A flexible packet parsing apparatus and method

Abstract

The application provides a flexible message analysis device and method, which comprises the following steps: identifying K common Ethernet message types through hardware hardening logic; selecting N bytes to form an Ethernet protocol key to be identified according to the identified Ethernet message type; providing a subdivided Ethernet message type redefinition; providing M TCAM entries; selecting a TCAM key length; searching in the TCAM through the Ethernet protocol key to be identified, and obtaining and updating a new Ethernet message type, a protocol identifier and a protocol offset value in the message. The technical scheme of the application realizes flexible message analysis.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of message analysis, in particular to a flexible message analysis device and method. BACKGROUND

[0002] Packet Analysis (PA) is used for protocol analysis and identification of messages in network forwarding.

[0003] The current mainstream methods are as follows: (1) the message analysis is completed by a dedicated network processor (microcode) to offload, without pure logic offload; although it can support full flexible analysis and rich business expansion, it has the problems of occupying network processor processing resources, large delay, etc. (2) the message analysis is purely hardware analysis; although it has less resource consumption and short delay, it lacks flexibility and can only analyze known protocols. (3) an independent programmable message analysis is programmed on hardware based on P4 language [Programming Protocol-independent Packet Processors is a domain-specific programming language used to describe how a programmable forwarding device processes messages, and the programmable forwarding device can be an ASIC, FPGA, network interface card, software switch, etc.], which needs an arithmetic logic unit (ALU) and an instruction storage (Memory) to run the P4 language analysis program; although it supports full flexible analysis and rich business expansion, it has high hardware cost, needs to develop a programmable Parser processor independently, and has large delay based on instruction processing.

[0004] The related message analysis has the problems of not being able to balance hardware cost and delay, and not being flexible enough in message analysis. SUMMARY

[0005] The present application aims to provide a flexible message analysis device and method, and aims to solve the problem of not being flexible enough in existing message analysis.

[0006] According to a first aspect of the present application, a flexible message analysis device is provided, comprising:

[0007] a hardware-hardened message analysis module and a flexible message analysis module;

[0008] The hardware-hardened message analysis module is configured to identify K commonly used Ethernet message types through hardware-hardened logic, where K is an integer greater than or equal to 1.

[0009] The flexible message analysis module includes a group key submodule, a ternary content addressable memory lookup engine submodule, and a result execution submodule.

[0010] The group keyword submodule receives the Ethernet message type identified by the hardware-hardened message parsing module, selects N bytes from the message at random according to the identified Ethernet message type to form an Ethernet protocol keyword to be identified, where N is an integer greater than or equal to 1;

[0011] The ternary content-addressable memory lookup engine submodule provides M ternary content-addressable memory entries, performs ternary content-addressable memory keyword length selection, and performs lookup in the ternary content-addressable memory through the Ethernet protocol keyword to be identified to obtain a new Ethernet message type, a protocol identifier, and an offset value of the corresponding protocol in the message, where M is an integer greater than or equal to 1;

[0012] The result execution submodule provides a redefinition of the subdivided Ethernet message type, adds a new protocol identifier, and modifies an old protocol, and updates the Ethernet message type identified by the hardware-hardened message parsing module and the protocol identifier and the offset value of the corresponding protocol in the message according to the new Ethernet message type, the protocol identifier, and the offset value of the corresponding protocol in the message obtained by the ternary content-addressable memory lookup engine submodule.

[0013] In an optional implementation, the redefinition of the subdivided Ethernet message type includes that the new Ethernet message type can contain one protocol or multiple protocols, or a combination of multiple protocols.

[0014] In an optional implementation, the ternary content-addressable memory keyword length selection includes selecting one or more Ethernet protocol keywords to be identified for logical splicing.

[0015] In an optional implementation, the lookup in the ternary content-addressable memory through the Ethernet protocol keyword to be identified to obtain a new Ethernet message type, a protocol identifier, and an offset value of the corresponding protocol in the message includes that one lookup can obtain one or more new protocol identifiers and the corresponding Ethernet message type and offset value.

[0016] In an optional implementation, the updating of the Ethernet message type identified by the hardware-hardened message parsing module and the protocol identifier and the offset value of the corresponding protocol in the message also includes supporting replacement and addition functions.

[0017] According to a second aspect of the present application, a flexible message parsing method is provided, including:

[0018] K common Ethernet message types are identified through hardware-hardened logic, where K is an integer greater than or equal to 1;

[0019] According to the identified Ethernet message type, N bytes are selected from the message to form an Ethernet protocol key to be identified, wherein N is an integer greater than or equal to 1.

[0020] A subdivided Ethernet message type redefinition is provided, a new protocol identifier is added, and an old protocol is modified.

[0021] M ternary content address memory entries are provided, wherein M is an integer greater than or equal to 1.

[0022] Ternary content address memory key length selection is performed.

[0023] The ternary content address memory is searched through the Ethernet protocol key to be identified to obtain a new Ethernet message type, a protocol identifier, and an offset value of the corresponding protocol in the message.

[0024] According to the new Ethernet message type, the protocol identifier, and the offset value of the corresponding protocol in the message, the identified Ethernet message type and the corresponding protocol identifier and the offset value of the corresponding protocol in the message are updated.

[0025] In an optional embodiment, the subdivided Ethernet message type redefinition includes that the new Ethernet message type can contain one protocol or multiple protocols, or a combination of multiple protocols.

[0026] In an optional embodiment, the ternary content address memory key length selection includes selecting one or more Ethernet protocol keys to be identified for logical splicing.

[0027] In an optional embodiment, the searching in the ternary content address memory to obtain the new Ethernet message type, the protocol identifier, and the offset value of the corresponding protocol in the message includes that one search can obtain one or more new protocol identifiers and the corresponding Ethernet message type and offset value.

[0028] In an optional embodiment, the updating of the identified Ethernet message type and the corresponding protocol identifier and the offset value of the corresponding protocol in the message further includes supporting replacement and addition functions.

[0029] Compared with the related art, the technical scheme of the present application has at least the following advantages:

[0030] The method and device of the embodiment of the present application adopt the idea of "basic hardening and flexible expansion", save time delay and area overhead through hardening of the basic network protocol, and further expand the protocol on the basis of the basic network protocol through flexible Match-Action structure processing, so as to achieve a low-cost, low-latency, and flexible message parser architecture with certain protocol expansion and business expansion.

[0031] Other features and advantages of the present application will be set forth in the description that follows, and in part will be apparent from the description, or can be learned by practice of the application. The purposes and other advantages of the present application will be realized and attained by the structure and processes particularly pointed out in the description and appended claims. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0033] Figure 1 It is the basic Ethernet message type according to the related art.

[0034] Figure 2 It is the commonly used L2-L5 layer protocol type according to the related art.

[0035] Figure 3 It is the flexible message parser architecture block diagram according to the exemplary embodiments of the present application.

[0036] Figure 4 It is the flowchart of the flexible message parsing method according to the exemplary embodiments of the present application.

[0037] Figure 5 It is the Ethernet protocol key diagram to be identified according to the exemplary embodiments of the present application.

[0038] Figure 6 It is the Ethernet protocol structure model diagram according to the exemplary embodiments of the present application. DETAILED DESCRIPTION

[0039] In order to make the purposes, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort belong to the protection scope of the present application.

[0040] In the network, the Ethernet message is the basic unit of data transmission, such as Figure 1As shown, TCP (Transmission Control Protocol), UDP (User Datagram Protocol), ICMP (Internet Control Message Protocol), and other protocols are encapsulated in the data field of the Ethernet message. When the data of TCP, UDP, ICMP, and other protocols needs to be transmitted through the network, they will be encapsulated in the data field of the Ethernet frame. This encapsulation process allows different levels of protocols to work together to ensure that data can be accurately transmitted from the source address to the destination address. Commonly used L2-L5 layer protocol types are as follows Figure 2 As shown.

[0041] The technical terms involved in the present application are explained as follows:

[0042] Ptype: Packet Type, Ethernet message type

[0043] TCAM: Temary Content Addressable Memory, ternary content addressable memory

[0044] ID: Identification, identification

[0045] Hardware Packet Analysis: Hardware Packet Analysis

[0046] Flexible Packet Analysis: Flexible Packet Analysis

[0047] Key Builder: Key Builder

[0048] TCAM Lookup: TCAM Lookup

[0049] Match-Action structure: Match-Action structure, message lookup result analysis and running message processor structure, including Match part for message information extraction and Action part for message lookup result analysis / processing.

[0050] As Figure 3 The flexible message parser architecture block diagram of an exemplary embodiment of the present application is shown, which device consists of two parts modules:

[0051] 1. Hardware Packet Analysis module: the hardware packet analysis module is used to identify common packet protocols according to existing Ethernet protocols; since the types of common packet protocols are fixed (K types), the logical overhead of hardware analysis is relatively fixed and small.

[0052] 2. Flexible Packet Analysis module: the flexible packet analysis module is used to flexibly expand to identification of complex protocols through flexible group Key (group keyword) and table lookup on the basis of K types of Ethernet packets identified by the previous stage. The flexible packet analysis module includes the following sub-modules:

[0053] 1) Group Key sub-module: that is, the Key Builder sub-module, which extracts the key of the packet from the packet to form the Ethernet protocol key to be identified under the current Ethernet packet type;

[0054] 2) TCAM Lookup sub-module: the TCAM lookup engine extracts the key extracted by the Key Builder in the previous stage in the TCAM, and obtains a new Ptype, a new Ethernet protocol ID (Protocol ID) and a corresponding protocol offset value in the packet according to the matching result; one table lookup matching is not limited to obtaining one new Ethernet protocol ID, and N new Ethernet IDs can be obtained according to requirements, that is, one table lookup and multiple protocol identification can be achieved;

[0055] 3) Result execution sub-module: to execute the update of the new Ptype, the protocol ID and the corresponding protocol offset value in the packet, and support functions such as replacement and addition.

[0056] Firstly, the embodiment of the application provides a flexible packet analyzer device, which comprises:

[0057] a hardware packet analysis module and a flexible packet analysis module; wherein the flexible packet analysis module comprises a group Key sub-module, a ternary content addressable memory (TCAM) lookup engine sub-module and a result execution sub-module; wherein:

[0058] the hardware packet analysis module is used to identify K common Ethernet packet types Ptype through hardware hardened logic, wherein K is an integer greater than or equal to 1.

[0059] A group Key sub-module, i.e., a group Key Builder sub-module, receives an Ethernet message type Ptype identified by a hardware-hardened message analysis module, uses a Match-Action structure based on PIPELINE, and according to the identified Ptype type, selects any N bytes to form an Ethernet protocol Key to be identified, where N is an integer greater than or equal to 1.

[0060] A ternary content addressable memory lookup engine (TCAM Lookup) sub-module provides M TCAM entries, selects a TCAM Key length, and performs a lookup in a TCAM through the Ethernet protocol Key to be identified to obtain a new Ptype, a protocol ID, and a protocol offset value in a message, where M is an integer greater than or equal to 1.

[0061] In an example, the TCAM Key length selection includes selecting one or more Ethernet protocol Keys to be identified for logical splicing.

[0062] A result execution sub-module provides a subdivided Ptype redefinition, adds a new protocol ID, and modifies an old protocol, and according to the new Ptype, the protocol ID, and the protocol offset value in the message obtained by the TCAM Lookup sub-module, updates the Ptype, the protocol ID, and the protocol offset value in the message identified by the hardware-hardened message analysis module.

[0063] In an example, the subdivided Ptype redefinition includes that the new Ptype can contain one protocol or multiple protocols, or a combination of multiple protocols.

[0064] In an example, the lookup in the TCAM through the Ethernet protocol Key to be identified to obtain a new Ptype, a protocol ID, and a protocol offset value in a message includes that one lookup can obtain one or more new protocol IDs and corresponding Ptypes and offset values.

[0065] In an optional implementation, the updating of the Ptype, the protocol ID, and the protocol offset value in the message identified by the hardware-hardened message analysis module also includes support for replacement and addition functions.

[0066] Correspondingly, as shown in Figure 4 The application also provides a flexible message analysis method, which includes the following steps:

[0067] S1: Identifying K common Ethernet message types Ptype through hardware-hardened logic, where K is an integer greater than or equal to 1.

[0068] The packet analysis module hardened by hardware recognizes K kinds of commonly used Ethernet packet types, i.e. K kinds of Ptype. Since the commonly used packet protocol types are fixed, the logic overhead of hardware analysis is relatively fixed and small.

[0069] S2: Selecting N bytes to form a Key group to form an Ethernet protocol key to be identified, wherein N is an integer greater than or equal to 1.

[0070] Specifically, the Match-Action structure based on PIPELINE is used to extract the key of the packet from the packet flexibly to form the Ethernet protocol key to be identified under the current Ptype.

[0071] As shown in Figure 5 , based on the identified Ptype and the protocol type that needs to be further analyzed under the current Ptype, a new set of packet protocol identification keys is selected from the packet, so that the extracted keys can be input into the TCAM for matching, thereby realizing the identification of the new protocol type.

[0072] S3: Provide a subdivided Ptype redefinition, add a new protocol ID, and modify an old protocol.

[0073] Specifically, the new Ptype can contain one protocol or multiple protocols, or a combination of multiple protocols. For example, the current identified Ptype is an Ethernet packet in Figure 1 , a three-layer IPV4 packet containing a layer of VLAN, and the Ptype type value is defined as 0x0, and two protocol IDs are defined, wherein the protocol ID 0x0 indicates that the Ptype=0x0 packet contains a MAC protocol; the protocol ID 0x1 indicates that the Ptype=0x0 packet contains an IPV4 protocol. Therefore, when four-layer protocol analysis is required, if it is analyzed as a UDP packet, the Ptype can be defined as 0x1; if it is analyzed as a TCP packet, the Ptype can be defined as 0x2, and so on.

[0074] The addition of the new protocol ID requires adding or replacing the new protocol ID of the newly identified packet to the original protocol ID. For example, the protocol ID of the defined UDP protocol is 0x2, and the protocol ID of the TCP protocol is 0x3. At this time, the packet of Ptype = 0x1 contains a total of 3 protocols, and the protocol IDs are 0x0, 0x1, 0x2 or 0x3. If the old protocol ID that has been identified does not need to be used after a new protocol is identified, the original protocol ID can be replaced with a new protocol ID. For example, 0x2 is used to replace 0x0. The packet of Ptype = 0x1 contains a total of 2 protocols: 0x2 and 0x1, and the original protocol ID 0x0 is replaced with the new protocol ID 0x2.

[0075] S4: providing M TCAM entries, where M is an integer greater than or equal to 1.

[0076] Specifically, M TCAM entries are provided, so that flexible new protocol / new service identification can be achieved with less entry overhead. Users can determine how many layers of deep protocol parsing are required based on actual conditions, and how many physical TCAM entries are required to be built-in for table lookup.

[0077] S5: selecting a TCAM Key length.

[0078] Specifically, one or more to-be-identified Ethernet protocol keys can be selected for logical splicing. For example, as shown in the current Ethernet protocol structure model of Figure 5 , the Ethernet packet in Figure 1 contains a three-layer IPV4 packet with one layer of VLAN, and the Ptype type value is defined as 0x0. As shown in Figure 6 , if four-layer protocol content needs to be identified, 8 bits of Protocol in the three-layer IP header in the packet are first extracted to indicate the protocol ID of the four-layer protocol as "Field 1" in Figure 5 . Secondly, if it is also necessary to specify, for example, the port number after UDP or the port number after TCP to specify a specific service type, then the port based on the UDP or TCP protocol needs to be extracted as "Field 2" in Figure 5 . According to this scheme, users can also define multiple extraction "fields" according to the depth requirement of protocol identification, and splice these fields to form a new protocol lookup key (Key).

[0079] S6: searching in the TCAM through the to-be-identified Ethernet protocol key to obtain a new Ptype, a protocol ID and a protocol offset value in the packet.

[0080] Specifically, according to the TCAM lookup table, one or more Ptype, protocol ID and protocol offset value in the packet are obtained. In this way, one lookup can obtain one or more new protocol ID and corresponding Ptype and offset value.

[0081] S7: According to the new Ptype, protocol ID and corresponding protocol offset value in the packet, the Ptype identified in S1 and the corresponding protocol ID and protocol offset value in the packet are updated.

[0082] Specifically, it also includes support for replacement and new features.

[0083] It can be understood that the structures, names and parameters described in the above embodiments are only examples. Those skilled in the art can also easily think of combinations and adjustments of the structural features of the above multiple embodiments according to the use needs, and the concept of the present application should not be limited to the specific details of the above examples.

[0084] Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A flexible packet parser apparatus, characterized by, The application relates to a packet analysis module, and comprises the following: a hardware-hardened packet analysis module and a flexible packet analysis module; the hardware-hardened packet analysis module is used for identifying K common Ethernet packet types through hardware-hardened logic, wherein K is an integer greater than or equal to 1; the flexible packet analysis module comprises a group key sub-module, a ternary content address memory lookup engine sub-module and a result execution sub-module; the group key sub-module receives the Ethernet packet types identified by the hardware-hardened packet analysis module, selects N bytes from the packet according to the identified Ethernet packet types to form an Ethernet protocol key to be identified, wherein N is an integer greater than or equal to 1; the ternary content address memory lookup engine sub-module provides M ternary content address memory entries, performs ternary content address memory key length selection, and performs lookup in the ternary content address memory through the Ethernet protocol key to be identified to obtain a new Ethernet packet type, a protocol identifier and an offset value of a corresponding protocol in the packet, wherein M is an integer greater than or equal to 1; the result execution sub-module provides a subdivided Ethernet packet type redefinition, adds a new protocol identifier and modifies an old protocol, and updates the Ethernet packet types identified by the hardware-hardened packet analysis module and the corresponding protocol identifiers and offset values of the corresponding protocols in the packet according to the new Ethernet packet type, the protocol identifier and the offset value of the corresponding protocol in the packet obtained by the ternary content address memory lookup engine sub-module; the ternary content address memory key length selection comprises selecting one or more Ethernet protocol keys to be identified for logical splicing.

2. The flexible packet parser apparatus of claim 1, wherein, the subdivided Ethernet packet type redefinition comprises that the new Ethernet packet type can contain one protocol or multiple protocols or a combination of multiple protocols.

3. The flexible packet parser device of claim 1, wherein, the lookup in the ternary content address memory through the Ethernet protocol key to be identified to obtain a new Ethernet packet type, a protocol identifier and an offset value of a corresponding protocol in the packet comprises that one lookup can obtain one or more new protocol identifiers and corresponding Ethernet packet types and offset values.

4. The flexible packet parser device of claim 1, wherein, the updating of the Ethernet packet types identified by the hardware-hardened packet analysis module and the corresponding protocol identifiers and offset values of the corresponding protocols in the packet further comprises support for replacement and addition functions.

5. A flexible packet parsing method, characterized in that, The application relates to a packet analysis module, and comprises the following: identifying K common Ethernet packet types through hardware-hardened logic, wherein K is an integer greater than or equal to 1; selecting N bytes from the packet according to the identified Ethernet packet types to form an Ethernet protocol key to be identified, wherein N is an integer greater than or equal to 1; providing a subdivided Ethernet packet type redefinition, adding a new protocol identifier and modifying an old protocol; providing M ternary content address memory entries, wherein M is an integer greater than or equal to 1; performing ternary content address memory key length selection; performing lookup in the ternary content address memory through the Ethernet protocol key to be identified to obtain a new Ethernet packet type, a protocol identifier and an offset value of a corresponding protocol in the packet; According to the new Ethernet message type, the protocol identifier and the offset value of the corresponding protocol in the message, the identified Ethernet message type and the offset value of the corresponding protocol identifier and the corresponding protocol in the message are updated; The selecting of the Ternary Content-Addressable Memory (TCAM) key length includes selecting one or more Ethernet protocol keys to be identified for logical splicing.

6. The flexible packet parsing method of claim 5, wherein, The providing of the subdivided Ethernet message type redefinition includes that the new Ethernet message type can contain one protocol or multiple protocols, or a combination of multiple protocols.

7. The flexible packet parsing method of claim 5, wherein, The searching in the TCAM through the Ethernet protocol keys to be identified to obtain the new Ethernet message type, the protocol identifier and the offset value of the corresponding protocol in the message includes that one search can obtain one or more new protocol identifiers and the corresponding Ethernet message type and offset value.

8. The flexible packet parsing method of claim 5, wherein, The updating of the identified Ethernet message type and the offset value of the corresponding protocol identifier and the corresponding protocol in the message further includes supporting replacement and addition functions.

Images