A high-performance IPSEC cache management device and management method

Abstract

The application provides a high-performance IPSEC cache management device and method. The device comprises an input queue management module, a cache pool module, an IPSEC core module and an output queue management module. The method comprises: adding a first Cell containing a message header and message parsing information into a message header queue to be encrypted or decrypted by the input queue management module, and storing the remaining message content into a shared cache space of the cache pool module; performing encryption and decryption and hash operation on the message to be encrypted or decrypted by the IPSEC core module, and backfilling the encrypted and decrypted data into the shared cache of the cache pool module; and outputting the message data processed by the IPSEC core module from the cache pool module based on an output queue by the output queue management module. The technical scheme of the application realizes flexible scalability of IPSEC cache performance.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of IPSEC cache management, in particular to a high-performance IPSEC cache management device and method. BACKGROUND

[0002] IPSEC (Internet Protocol Security) is a collection of protocols and services that provide security for IP networks. Since IP packets do not integrate any security features, IP packets transmitted in public networks such as the Internet may be at risk of being forged, stolen or tampered with.

[0003] The two parties of communication establish an IPSEC tunnel through IPSEC, and IP packets are encrypted and transmitted through the IPSEC tunnel, effectively ensuring the security of data transmission in an insecure network environment such as the Internet; IPSEC implemented through a hardware encryption and decryption engine can greatly offload the computing power of the CPU, but the current commercial IP has the following problems: first, the encryption and decryption algorithm is complex, and a single acceleration engine cannot meet the growing demand for network bandwidth, and line-speed IPSEC is a challenge; second, the commonly used IPSEC architecture is a single-engine with independent packet cache, and in the case of increasing network bandwidth, the processing power of each single engine needs to be increased by adding an independent packet cache, which is costly. SUMMARY

[0004] The purpose of the present application is to provide a high-performance IPSEC cache management device and method, aiming to solve the problem of inflexible deployment of existing IPSEC.

[0005] According to the first aspect of the present application, an IPSEC cache management device is provided, comprising an input queue management module, a cache pool module, an IPSEC core module, and an output queue management module.

[0006] The input queue management module receives the parsed packets from the previous stage and inputs them into the packet queue, takes the first storage unit (Cell) containing the packet header and the packet parsing information as data, and adds it to the packet header queue to be encrypted and decrypted based on the port of the packet, and stores the remaining packet content in the shared cache space of the cache pool module.

[0007] The IPSEC core module, when detecting that it is in an idle state, sends idle resource information to the message header queue, stores the message header to be encrypted and decrypted and its corresponding message other content in the local message cache according to the scheduling of the message header and performs encryption and decryption and HASH operation on the content in the local message cache, and after processing the current storage unit, fills the encrypted data back to the shared cache of the cache pool module according to the message information indication, and initiates a data reading application operation of the next storage unit of the message to the shared cache;

[0008] The cache pool module performs the reading operation of the message content through the shared cache therein.

[0009] The output queue management module: outputs the message data after the IPSEC core module processing from the cache pool module based on the output queue.

[0010] In an optional embodiment, the receiving of the message whose previous stage analysis is completed and the input of the message queue, the first storage unit containing the message header and the message analysis information as data, and the joining of the message to the message header queue to be encrypted based on the port of the message include: setting different priorities or / and characteristic identifiers for each message queue, the message header can contain multiple storage units, and the storage units are realized in the form of a linked list.

[0011] In an optional embodiment, the IPSEC core module integrates multiple independent IPSEC encryption and decryption engines and HASH processing logic engines, and the processing capacity of each independent engine can be the same or different.

[0012] In an optional embodiment, the multiple local message caches in the IPSEC core module are used to provide a bandwidth acceleration ratio, and the multiple local message caches can be regarded as a cache as a whole.

[0013] In an optional embodiment, the shared cache in the cache pool module is composed of multiple independent cache blocks, and the multiple independent cache blocks adopt a load sharing algorithm.

[0014] According to a second aspect of the present application, a high-performance IPSEC cache management method is provided, which is applied to an IPSEC cache management device, and the IPSEC cache management device includes an input queue management module, a cache pool module, an IPSEC core module, and an output queue management module. The method includes the following steps:

[0015] The input queue management module receives the packet parsed by the previous stage and inputs the packet queue, takes the first storage unit containing the packet header and the packet parsing information as data, and adds the packet header queue to be encrypted and decrypted based on the port of the packet.

[0016] When detecting that the self is in an idle state, the IPSEC core module sends idle resource information to the packet header queue, stores the packet header to be encrypted and decrypted and the corresponding packet content in the local packet cache according to the scheduling of the packet header, and performs encryption and decryption and hash operation on the content in the local packet cache;

[0017] After processing the current storage unit, the IPSEC core module fills the encrypted data back to the shared cache of the cache pool module according to the packet information indication, and initiates a data reading application operation of the next storage unit of the packet to the shared cache.

[0018] The shared cache in the cache pool module performs the reading operation of the packet content.

[0019] The output queue management module outputs the packet data processed by the IPSEC core module from the cache pool module based on the output queue.

[0020] In an optional implementation, the receiving the packet parsed by the previous stage and inputting the packet queue, taking the first storage unit containing the packet header and the packet parsing information as data, and adding the packet header queue to be encrypted and decrypted based on the port of the packet includes: setting different priorities or / and characteristic identifiers for each packet queue, the packet header can contain multiple storage units, and the storage units are realized by in-packet chaining in the form of a linked list.

[0021] In an optional implementation, the IPSEC core module integrates multiple independent IPSEC encryption and decryption engines and hash processing logic engines, and the processing capabilities of the independent engines can be the same or different.

[0022] In an optional implementation, the multiple local packet caches in the IPSEC core module are used to provide a bandwidth acceleration ratio, and the multiple local packet caches can be regarded as a cache as a whole.

[0023] In an optional implementation, the shared cache in the cache pool module is composed of multiple independent cache blocks, and a load sharing algorithm is used between the multiple independent cache blocks.

[0024] Compared with the related art, the technical scheme of the present application has at least the following advantages:

[0025] The device and method of the embodiment of the present application adopt independent IPSEC core modules, and embed a message cache to be processed. Since the IPSEC core modules are independent of other control units, the performance scalability is high. All the IPSEC core modules share a cache, thereby saving cache overhead. A plurality of groups of mechanisms and a load balancing operation of idle addresses among the groups are adopted, so that the utilization rate of group bandwidth can be repeatedly improved. Moreover, the IPSEC processing unit and the cache management unit based on cells can realize T-level data bandwidth throughput by expanding the cell size and the ingress / egress bit width.

[0026] Other features and advantages of the present application will be set forth in the following description, and in part will be apparent from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and attained by the structure and processes particularly pointed out in the description and the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the embodiment or related art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0028] Figure 1 is a schematic diagram of IPSEC communication according to the related art.

[0029] Figure 2 is a flexible message parser architecture block diagram according to an exemplary embodiment of the present application.

[0030] Figure 3 is a flowchart of a flexible message parsing method according to an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purposes, technical solutions and advantages of the embodiments of the present application more clear, the following will combine the drawings in the embodiments of the present application to clearly and completely explain the technical solutions in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort are within the protection scope of the present application.

[0032] IPSEC is a set of open network security protocols formulated by IETF (Internet Engineering Task Force, International Internet Engineering Task Force), such as Figure 1As shown, at the IP layer, data source authentication, data encryption, data integrity, and anti-replay functions are used to ensure the security of data transmitted between communicating parties on the Internet.

[0033] like Figure 2 As shown in the illustration, this application provides an exemplary IPSEC cache management device, which comprises the following modules:

[0034] Input queue management module, buffer pool module, IPSEC core module, output queue management module;

[0035] 1. Input Queue Management Module: This module receives messages parsed by the previous layer and enqueues and dequeues the input messages, as well as manages queues based on dimensions such as port.

[0036] 2. Cache pool module: Used for storing input messages and managing cache resources.

[0037] 3. IPSEC Core Module: Integrates multiple IPSEC encryption / decryption and hash processing logics.

[0038] 4. Output Queue Management Module: Output queue management is used to output the packet data processed by the IPSEC core module from the buffer pool module based on the output queue.

[0039] Specifically:

[0040] The input queue management module receives parsed messages from the previous stage and manages them by enqueuing, dequeuing, and managing queues based on dimensions such as port. Since data is organized in different queues, each queue may have different priorities or characteristics. Queues allow for flexible management of data priorities and characteristics. The input queue management module receives parsed messages from the previous stage and inputs them into the message queue. It takes the first cell containing the message header and the message parsing information as data, adds it to the message header queue (to be encrypted / decrypted) based on the message's port, and stores the remaining message content in the shared cache space of the cache pool module. Specifically, different priorities and / or queue identifiers are set for each message queue.

[0041] Cell is a fixed-length storage unit. A message can be divided into multiple Cells for storage. For example, a 513-byte message with a Cell storage granularity of 128 bytes requires 5 Cells for message storage.

[0042] The queue data structure includes: the first cell data in the message header, the message length, the address of the nextpointer in the cell linked list within the message, and the key ID of the key used for encryption and decryption.

[0043] The packet header can contain multiple Cells, and the Cells are connected by a chain table. When the packet header is enqueued, the address of the next Cell is enqueued together with the packet information. Thus, the Cells in the packet can be taken out one by one through the Cell chain in the packet.

[0044] Specifically, different priorities or / and characteristic identifiers can be set for each packet queue.

[0045] The IPSEC core module integrates multiple IPSEC encryption and decryption and hash processing logic. When it is detected that the IPSEC core module is in an idle state, the idle resource information is sent to the packet header queue. According to the scheduling of the packet header, the packet header to be encrypted and decrypted and the corresponding packet content are stored in the local packet Cache in the form of Cell, and the content in the local packet Cache is encrypted and decrypted and hashed. After the current Cell is processed, the encrypted and decrypted data is filled back to the shared cache of the cache pool module according to the packet information indication, and the data reading application operation of the next Cell of the packet is initiated to the shared cache. For example, in the case of supporting the AES algorithm [Advanced Encryption Standard, i.e. a symmetric encryption algorithm published by the National Institute of Standards and Technology (NIST) of the United States in 2001, i.e. the same key is used for encryption and decryption], each IPSEC core module supports N Gbps performance. Therefore, in the case of using 10 IPSEC core modules, the performance of 10*N Gbps can be supported. Specifically, when the IPSEC core module encrypts and decrypts and hashes the content in the local packet Cache, the current IPSEC core module is set to a working state.

[0046] The multiple local packet Caches in the IPSEC core module are used to provide the acceleration ratio of the bandwidth, and the multiple local packet Caches can be regarded as a whole as a cache.

[0047] Of course, multiple performance different processing logic can also be combined to further realize the convenience of performance expansion of the IPSEC core module. Through the use of IPSEC core processing performance modules with different algorithms, such as supporting the DES (Data Encryption Standard) encryption algorithm, the IPSEC core module supports M Gbps performance. Therefore, in the case of using 10 IPSEC cores supporting DES, the performance of 10*M Gbps can be supported. In combination with the above example, the total performance of 10*N+10*M Gbps can be supported, in which the AES encryption algorithm can support 10*N Gbps, and the DES encryption algorithm can support 10*M Gbps.

[0048] The cache pool module is used for packet storage of input packets and resource management of the cache. When a packet enters the IPSEC engine, the cache is needed to store the packet locally, waiting for the IPSEC core module to perform encryption and decryption and hash processing on the packet; at the same time, the data processed by the IPSEC core module is backfilled, that is, the data of the source packet is updated, and is also stored in the same cache. After the IPSEC core module processing is completed, the packet is read from the cache according to the exit scheduling, and the processed packet data is output. Specifically, when allocating shared cache storage space for new incoming packets, the idle resources of the independent physical cache are checked in real time, and the most idle physical cache resources are selected for storage.

[0049] The cache pool module performs read operations on the content of the packet through the shared cache therein. The plurality of independent cache blocks in the shared cache form a cache group, and the plurality of independent cache groups adopt a load sharing algorithm. Through the multi-group form, the cache bandwidth is expanded from 1x bandwidth to Nx bandwidth to cope with the packet read operation initiated by multiple IPSEC cores, and the load sharing operation scheduling is performed between the multiple groups.

[0050] Specifically, when allocating shared cache storage space for new incoming packets, the idle resources of the independent physical cache are checked in real time, and the most idle physical cache resources are selected for storage.

[0051] The output queue management module: the packet data processed by the IPSEC core module is output from the cache pool module based on the output queue.

[0052] Correspondingly, as shown in Figure 3 The present application embodiment exemplarily provides a high-performance IPSEC cache management method applied to an IPSEC cache management device, the IPSEC cache management device comprising an input queue management module, a cache pool module, an IPSEC core module, and an output queue management module; the method comprises the following steps:

[0053] Step 301: The input queue management module receives the packet parsed by the previous stage and inputs the packet queue, takes the first Cell containing the packet header and the packet parsing information as data, and adds the packet header to the to-be-encrypted packet header queue based on the port of the packet, and stores the remaining packet content in the shared cache space of the cache pool module.

[0054] Among them, Cell is a fixed-length storage unit, and one packet can be divided into multiple Cells for storage; for example, a 513 Byte packet, the storage granularity of Cell is 128 Byte, and 5 Cells are needed for packet storage.

[0055] The queue data structure includes: the first Cell data of the packet header, the packet length, the next pointer address of the Cell list in the packet, the key ID of the key used for encryption and decryption, and the like.

[0056] The packet header can include multiple Cells, and the Cells are connected in a list form. When the packet header is enqueued, the next Cell list address is enqueued together with the packet information. Thus, each Cell in the packet can be taken out one by one through the Cell list in the packet.

[0057] Specifically, different priorities or / and characteristic identifiers can be set for each packet queue.

[0058] In step 302, when it is detected that the IPSEC core module is in an idle state, the idle resource information is sent to the packet header queue by the IPSEC core module. According to the scheduling of the packet header, the packet header to be encrypted and decrypted and the corresponding other contents of the packet are stored in the local packet Cache in the form of Cell, and the contents in the local packet Cache are encrypted and decrypted and hashed.

[0059] Specifically, when the IPSEC core module encrypts and decrypts and hashes the contents in the local packet Cache, the current IPSEC core module is set to a working state.

[0060] The multiple local packet Caches in the IPSEC core module are used to provide an acceleration ratio of bandwidth, and the multiple local packet Caches are regarded as a cache as a whole.

[0061] Specifically, multiple independent IPSEC encryption and decryption engines and hash processing engines are integrated in the IPSEC core module. Each engine has the same processing thread and processing capacity. For example, in the case of supporting the AES algorithm, X ASE encryption and decryption engines are set in each IPSEC core module, and the performance of N Gbps is supported. In the case of using 10 IPSEC core modules, the performance of 10*N Gbps can be supported.

[0062] Of course, a plurality of processing logic engines with different processing performance can also be combined to further realize the convenience of performance expansion of the IPSEC core module. By using IPSEC core processing performance modules with different algorithms, such as supporting the DES (Data Encryption Standard) encryption algorithm, the IPSEC core module supports a performance of 10*M Gbps. In the case of using 10 IPSEC cores supporting DES, the performance can be supported to 10*M Gbps. In combination with the above example, the total performance can be supported to 10*N+10*M Gbps, where the AES encryption algorithm can be supported to 10*N Gbps, and the DES encryption algorithm can be supported to 10*M Gbps.

[0063] Step 303: After processing the current Cell, the IPSEC core module fills the encrypted and decrypted data back into the shared cache of the cache pool module according to the message information indication, and initiates a data reading application operation of the next Cell of the message to the shared cache.

[0064] Step 304: Perform the reading operation of the message content through the shared cache in the cache pool module.

[0065] Specifically, when allocating storage space of the shared cache to the new message, the idle resources of the independent physical cache are checked in real time, and the most idle physical cache resources are selected for storage.

[0066] Step 305: The message data processed by the IPSEC core module is output from the cache pool module based on the output queue by the output queue management module.

[0067] Specifically, the shared cache in the cache pool module is composed of a plurality of independent cache blocks, and a load sharing algorithm is used between the plurality of independent cache blocks.

[0068] It can be understood that the structures, names and parameters described in the above embodiments are only examples. Those skilled in the art can also easily combine and adjust the structural features of the above multiple embodiments according to the use needs, and the concept of the present application should not be limited to the specific details of the above examples.

[0069] Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An IPSEC cache management device, comprising an input queue management module, a cache pool module, an IPSEC core module, and an output queue management module; characterized in that, The input queue management module receives the parsed messages from the previous stage and inputs them into the message queue. It takes the first storage unit containing the message header and the message parsing information as data, adds it to the message header queue to be encrypted and decrypted based on the message port, and stores the remaining message content in the shared cache space of the cache pool module. When the IPSEC core module detects that it is in an idle state, it sends idle resource information to the packet header queue. According to the packet header scheduling, it stores the packet header to be encrypted / decrypted and its corresponding other packet content into the local packet cache according to the storage unit, and performs encryption / decryption and hash operations on the content in the local packet cache. After processing the current storage unit, according to the packet information indication, it fills the encrypted / decrypted data back into the shared cache of the cache pool module, and initiates a data read request operation for the next storage unit of the packet to the shared cache. The cache pool module performs message content reading operations through its shared cache; The output queue management module outputs the packet data processed by the IPSEC core module from the cache pool module based on the output queue.

2. The IPSEC cache management device according to claim 1, characterized in that, The process of receiving the parsed message from the previous stage and inputting it into the message queue, taking the first storage unit containing the message header and the message parsing information as data, and adding it to the message header queue to be encrypted and decrypted based on the message port includes: setting different priorities and / or characteristic identifiers for each message queue, wherein the message header may contain multiple storage units, and the storage units are linked together in the form of a linked list within the packet.

3. The IPSEC cache management device according to claim 1, characterized in that, The IPSEC core module integrates multiple independent IPSEC encryption / decryption engines and hash processing logic engines, and the processing capabilities of each independent engine may be the same or different.

4. The IPSEC cache management device according to claim 1, characterized in that, The multiple local packet caches in the IPSEC core module are used to provide a bandwidth speedup, and the multiple local packet caches can be regarded as a whole as a high-speed cache.

5. The IPSEC cache management device according to claim 1, characterized in that, The shared cache in the cache pool module consists of multiple independent cache groups, and the multiple independent cache groups adopt a load-sharing algorithm.

6. A high-performance IPSEC cache management method, applied to an IPSEC cache management device, the IPSEC cache management device comprising an input queue management module, a cache pool module, an IPSEC core module, and an output queue management module; Its features are, include: The input queue management module receives the parsed message from the previous stage and inputs it into the message queue. The first storage unit containing the message header and the message parsing information are used as data and added to the message header queue to be encrypted and decrypted based on the port of the message. The remaining message content is stored in the shared cache space of the cache pool module. When it detects that it is in an idle state, the IPSEC core module sends idle resource information to the packet header queue. According to the packet header scheduling, the packet header to be encrypted and decrypted and its corresponding other packet content are stored in the local packet cache according to the storage unit, and the contents in the local packet cache are encrypted, decrypted and hashed. After processing the current storage unit, the IPSEC core module fills the encrypted and decrypted data back into the shared cache of the cache pool module according to the message information, and initiates a data read request operation for the next storage unit of the message to the shared cache. The message content is read through the shared cache in the cache pool module; The output queue management module outputs the packet data processed by the IPSEC core module from the cache pool module based on the output queue.

7. The IPSEC cache management method according to claim 6, characterized in that, The process of receiving the parsed message from the previous stage and inputting it into the message queue, taking the first storage unit containing the message header and the message parsing information as data, and adding it to the message header queue to be encrypted and decrypted based on the message port includes: setting different priorities and / or characteristic identifiers for each message queue, wherein the message header may contain multiple storage units, and the storage units are linked together in the form of a linked list within the packet.

8. The IPSEC cache management method according to claim 6, characterized in that, The IPSEC core module integrates multiple independent IPSEC encryption / decryption engines and hash processing logic engines, and the processing capabilities of each independent engine may be the same or different.

9. The IPSEC cache management method according to claim 6, characterized in that, The multiple local packet caches in the IPSEC core module are used to provide a bandwidth speedup, and the multiple local packet caches can be regarded as a whole as a high-speed cache.

10. The IPSEC cache management method according to claim 6, characterized in that, The shared cache in the cache pool module consists of multiple independent cache blocks, and the multiple independent cache blocks adopt a load-sharing algorithm.

Images