the aged hash entry for release.

[0011] In some embodiments of the first aspect of the present application, the flow key to be identified includes: a first type of flow key or a second type of flow key; wherein the first type of flow key includes: the IP source address, IP destination address, source port, destination port and transport layer protocol of the data packet to be identified; the second type of flow key includes: the MAC source address and MAC destination address of the data packet to be identified.

[0012] In some embodiments of the first aspect of the present application, another method for constructing the hash entry table includes: using the first hash function and the second hash function to perform hash operations on the flow keys of multiple data packets in turn, generating a first hash value and a second hash value for each flow key; constructing a hash entry table; wherein the hash entry table includes multiple hash buckets, each hash bucket includes multiple hash entries; each hash entry includes a flag bit; screening each flow key with the same first hash value, and storing the second hash value of each flow key in each hash entry of the same hash bucket, respectively, and using the corresponding first hash value as the index of the hash bucket; traversing each hash entry, and storing the processing flow information of the data packet corresponding to the second hash value stored therein in its flag bit in turn.

[0013] To achieve the above-mentioned purpose and other related purposes, the second aspect of the present application provides a data packet identification system based on double hash values, and the data packet identification system based on double hash values ​​includes: a flow key acquisition module, which is used to extract information used to characterize the identity of a data flow in a data packet to be identified, and obtain a flow key to be identified; a hash operation module, connected to the flow key acquisition module, which is used to perform hash operations on the flow key to be identified using a first hash function and a second hash function respectively, and generate a first hash value and a second hash value of the flow key to be identified; a hash entry search module, connected to the hash operation module, which is used to search a pre-constructed hash entry table according to the first hash value to obtain a matching target hash bucket, and perform a CAM search operation on multiple hash entries in the target hash bucket according to the second hash value to obtain one or more matching target hash entries; a data packet identification module, connected to the hash entry search module, which is used to obtain one or more flow keys corresponding to each target hash entry, and filter the target flow key matching the flow key to be identified, determine the processing flow information of the data packet to be identified, so as to execute the corresponding processing flow on the data packet to be identified.

[0014] To achieve the above-mentioned purpose and other related purposes, the third aspect of the present application provides a data packet identification terminal based on double hash values, and the data packet identification terminal based on double hash values ​​includes: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the terminal executes the data packet identification method based on double hash values ​​described in any one of the above-mentioned embodiments.

[0015] As described above, the present application provides a data packet identification method, system and terminal based on double hash values, by using two different hash functions to perform hash operations on the flow key to be identified, generating two hash values ​​of the flow key to be identified; and using the generated first hash value as an index to search the pre-constructed hash entry table to obtain a matching target hash bucket; then according to the second hash value, perform a CAM search operation on multiple hash entries of the target hash bucket to obtain one or more matching target hash entries; according to each target hash entry, obtain one or more flow keys corresponding thereto, and filter the target flow keys that match the flow key to be identified. The present application has the following beneficial effects: since the probability that the first hash values ​​and the second hash values ​​of multiple flow keys are equal is very low, the present application can effectively reduce the number of table lookups for flow keys, thereby effectively improving the efficiency of data packet identification and processing, and reducing the error rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Shown is a flowchart of a data packet identification method based on double hash values ​​in one embodiment of the present application.

[0017] Figure 2 Shown is a structural diagram of a hash entry table and a stream key content table in one embodiment of the present application.

[0018] Figure 3 Shown is a schematic diagram of the structure of a hash entry table in another embodiment of the present application.

[0019] Figure 4 Shown is a schematic diagram of a network device in a specific embodiment of the present application.

[0020] Figure 5 Shown is a schematic diagram of a data packet identification method based on double hash values ​​in a specific embodiment of the present application.

[0021] Figure 6 Shown is a structural schematic diagram of a data packet identification system based on double hash values ​​in one embodiment of the present application.

[0022] Figure 7 Shown is a structural schematic diagram of a data packet identification terminal based on double hash values ​​in one embodiment of the present application. DETAILED DESCRIPTION

[0023] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0024] In order to solve the problems in the above-mentioned background technology, the present application provides a data packet identification method, system and terminal based on double hash values, aiming to solve the problem in the prior art that when a flow key is converted into a hash value based on a hash function, multiple flow keys are easily converted into the same hash value, thereby affecting the efficiency of data packet identification and processing. By using different hash functions to convert the flow key into two hash values, and identifying the data packets to be processed by the network switching device and the network device through the hash value, the number of table lookups can be effectively reduced, and the identification and processing efficiency of the data packets can be improved, thereby improving the efficiency of data processing of the network switching device and the network device. At the same time, in order to make the purpose, technical solution and advantages of the present application clearer, the technical solution in the embodiment of the present application is further described in detail through the following embodiments and in combination with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the invention.

[0025] like Figure 1 FIG. 2 is a flow chart showing a method for identifying a data packet based on double hash values ​​in an embodiment of the present application. The method for identifying a data packet based on double hash values ​​in this embodiment mainly includes the following steps.

[0026] Step S1: extract information used to characterize the identity of the data flow in the data packet to be identified, and obtain the flow key to be identified.

[0027] Network switching equipment is mainly used for data forwarding and can usually exchange tens of thousands of data packets. It should be understood that a data packet is the basic data unit in network communication, which contains the address information of the sender and the receiver, and can be transmitted along different paths in the network and reassembled at the destination. In a distributed computing system, each data packet can be grouped according to the processing flow information of the data packet to form different flow groups, so as to execute the corresponding processing flow on each data packet and output it from the specified output port. In order to identify the flow group to which the data packet belongs and obtain its corresponding processing flow information, a table lookup can be performed based on the flow key.

[0028] It should be understood that the flow key contains information in the data packet that is used to characterize its identity. It is mainly composed of a field or a combination of multiple fields in the data packet, and determines the routing and processing of the data packet.

[0029] In one embodiment, the flow key to be identified includes: a first type of flow key or a second type of flow key. Among them, the first type of flow key includes: the IP source address, IP destination address, source port, destination port and transport layer protocol of the data packet to be identified; the second type of flow key includes: the MAC source address and MAC destination address of the data packet to be identified. For the first type of flow key, if the data packet adopts the IPV4 version of the Internet Protocol, the flow key bit width is equal to 32 bits of the IP source address + 32 bits of the IP destination address + 16 bits of the source port + 16 bits of the destination port + 8 bits of the transport layer protocol, a total of 104 bits; if the data packet adopts the IPV6 version of the Internet Protocol, the flow key bit width is equal to 128 bits of the IP source address + 128 bits of the IP destination address + 16 bits of the source port + 16 bits of the destination port + 8 bits of the transport layer protocol, a total of 296 bits. For the second type of flow key, the flow key bit width is equal to 48 bits of the MAC source address + 48 bits of the MAC destination address, a total of 96 bits.

[0030] Step S2: respectively use the first hash function and the second hash function to perform hash operations on the flow key to be identified, and generate a first hash value and a second hash value of the flow key to be identified.

[0031] The number of bits of the stream key to be identified is relatively large. If the stream group to which the data packet to be identified belongs is directly searched based on the stream key to be identified to determine its processing flow information, the efficiency is low. In the prior art, a hash function is usually used to first convert the stream key to be identified into a shorter hash value, and the hash value is used as an index of a hash entry table storing the stream key to search for the stream key, thereby saving storage space and improving the efficiency of data packet lookup and identification. However, when converting a multi-bit stream key into a shorter hash value, it is very easy to convert multiple stream keys into the same hash value, and the stream keys with the same hash value need to be further screened according to the stream key, and the efficiency is still low. The present application uses two different hash functions to perform hash operations on the stream key to be identified; at this time, the probability that the first hash value and the second hash value generated by multiple stream keys are equal will be greatly reduced, and even if they are equal, the number is small; therefore, the search and identification of the data packet to be identified by double hash values ​​will be more efficient and have a lower error rate.

[0032] In a preferred embodiment, the first hash value and the second hash value generated by the present application are usually 16 bits or 32 bits. The number of bits of the first hash value and the second hash value is usually determined according to the selected hash function. It should be noted that the first hash function and the second hash function of the present application are not limited in the present application, and the number of bits of the first hash value and the second hash value is not limited either, and the user can set it according to the needs.

[0033] Step S3: according to the first hash value, search the pre-constructed hash entry table to obtain a matching target hash bucket, and according to the second hash value, perform a CAM search operation on multiple hash entries in the target hash bucket to obtain one or more matching target hash entries.

[0034] like Figure 2 As shown, a schematic diagram of the structure of a pre-built hash entry table in an embodiment of the present application is shown.

[0035] In this embodiment, the index of the hash entry table is the first hash value generated by the stream key based on the first hash function; the hash entry table includes multiple hash buckets, each hash bucket corresponds to a first hash value; each hash bucket includes multiple hash entries. Each hash entry in the same hash bucket is used to store the second hash value of each stream key that is the same as the first hash value corresponding to it. That is, each hash entry is used to store the second hash value generated by the stream key based on the second hash function, and the first hash value corresponding to each hash entry in the same hash bucket is the same.

[0036] When the sample size of data packets is large and the sample size of the flow group to which it belongs is large, the present application can pre-construct multiple flow key content tables, and further match the flow keys by searching the flow key content table to avoid overlapping problems where the second hash value is also the same.

[0037] In addition, each hash entry in the present application includes a flag bit, which is used to identify whether the Internet protocol type to which the corresponding flow key belongs is the first type or the second type, such as the IPV4 version of the Internet Protocol or the IPV6 version of the Internet Protocol, so that each hash entry can point to the corresponding type of flow key content table through this flag bit.

[0038] In a preferred embodiment, the high-order storage space in each hash entry can be used as a flag bit.

[0039] like Figure 2 As shown, the pre-built multiple flow key content tables are used to store the complete flow keys and processing flow information of data packets using different types of Internet protocols, so that by searching the hash entry, the corresponding complete flow key is obtained, and then the processing flow information of the data packet to be identified is obtained.

[0040] It should be noted that the processing flow information of the data packet to be identified described in this application includes but is not limited to: the next action information of the data packet to be identified, the designated output port information and statistical information. Among them, the next action information of the data packet to be identified includes: forwarding to a specific port, discarding the data packet, sending to a controller, etc.; the statistical information includes: the number of flow key matches, the number of bytes and other types of statistical items, which are used to help network administrators monitor network traffic.

[0041] In this embodiment, the method of constructing the hash entry table includes the following steps.

[0042] ① Use the first hash function and the second hash function to perform hash operations on the flow keys of multiple data packets in sequence, and generate a first hash value and a second hash value for each flow key.

[0043] ② Constructing a hash entry table, wherein the hash entry table includes a plurality of hash buckets, each hash bucket includes a plurality of hash entries, and each hash entry includes a flag bit.

[0044] ③ Filter the stream keys with the same first hash value, and store the second hash value of each stream key in each hash entry of the same hash bucket, and use the first hash value as the index of the hash bucket.

[0045] ④ Traverse each hash entry, and store the Internet protocol type of the stream key corresponding to the second hash value stored in it in its flag bit in turn to point to the newly created stream key content table of the corresponding type.

[0046] The flow key content table includes a plurality of flow key entries corresponding to each hash entry in the hash entry table, and each flow key entry is used to store processing flow information of each flow key and each data packet.

[0047] For example, there are two data packets (a first data packet and a second data packet) whose flow keys are the first flow key and the second flow key respectively. The two flow keys are hashed based on the first hash function and the second hash function respectively to generate the first hash value and the second hash value of the first flow key, and the first hash value and the second hash value of the second flow key. If the first hash values ​​of the two flow keys are the same, both 3, the second hash value of the first flow key and the second hash value of the second flow key are stored in two hash entries of the same hash bucket (referred to as the first hash entry and the second hash entry). The index of the hash bucket is set to 3, the flag bit of the first hash entry is set to the Internet protocol type of the first data packet, and the flag bit of the second hash entry is set to the Internet protocol type of the second data packet, such as IPV4 or IPV6. At the same time, the processing flow information of the first flow key and the first data packet is stored in the flow key entry corresponding to the first hash entry in the flow key content table of the corresponding type; and the processing flow information of the second flow key and the second data packet is stored in the flow key entry corresponding to the second hash entry in the flow key content table of the corresponding type.

[0048] After obtaining the first hash value and the second hash value of the stream key to be identified, the present application first uses the first hash value as an index to find the corresponding target hash bucket in the hash entry table; then performs a CAM search operation on each hash entry in the target hash bucket according to the second hash value to obtain one or more matching target hash entries.

[0049] In one embodiment, the number N of hash buckets in the hash entry table is related to the bit width n of the first hash value. For example, if the user sets the bit width of the first hash value generated by the first hash function to 16 bits as needed, the constructed hash entry table includes 2 16 Thus, the hash buckets have a one-to-one mapping relationship with the first hash values ​​of the stream keys, and each first hash value has a unique hash bucket corresponding thereto.

[0050] It should be noted that each hash bucket includes a preset number of hash entries. This number can be set by the user according to needs, and is not limited in this application. Therefore, when performing a CAM search operation on multiple hash entries in the target hash bucket according to the second hash value, there may be a situation where the target hash entry that matches the second hash value is not obtained. At this time, the present application can directly learn the flow key to be identified into the hash entry table and the flow key content table, that is, it is necessary to add new entry data to the hash entry table and the flow key content table. In this way, the present application can continuously learn while identifying data packets, so that the hash entry table and the flow key content table can be continuously updated according to actual needs, and can also further improve the efficiency of data packet search and identification.

[0051] In detail, when the target hash bucket is searched but the target hash entry matching the second hash value is not obtained, it is determined whether the target hash bucket still includes free hash entries; if the target hash bucket still includes free hash entries, the second hash value of the flow key to be identified is stored in a free hash entry of the target hash bucket, and the flow key to be identified is learned into the flow key content table; if the target hash bucket does not include free hash entries, an aged hash entry of the target hash bucket is selected and released to store the second hash value of the flow key to be identified, and the flow key to be identified is learned into the flow key content table.

[0052] Specifically, the method of learning the flow key to be identified into the flow key content table includes: generating processing flow information of the data packet to be identified, and storing the flow key to be identified and the processing flow information in the corresponding free flow key entry of the corresponding flow key content table.

[0053] In a specific embodiment, when the target hash bucket does not include an idle hash entry, the method of selecting an aged hash entry of the target hash bucket for release includes: obtaining all hash entries of the target hash bucket; obtaining the corresponding flow key content table according to the flag bit of each hash entry, and obtaining the processing flow information of each data packet according to each hash entry; obtaining the number of flow key matches of each data packet according to the processing flow information of each data packet, and screening the data packets and their flow keys with the least number of flow key matches, and selecting the hash entry storing the second hash value of the flow key as the aged hash entry for release.

[0054] It should be noted that, in this embodiment, each time each stream key stored in the stream key content table is matched, the number of stream key matches is increased by one, which is used to count the activity of the stream key. The number of stream key matches of each stream key is reduced at a certain frequency within a preset time, and a fixed value is subtracted from the number of stream key matches until it is reduced to zero. If the number of stream key matches of a stream key is reduced to zero, it is an aged stream key, and the corresponding hash entry storing the second hash value of the stream key can be used as an aged hash entry.

[0055] The purpose of the design of the present application in this embodiment is: the present application not only designs a learning process for new stream keys, but also designs an aging process for stream keys. For aged stream keys that have not been matched for a long time, their storage space is released, and the corresponding hash entries are turned into free entries to facilitate the subsequent learning of new stream keys.

[0056] like Figure 3 As shown, a schematic diagram of the structure of another pre-built hash entry table in an embodiment of the present application is shown.

[0057] In this embodiment, the hash entry table is a first hash value generated by the stream key based on the first hash function; the hash entry table includes multiple hash buckets, each hash bucket corresponds to a first hash value; each hash bucket includes multiple hash entries, and each hash entry includes a flag. Each hash entry in the same hash bucket is used to store the second hash value of each stream key that is the same as the first hash value corresponding to it. That is, each hash entry is used to store the second hash value generated by the stream key based on the second hash function, and the first hash value corresponding to each hash entry in the same hash bucket is the same.

[0058] When the sample size of a data packet is small and the sample size of the flow group to which it belongs is small, the probability that the first hash value and the second hash value calculated by different flow keys are the same at the same time is extremely low. The present application does not need to construct a flow key content table, and the processing flow information of the data packet can be directly stored in the flag bit of each hash entry. That is, the next action information, designated output port information, and statistical information of the data packet are directly stored in the flag bit. At this time, the first hash value and the second hash value of the flow key are used to complete the identification of the data packet, which can save storage space. And because the bit width of the first hash value and the second hash value is small, the CAM search operation is more efficient, thereby improving the efficiency of data packet search and identification.

[0059] For example, the storage space of each hash entry is 64 bits, of which N bits of the low-order storage space can be used to store the second hash value of the stream key, and the (64-N) bits of the high-order storage space can be used to store the next action information, the specified output port information, and statistical information.

[0060] In this embodiment, the method of constructing the hash entry table includes the following steps.

[0061] ① Use the first hash function and the second hash function to perform hash operations on the flow keys of multiple data packets in sequence, and generate a first hash value and a second hash value for each flow key.

[0062] ② Constructing a hash entry table, wherein the hash entry table includes a plurality of hash buckets, each hash bucket includes a plurality of hash entries, and each hash entry includes a flag bit.

[0063] ③ Filter the stream keys with the same first hash value, and store the second hash value of each stream key in each hash entry of the same hash bucket, and use the corresponding first hash value as the index of the hash bucket.

[0064] ④ Traverse each hash entry and store the processing flow information of the data packet corresponding to the second hash value stored in the hash entry in turn in its flag bit.

[0065] Step S4: According to each target hash entry, obtain one or more flow keys corresponding thereto, and filter out the target flow keys matching the flow keys to be identified, determine the processing flow information of the data packet to be identified, and execute the corresponding processing flow for the data packet to be identified.

[0066] In one embodiment, if a flow key content table is constructed, the step S4 includes: obtaining the corresponding flow key content table according to the flag bit of each target hash entry, and obtaining the corresponding flow key entries according to each target hash entry to perform a CAM search operation, filter the target flow key that matches the flow key to be identified, and then determine the processing flow information of the data packet to be identified.

[0067] When the sample size of the data packet is small and the sample size of the flow group to which it belongs is small, the flow key content table is not constructed, but the processing flow information of the data packet is directly stored in the flag bit of each hash entry. The step S4 includes: directly obtaining the processing flow information of the data packet to be identified according to the flag bit of each target hash entry.

[0068] It should be noted that when the sample size of data packets is small and the sample size of the flow group to which it belongs is small, the probability that the first hash value and the second hash value calculated by different flow keys are simultaneously the same is extremely low, and the matched target hash entry is usually only one. Therefore, the processing flow information of the corresponding data packet can be obtained directly by matching the second hash value without matching the complete flow key.

[0069] In order to better illustrate and describe the specific process of the data packet identification method based on double hash values, and the structure of the constructed hash entry table, the present application provides a specific embodiment to further describe in detail a data packet identification method based on double hash values.

[0070] Embodiment 1: A data packet identification method based on double hash values ​​applied to a network device.

[0071] Figure 4 The schematic diagram of a network device for data forwarding in the present application is shown. Figure 4 As shown, the network device (NETWORK APPLIANCE, number 1) includes: multiple input ports (INPUT PORTS, number 3-6), multiple output ports (OUTPUT PORTS, number 7-10) and a host (HOST, number 11). The host part (HOST, number 11) includes a CPU (HOST CPU, number 33) and is connected to a flow processor expansion card (FLOW PROCESSOR EXPANSION CARD, number 13) through a high-speed bus, such as a PCI EXPRESS bus (PCI EXPRESS BUS, number 12).

[0072] Figure 5 The present application shows a data packet identification method based on double hash values ​​applied to the above network device. The specific steps are as follows.

[0073] ① When the data packet to be identified (PACKET, No. 2) is received by the input port of the network device, the information used to characterize the identity of the data flow, such as the IP source address (IP SRC), IP destination address (IPDEST), source port (TCP SRC), destination port (TCP DEST), MAC source address (MAC SRC), MAC destination address (MACDEST) and transport layer protocol (PROTOCOL ID), is extracted from the message header (HDR) of the data packet to obtain the flow key to be identified (FLOW KEY, No. 62). It should be understood that the data packet (PACKET, No. 2) includes the message header (HDR) and the data part (PAYLOAD).

[0074] ② Use the first hash function and the second hash function to perform hash operations on the flow key to be identified (FLOWKEY, number 62) to generate a first hash value (HASHA, number 63) and a second hash value (HASH B, number 64) of the flow key to be identified (FLOW KEY, number 62).

[0075] ③ Using the first hash value (HASH A, number 63) of the flow key to be identified (FLOW KEY, number 62) as the index (HASH BUCKET NUMBER) in the pre-built hash entry table (HASH TABLE, number 65) to determine the location of the target hash bucket (HASH BUCKET, number 66); then performing a CAM search operation on the content of each hash entry field in the target hash bucket (HASH BUCKET, number 66) according to the second hash value (HASH B, number 64) of the flow key to be identified (FLOW KEY, number 62) to obtain one or more target hash entries.

[0076] Among them, the hash entry table (HASH TABLE, number 65) includes multiple hash buckets (HASH BUCKET, number 66); each hash bucket (HASH BUCKET, number 66) includes 8 hash entries (ENTRY FIELD0-7); each hash entry (ENTRY FIELD0-7) is used to store the second hash value generated by each flow key according to the second hash function, and includes a flag bit (FLAG BITS, number 67-74); the flag bit is used to identify the Internet protocol type of the corresponding flow key, such as IPV4 or IPV6.

[0077] For example, if the first hash value (HASH A, number 63) of the flow key to be identified (FLOW KEY, number 62) is actually 3, then it points to the target hash bucket (HASHBUCKET, number 66) with the hash bucket number 3 in the hash entry table (HASH TABLE, number 65). The second hash values ​​stored in the 8 hash entries of the target hash bucket (HASH BUCKET, number 66) are: hash entry ENTRY FIELD 0 stores the second hash value c, hash entry ENTRY FIELD 1 stores the second hash value d, hash entry ENTRY FIELD 2 stores the second hash value a, hash entry ENTRY FIELD 3 stores the hash value e, hash entry ENTRY FIELD 4 stores the second hash value a, hash entry ENTRY FIELD 5 stores the second hash value d, hash entry ENTRY FIELD 6 stores the second hash value d, and hash entry ENTRY FIELD 7 stores the second hash value d. Therefore, according to the second hash value (HASH B, number 64) of the flow key to be identified (FLOW KEY, number 62), the corresponding hash entry ENTRY FIELD 2 and hash entry ENTRY FIELD 4 are matched as target hash entries.

[0078] ④According to the flag bits (FLAG BITS, numbers 67-74) of each target hash entry, obtain the corresponding flow key content table (IPV4 KEY TABLE, number 76; IPV6 KEY TABLE, number 77), and according to each target hash entry, obtain the corresponding flow key entries to perform a CAM search operation, filter the target flow key that matches the flow key to be identified, and then determine the processing flow information of the data packet to be identified.

[0079] For example, for the flag bits of the target hash entries ENTRY FIELD 2 and ENTRY FIELD 4, the corresponding IPV4 flow key content table (IPV4 KEY TABLE, number 76) is obtained, and two flow key entries storing the corresponding flow keys are obtained, and the flow keys α and β stored in the two flow key entries are subjected to a CAM search operation to obtain the target flow key α matching the flow key to be identified (FLOW KEY, number 62), and then the processing flow information corresponding to the data packet to be identified (PACKET, number 2) is obtained. The processing flow information includes the next action information stored in the action information table (ACTIONS, number 78) and the statistical information stored in the statistical table (STATISTICS, number 79).

[0080] It should be noted that each type of stream key content table includes multiple address partitions for storing each hash bucket of the hash entry table (HASH TABLE, number 65), and each address partition is divided into multiple address spaces for storing each hash entry of the corresponding hash bucket. That is, the stream key entry in each stream key content table has a one-to-one mapping relationship with all hash entries of the hash entry table (HASH TABLE, number 65), and the corresponding stream key entry can be directly obtained according to the hash entry.

[0081] The hash entry table (HASH TABLE, number 65), the IPV4 stream key content table (IPV4 KEYTABLE, number 76), the IPV6 stream key content table (IPV4 KEY TABLE, number 77), the action information table (ACTIONS, number 78) and the statistics table (STATISTICS, number 79) can be stored in Figure 4 In the multiple blocks of RAM of the network device (NETWORKAPPLIANCE, number 1) memory (MEMORY, number 32) shown.

[0082] The next action information of the data packet usually includes: sending the data packet from the network device without modification; discarding the data packet and not sending the data packet out of the network device; sending the first data packet of a predetermined length in the data stream to the host for special processing; updating the Time to Live (TTL) field of the IP header; popping the VLAN tag, etc.

[0083] In the above example, if the next action information of the packet to be identified (PACKET, number 2) is "send the packet from the network device without modification", then according to Figure 4 The "fast path" (FAST PATH, number 85) shown in FIG. 1 performs data processing operations; if the next action information of the packet to be identified (PACKET, number 2) is "send the first packet of the predetermined length of the data stream to the host for special processing", then according to Figure 4The "slow path" (SLOW PATH, number 86) shown performs data processing operations, forwards the data packet to be identified (PACKET, number 2) to the host (HOST, number 11) of the network device through the PCI EXPRESS bus (PCIEXPRESS BUS, number 12), and the host (HOST, number 11) processes the data packet to be identified (PACKET, number 2) and determines from which output port of the network device the data packet to be identified (PACKET, number 2) will be output; the data packet to be identified (PACKET, number 2) is returned to the flow processor expansion card (FLOW PROCESSOR EXPANSION CARO, number 13) through the PCI EXPRESS bus (PCI EXPRESS BUS, number 12) and is output from the output port indicated by the host (HOST, number 11).

[0084] It should be noted that in the above example, if the existing technology is used to search for a stream key through a hash value, at least 8 hash entries of the same hash bucket and the corresponding complete stream key need to be searched for to screen the target stream key, which requires 8 searches; while the data packet identification method based on double hash values ​​of the present application only needs to perform CAM search operations of 8 hash entries for the second hash value with a shorter data bit width, and only 2 stream key entries need to be searched for the complete stream key with a longer data bit width to screen the target stream key. Therefore, the present application can greatly reduce the scale of CAM searches, thereby greatly improving the recognition efficiency of data packets, and further improving the efficiency of network switching equipment and network equipment in processing data.

[0085] It should be understood that Figure 4 As shown in the figure, the number 30 NETWORK FLOW PROCESSOR INTEGRATED CIRCUIT refers to the integrated circuit integrated with the network flow processing function, TCP CONNECTION IS NOT TERMINATER ON HOST OR FLOW PROCESSOR EXPANSION CARD refers to the TCP connection of the host or flow processor expansion card is not terminated, and OFFLOAD OF DETERMINATION OF HOW TO FORWARD THE PACKET is the offload of the packet forwarding decision. Figure 5As shown in the figure, CALCULATE HASHES refers to hash operation, also known as hash operation, number 24 MULTIPLESIMULTANEOUS CAM LOOKUP OPERATIONS refers to multiple simultaneous CAM lookup operations, number 75 CAMLOOKUP OUTPUT VALUES refers to the output value after the CAM lookup operation, INDEX VALUE = BUCKET NUMBER *ENTRIES PER BUCKET + ENTRY NUMBER refers to the index value of the stream key content table = the bucket number of the target hash bucket * the number of entries in each hash bucket + the entry number of the target hash entry, WHERE TO LOOK IN A KEY TABLE FOR AMATCHING KEY refers to the position of the matching target stream key in the stream key content table, MATCHING FLOE KEYS refers to matching target stream keys, number 80 LOOKUP OUTPUT INFORMATION VALUE refers to the matching output information value (such as processing flow information), number 81 ACTION VALUE refers to the next action value, THE LOOKUP OUTPUT INFORMATION VALUE INDICATES HOW TO HANDLE / PROCESS / FORWARD THE PACKET refers to finding the output information value indicating how to handle or forward the packet, and HANDLE / PROCESS / FORWARD THE PACKET refers to processing or forwarding the packet.

[0086] In the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with substantially the same functions and effects. For example, the first XX and the second XX are only used to distinguish different XXs, and do not limit their order. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different.

[0087] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" represent examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0088] like Figure 6, a schematic diagram of a data packet identification system 600 based on double hash values ​​in an embodiment of the present application is shown. The data packet identification system 600 based on double hash values ​​includes: a stream key acquisition module 601, a hash operation module 602, a hash entry search module 603 and a data packet identification module 604.

[0089] The stream key acquisition module 601 is used to extract information used to characterize the identity of the data stream from the data packet to be identified, and obtain the stream key to be identified.

[0090] The hash operation module 602 is connected to the stream key acquisition module 601, and is used to use the first hash function and the second hash function to perform hash operations on the stream key to be identified, respectively, to generate a first hash value and a second hash value of the stream key to be identified.

[0091] The hash entry search module 603 is connected to the hash operation module 602, and is used to search the pre-constructed hash entry table according to the first hash value to obtain a matching target hash bucket, and perform a CAM search operation on multiple hash entries in the target hash bucket according to the second hash value to obtain one or more matching target hash entries.

[0092] The data packet identification module 604 is connected to the hash entry search module 603, and is used to obtain one or more flow keys corresponding to each target hash entry, and filter out target flow keys that match the flow keys to be identified, determine the processing flow information of the data packet to be identified, and execute the corresponding processing flow on the data packet to be identified.

[0093] It should be understood that the specific process of each module executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0094] It should also be understood that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0095] Figure 7 is a schematic diagram of the structure of a data packet identification terminal 700 based on double hash values ​​provided in an embodiment of the present application. Figure 7As shown, the double hash value based packet identification terminal 700 includes: at least one processor 701, a memory 702, at least one network interface 704 and a user interface 706. The various components in the terminal are coupled together through a bus system 705. It can be understood that the bus system 705 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 705 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 7 In the specification, various buses are labeled as bus systems.

[0096] The user interface 706 may include a display, a keyboard, a mouse, a trackball, a click gun, keys, buttons, a touch pad or a touch screen.

[0097] It is understood that the memory 702 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), which is used as an external cache. By way of exemplary but not limiting explanation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable categories of memory.

[0098] The memory 702 in the embodiment of the present application is used to store various categories of data to support the operation of the double hash value-based packet identification terminal 700. Examples of these data include: any executable program used to operate on the double hash value-based packet identification terminal 700, such as an operating system 7021 and an application 7022; the operating system 7021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks. The application 7022 may include various applications, such as a media player (Media Player), a browser (Browser), etc., for implementing various application services. The double hash value-based packet identification method provided in the embodiment of the present application may be included in the application 7022.

[0099] The data packet identification method based on double hash values ​​disclosed in the above embodiment of the present application can be applied to the processor 701, or implemented by the processor 701. The processor 701 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 701 or an instruction in the form of software. The above processor 701 may be a general-purpose processor, a digital signal processor (DSP, DigitalSignal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 701 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor 701 may be a microprocessor or any conventional processor, etc. In combination with the steps of the data packet identification method based on double hash values ​​provided in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0100] In an exemplary embodiment, the double hash value-based data packet identification terminal 700 can be used by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), and complex programmable logic devices (CPLDs) to execute the aforementioned method.

[0101] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0102] In summary, the present application provides a data packet identification method, system and terminal based on double hash values, which generates two hash values ​​of the flow key to be identified by using two different hash functions to perform hash operations on the flow key to be identified; and uses the generated first hash value as an index to search the pre-constructed hash entry table to obtain a matching target hash bucket; then, according to the second hash value, performs a CAM search operation on multiple hash entries of the target hash bucket to obtain one or more matching target hash entries; according to each target hash entry, obtains one or more flow keys corresponding thereto, and selects the target flow keys that match the flow key to be identified. Since the probability that the first hash values ​​and the second hash values ​​of multiple flow keys are equal is very low, the present application can effectively reduce the number of table lookups for flow keys, thereby effectively improving the efficiency of data packet identification and processing, and reducing the error rate.

[0103] Therefore, the present application effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

[0104] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A data packet identification method based on double hash values, characterized in that: include: Extracting information used to characterize the identity of the data flow from the data packet to be identified, and obtaining the flow key to be identified; Using a first hash function and a second hash function to perform hash operations on the flow key to be identified, respectively, to generate a first hash value and a second hash value of the flow key to be identified; According to the first hash value, a pre-constructed hash entry table is searched to obtain a matching target hash bucket, and according to the second hash value, a CAM search operation is performed on multiple hash entries in the target hash bucket to obtain one or more matching target hash entries; wherein, a construction method of the hash entry table includes: using the first hash function and the second hash function to perform hash operations on the flow keys of multiple data packets in sequence, respectively, to generate a first hash value and a second hash value of each flow key; constructing a hash entry table; wherein, the hash entry table includes multiple hash buckets, each hash bucket includes multiple hash entries Each hash entry includes a flag bit; the flow keys having the same first hash value are screened, and the second hash values ​​of the flow keys are respectively stored in the hash entries of the same hash bucket, and the first hash value is used as the index of the hash bucket; each hash entry is traversed, and the Internet protocol type of the flow key corresponding to the second hash value stored therein is sequentially stored in the flag bit thereof to point to the newly created flow key content table of the corresponding type; wherein the flow key content table includes a plurality of flow key entries corresponding to the hash entries in the hash entry table, and each flow key entry is respectively used to store the processing flow information of each flow key and each data packet; According to each target hash entry, one or more flow keys corresponding thereto are obtained, and the target flow keys matching the flow keys to be identified are screened therefrom to determine the processing flow information of the data packet to be identified, so as to execute the corresponding processing flow for the data packet to be identified; wherein the specific method includes: according to the flag bit of each target hash entry, the corresponding flow key content table is obtained, and according to each target hash entry, the corresponding flow key entries are obtained to execute a CAM search operation, screen the target flow keys matching the flow keys to be identified, and further determine the processing flow information of the data packet to be identified.

2. The data packet identification method based on double hash values ​​according to claim 1, characterized in that: The calculation formula for the number of hash buckets is: N＝2 n ； Wherein, N is the number of hash buckets in the hash entry table, and n is the bit width of the first hash value.

3. The data packet identification method based on double hash values ​​according to claim 1, characterized in that: The method of performing a CAM lookup operation on a plurality of hash entries in the target hash bucket according to the second hash value includes: When the target hash bucket is searched but no target hash entry matching the second hash value is obtained, determining whether the target hash bucket further includes a free hash entry; If the target hash bucket further includes an idle hash entry, the second hash value of the to-be-identified stream key is stored in an idle hash entry of the target hash bucket, and the to-be-identified stream key is learned into the stream key content table; If the target hash bucket does not include an idle hash entry, an aged hash entry of the target hash bucket is selected and released to store the second hash value of the to-be-identified stream key, and the to-be-identified stream key is learned into the stream key content table; The method of learning the to-be-identified stream key into the stream key content table includes: Generate processing flow information of the data packet to be identified, and store the flow key to be identified and the processing flow information in a corresponding idle flow key entry of a corresponding flow key content table.

4. The data packet identification method based on double hash values ​​according to claim 3 is characterized in that: The method of selecting an aged hash entry of the target hash bucket for release includes: Obtain all hash entries of the target hash bucket; According to the flag bit of each hash entry, the corresponding flow key content table is obtained, and according to each hash entry, the processing flow information corresponding to each data packet is obtained; According to the processing flow information of each data packet, the flow key matching times of each data packet are obtained, and the data packet with the least flow key matching times and its flow key are screened, and the hash entry storing the second hash value of the flow key is selected as the aged hash entry for release.

5. The data packet identification method based on double hash values ​​according to claim 1, characterized in that: The flow key to be identified includes: a first type of flow key or a second type of flow key; wherein, the first type of flow key includes: the IP source address, IP destination address, source port, destination port and transport layer protocol of the data packet to be identified; the second type of flow key includes: the MAC source address and MAC destination address of the data packet to be identified.

6. The data packet identification method based on double hash values ​​according to claim 1, characterized in that: Another way to construct the hash entry table includes: Using the first hash function and the second hash function to perform hash operations on the flow keys of multiple data packets in sequence, respectively, to generate a first hash value and a second hash value of each flow key; Constructing a hash entry table; wherein the hash entry table includes a plurality of hash buckets, each hash bucket includes a plurality of hash entries; each hash entry includes a flag bit; Filter the stream keys having the same first hash value, and store the second hash values ​​of the stream keys in the hash entries of the same hash bucket, respectively, and use the corresponding first hash value as the index of the hash bucket; Each hash entry is traversed, and the processing flow information of the data packet corresponding to the second hash value stored therein is sequentially stored in the flag bit thereof.

7. A data packet identification system based on double hash values, characterized in that: include: A stream key acquisition module is used to extract information used to characterize the identity of a data stream from a data packet to be identified, and obtain a stream key to be identified; A hash operation module, connected to the stream key acquisition module, configured to respectively use a first hash function and a second hash function to perform a hash operation on the stream key to be identified, so as to generate a first hash value and a second hash value of the stream key to be identified; a hash entry search module, connected to the hash operation module, for searching a pre-constructed hash entry table according to the first hash value to obtain a matching target hash bucket, and performing a CAM search operation on multiple hash entries in the target hash bucket according to the second hash value to obtain one or more matching target hash entries; wherein a construction method of the hash entry table includes: using the first hash function and the second hash function to perform hash operations on the flow keys of multiple data packets in sequence, respectively, to generate a first hash value and a second hash value of each flow key; constructing a hash entry table; wherein the hash entry table includes multiple hash buckets, each containing a first hash value and a second hash value of each flow key; A hash bucket includes multiple hash entries; each hash entry includes a flag bit; each flow key having the same first hash value is screened, and the second hash value of each flow key is respectively stored in each hash entry of the same hash bucket, and the first hash value is used as the index of the hash bucket; each hash entry is traversed, and the Internet protocol type of the flow key corresponding to the second hash value stored therein is sequentially stored in the flag bit thereof to point to a newly created flow key content table of the corresponding type; wherein the flow key content table includes multiple flow key entries corresponding to each hash entry in the hash entry table, and each flow key entry is respectively used to store the processing flow information of each flow key and each data packet; A data packet identification module is connected to the hash entry search module and is used to obtain one or more flow keys corresponding to each target hash entry, and filter the target flow key that matches the flow key to be identified, determine the processing flow information of the data packet to be identified, and execute the corresponding processing flow for the data packet to be identified; wherein the specific method includes: according to the flag bit of each target hash entry, obtain the corresponding flow key content table, and according to each target hash entry, obtain the corresponding flow key entry to perform a CAM search operation, filter the target flow key that matches the flow key to be identified, and then determine the processing flow information of the data packet to be identified.

8. A data packet identification terminal based on double hash values, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the terminal executes the data packet identification method based on double hash values ​​according to any one of claims 1 to 6.

Images