High-performance IPSEC cache management device and management method

Abstract

The invention provides a high-performance IPSEC cache management device and management method. The device comprises an input queue management module, a cache pool module, an IPSEC core module and an output queue management module. The method comprises the following steps of: adding a first Cell containing a message header and message analysis information into a message header queue to be encrypted and decrypted by an input queue management module, and storing other message contents into a shared cache space of a cache pool module; the IPSEC core module performs encryption, decryption and Hash operation on a message to be encrypted and decrypted, and backfills the encrypted and decrypted data into a shared cache of the cache pool module; and the output queue management module outputs the message data processed by the IPSEC core module from the cache pool module based on the output queue. According to the technical scheme, flexible expansibility of IPSEC cache performance is achieved.

Description

Technical Field

[0001] The present application relates to the technical field of IPSEC cache management, and in particular to a high-performance IPSEC cache management device and management method. Background Art

[0002] IPSEC (Internet Protocol Security) is a collection of protocols and services that provide security for IP networks. Since IP packets themselves do not integrate any security features, IP data packets may be at risk of being forged, stolen, or tampered with when transmitted in public networks such as the Internet.

[0003] The communicating parties establish an IPSEC tunnel through IPSEC, and IP data packets are encrypted and transmitted through the IPSEC tunnel, which effectively ensures the security of data transmission in an insecure network environment such as the Internet; IPSEC implemented by a hardware encryption and decryption engine can greatly unload the computing power of the CPU, but the current commercial IP has the following problems: First, the encryption and decryption algorithms are complex, and a single acceleration engine cannot meet the growing network bandwidth requirements, and line-speed IPSEC is a challenge; second, the common IPSEC architecture is a single engine with an independent message cache. When the network bandwidth increases, each increase in the processing power of a single engine requires an increase in an independent message cache, which is costly. Summary of the invention

[0004] The purpose of this application is to provide a high-performance IPSEC cache management device and method, aiming to solve the problem that the existing IPSEC deployment is not flexible enough.

[0005] According to a first aspect of the present application, there is provided an IPSEC cache management device, comprising an input queue management module, a cache pool module, an IPSEC core module, and an output queue management module;

[0006] The input queue management module receives the message parsed by the previous stage and inputs it into the message queue, takes the first storage unit (Cell) containing the message header and the message parsing information as data, adds it to the message header queue to be encrypted and decrypted based on the port of the message, and stores the rest of the message content into the shared cache space of the cache pool module;

[0007] The IPSEC core module, when detecting that it is in an idle state, sends idle resource information to the message header queue, stores the message header to be encrypted and other contents of the message corresponding to it into the local message cache (Cache) according to the scheduling of the message header, and performs encryption and decryption and hash operation (HASH operation, used for discrete calculation of data) on the contents in the local message cache; and after processing the current storage unit, according to the indication of the message information, fills the encrypted and decrypted data back into the shared cache of the cache pool module, and initiates a data read application operation of the next storage unit of the message to the shared cache;

[0008] The buffer pool module performs a message content reading operation through a shared buffer therein;

[0009] The output queue management module outputs the message data processed by the IPSEC core module from the buffer pool module based on the output queue.

[0010] In an optional implementation, the message that has been parsed by the previous stage is received and input into a message queue, and the first storage unit containing the message header and the message parsing information are used as data, and added to the message header queue to be encrypted and decrypted based on the port of the message, including: setting different priorities and / or characteristic identifiers for each message queue, and the message header may contain multiple storage units, and the storage units are linked within the packet in the form of a linked list.

[0011] In an optional implementation, the IPSEC core module integrates multiple independent IPSEC encryption and decryption engines and hash processing logic engines, and the processing capabilities of the independent engines may be the same or different.

[0012] In an optional implementation, the multiple local message caches in the IPSEC core module are used to provide a bandwidth acceleration ratio, and the multiple local message caches can be regarded as a high-speed cache as a whole.

[0013] In an optional implementation, the shared cache in the cache pool module is composed of a plurality of independent cache groups, and a load sharing algorithm is adopted between the plurality of independent cache groups.

[0014] According to a second aspect of the present application, a high-performance IPSEC cache management method is provided, which is applied to an IPSEC cache management device, wherein the IPSEC cache management device comprises an input queue management module, a cache pool module, an IPSEC core module, and an output queue management module; the method comprises the following steps:

[0015] The input queue management module receives the message that has been parsed by the previous stage and inputs it into the message queue. The first storage unit containing the message header and the message parsing information are used as data and added to the message header queue to be encrypted and decrypted based on the port of the message. The rest of the message content is stored in the shared cache space of the cache pool module.

[0016] When it is detected that the IPSEC core module is in an idle state, the idle resource information is sent to the message header queue by the IPSEC core module, and according to the scheduling of the message header, the message header to be encrypted and decrypted and other contents of the corresponding message are stored in the local message cache according to the storage unit, and the contents in the local message cache are encrypted, decrypted and hashed;

[0017] After processing the current storage unit, the IPSEC core module will fill the encrypted and decrypted data back into the shared cache of the cache pool module according to the message information, and initiate a data read request operation for the next storage unit of the message to the shared cache;

[0018] The message content is read through the shared cache in the cache pool module;

[0019] The output queue management module outputs the message data processed by the IPSEC core module from the buffer pool module based on the output queue.

[0020] In an optional implementation, the message that has been parsed by the previous stage is received and input into a message queue, and the first storage unit containing the message header and the message parsing information are used as data, and added to the message header queue to be encrypted and decrypted based on the port of the message, including: setting different priorities and / or characteristic identifiers for each message queue, and the message header may contain multiple storage units, and the storage units are linked in the packet in the form of a linked list.

[0021] In an optional implementation, the IPSEC core module integrates multiple independent IPSEC encryption and decryption engines and hash processing logic engines, and the processing capabilities of each independent engine may be the same or different.

[0022] In an optional implementation, the multiple local message caches in the IPSEC core module are used to provide a bandwidth acceleration ratio, and the multiple local message caches can be regarded as a high-speed cache as a whole.

[0023] In an optional implementation, the shared cache in the cache pool module is composed of a plurality of independent cache groups, and a load sharing algorithm is adopted between the plurality of independent cache groups.

[0024] Compared with the related art, the technical solution of the present application has at least the following advantages:

[0025] The device and method of the embodiment of the present application adopt an independent IPSEC core module with a built-in cache of messages to be processed. Since the IPSEC core module is independent of other control units, the performance scalability is high; all IPSEC core modules share a cache, saving cache overhead; a multi-group mechanism plus load balancing operations of free addresses between multiple groups can repeatedly improve the utilization of group bandwidth; and based on the Cell's IPSEC processing unit and cache management unit, a T-level data bandwidth throughput can be achieved by expanding the Cell size and the ingress and egress bit width.

[0026] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained through the structures and processes indicated in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. It is obvious that the drawings described below are certain embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0028] Figure 1 It is a schematic diagram of using IPSEC communication according to the relevant technology.

[0029] Figure 2 It is a block diagram of the flexible message parser architecture according to an exemplary embodiment of the present application.

[0030] Figure 3 It is a flowchart of a flexible message parsing method according to an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] IPSEC is a set of open network security protocols developed by IETF (Internet Engineering Task Force). Figure 1As shown in the figure, at the IP layer, data source authentication, data encryption, data integrity and anti-replay functions are used to ensure the security of data transmission between the communicating parties on the Internet.

[0033] like Figure 2 As shown, the embodiment of the present application exemplarily provides an IPSEC cache management device, which is composed of the following modules:

[0034] Input queue management module, buffer pool module, IPSEC core module, output queue management module;

[0035] 1. Input queue management module: used to receive the messages parsed by the previous stage and queue and dequeue the input messages, as well as manage the queues based on dimensions such as ports.

[0036] 2. Cache pool module: used for message storage of input messages and cache resource management.

[0037] 3.IPSEC core module: integrates multiple IPSEC encryption, decryption and hash processing logic.

[0038] 4. Output queue management module: Output queue management is used to output the message data processed by the IPSEC core module from the buffer pool module based on the output queue.

[0039] Specific:

[0040] The input queue management module is used to receive the message that has been parsed by the previous stage and put the input message into the queue, dequeue the message, and manage the queue based on dimensions such as ports. Since the data is organized in different queues, each queue may have different priorities or characteristics. Flexible management of data priority and data characteristics can be achieved through queues. The input queue management module receives the message that has been parsed by the previous stage and inputs it into the message queue. It takes the first Cell containing the message header and the message parsing information as data, and adds it to the message header queue to be encrypted and decrypted based on the port of the message. The remaining message content is stored in the shared cache space of the cache pool module. Specifically, different priorities and / or queue identifiers are set for each message queue.

[0041] Among them, Cell is a storage unit of fixed length, and a message can be divided into multiple Cells for storage; for example, for a 513-Byte message, the storage granularity of Cell is 128 Byte, and 5 Cells are required to store the message.

[0042] The queue data structure includes: the first Cell data of the message header, the message length, the next pointer address of the Cell linked list in the message, the key ID of the key used for encryption and decryption, etc.

[0043] The message header may contain multiple cells, and the cells are linked in the packet in the form of a linked list. When the message header is queued, the linked list address of the next cell is queued together with the message information. In this way, each cell in the message can be taken out one by one through the cell chain in the message.

[0044] Specifically, a different priority and / or characteristic identifier may be set for each message queue.

[0045] The IPSEC core module integrates multiple IPSEC encryption, decryption and hash processing logics. When it detects that it is in an idle state, it sends idle resource information to the message header queue. According to the scheduling of the message header, the message header to be encrypted and decrypted and the corresponding message content are stored in the local message cache according to the cell, and the content in the local message cache is encrypted, decrypted and hashed; and after processing the current cell, according to the message information indication, the encrypted and decrypted data is backfilled into the shared cache of the cache pool module, and the data read application operation of the next cell of the message is initiated to the shared cache. For example, in the case of supporting the AES algorithm [Advanced Encryption Standard, a symmetric encryption algorithm released by the National Institute of Standards and Technology (NIST) of the United States in 2001, that is, encryption and decryption use the same key], each IPSEC core module supports N Gbps performance, then in the case of using 10 IPSEC core modules, it can support 10*N Gbps performance. Specifically, when the IPSEC core module performs encryption, decryption and hash operations on the content in the local message Cache, the current IPSEC core module is set to a working state.

[0046] Among them, multiple local message caches in the IPSEC core module are used to provide bandwidth acceleration ratio, and the multiple local message caches can be regarded as a high-speed cache as a whole.

[0047] Of course, multiple processing logics with different performances can also be combined to further realize the convenience of IPSEC core module performance expansion. By using IPSEC core processing performance modules with different algorithms, for example, when supporting the DES (Data Encryption Standard) encryption algorithm, the IPSEC core module supports M Gbps performance. In the case of using 10 IPSEC cores supporting DES, IA can support 10*M Gbps performance; combined with the above example, it can support a total performance of 10*N+10*M Gbps, where the AES encryption algorithm can support 10*N Gbps and the DES encryption algorithm can support 10*M Gbps.

[0048] The cache pool module is used for message storage of input messages and cache resource management. When a message enters the IPSEC engine, a cache is required to store the message locally, waiting for the IPSEC core module to encrypt, decrypt and hash the message; at the same time, the data encrypted and decrypted by the IPSEC core module is backfilled, that is, the data of the source message is updated, which is also stored in the same cache. After the IPSEC core module completes the processing, the message data is read from the cache and output according to the export scheduling. Specifically, when allocating shared cache storage space to new incoming messages, the free resources of the independent physical cache are checked in real time, and the resources of the most idle physical cache are selected for storage.

[0049] The cache pool module performs the reading operation of the message content through the shared cache. Multiple independent cache blocks in the shared cache form a cache group, and a load sharing algorithm is adopted between multiple independent cache groups. Through the form of multiple groups, the cache bandwidth is expanded from 1x bandwidth to Nx bandwidth to cope with the data packet reading operation initiated by multiple IPSEC cores, and the operation scheduling using load sharing is performed between multiple groups.

[0050] Specifically, when allocating storage space of the shared cache to a newly-incoming message, the idle resources of the independent physical cache are checked in real time, and the resources of the idlest physical cache are selected for storage.

[0051] Output queue management module: Outputs the message data processed by the IPSEC core module from the buffer pool module based on the output queue.

[0052] Accordingly, if Figure 3 As shown, the embodiment of the present application exemplarily provides a high-performance IPSEC cache management method, which is applied to an IPSEC cache management device, wherein the IPSEC cache management device includes an input queue management module, a cache pool module, an IPSEC core module, and an output queue management module; the method includes the following steps:

[0053] Step 301: The input queue management module receives the message that has been parsed in the previous stage and inputs it into the message queue. The first Cell containing the message header and the message parsing information are used as data and added to the message header queue to be encrypted and decrypted based on the port of the message. The remaining message content is stored in the shared cache space of the cache pool module.

[0054] Among them, Cell is a storage unit of fixed length, and a message can be divided into multiple Cells for storage; for example, for a 513-byte message, the storage granularity of Cell is 128 bytes, and 5 Cells are required to store the message.

[0055] The queue data structure includes: the first Cell data of the message header, the message length, the next pointer address of the Cell linked list in the message, the key ID of the key used for encryption and decryption, etc.

[0056] The message header may contain multiple cells, and the cells are linked in the packet in the form of a linked list. When the message header is queued, the linked list address of the next cell is queued together with the message information. In this way, each cell in the message can be taken out one by one through the cell chain in the message.

[0057] Specifically, a different priority and / or characteristic identifier may be set for each message queue.

[0058] Step 302: When it is detected that it is in an idle state, the IPSEC core module sends idle resource information to the message header queue, and according to the scheduling of the message header, stores the message header to be encrypted and decrypted and its corresponding message other contents into the local message cache according to the cell, and encrypts, decrypts and hashes the contents in the local message cache.

[0059] Specifically, when the IPSEC core module performs encryption, decryption and hash operations on the content in the local message Cache, the current IPSEC core module is set to a working state.

[0060] Among them, multiple local message caches in the IPSEC core module are used to provide bandwidth acceleration ratio, and the multiple local message caches are regarded as a high-speed cache as a whole.

[0061] Specifically, the IPSEC core module integrates multiple independent IPSEC encryption and decryption engines and hash processing engines. Each engine has the same processing thread and processing power: for example, in the case of supporting the AES algorithm, each IPSEC core module is provided with X ASE encryption and decryption engines, supporting N Gbps performance, then in the case of using 10 IPSEC core modules, it can support 10*N Gbps performance.

[0062] Of course, multiple processing logic engines with different processing performance can also be combined to further realize the convenience of IPSEC core module performance expansion. By using IPSEC core processing performance modules with different algorithms, for example, when supporting the DES (Data Encryption Standard) encryption algorithm, the IPSEC core module supports M Gbps performance, then when using 10 IPSEC cores supporting DES IA (Identification Authentication), it can support 10*M Gbps performance; combined with the above example, it can support a total performance of 10*N+10*M Gbps, of which the AES encryption algorithm can support 10*N Gbps and the DES encryption algorithm can support 10*M Gbps.

[0063] Step 303: After processing the current Cell, the IPSEC core module fills the encrypted and decrypted data back into the shared cache of the cache pool module according to the message information instruction, and initiates a data read request operation of the next Cell of the message to the shared cache.

[0064] Step 304: Execute a reading operation of the message content through the shared cache in the cache pool module.

[0065] Specifically, when allocating storage space of the shared cache to a newly-incoming message, the idle resources of the independent physical cache are checked in real time, and the resources of the idlest physical cache are selected for storage.

[0066] Step 305: The output queue management module outputs the message data processed by the IPSEC core module from the buffer pool module based on the output queue.

[0067] Specifically, the shared cache in the cache pool module is composed of a plurality of independent cache groups, and a load sharing algorithm is adopted between the plurality of independent cache groups.

[0068] It is understood that the structures, names and parameters described in the above embodiments are only examples. Those skilled in the art can also easily think of combinations and adjustments to the structural features of the above embodiments according to the use requirements, and should not limit the concept of the present application to the specific details of the above examples.

[0069] Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that he or she may still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An IPSEC cache management device, comprising an input queue management module, a cache pool module, an IPSEC core module and an output queue management module; characterized in that: The input queue management module receives the message parsed by the previous stage and inputs it into the message queue, takes the first storage unit containing the message header and the message parsing information as data, adds it to the message header queue to be encrypted and decrypted based on the port of the message, and stores the rest of the message content into the shared cache space of the cache pool module; The IPSEC core module, when detecting that it is in an idle state, sends idle resource information to the message header queue, stores the message header to be encrypted and other contents of the message corresponding to it into the local message cache according to the scheduling of the message header, and performs encryption, decryption and hash operations on the contents in the local message cache; and after processing the current storage unit, according to the indication of the message information, fills the encrypted and decrypted data back into the shared cache of the cache pool module, and initiates a data read application operation of the next storage unit of the message to the shared cache; The buffer pool module performs a message content reading operation through a shared buffer therein; The output queue management module outputs the message data processed by the IPSEC core module from the buffer pool module based on the output queue.

2. The IPSEC cache management device according to claim 1, characterized in that: The method comprises: setting different priorities and / or characteristic identifiers for each message queue, wherein the message header may contain multiple storage units, and the storage units are linked in a packet in the form of a linked list.

3. The IPSEC cache management device according to claim 1, characterized in that: The IPSEC core module integrates multiple independent IPSEC encryption and decryption engines and hash processing logic engines, and the processing capabilities of each independent engine can be the same or different.

4. The IPSEC cache management device according to claim 1, characterized in that: The multiple local message caches in the IPSEC core module are used to provide bandwidth acceleration ratio, and the multiple local message caches can be regarded as a high-speed cache as a whole.

5. The IPSEC cache management device according to claim 1, characterized in that: The shared cache in the cache pool module is composed of a plurality of independent cache groups, and a load sharing algorithm is adopted between the plurality of independent cache groups.

6. A high-performance IPSEC cache management method, applied to an IPSEC cache management device, wherein the IPSEC cache management device comprises an input queue management module, a cache pool module, an IPSEC core module and an output queue management module; It is characterized in that include: The input queue management module receives the message parsed by the previous stage and inputs it into the message queue, takes the first storage unit containing the message header and the message parsing information as data, adds it to the message header queue to be encrypted and decrypted based on the port of the message, and stores the rest of the message content into the shared cache space of the cache pool module; When it is detected that the IPSEC core module is in an idle state, the idle resource information is sent to the message header queue by the IPSEC core module, and according to the scheduling of the message header, the message header to be encrypted and decrypted and other contents of the corresponding message are stored in the local message cache according to the storage unit, and the contents in the local message cache are encrypted, decrypted and hashed; After processing the current storage unit, the IPSEC core module fills the encrypted and decrypted data back into the shared cache of the cache pool module according to the message information instruction, and initiates a data read request operation of the next storage unit of the message to the shared cache; The message content is read through the shared cache in the cache pool module; The output queue management module outputs the message data processed by the IPSEC core module from the buffer pool module based on the output queue.

7. The IPSEC cache management method according to claim 6, characterized in that: The method comprises: setting different priorities and / or characteristic identifiers for each message queue, wherein the message header may contain multiple storage units, and the storage units are linked in a packet in the form of a linked list.

8. The IPSEC cache management method according to claim 6, characterized in that: The IPSEC core module integrates multiple independent IPSEC encryption and decryption engines and hash processing logic engines, and the processing capabilities of each independent engine can be the same or different.

9. The IPSEC cache management method according to claim 6, characterized in that: The multiple local message caches in the IPSEC core module are used to provide bandwidth acceleration ratio, and the multiple local message caches can be regarded as a high-speed cache as a whole.

10. The IPSEC cache management method according to claim 6, characterized in that: The shared cache in the cache pool module is composed of a plurality of independent cache groups, and a load sharing algorithm is adopted between the plurality of independent cache groups.

Images