Flexible message analysis device and method

Abstract

The invention provides a flexible message analysis device and method, and the method comprises the steps: recognizing K common Ethernet message types through hardware hardening logic; randomly selecting N bytes to perform group Key according to the identified Ethernet message type, and forming to-be-identified Ethernet protocol keywords; providing subdivided Ethernet message type redefinition; providing M tri-state content addressable memory entries; tCAMKey length selection is carried out; and searching in a ternary content addressable memory through the to-be-identified Ethernet protocol keyword to obtain a new Ethernet message type, a new protocol identifier and a new offset value of the protocol in the message, and updating the Ethernet message type, the protocol identifier and the offset value of the protocol in the message. According to the technical scheme, flexible message analysis is realized.

Description

Technical Field

[0001] The present application relates to the technical field of message parsing, and in particular to a flexible message parsing device and method. Background Art

[0002] The packet analyzer (PA) is used for protocol analysis and identification of packets during network forwarding.

[0003] The current mainstream practices are divided into the following categories: (1) The message parser is unloaded by a dedicated network processor (microcode), without pure logic unloading; although it can support fully flexible parsing and rich business expansion, it has the problem of occupying the processing resource overhead of the network processor and high latency. (2) The message parser is pure hardware parsing; although the resource overhead is low and the latency is short, it lacks flexibility and can only parse known protocols. (3) Independent programmable message parser, based on the P4 language [Programming Protocol-independent Packet Processors, a domain-specific programming language used to describe how programmable forwarding devices process messages. Programmable forwarding devices can be switching chips ASIC, field programmable gate arrays FPGA, network interface cards, software switches, etc.] The programming hardware needs to have an arithmetic logic unit (ALU) and instruction storage (Memory) to run the P4 language parsing program; although it supports fully flexible parsing and rich business expansion, the hardware cost is high, and it is necessary to independently develop a programmable Parser processor, and it is based on instruction processing, which has a large latency.

[0004] The related message parsers have the problem of not taking into account both hardware cost and latency, and the message parsing is not flexible enough. Summary of the invention

[0005] The purpose of the present application is to provide a flexible message parsing device and method, aiming to solve the problem that the existing message parsing is not flexible enough.

[0006] According to a first aspect of the present application, a flexible message parser device is provided, comprising:

[0007] Hardware-hardened message parsing module and flexible message parsing module;

[0008] The hardware-hardened message parsing module is used to identify K commonly used Ethernet message types through hardware-hardened logic, where K is an integer greater than or equal to 1;

[0009] The flexible message parsing module includes a group keyword submodule, a ternary content addressable memory search engine submodule and a result execution submodule;

[0010] The keyword group submodule receives the Ethernet message type identified by the hardware hardened message parsing module, and selects N bytes from the message at random according to the identified Ethernet message type to form a keyword group to form an Ethernet protocol keyword to be identified, wherein N is an integer greater than or equal to 1;

[0011] A ternary content addressable memory search engine submodule provides M ternary content addressable memory entries, performs ternary content addressable memory keyword length selection, searches in the ternary content addressable memory through the Ethernet protocol keyword to be identified, and obtains a new Ethernet message type, a protocol identifier, and an offset value of the corresponding protocol in the message, wherein M is an integer greater than or equal to 1;

[0012] The result execution submodule provides a subdivided Ethernet message type redefinition, adds a new protocol identifier, and modifies the old protocol; and based on the new Ethernet message type, protocol identifier, and offset value of the corresponding protocol in the message obtained by the three-state content addressable memory search engine submodule, updates the Ethernet message type identified in the hardware hardened message parsing module and its corresponding protocol identifier and offset value of the corresponding protocol in the message.

[0013] In an optional implementation manner, the providing of subdivided Ethernet message type redefinition includes: the new Ethernet message type may include one protocol or multiple protocols, or may include a combination of multiple protocols.

[0014] In an optional implementation, the performing of ternary content addressable memory keyword length selection includes selecting one or more Ethernet protocol keywords to be identified for logical splicing.

[0015] In an optional implementation, the Ethernet protocol keyword to be identified is used to search in a ternary content addressable memory to obtain a new Ethernet message type, a protocol identifier, and an offset value of the corresponding protocol in the message, including: one search can obtain one or more new protocol identifiers and their corresponding Ethernet message types and offset values.

[0016] In an optional implementation, the updating of the Ethernet message type identified in the hardware-hardened message parsing module and its corresponding protocol identifier and the offset value of the corresponding protocol in the message also includes supporting replacement and new addition functions.

[0017] According to a second aspect of the present application, a flexible message parsing method is provided, including:

[0018] Through hardware hardening logic, K commonly used Ethernet message types are identified, where K is an integer greater than or equal to 1;

[0019] According to the identified Ethernet message type, N bytes are randomly selected from the message to form a keyword to form an Ethernet protocol keyword to be identified, where N is an integer greater than or equal to 1;

[0020] Provides subdivided Ethernet message type redefinition, adds new protocol identifiers, and modifies old protocols;

[0021] Providing M ternary content addressable memory entries, where M is an integer greater than or equal to 1;

[0022] Perform long selection of key words of ternary content addressable memory;

[0023] By using the Ethernet protocol keyword to be identified, searching in the ternary content addressable memory, obtaining a new Ethernet message type, a protocol identifier and an offset value of the corresponding protocol in the message;

[0024] According to the new Ethernet message type, protocol identifier and offset value of the corresponding protocol in the message, the identified Ethernet message type, its corresponding protocol identifier and offset value of the corresponding protocol in the message are updated.

[0025] In an optional implementation manner, the providing of subdivided Ethernet message type redefinition includes: the new Ethernet message type may include one protocol or multiple protocols, or may include a combination of multiple protocols.

[0026] In an optional implementation, the performing of ternary content addressable memory keyword length selection includes selecting one or more Ethernet protocol keywords to be identified for logical splicing.

[0027] In an optional implementation, searching in a ternary content addressable memory to obtain a new Ethernet message type, a protocol identifier, and an offset value of a corresponding protocol in the message includes: one search can obtain one or more new protocol identifiers and their corresponding Ethernet message types and offset values.

[0028] In an optional implementation manner, the updating of the identified Ethernet message type and its corresponding protocol identifier and the offset value of the corresponding protocol in the message also includes supporting replacement and new addition functions.

[0029] Compared with the related art, the technical solution of the present application has at least the following advantages:

[0030] The method and device of the embodiments of the present application adopt the idea of ​​"basic hardening, flexible expansion". By hardening the basic network protocol, latency and area overhead are saved. At the same time, through flexible Match-Action structure processing, further protocol expansion is performed on the basis of the basic network protocol, thereby achieving a low-cost, low-latency message parser architecture with certain flexible parsing and business expansion.

[0031] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained through the structures and processes indicated in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. It is obvious that the drawings described below are certain embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0033] Figure 1 It is based on the basic Ethernet message type of related technologies.

[0034] Figure 2 It is a commonly used L2 to L5 layer protocol type according to the relevant technology.

[0035] Figure 3 It is a block diagram of the flexible message parser architecture according to an exemplary embodiment of the present application.

[0036] Figure 4 It is a flowchart of a flexible message parsing method according to an exemplary embodiment of the present application.

[0037] Figure 5 It is a schematic diagram of Ethernet protocol keywords to be identified according to an exemplary embodiment of the present application.

[0038] Figure 6 It is a schematic diagram of an Ethernet protocol structure model according to an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] In the network, Ethernet message is the basic unit of data transmission, such as Figure 1As shown in the figure, protocols such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and ICMP (Internet Control Message Protocol) are encapsulated in the data field of the Ethernet message. When data of protocols such as TCP, UDP, and ICMP need to be transmitted over the network, they will be encapsulated in the data field of the Ethernet frame. This encapsulation process allows protocols at different levels to work together to ensure that data can be accurately transmitted from the source address to the destination address. Common L2 to L5 layer protocol types are as follows: Figure 2 shown.

[0041] Definitions of technical terms involved in this application:

[0042] Ptype: Packet Type, Ethernet message type;

[0043] TCAM: Temary Content Addressable Memory, ternary content addressable memory;

[0044] ID: Identification;

[0045] Hardware Packet Analysis: Hardware hardened packet analysis;

[0046] Flexible Packet Analysis: Flexible packet analysis;

[0047] Key Builder: Group keywords;

[0048] TCAM Lookup: Ternary Content Addressable Memory Lookup Engine;

[0049] Match-Action structure: The message processor structure for parsing and running message search results, including the Match part for extracting message information and the Action part for parsing / processing message search results.

[0050] like Figure 3 The figure shows a flexible message parser architecture block diagram of an exemplary embodiment of the present application. The device is composed of two modules:

[0051] 1. Hardware hardened packet analysis module: The hardware hardened packet analysis module is used to identify commonly used packet protocols based on existing Ethernet protocols. Since the commonly used packet protocols are fixed (K types), the logical overhead of hardware analysis is relatively fixed and the overhead is small.

[0052] 2. Flexible Packet Analysis Module: The Flexible Packet Analysis Module is used to flexibly expand the identification of complex protocols based on the K types of Ethernet packets that have been identified in the previous stage through flexible group keys (group keywords) and table lookup. The Flexible Packet Analysis Module contains the following submodules:

[0053] 1) Key Builder submodule: the Key Builder submodule extracts the key of the message from the message flexibly to form the Ethernet protocol key that needs to be identified under the current Ethernet message type;

[0054] 2) TCAM Lookup Submodule: TCAM Lookup Engine, which searches the TCAM for keywords extracted by the previous Key Builder, and obtains the new Ptype, the new Ethernet protocol ID and the offset value of the corresponding protocol in the message according to the matching result. One table lookup is not limited to obtaining a new Ethernet protocol ID, but can be customized to obtain N new Ethernet IDs according to the needs, that is, one table lookup can achieve multi-protocol identification.

[0055] 3) Result execution submodule: executes the update of the new Ptype, protocol ID and the offset value of the corresponding protocol in the message, and supports functions such as replacement and addition.

[0056] First, an embodiment of the present application provides a flexible message parser device, including:

[0057] A hardware-hardened message parsing module and a flexible message parsing module; wherein the flexible message parsing module comprises a group key submodule, a ternary content addressable memory (TCAM) search engine submodule, and a result execution submodule; wherein:

[0058] The hardware-hardened message parsing module is used to identify K commonly used Ethernet message types Ptype through hardware-hardened logic, where K is an integer greater than or equal to 1.

[0059] The Key Builder submodule receives the Ethernet message type Ptype identified by the hardware-hardened message parsing module, and uses the PIPELINE-based Match-Action structure to arbitrarily select N bytes to form a Key Builder based on the identified Ptype type to form an Ethernet protocol keyword to be identified, where N is an integer greater than or equal to 1.

[0060] The ternary content addressable memory search engine (TCAM Lookup) submodule provides M TCAM entries, performs TCAM Key length selection, searches in the TCAM through the Ethernet protocol keyword to be identified, and obtains a new Ptype, protocol ID and offset value of the protocol in the message, where M is an integer greater than or equal to 1.

[0061] Exemplarily, the selecting of TCAM Key length includes selecting one or more Ethernet protocol keywords to be identified for logical splicing.

[0062] The result execution submodule provides subdivision Ptype redefinition, adds new protocol IDs, and modifies old protocols; and based on the new Ptype, protocol ID, and offset value of the corresponding protocol in the message obtained by the TCAM Lookup submodule, updates the Ptype, protocol ID, and offset value of the protocol in the message identified in the hardware hardened message parsing module.

[0063] Exemplarily, the providing of redefinition of subdivided Ptype includes: the new Ptype may include one protocol or multiple protocols, or a combination of multiple protocols.

[0064] Exemplarily, the searching in TCAM through the Ethernet protocol keyword to obtain a new Ptype, protocol ID and offset value of the protocol in the message includes: one search can obtain one or more new protocol IDs and their corresponding Ptype and offset values.

[0065] In an optional implementation, the updating of the Ptype, protocol ID, and offset value of the protocol in the message identified in the hardware-hardened message parsing module also includes supporting replacement and new functions.

[0066] Accordingly, if Figure 4 As shown, the embodiment of the present application also provides a flexible message parsing method, which includes the following steps:

[0067] S1: Identify K commonly used Ethernet message types Ptype through hardware hardening logic, where K is an integer greater than or equal to 1.

[0068] The hardware-hardened message parsing module identifies K commonly used Ethernet message types, namely K Ptypes. Since the commonly used message protocol types are fixed, the logical overhead of hardware parsing is relatively fixed and small.

[0069] S2: randomly select N bytes to form a Key to form the Ethernet protocol keyword to be identified, where N is an integer greater than or equal to 1.

[0070] Specifically, the Match-Action structure based on PIPELINE is used, and the keyword (Key) of the message is flexibly extracted from the message to form the Ethernet protocol keyword that needs to be identified under the current Ptype.

[0071] like Figure 5 As shown, based on the identified Ptype and the protocol type that needs further in-depth analysis under the current Ptype, one or more groups of search keywords required for new message protocol identification are selected from the message, so that the extracted keywords can be input into the TCAM for matching, thereby realizing the identification of the new protocol type.

[0072] S3: Provides segmentation Ptype redefinition, adds new protocol IDs, and modifies old protocols.

[0073] Specifically, the new Ptype can include one protocol or multiple protocols, or a combination of multiple protocols. For example, the currently recognized Ptype is Figure 1 The Ethernet message in contains a three-layer IPV4 message with one layer of VLAN, and the Ptype type value is defined as 0x0, and two protocol IDs are defined, where protocol ID 0x0 means that the message with Ptype=0x0 contains the MAC protocol; protocol ID 0x1 means that the message with Ptype=0x0 contains the IPV4 protocol. Then: when four-layer protocol parsing is required, if it is parsed as a UDP message, Ptype can be defined as 0x1; if it is parsed as a TCP message, Ptype can be defined as 0x2, and so on.

[0074] The addition of a new protocol ID requires adding or replacing the new protocol ID of the newly identified message to the original protocol ID. For example, the protocol ID of the UDP protocol is defined as 0x2, and the protocol ID of the TCP protocol is 0x3. At this time, the message with Ptype=0x1 contains a total of 3 protocols, and the protocol IDs are 0x0, 0x1, 0x2 or 0x3 respectively; if after the new protocol is identified, the identified old protocol ID does not need to be used, the new protocol ID can be used to replace the original protocol ID, such as replacing 0x0 with 0x2, then the message with Ptype=0x1 contains a total of 2 protocols: 0x2 and 0x1, and the original protocol ID 0x0 is replaced by the new protocol ID 0x2.

[0075] S4: Provide M TCAM entries, where M is an integer greater than or equal to 1.

[0076] Specifically, M TCAM entries are provided, so that flexible identification of new protocols / new services can be achieved with less entry overhead. Users can determine how many layers of deep protocol parsing requirements are required based on the existing fixed identified protocols, and how many physical TCAM entries are physically required for table lookup based on actual conditions.

[0077] S5: Select TCAM Key length.

[0078] Specifically, one or more Ethernet protocol keywords to be identified can be selected for logical splicing, for example, Figure 5 The currently recognized Ptype shown in Figure 1 The Ethernet message in contains a three-layer IPV4 message with one layer of VLAN, and the Ptype type value is defined as 0x0; then Figure 6 The Ethernet protocol structure model shown in the figure: If you need to identify the content of the four-layer protocol, you first need to extract the 8-bit Protocol1 from the three-layer IP header in the message to indicate the protocol ID of the four-layer protocol as Figure 5 "Field 1" in; secondly, if you need to specify, for example, the port number after identifying UDP, or the port number after TCP is used to specify a specific business type, then you need to extract the port based on the UDP or TCP protocol as Figure 5 According to this solution, users can also customize multiple extracted "fields" according to the depth requirements of protocol recognition, and splice these fields to form the search keyword (Key) of the new protocol.

[0079] S6: Searching in TCAM by using the Ethernet protocol keyword to be identified, and obtaining a new Ptype, protocol ID, and an offset value of the protocol in the message.

[0080] Specifically, one or more Ptypes, protocol IDs and offset values ​​of the protocols in the message are obtained by looking up the TCAM table. In this way, one or more new protocol IDs and their corresponding Ptypes and offset values ​​can be obtained by one lookup.

[0081] S7: Update the Ptype identified in S1 and its corresponding protocol ID and the offset value of the protocol in the message according to the new Ptype, protocol ID and the offset value of the corresponding protocol in the message.

[0082] Specifically, it also includes support for replacement and new features.

[0083] It is understood that the structures, names and parameters described in the above embodiments are only examples. Those skilled in the art can also easily think of combinations and adjustments to the structural features of the above embodiments according to the use requirements, and the concept of this application should not be limited to the specific details of the above examples.

[0084] Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that he or she may still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A flexible message parser device, characterized in that: include: Hardware-hardened message parsing module and flexible message parsing module; The hardware-hardened message parsing module is used to identify K commonly used Ethernet message types through hardware-hardened logic, where K is an integer greater than or equal to 1; The flexible message parsing module includes a group keyword submodule, a ternary content addressable memory search engine submodule and a result execution submodule; The keyword group submodule receives the Ethernet message type identified by the hardware hardened message parsing module, and selects N bytes from the message at random according to the identified Ethernet message type to form a keyword group to form an Ethernet protocol keyword to be identified, wherein N is an integer greater than or equal to 1; A ternary content addressable memory search engine submodule provides M ternary content addressable memory entries, performs ternary content addressable memory keyword length selection, searches in the ternary content addressable memory through the Ethernet protocol keyword to be identified, and obtains a new Ethernet message type, a protocol identifier, and an offset value of the corresponding protocol in the message, wherein M is an integer greater than or equal to 1; The result execution submodule provides a subdivided Ethernet message type redefinition, adds a new protocol identifier, and modifies the old protocol; and based on the new Ethernet message type, protocol identifier, and offset value of the corresponding protocol in the message obtained by the three-state content addressable memory search engine submodule, updates the Ethernet message type identified in the hardware hardened message parsing module and its corresponding protocol identifier and offset value of the corresponding protocol in the message.

2. The flexible message parser device according to claim 1, characterized in that: The redefinition of the Ethernet message type providing subdivision includes: the new Ethernet message type may include one protocol or multiple protocols, or may include a combination of multiple protocols.

3. The flexible message parser device according to claim 1, characterized in that: The performing of ternary content addressable memory keyword length selection includes selecting one or more Ethernet protocol keywords to be identified for logical splicing.

4. The flexible message parser device according to claim 1, characterized in that: The method of searching in the ternary content addressable memory through the Ethernet protocol keyword to be identified to obtain a new Ethernet message type, a protocol identifier and an offset value of the corresponding protocol in the message includes: one search can obtain one or more new protocol identifiers and their corresponding Ethernet message types and offset values.

5. The flexible message parser device according to claim 1, characterized in that: The updating of the Ethernet message type identified in the message parsing module of the hardware hardening and its corresponding protocol identifier and the offset value of the corresponding protocol in the message also includes supporting replacement and new addition functions.

6. A flexible message parsing method, characterized in that: include: Through hardware hardening logic, K commonly used Ethernet message types are identified, where K is an integer greater than or equal to 1; According to the identified Ethernet message type, N bytes are randomly selected from the message to form a keyword to form an Ethernet protocol keyword to be identified, where N is an integer greater than or equal to 1; Provides subdivided Ethernet message type redefinition, adds new protocol identifiers, and modifies old protocols; Providing M ternary content addressable memory entries, where M is an integer greater than or equal to 1; Perform long selection of key words of ternary content addressable memory; By using the Ethernet protocol keyword to be identified, searching in the ternary content addressable memory, obtaining a new Ethernet message type, a protocol identifier and an offset value of the corresponding protocol in the message; According to the new Ethernet message type, protocol identifier and offset value of the corresponding protocol in the message, the identified Ethernet message type, its corresponding protocol identifier and offset value of the corresponding protocol in the message are updated.

7. The flexible message parsing method according to claim 6, characterized in that: The redefinition of the Ethernet message type providing subdivision includes: the new Ethernet message type may include one protocol or multiple protocols, or may include a combination of multiple protocols.

8. The flexible message parsing method according to claim 6, characterized in that: The performing of ternary content addressable memory keyword length selection includes selecting one or more Ethernet protocol keywords to be identified for logical splicing.

9. The flexible message parsing method according to claim 6, characterized in that: The method of searching in the ternary content addressable memory through the Ethernet protocol keyword to be identified to obtain a new Ethernet message type, a protocol identifier and an offset value of the corresponding protocol in the message includes: one search can obtain one or more new protocol identifiers and their corresponding Ethernet message types and offset values.

10. The flexible message parsing method according to claim 6, characterized in that: The updated identified Ethernet message type and its corresponding protocol identifier and the offset value of the corresponding protocol in the message also include support for replacement and new functions.

Images