TCAM high-speed method and system based on FPGA

Abstract

The invention discloses a TCAM (Ternary Content Addressable Memory) high-speed method and system based on an FPGA (Field Programmable Gate Array). The TCAM high-speed method comprises the following steps: capturing a data packet transmitted through a network interface by using hardware logic of the FPGA; preprocessing the data packet; the FPGA extracts a data part in the data packet according to the information in the packet header; key information of the preprocessed data packet is sent to a TCAM for searching; checking a matching result output by the TCAM, and confirming whether a matched table item is found or not; the FPGA determines a subsequent processing path of the data packet according to a search result of the TCAM; different shunting strategies are configured; and updating and optimizing table items of the TCAM according to the search result and the execution effect. The hardware logic of the FPGA can capture and process network data packets at a high speed, and high-speed classification and search of the data packets are realized in combination with the parallel comparison capability of the TCAM; the parallel processing capability of the FPGA enables the system to process a plurality of data packets at the same time, and the overall processing throughput is improved.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a TCAM high-speed method and system based on FPGA. Background Art

[0002] Currently, TCAM (Ternary Content Addressable Memory) is widely used in high-speed network processing for packet classification and other processing. TCAM can store a third state "don't care" (*) in addition to 0 and 1, and can complete the search within one clock cycle and output the address information of the first matching entry; because they can compare the input key value with a set of stored rules in parallel and output the matching result. Field Programmable Gate Arrays (FPGA) have the characteristics of programmability, high performance and low latency, and are a device that balances flexibility and high performance.

[0003] For example, in an existing technical solution of a TCAM circuit structure implemented in an FPGA, a user configures the number of basic search units of the TCAM and the table entry depth of the basic search unit storage area according to their own needs. Although resource consumption is reduced by dividing the basic search units and reading out the table entries in sequence for comparison, this method may sacrifice the search speed. Summary of the invention

[0004] To this end, the present invention provides a high-speed TCAM method and system based on FPGA to solve the problem of reducing power consumption while ensuring the search speed in the prior art.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] A high-speed TCAM method and system based on FPGA, comprising the following steps:

[0007] S1. Use the hardware logic of the FPGA to capture the data packets incoming through the network interface;

[0008] S2. Preprocess the data packet; FPGA needs to identify the header information of the data packet. After parsing the header, FPGA extracts the data part of the data packet according to the information in the header;

[0009] S3. Send the key information of the pre-processed data packet to TCAM for search; use the sorted KEY as the input data of TCAM; all storage units in TCAM will be compared with the input KEY in parallel; if a matching storage unit is found, TCAM will output the data corresponding to the storage unit; check the matching result output by TCAM to confirm whether a matching table entry is found; the key information refers to the packet header field used for matching and routing decision data;

[0010] S4.FPGA determines the subsequent processing path of the data packet based on the TCAM search result and configures different diversion strategies;

[0011] S5. Update and optimize the TCAM table entries according to the search results and execution effects.

[0012] Furthermore: the FPGA receives data packets from external devices through its hardware interface, and stores these data packets in an internal buffer or external memory, waiting for further processing.

[0013] Further: the FPGA usually calculates the CRC value of the data packet and compares it with the CRC value carried in the data packet; the CRC check calculates the data in the data packet bit by bit and generates a checksum; this checksum is then compared with the checksum carried in the data packet to detect whether there is a data transmission error; if a CRC check error is found, the FPGA takes error handling measures.

[0014] Furthermore: during the process of the FPGA performing the data conversion operation, the key information is organized into KEY according to the storage structure of the TCAM, and the length and format of the KEY are ensured to match the table entry in the TCAM.

[0015] Furthermore: the logic circuit and state machine inside the FPGA are defined by writing HDL code to complete the parsing, verification and preprocessing of the data packet.

[0016] Further: the TCAM will return the addresses or indexes of all table entries that match the KEY; if there are multiple table entries that match the KEY, the TCAM will determine which match has the highest priority based on the location of the table entries in the memory or the preset priority rules; the keyword table entries with longer prefixes will be stored in the low address area of ​​the TCAM, while the keyword table entries with shorter prefixes will be stored in the high address area; therefore, the TCAM will return the match with the lowest address as the match with the highest priority; based on the result of the priority judgment, the TCAM will return the matching rule ID or the address or index of the match with the highest priority; the receiver obtains the specific rule content from the RAM or other memory or performs the corresponding operation based on this address or index.

[0017] Furthermore: when implementing the diversion strategy, FPGA makes full use of its advantages of parallel processing and high-speed IO interface to improve the speed and efficiency of data packet processing; if it is necessary to obtain the matching rule content, the receiver extracts the specific rule data from RAM or other memory according to the address or index returned by TCAM; and performs corresponding operations according to the matching rule ID or the highest priority match.

[0018] Further: analyzing the TCAM search results to identify which entries lead to high false positive or false negative rates; checking whether there are overly broad or overly specific matching rules; evaluating the impact of classification decisions on system performance; and adjusting overly broad matching rules based on data analysis.

[0019] In order to achieve the above object, the present invention also provides a technical solution:

[0020] A TCAM high-speed system based on FPGA, comprising:

[0021] High-speed network access module: responsible for receiving and processing network signals to ensure stable access to high-speed network signals;

[0022] Data preprocessing unit: reduces the complexity of data processing and improves the efficiency of subsequent processing through data cleaning, integration and transformation; this unit uses the parallel processing capability of FPGA to quickly process the large amount of traffic data generated per second to ensure the real-time response capability of the system;

[0023] Flow management module: responsible for data fragmentation and message reordering to restore the complete data flow; at the same time, it establishes flow tables and manages data flows to ensure data integrity and orderliness; the processed data flow is sent to the matching module for further processing;

[0024] Matching module: uses TCAM for efficient matching and sends matching results and related action command addresses to the online management and deep analysis modules. TCAM can store matching table entries. When the system inputs search content into TCAM, TCAM compares this content with the matching table entries, returns the optimal item, and obtains the action command address to be executed.

[0025] Online management and in-depth analysis module: perform subsequent processing on matching results.

[0026] The data preprocessing unit, supported by the parallel processing capability of the FPGA, cleans, integrates and transforms the data, and then transmits the processed data stream to the stream management module.

[0027] Furthermore: the online management and deep analysis module performs data forwarding, classification, and deeper data analysis and processing based on the matching results; and feeds back any control signals or configuration parameters that may be generated to the data preprocessing unit and the flow management module to adjust their processing behavior.

[0028] The present invention has the following advantages:

[0029] The hardware logic of the FPGA of the present invention can capture and process network data packets at high speed; use TCAM for efficient matching; all storage units in the TCAM will be compared with the input KEY in parallel; check the matching results output by the TCAM to confirm whether a matching table item is found; the TCAM can store matching table items inside, and when the system inputs search content to the TCAM, the TCAM will compare this content with the matching table item, return the optimal item, and obtain the address of the action command to be executed; realize high-speed classification and search of data packets; the parallel processing capability of the FPGA enables the system to process multiple data packets at the same time, thereby improving the overall processing throughput; the TCAM can perform accurate three-state matching, and can realize efficient search and classification for key information in the data packet; by adjusting the table items in the TCAM, fine control and management of network traffic can be realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more intuitively illustrate the prior art and the present application, exemplary drawings are given below. It should be understood that the specific shapes and structures shown in the drawings should not generally be regarded as limiting conditions for implementing the present application; for example, those skilled in the art are capable of easily making conventional adjustments or further optimizations to the addition / reduction / attribution division, specific shapes, positional relationships, connection methods, dimensional ratios, etc. of certain units (components) based on the technical concepts and exemplary drawings disclosed in the present application.

[0031] Figure 1 The present invention provides a flowchart of a FPGA-based TCAM high-speed method.

[0032] Figure 2 A pin diagram of a LUT in a logic slice is stored in a FPGA-based TCAM high-speed method provided by the present invention.

[0033] Figure 3 A system block diagram of a FPGA-based TCAM high-speed system provided by the present invention. DETAILED DESCRIPTION

[0034] The following is an explanation of the implementation of the present invention by specific specific examples. People familiar with this technology can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. It should be understood that these embodiments are only to further illustrate the present invention and cannot be understood as limiting the scope of protection of the present invention. Technical engineers in this field can make some non-essential improvements and adjustments to the present invention based on the contents of the above invention; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] See also Figure 1 , a TCAM high-speed method based on FPGA, comprising the following steps:

[0036] S1. Capture data packets coming in through the network interface; Use the hardware logic of FPGA to capture data packets coming in through the network interface; FPGA receives data packets from external devices through its hardware interface (such as UART, Ethernet, etc.) and stores these data packets in the internal buffer or external memory (such as DDR) for further processing.

[0037] S2. Preprocess the data packet;

[0038] FPGA needs to identify the header information of the data packet, which usually includes fields such as frame header, command, data length, etc. By parsing these fields, FPGA can determine the type and length of the data packet and the subsequent processing method; the packet header (header information of the data packet) parsing can be achieved through the state machine; after parsing the packet header, FPGA can extract the data part of the data packet based on the information in the packet header.

[0039] To ensure data integrity, the FPGA typically calculates a CRC (cyclic redundancy check) value for the data packet and compares it with the CRC value carried in the data packet.

[0040] CRC checksum calculates the data in the data packet bit by bit and generates a checksum; this checksum is then compared with the checksum carried in the data packet to detect whether there is a data transmission error; if a CRC checksum error is found, the FPGA can take appropriate error handling measures, such as discarding the erroneous data packet, sending an error notification to the sender, etc.

[0041] Based on the packet header information or data content, FPGA can filter the data packets and only retain the data packets that meet specific conditions for subsequent processing; FPGA can also perform necessary conversion operations on the data, such as byte order conversion, data format conversion, etc., to meet the needs of subsequent processing; according to the storage structure of TCAM, key information is organized into KEY (search keyword); ensure that the length and format of the KEY match the table entry in TCAM.

[0042] The pre-processed data packets can be stored in the internal buffer of the FPGA or in the external memory, waiting for further processing or transmission.

[0043] By writing HDL code, you can define the logic circuits and state machines inside the FPGA to complete operations such as data packet parsing, verification, and preprocessing; for example, you can design a three-stage state machine that identifies the packet header based on the received data byte stream and extracts the relevant header information.

[0044] S3. Send the key information of the preprocessed data packet to TCAM for search; use the sorted KEY as the input data of TCAM; all storage units in TCAM will be compared with the input KEY in parallel; if a matching storage unit is found, TCAM will output the data corresponding to the storage unit (i.e., the matching result); check the matching result output by TCAM to confirm whether a matching table entry is found.

[0045] The key information in step S3 above usually refers to the packet header fields used for matching and routing decisions; these fields are crucial for quickly finding ACLs (access control lists), routing table entries, or other network policy rules.

[0046] Key information usually includes:

[0047] (1) Source IP address and destination IP address: These addresses are used to determine the origin and destination of a data packet and are the basis for routing lookup and access control;

[0048] (2) Source port and destination port: In transport layer protocols such as TCP or UDP, port numbers are used to identify the sender and receiver applications; these port numbers play an important role in firewall rule and network policy matching;

[0049] (3) Protocol type: Identifies the protocol used by the data packet (such as TCP, UDP, ICMP, etc.), which is necessary for application layer filtering and security policy implementation;

[0050] (4) Other important flags: such as DSCP (Differential Services Code Point) marking, used for QoS (Quality of Service) decisions; TTL (Time to Live) value, used to prevent data packets from looping infinitely in the network, etc.

[0051] During use, in routers, TCAM uses this key information to quickly look up the routing table and determine the next hop address or outbound interface of the data packet; security devices such as firewalls use the ACL rules in TCAM to allow or block data packets based on this key information; network devices use this key information to execute various network policies, such as QoS policies, traffic shaping, and load balancing.

[0052] TCAM returns the addresses or indices of all entries that match the KEY;

[0053] If there are multiple table entries that match the KEY, TCAM will determine which match has the highest priority based on the location of the table entries in the memory or the preset priority rules; usually, keyword table entries with longer prefixes are stored in the low address area of ​​​​TCAM, while keyword table entries with shorter prefixes are stored in the high address area; therefore, TCAM will return the match with the lowest address as the match with the highest priority.

[0054] Based on the result of the priority judgment, TCAM will return the matching rule ID or the address or index of the highest priority matching item; the receiver can obtain the specific rule content from RAM or other memory or perform corresponding operations based on this address or index.

[0055] S4.FPGA determines the subsequent processing path of the data packet based on the search results of TCAM; different diversion strategies can be configured, and network administrators or system developers can formulate diversion strategies based on the actual needs and topology of the network; diversion strategies can include sending specific types of data packets to specific network interfaces, performing further deep packet inspection (DPI) on data packets, encrypting / decrypting data packets, discarding data packets, etc.

[0056] When implementing the diversion strategy, FPGA can take full advantage of its parallel processing and high-speed IO interface to improve the speed and efficiency of data packet processing.

[0057] If it is necessary to obtain the content of the matched rule, the receiver can extract the specific rule data from the RAM or other memory according to the address or index returned by the TCAM; according to the matched rule ID or the highest priority match, perform corresponding operations such as routing forwarding, security control, etc.

[0058] DRAM is a distributed memory in FPGA. The basic logic unit is a configurable logic block, which is composed of several logic slices, such as Figure 2The storage logic slice (SliceM) shown in the figure has a pin diagram of its LUT (Look-Up Table); when used as RAM, DI1 and DI2 are write data input ports; O5 and O6 are data output ports, supporting one-time 2-bit or 1-bit read and write; A6: A1 is the read address; W6: W1 is the write address; WEN is the write enable; CLK is the clock port. By optimizing the layout and access method of the memory, access delay can be reduced.

[0059] Assume that in a large network device, the traffic passing through needs to be classified so that different types of traffic can be processed differently.

[0060] Define classification rules based on network protocols and traffic types; for example, identify traffic with destination port 80 in the TCP protocol as HTTP traffic, and identify traffic with destination port 21 as FTP traffic; at the same time, define the characteristics of malicious traffic, such as specific IP addresses, abnormal packet sizes, or specific protocol fields.

[0061] FPGA pre-processes the received data packets to extract the header information (such as IP address, port number, etc.) and specific parts of the data content; for the detection of malicious traffic, it can also extract specific protocol fields or behavioral characteristics in the data packets.

[0062] The extracted features are sent to TCAM for fast search; TCAM stores predefined classification rules and malicious traffic features; TCAM can find entries that match the input features in a very short time and output the corresponding classification results and malicious traffic identification.

[0063] FPGA performs corresponding operations based on the classification results and malicious traffic identification output by TCAM; HTTP traffic and FTP traffic are forwarded to different processing paths respectively; for malicious traffic, it filters, isolates or sends alarms to the security system.

[0064] S5. Update the rule table in the TCAM; based on the search results and execution effects, the table entries in the TCAM may be updated and optimized to improve search efficiency and accuracy.

[0065] Analyze TCAM lookup results to identify which entries result in high false positive or false negative rates; check whether there are overly broad or overly specific matching rules; evaluate the impact of classification decisions on system performance, such as processing delay, throughput, etc.; determine which optimizations can improve overall efficiency.

[0066] Based on data analysis, adjust overly broad matching rules to make them more precise, which helps reduce false positives and missed negatives; add new matching rules to TCAM in a timely manner for emerging threats or traffic patterns; identify and delete redundant or conflicting rules to optimize TCAM resource usage; adjust the priority of matching rules based on the importance and urgency of the traffic.

[0067] See also Figure 3 , a TCAM high-speed system based on FPGA, including

[0068] High-speed network access module: responsible for receiving and processing network signals up to 40 Gb / s, ensuring stable access to high-speed network signals.

[0069] Data preprocessing unit: reduces the complexity of data processing and improves the efficiency of subsequent processing through data cleaning, integration and transformation; this unit uses the parallel processing capability of FPGA to quickly process the large amount of traffic data generated per second to ensure the real-time response capability of the system.

[0070] Flow management module: responsible for data fragmentation and message reordering to restore the complete data flow. At the same time, it establishes flow tables and manages data flows to ensure data integrity and orderliness; the processed data flows are sent to the matching module for further processing.

[0071] Matching module: Uses TCAM for efficient matching; sends matching results and related action command addresses to the online management and deep analysis modules; TCAM can store matching table entries. When the system inputs search content into TCAM, TCAM compares this content with the matching table entries, returns the optimal item, and obtains the action command address to be executed.

[0072] Online management and in-depth analysis module: perform subsequent processing on matching results, including data forwarding, classification, and deeper data analysis and processing.

[0073] After receiving the network signal of up to 40 Gb / s, the high-speed network access module will first perform preliminary signal decoding and formatting, and then forward these raw data streams to the data preprocessing unit; the connection method may be through a high-speed serial interface (such as PCIe, Ethernet, etc.) or a dedicated data channel to ensure low latency and high throughput data transmission.

[0074] The data preprocessing unit, supported by the parallel processing capability of the FPGA, cleans, integrates and transforms the data, and then transmits the processed data stream to the stream management module.

[0075] The online management and deep analysis module performs data forwarding, classification, and deeper data analysis and processing according to the matching results; at the same time, it may generate control signals or configuration parameters and feed them back to other modules (such as data preprocessing unit, flow management module) to adjust their processing behaviors.

[0076] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A high-speed TCAM method based on FPGA, characterized in that: The following steps are involved: S1. Use the hardware logic of the FPGA to capture the data packets incoming through the network interface; S2. Preprocess the data packet; FPGA identifies the header information of the data packet. After parsing the header, FPGA extracts the data portion of the data packet according to the information in the header; S3. Send the key information of the preprocessed data packet to TCAM for search; According to the storage structure of TCAM, key information is organized into KEY, and the length and format of KEY are ensured to match the table entry in TCAM; the organized KEY is used as the input data of TCAM; all storage units in TCAM are compared with the input KEY in parallel; if a matching storage unit is found, TCAM will output the data corresponding to the storage unit; check the matching result output by TCAM to confirm whether a matching table entry is found; key information includes the data packet header field used for matching and routing decisions; S4.FPGA determines the subsequent processing path of the data packet based on the TCAM search result and configures different diversion strategies; S5. Update and optimize the TCAM table entries according to the search results and execution effects.

2. The FPGA-based TCAM high-speed method according to claim 1, characterized in that: The FPGA receives data packets from external devices through its hardware interface and stores these data packets in an internal buffer or an external memory, waiting for further processing.

3. The FPGA-based TCAM high-speed method according to claim 1, characterized in that: The FPGA calculates the CRC value of the data packet and compares it with the CRC value carried in the data packet; the CRC check calculates the data in the data packet bit by bit and generates a checksum; This checksum is then compared to the checksum carried in the packet to detect any data transmission errors; If a CRC check error is found, the FPGA takes error handling measures.

4. The FPGA-based TCAM high-speed method according to claim 1, characterized in that: The logic circuit and state machine inside the FPGA are defined by writing HDL codes to complete the parsing, verification and preprocessing of data packets.

5. The FPGA-based TCAM high-speed method according to claim 1, characterized in that: The TCAM will return the addresses or indexes of all table entries that match the KEY; if there are multiple table entries that match the KEY, the TCAM will determine which matching item has the highest priority based on the location of the table entries in the memory or the preset priority rules; keyword table entries with longer prefixes will be stored in the low address area of ​​the TCAM, while keyword table entries with shorter prefixes will be stored in the high address area; therefore, the TCAM will return the matching item with the lowest address as the matching item with the highest priority; based on the result of the priority judgment, the TCAM will return the matching rule ID or the address or index of the matching item with the highest priority; the receiver obtains the specific rule content from the RAM or other memory or performs the corresponding operation based on this address or index.

6. The FPGA-based TCAM high-speed method according to claim 1, characterized in that: When implementing the diversion strategy, FPGA makes full use of its advantages of parallel processing and high-speed IO interface to improve the speed and efficiency of data packet processing; if it is necessary to obtain the matching rule content, the receiver extracts the specific rule data from RAM or other memory according to the address or index returned by TCAM; and performs corresponding operations according to the matching rule ID or the highest priority match.

7. The FPGA-based TCAM high-speed method according to claim 1, characterized in that: Analyze the TCAM search results to identify which entries lead to high false positive or false negative rates; check whether there are overly broad or overly specific matching rules; evaluate the impact of classification decisions on system performance; and adjust overly broad matching rules based on data analysis.

8. A TCAM high-speed system based on FPGA, characterized in that: include: High-speed network access module: responsible for receiving and processing network signals to ensure stable access to high-speed network signals; Data preprocessing unit: reduces the complexity of data processing and improves the efficiency of subsequent processing through data cleaning, integration and transformation; this unit uses the parallel processing capability of FPGA to quickly process the large amount of traffic data generated per second to ensure the real-time response capability of the system; Stream management module: responsible for data fragmentation and message reordering to restore the complete data stream; At the same time, flow tables are established and data flows are managed to ensure data integrity and orderliness; the processed data flows are sent to the matching module for further processing; Matching module: Use TCAM for efficient matching; send matching results and related action command addresses to online management and deep analysis modules; all storage units in TCAM are compared with the input KEY in parallel; check the matching results output by TCAM to confirm whether a matching table entry is found; TCAM can store matching table entries inside. When the system inputs search content to TCAM, TCAM compares this content with the matching table entry, returns the optimal item, and obtains the action command address to be executed; Online management and in-depth analysis module: perform subsequent processing on matching results.

9. The FPGA-based TCAM high-speed system according to claim 8, characterized in that: The online management and in-depth analysis module performs data forwarding, classification, and deeper data analysis and processing according to the matching results; and feeds back the generated control signals or configuration parameters to the data preprocessing unit and the flow management module to adjust their processing behaviors.

Images