A packet offloading smart network card based on ARM+ASIC heterogeneous implementation

Abstract

The present invention belongs to the field of information security application technology, and specifically relates to a message unloading intelligent network card based on ARM+ASIC heterogeneous implementation, including a message analysis module, an ARM+ASIC heterogeneous module, a traffic filtering module and a label adding module, wherein the ARM+ASIC heterogeneous module includes a GIGABIT MAC module, a rule setting module, a rule search module, a DDR3 SDRAM controller, a QDR SRAM controller, and a PCI-E interface. The intelligent network card based on ARM+ASIC heterogeneous takes advantage of the low cost and low latency of domestic chips to achieve high efficiency and high performance in message classification and processing, implements message classification and filtering in hardware, effectively unloads the overhead of application software for underlying network message processing, and develops message capture and data collection functions based on the intelligent network card for network security application software on high-speed networks, effectively improving the overall performance of the system.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security application, and in particular relates to a message unloading intelligent network card based on ARM+ASIC heterogeneous implementation. Background Art

[0002] In the field of information security applications, network security application software receives messages from the underlying network card hardware and the protocol stack of the operating system. The network card and protocol stack software are responsible for sending, receiving and processing network data packets. The transmission of network data consumes a large amount of CPU computing resources. With the advent of the 10G bandwidth era, blindly increasing the server CPU's operating frequency and expanding the server's memory to increase the server's processing speed of network data packets will face a series of bottlenecks such as power consumption, cost, and heat dissipation in the computer room. More importantly, the server CPU's processing capacity for network data does not increase linearly with the increase in CPU speed. If a lot of CPU overhead is to perform relatively simple but time-consuming I / O operations such as responding to interrupts, copying data, checking, and filtering the addresses of network data packets, the computing power it can provide to the application layer processing software will be greatly affected, thereby affecting the speed and performance of the application layer processing software.

[0003] The existing smart NICs are FPGA smart NICs. The high price of FPGA chips and the high labor costs required for design, development and debugging make the overall cost of FPGA smart NICs high. FPGA resources are limited, including logic units, memory, and input / output pins. When designing complex message processing logic, resources may be constrained, limiting its performance and functional expansion. The processing delay of FPGA smart NICs is usually large and difficult to predict and control. Due to the programmability of FPGAs, the layout and clock distribution of logic circuits may lead to uncertain delays, which is unacceptable for applications with high real-time requirements. FPGA chips usually have high power consumption, especially when processing high-speed data streams, the power consumption will increase further. This not only increases the energy consumption cost of the equipment, but may also cause problems in heat dissipation and stability. The design and development cycle of FPGA smart NICs is usually long. Since the hardware description language is required to write logic, perform synthesis, layout and routing, etc., the entire development process requires a lot of time and effort. And once the FPGA smart NIC is deployed, it may be difficult to upgrade its functions or fix defects. Once the hardware design is determined, modifications and upgrades will require redesign, verification, and deployment, so FPGA smart network cards are difficult to maintain and upgrade.

[0004] By canceling the UC (Un-cacheable) mode, adopting zero copy, data prefetching and other methods, the network data processing capability can be improved to a certain extent, but the unloading of the upper-layer CPU load is limited. Some existing NICs can provide checksum calculations and reduce the CPU load by about 10%, but for 64-byte packets, using NIC to offload the checksum operation does not help much in reducing CPU usage. This is because the checksum operation is based on bytes, so offloading the checksum is more effective for large data packets but has little effect on 64-byte packets. By utilizing the high-speed processing and parallel processing characteristics of hardware, relatively simple but time-consuming I / O operations can be completed by smart network cards, thereby effectively reducing the CPU workload and improving the network data packet capture capability, especially the processing capability of dense small packets. Existing ASICs are custom integrated circuits designed specifically for specific applications. Their hardware structure is optimized to achieve higher performance and lower latency. ASICs usually have better performance than FPGAs when processing high-speed data streams and complex algorithms, thereby providing higher network data packet capture and processing capabilities in conjunction with server application layer processing software. Summary of the invention

[0005] The purpose of the present invention is to provide a message unloading smart network card based on ARM+ASIC heterogeneous implementation, so as to solve the technical problems of FPGA smart network card, such as high cost, limited resources, uncontrollable delay, high power consumption, long development cycle and difficult maintenance and upgrade.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0007] A message unloading intelligent network card based on ARM+ASIC heterogeneous implementation, comprising a message analysis module, an ARM+ASIC heterogeneous module, a traffic filtering module and a label adding module, wherein the ARM+ASIC heterogeneous module is connected to a message classification module, the message classification module is connected to the traffic filtering module, and the traffic filtering module is connected to the label adding module;

[0008] The message analysis module is used to analyze the message protocol;

[0009] The ARM+ASIC heterogeneous module is used to classify and process the hardware messages according to the user configuration rules;

[0010] The traffic filtering module is used to directly filter out unnecessary traffic in the upper layer;

[0011] The label adding module is used to add a protocol label to the traffic required by the upper layer and submit it to the application layer data processing software of the server for processing, and the application layer data processing software performs application layer data analysis on the network data obtained by the smart network card;

[0012] The ARM+ASIC heterogeneous module includes a GIGABIT MAC module, a rule setting module, a rule search module, a DDR3 SDRAM controller, a QDRSRAM controller, and a PCI-E interface;

[0013] The GIGABIT MAC module implements back pressure on data flow, monitoring of MAC side data MIB information, CRC check of messages, packet length setting, removes the preamble and CRC of received link layer data, sends the sent message with the preamble and CRC, detects whether the message is an IP message, opens the VLAN working mode according to the software settings and extracts the five-tuple information to the subsequent module;

[0014] The rule setting module updates the rule table in the hardware according to the configuration of the application software;

[0015] The rule search module searches the rule table according to the five-tuple information of the received message, and if found, discards the message or uploads the message to the CPU according to the action specified by the rule;

[0016] The DDR3 SDRAM controller and the QDR SRAM controller implement DDR3 and QDR bus arbitration mechanisms and configuration control respectively;

[0017] The PCI-E interface uploads messages to the CPU, downloads rules to the ARM+ASIC heterogeneous, configures the internal registers of the ARM+ASIC heterogeneous, monitors the internal working status of the ARM+ASIC heterogeneous, and performs basic configuration of the PCI-E according to the content in the EEPROM.

[0018] Preferably, the ARM+ASIC heterogeneous module is further provided with two execution modules, including a message receiving module and a five-tuple filtering module, and the interface between the message receiving module and the five-tuple filtering module is a first-in-first-out message index buffer queue.

[0019] Preferably, after the message receiving module receives the message, the message index is put into the input queue of the five-tuple filtering module, and the five-tuple filtering module takes out the message index from the queue for further processing.

[0020] Preferably, the message index buffer queue stores the buffer index of the message in DDR3, which is also the storage area index of the header information in BRAM, and the header information includes a five-tuple and a payload offset.

[0021] Preferably, when the message receiving module receives a message, the message receiving module obtains a free buffer index from the global available buffer queue, stores the message into the buffer, and then sends the buffer index to the input queue of the five-tuple filtering module. After the message filtering module processes the message in the buffer, the message buffer index is put into the global available buffer queue again.

[0022] Preferably, the message receiving module is provided with two submodules, the two submodules include a message buffer module and a link layer filtering module, the message buffer module buffers the message from MAC in the chip, and if it is not an IP message, it is discarded; if it is an IP message, it is buffered to the DDR3 SDRAM controller, and when the message is buffered in the chip, the header information extraction module is responsible for extracting the five-tuple information in the header and storing it in the BRAM.

[0023] Preferably, the five-tuple filtering module includes a concurrent flow matching module, a rule matching module, a rule control module, a concurrent flow control module, and a hit action execution module;

[0024] The concurrent flow matching module searches for the flow corresponding to the message in the concurrent flow hash table in DDR3 according to the five-tuple of the message in the BRAM. If found, the message index is put into the discard or upload queue according to the hit action of the flow. If not found, the message is handed over to the rule matching module for matching the five-tuple rule.

[0025] When a message is the first message in a flow, there is no entry for the flow in the concurrent flow hash table. The concurrent flow matching module cannot decide the action for the message. The rule matching module is responsible for searching the five-tuple rule table and comparing the message five-tuple with the found rule table entry. Regardless of whether the rule is hit or not, the rule filtering module will notify the rule control module to write the five-tuple of the message and the corresponding action into the concurrent flow table, and put the message index into the discard or upload queue.

[0026] The five-tuple rule table is a hash table.

[0027] Preferably, when a new flow is discovered by the rule matching module, the five-tuple of the flow is written into the concurrent flow table, and each rule has a lifetime, which is stored in a rule lifetime array; wherein, if the lifetime of a rule is infinite, it is represented by 0;

[0028] The rule control module polls the rule lifetime array every second to reduce the lifetime. For rules whose lifetime decreases from 1 to 0, the valid flag is invalidated. The concurrent flow control module also handles the timeout of each flow in the concurrent flow.

[0029] Preferably, when a message matches the corresponding five-tuple in the concurrent flow table, the message index enters the discard or upload queue according to the action that should be taken for the flow. When a message hits a rule in the rule table, it enters the discard or upload queue. The hit action execution module obtains the message index to be processed from the discard and upload queues and executes the corresponding action.

[0030] Preferably, the quintuple rule matching algorithm of the quintuple filtering module is:

[0031] Each rule enters the hash table through hash operation, and each message searches for the rule in the hash table through hash operation. In this process, it includes the five-tuple mask process, which is to first add the mask mark of each element to the rule to form a fixed rule; then store the rule in a hash table; then add the mask rule of each element to the five-tuple information of each message received to form a five-tuple to be matched; finally, each to-be-matched item searches for the rule through the hash table for matching;

[0032] Among them, each element includes IP, protocol, and port;

[0033] The number of quintuple items to be matched is any number between 32 and 1.

[0034] The beneficial effects of the present invention include:

[0035] The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation provided by the present invention comprises a message analysis module, an ARM+ASIC heterogeneous module, a traffic filtering module and a label adding module, wherein the ARM+ASIC heterogeneous module comprises a GIGABITMAC module, a rule setting module, a rule searching module, a DDR3 SDRAM controller, a QDRSRAM controller and a PCI-E interface.

[0036] The message unloading smart network card based on ARM+ASIC heterogeneous implementation of the present application realizes high efficiency and high performance of message classification and processing by setting up ARM+ASIC heterogeneous modules and taking advantage of the low cost and low latency of domestic chips. It can realize message classification and filtering in hardware, effectively unloading the overhead of application software for underlying network message processing, and network security application software on high-speed networks develops message capture and data collection functions based on smart network cards, which greatly improves the overall performance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 The present invention is a schematic diagram of the composition structure of the message offloading intelligent network card based on ARM+ASIC heterogeneous implementation.

[0038] Figure 2The figure is a schematic diagram of the workflow of the message offloading intelligent network card based on ARM+ASIC heterogeneous implementation of the present invention.

[0039] Figure 3 It is a schematic diagram of the composition structure of the ARM+ASIC heterogeneous module of the present invention. DETAILED DESCRIPTION

[0040] The following is combined with Figure 1~Figure 3 The present invention is further described in detail:

[0041] Example 1

[0042] See attached Figure 1 As shown, the packet unloading intelligent network card based on ARM+ASIC heterogeneous implementation includes a packet analysis module, an ARM+ASIC heterogeneous module, a traffic filtering module and a label adding module. The ARM+ASIC heterogeneous module is connected to the packet classification module, the packet classification module is connected to the traffic filtering module, and the traffic filtering module is connected to the label adding module. The packet analysis module is used to analyze the protocol of the packet; the ARM+ASIC heterogeneous module is used to classify and process the hardware packets according to the user configuration rules; the traffic filtering module is used to directly filter out the unnecessary traffic of the upper layer; the label adding module is used to add protocol labels to the necessary traffic of the upper layer and submit it to the application layer data processing software of the server for processing, and the application layer data processing software performs application layer data analysis on the network data obtained by the intelligent network card. See Figure 2 The workflow of the network card is that after being processed by the ARM+ASIC heterogeneous module, the message analysis module performs message analysis and processing, and then the traffic filtering module performs traffic filtering processing, and finally the label adding module adds labels. The message unloading intelligent network card based on ARM+ASIC heterogeneity is based on the ARM+ASIC heterogeneous module, and takes advantage of the low cost and low latency of domestic chips to achieve high efficiency and high performance in message classification and processing. The classification and filtering of messages are implemented in hardware, which effectively offloads the overhead of application software for underlying network message processing, network security application software on high-speed networks, and develops message capture and data collection functions based on intelligent network cards, which greatly improves the overall performance of the system.

[0043] See also Figure 3, the ARM+ASIC heterogeneous module includes GIGABIT MAC module, rule setting module, rule search module, DDR3 SDRAM controller, QDRSRAM controller, and PCI-E interface; through the GIGABIT MAC module, back pressure on the data flow is realized, the MIB information of the MAC side data is monitored, the CRC check of the message is performed, the packet length is set, the preamble and CRC of the received link layer data are removed, and the preamble and CRC of the sent message are added to the subsequent module and sent out, and the message is detected whether it is an IP message, and the VLAN working mode is enabled according to the software settings and the five-tuple information is extracted and given to the subsequent module; through the rule setting module, the rule table in the hardware is updated according to the configuration of the application software; through the rule search module, the five-tuple information of the received message is searched in the rule table. If found, the message is discarded or uploaded to the CPU according to the action specified by the rule; through the DDR3SDRAM controller and QDR The SRAM controller implements the DDR3 and QDR bus arbitration mechanisms and configuration control respectively; uploads messages to the CPU through the PCI-E interface, downloads rules to the ARM+ASIC heterogeneous, configures the ARM+ASIC heterogeneous internal registers, monitors the internal working status of the ARM+ASIC heterogeneous, and performs basic PCI-E configuration according to the contents in the EEPROM.

[0044] Example 2

[0045] On the basis of Example 1, the ARM+ASIC heterogeneous module is further provided with two execution modules, including a message receiving module and a five-tuple filtering module, and the interface between the message receiving module and the five-tuple filtering module is a first-in-first-out message index buffer queue. When the message receiving module receives the message, it puts the message index into the input queue of the five-tuple filtering module, and the five-tuple filtering module takes out the message index from the queue for further processing. The message index buffer queue stores the buffer index of the message in DDR3, and is also the storage area index of the header information in BRAM, and the header information includes a five-tuple and a payload offset.

[0046] When the message receiving module receives the message, it obtains a free buffer index from the global available buffer queue, stores the message in the buffer, and sends the buffer index to the input queue of the five-tuple filtering module. After the message filtering module processes the message in the buffer, it puts the message buffer index into the global available buffer queue again.

[0047] The message receiving module has two sub-modules, including a message buffer module and a link layer filtering module. The message buffer module buffers the message from the MAC on-chip. If it is not an IP message, it is discarded; if it is an IP message, it is buffered to the DDR3SDRAM controller. When the message is buffered on-chip, the header information extraction module is responsible for extracting the five-tuple information in the header and storing it in the BRAM.

[0048] Example 3

[0049] On the basis of Embodiment 1 or Embodiment 2, the quintuple filtering module includes a concurrent flow matching module, a rule matching module, a rule control module, a concurrent flow control module, and a hit action execution module;

[0050] The concurrent flow matching module searches for the flow corresponding to the message in the concurrent flow hash table in DDR3 according to the five-tuple of the message in the BRAM. If found, the message index is put into the discard or upload queue according to the hit action of the flow. If not found, the message is handed over to the rule matching module for matching the five-tuple rule.

[0051] When a message is the first message in a flow, there is no entry for the flow in the concurrent flow hash table. The concurrent flow matching module cannot decide the action for the message. The rule matching module is responsible for searching the five-tuple rule table and comparing the message five-tuple with the found rule table entry. Regardless of whether the rule is hit or not, the rule filtering module will notify the rule control module to write the five-tuple of the message and the corresponding action into the concurrent flow table, and put the message index into the discard or upload queue.

[0052] The five-tuple rule table is a hash table.

[0053] When a new flow is discovered by the rule matching module, the five-tuple of the flow is written into the concurrent flow table. Each rule has a lifetime, which is stored in a rule lifetime array; if the lifetime of a rule is infinite, it is represented by 0. The rule control module polls the rule lifetime array every second to reduce the lifetime. For the rule whose lifetime decreases from 1 to 0, the valid flag is set to invalid, and the concurrent flow control module also handles the timeout of each flow in the concurrent flow.

[0054] When a message matches the corresponding five-tuple in the concurrent flow table, the message index enters the discard or upload queue according to the action that should be taken for the flow. When a message hits a rule in the rule table, it enters the discard or upload queue. The hit action execution module obtains the message index to be processed from the discard and upload queues and executes the corresponding action.

[0055] The five-tuple rule matching algorithm of the five-tuple filtering module is:

[0056] Each rule enters the hash table through hash operation, and each message searches for the rule in the hash table through hash operation. In this process, it includes the five-tuple mask process, which is to add the mask flag of each element to the rule to form a fixed rule; then store the rule in a hash table; then add the mask rule of each element to the five-tuple information of each message received to form a five-tuple to be matched; finally, each to-be-matched item searches for the rule through the hash table for matching; each element includes IP, protocol, and port. The number of five-tuple to-be-matched items is any number between 32 and 1.

[0057] In this embodiment, it is assumed that the format is (mask) (quintuple) (others), the mask indicates which element of the quintuple is valid, the quintuple is source address IP, destination address IP, protocol, source address port, destination address port, and other information includes rule number and hit action, etc., which are omitted here. There are two rules in the configuration file. The first rule stipulates the message sent from 10.0.0.1, and the second rule stipulates the message sent to 10.0.0.1. The two rules are written into the m and n positions of the hash table after hash operation. Assuming an ICMP (protocol number is 0) message from 10.0.0.1 to 10.0.0.2, the quintuple of the message (actually a triplet) must first pass through a "masked quintuple" generator, where the quintuple is matched with different masks to generate multiple (7 triplet, 31 quintuple) structures with the same format as the rule. What is generated here is: (10000) (10.0.0.1, 0, 0, 0, 0), etc. Each masked quintuple is hashed to get the position of the corresponding rule in the hash table, and the rule is taken out for comparison. For example, in this example, the quintuple with the mask in the first position will also get m after hashing, because it is actually the same as the first rule. However, the quintuple with the mask in the second position cannot get a matching rule in the hash table after hashing. The above masked quintuple generator and comparator have multiple parallel operations to ensure the message processing rate.

[0058] The performance test of the ARM+ASIC heterogeneous packet unloading smart network card involves multiple aspects of testing, including throughput testing, latency testing, load balancing testing, concurrent connection testing, packet loss rate testing, security performance testing, energy efficiency testing, and fault recovery testing. This is to comprehensively evaluate the performance and functions of the smart network card. The actual application scenario should be taken into account during the test, and corresponding adjustments and optimizations should be made according to the needs.

[0059] Testing the throughput of the Smart NIC under different loads, that is, the amount of data it can handle. This can be done by sending packets of various sizes and types and measuring how quickly they are processed. Testing should cover multiple packet sizes and different traffic patterns to fully evaluate performance. Testing the latency introduced by the Smart NIC during packet transmission involves measuring the total time from when a packet enters the NIC to when it leaves the NIC, taking into account the time required for internal processing by the NIC. Latency testing is very important for real-time applications, such as audio / video transmission, financial transactions, etc. Testing the performance of the Smart NIC in load balancing involves sending data of different loads on different ports and verifying that the Smart NIC can effectively distribute traffic to available resources to ensure optimal performance and resource utilization. Testing the performance of the Smart NIC when handling a large number of concurrent connections involves simulating multiple clients connecting to the server at the same time and observing the ability of the Smart NIC to handle these connections. Concurrent connection testing is very important for high-load environments such as network servers. Testing the packet loss of the Smart NIC under high load conditions. By sending a large number of packets to the NIC and monitoring whether the receiving end receives all the packets, the packet loss rate can be evaluated. Testing the performance of the Smart NIC in the face of various network security attacks. This includes DDoS attacks, malware injection, etc. By simulating these attacks and observing the reaction of the Smart NIC, its security performance and anti-attack ability can be evaluated. Test the energy efficiency of the Smart NIC under different loads, that is, the energy consumed to process each data packet. This is critical for data centers and large network environments because energy efficiency directly affects costs and environmental impact. Test the recovery ability of the Smart NIC in the event of a failure, including power outage recovery, network connection interruption, etc., whether the Smart NIC can quickly return to normal working state.

[0060] In summary, the message unloading intelligent network card based on ARM+ASIC heterogeneous implementation provided by the present invention includes a message analysis module, an ARM+ASIC heterogeneous module, a traffic filtering module and a label adding module, wherein the ARM+ASIC heterogeneous module includes a GIGABIT MAC module, a rule setting module, a rule search module, a DDR3 SDRAM controller, a QDRSRAM controller, and a PCI-E interface. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation realizes high efficiency and high performance of message classification and processing by setting up ARM+ASIC heterogeneous modules and taking advantage of the low cost and low latency of domestic chips. It can realize message classification and filtering in hardware, effectively unload the overhead of application software for underlying network message processing, and network security application software on high-speed networks develops message capture and data acquisition functions based on intelligent network cards, which greatly improves the overall performance of the system.

Claims

1. A message unloading intelligent network card based on ARM+ASIC heterogeneous implementation, characterized in that: It includes a message analysis module, an ARM+ASIC heterogeneous module, a traffic filtering module and a label adding module, wherein the ARM+ASIC heterogeneous module is connected to the message classification module, the message classification module is connected to the traffic filtering module, and the traffic filtering module is connected to the label adding module; The message analysis module is used to analyze the message protocol; The ARM+ASIC heterogeneous module is used to classify and process the hardware messages according to the user configuration rules; The traffic filtering module is used to directly filter out unnecessary traffic in the upper layer; The label adding module is used to add a protocol label to the traffic required by the upper layer and submit it to the application layer data processing software of the server for processing, and the application layer data processing software performs application layer data analysis on the network data obtained by the smart network card; The ARM+ASIC heterogeneous module includes a GIGABIT MAC module, a rule setting module, a rule search module, a DDR3SDRAM controller, a QDR SRAM controller, and a PCI-E interface; The GIGABIT MAC module implements back pressure on data flow, monitoring of MAC side data MIB information, CRC check of messages, packet length setting, removes the preamble and CRC of received link layer data, sends the sent message with the preamble and CRC, detects whether the message is an IP message, opens the VLAN working mode according to the software settings and extracts the five-tuple information to the subsequent module; The rule setting module updates the rule table in the hardware according to the configuration of the application software; The rule search module searches the rule table according to the five-tuple information of the received message, and if found, discards the message or uploads the message to the CPU according to the action specified by the rule; The DDR3 SDRAM controller and the QDR SRAM controller implement DDR3 and QDR bus arbitration mechanisms and configuration control respectively; The PCI-E interface uploads messages to the CPU, downloads rules to the ARM+ASIC heterogeneous, configures the internal registers of the ARM+ASIC heterogeneous, monitors the internal working status of the ARM+ASIC heterogeneous, and performs basic configuration of the PCI-E according to the content in the EEPROM.

2. According to claim 1, a message unloading intelligent network card based on ARM+ASIC heterogeneous implementation is characterized in that: The ARM+ASIC heterogeneous module is also provided with two execution modules, including a message receiving module and a five-tuple filtering module, and the interface between the message receiving module and the five-tuple filtering module is a first-in-first-out message index buffer queue.

3. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation according to claim 2 is characterized in that: After the message receiving module receives the message, it puts the message index into the input queue of the five-tuple filtering module, and the five-tuple filtering module takes out the message index from the queue for further processing.

4. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation according to claim 3 is characterized in that: The message index buffer queue stores the buffer index of the message in DDR3, and is also the storage area index of the header information in BRAM. The header information includes a five-tuple and a payload offset.

5. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation according to claim 3 is characterized in that: When the message receiving module receives the message, the message receiving module obtains a free buffer index from the global available buffer queue, stores the message in the buffer, and then sends the buffer index to the input queue of the five-tuple filtering module. After the message filtering module processes the message in the buffer, the message buffer index is put into the global available buffer queue again.

6. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation according to claim 2, characterized in that: The message receiving module is provided with two submodules, which include a message buffer module and a link layer filtering module. The message buffer module buffers the message from MAC in the chip. If it is not an IP message, it is discarded; if it is an IP message, it is buffered to the DDR3 SDRAM controller. When the message is buffered in the chip, the header information extraction module is responsible for extracting the five-tuple information in the header and storing it in the BRAM.

7. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation according to claim 2, characterized in that: The five-tuple filtering module includes a concurrent flow matching module, a rule matching module, a rule control module, a concurrent flow control module, and a hit action execution module; The concurrent flow matching module searches for the flow corresponding to the message in the concurrent flow hash table in DDR3 according to the five-tuple of the message in the BRAM. If found, the message index is put into the discard or upload queue according to the hit action of the flow; if not found, the message is handed over to the rule matching module for matching the five-tuple rule. When a message is the first message in a flow, there is no entry for the flow in the concurrent flow hash table. The concurrent flow matching module cannot decide the action for the message. The rule matching module is responsible for searching the five-tuple rule table and comparing the message five-tuple with the found rule table entry. Regardless of whether the rule is hit or not, the rule filtering module will notify the rule control module to write the five-tuple of the message and the corresponding action into the concurrent flow table, and put the message index into the discard or upload queue. The five-tuple rule table is a hash table.

8. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation according to claim 7, characterized in that: When a new flow is discovered by the rule matching module, the five-tuple of the flow is written into the concurrent flow table. Each rule has a lifetime, which is stored in a rule lifetime array. If the lifetime of a rule is infinite, it is represented by 0. The rule control module polls the rule lifetime array every second to reduce the lifetime. For rules whose lifetime decreases from 1 to 0, the valid flag is invalidated. The concurrent flow control module also handles the timeout of each flow in the concurrent flow.

9. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation according to claim 8, characterized in that: When a message matches the corresponding five-tuple in the concurrent flow table, the message index enters the discard or upload queue according to the action that should be taken for the flow. When a message hits a rule in the rule table, it enters the discard or upload queue. The hit action execution module obtains the message index to be processed from the discard and upload queues and executes the corresponding action.

10. The message unloading intelligent network card based on ARM+ASIC heterogeneous implementation according to claim 7, characterized in that: The five-tuple rule matching algorithm of the five-tuple filtering module is: Each rule enters the hash table through hash operation, and each message searches for the rule in the hash table through hash operation. In this process, it includes the five-tuple mask process, which is to first add the mask mark of each element to the rule to form a fixed rule; then store the rule in a hash table; then add the mask rule of each element to the five-tuple information of each message received to form a five-tuple to be matched; finally, each to-be-matched item searches for the rule through the hash table for matching; Among them, each element includes IP, protocol, and port; The number of quintuple items to be matched is any number between 32 and 1.

Images