Network card with network message processing function

Abstract

The invention relates to the technical field of electronic information application, in particular to a network card with a network message processing function. Comprising an upper computer interface, a multi-channel DMA module, a strategy storage module, a network message processing module, a storage data processing module, a network interface and a storage interface. The multi-channel DMA module comprises a configuration channel, a network input channel, a network output channel, a storage write-in channel, a storage read channel and a storage instruction channel. The strategy storage module is connected with the configuration channel, the network message processing module is connected with the network input channel and the network output channel, the storage data processing module is connected among the storage write-in channel, the storage read channel, the storage instruction channel and the storage interface, and the storage data processing module is also connected with the network message processing module. According to the invention, the network card has the functions of message classification, message security detection and storage direct connection and intercommunication, so that the processing pressure of the CPU on the network message is shared, and the load of the CPU is reduced.

Description

Technical Field

[0001] The invention relates to the technical field of electronic information application, in particular to a network card with a network message processing function. Background Art

[0002] In the process of computer network communication, traditional network cards are responsible for the work of the physical layer and the link layer, while the key to testing performance lies in the CPU's heavy processing tasks at the network layer and above.

[0003] The CPU not only needs to parse and classify network messages, but also needs to perform security checks to ensure the legitimacy and security of the messages. This series of processing processes puts a huge load on the CPU in network communications. What is more worth mentioning is that the CPU's parallel processing capabilities are limited, and its processing pressure becomes more and more significant when faced with a large number of concurrent tasks. Especially when processing malformed messages, error messages, or potential attack messages, the CPU not only needs to mobilize more resources for identification and defense, but may also trigger additional security mechanisms, further increasing its processing burden. Summary of the invention

[0004] In view of the defects of the prior art, the present invention provides a network card with a network message processing function, aiming to share the processing pressure of the CPU on the network message and reduce the load of the CPU.

[0005] In order to solve the technical problem, the technical solution adopted by the present invention is: a network card with network message processing function, including a host computer interface, a multi-channel DMA module, a policy storage module, a network message processing module, a storage data processing module, a network interface and a storage interface; The host computer is connected to the multi-channel DMA module through the host computer interface to realize the communication between the host computer and the network card; The multi-channel DMA module includes a configuration channel, multiple network input channels, multiple network output channels, a storage write channel, a storage read channel, and a storage instruction channel; The policy storage module is connected to the configuration channel and is used to store the initial policy sent by the host computer to the network card; the initial policy includes classification policy, security policy and interface policy. The classification policy determines the final destination of the network input message, that is, the received network message is written into different network input channels or directly into the storage medium connected to the storage interface according to the classification policy. The security policy refers to the determination of whether the current message is allowed to pass according to the security policy after parsing the network input message. The interface policy determines the type of network communication to be enabled. The network message processing module includes a message input processing module and a message output processing module. The network interface is connected to the network input channel through the message input processing module to transmit the processed network message to the host computer. The network output channel is connected to the network interface through the message output processing module to realize the host computer to transmit the message to be sent to the network card. The storage data processing module is connected between the storage write channel, the storage read channel, the storage instruction channel and the storage interface, and the storage interface is connected to the storage medium, so that the host computer can write data to the storage medium or read data from the storage medium through the network card, and realize the storage-related instruction intercommunication between the host computer and the network card; The storage data processing module is also connected to the network message processing module, and is used to enable the network card to directly write data to the storage medium or read data from the storage medium.

[0006] Furthermore, the message input processing module includes a network input queue, a network input security detection unit and a network input classification unit. The input end of the network input queue is connected to the network interface, and is used to store the messages of the network interface into a cache queue. The input end of the network input security detection unit is connected to the output end of the network input queue, and is used to parse and filter the messages output by the network input queue, and execute pass or discard operations on the messages according to the security policy. The input end of the network input classification unit is connected to the output end of the network input security detection unit, and the output end of the network input classification unit is connected to the network input channel or the storage data processing module, and is used to send the processed messages to the corresponding network input channel or the storage data processing module according to the classification strategy.

[0007] Furthermore, after the network input security detection unit parses and filters the network message, if the current message is a fragmented message, the network message is reassembled and then fragmented according to the maximum transmission unit of the host computer interface.

[0008] Furthermore, the message output processing module includes a network output queue, a network output encapsulation unit and a network output classification unit. The network output queue is connected to the network output channel or the storage data processing module, and is used to store the messages transmitted from the network output channel or the storage data processing module into the cache queue. The input end of the network output encapsulation unit is connected to the output end of the network output queue, and is used to perform network message encapsulation on the messages output by the network output queue. The input end of the network output classification unit is connected to the output end of the network output encapsulation unit, and the output end of the network output classification unit is connected to the network interface, and is used to send the network output messages to the corresponding network interface according to the classification strategy.

[0009] Further, the storage data processing module includes a storage write queue, a storage write processing unit, a storage read queue, a storage read processing unit and a storage instruction queue; The input end of the storage write queue is connected to the storage write channel or the message input processing module. The user receives the message written by the host computer through the storage write channel or the message input by the network interface through the message input processing module, and stores the message in the cache queue. The input end of the storage write processing unit is connected to the output end of the storage write queue. The output end of the storage write processing unit is connected to the storage interface. The storage write processing unit encrypts the data in the message output by the storage write queue and then stores the encrypted data in the storage medium connected to the storage interface. The input end of the storage read processing unit is connected to the storage interface, and is used to read data from the storage medium connected to the storage interface, decrypt the data, and then encapsulate it into a message. The input end of the storage read queue is connected to the output end of the storage read processing unit, and the output end of the storage read queue is connected to the storage read channel or the message output processing module, and is used to encapsulate the data output by the storage read queue into a message and send it to the host computer through the storage read channel or send it to the network interface through the message output processing module.

[0010] Furthermore, the network interface includes an Ethernet electrical port, a WiFi module interface, and a 5G module interface, and the interface strategy supports opening a single or multiple network interfaces at the same time. Network input messages can be received simultaneously through one or more network forms, and specific network output messages can be sent through a specific network form.

[0011] Furthermore, the multi-channel DMA module, the policy storage module, the network message processing module, and the storage data processing module are implemented based on FPGA.

[0012] Furthermore, the user configures the initial strategy through the host computer, and the initial strategy configured by the user has the highest priority, and the configured strategy is optimized through reinforcement learning.

[0013] Furthermore, the host computer interface is a Thunderbolt interface.

[0014] Furthermore, the storage interface is an NVMe interface, and the NVMe interface is connected to the hard disk.

[0015] Beneficial effects of the present invention: (1) The network card classifies the messages according to the configured classification strategy. The CPU in the host computer can directly read the network input messages classified according to the classification strategy from different DMA channels, avoiding the CPU load overhead caused by message classification.

[0016] (2) The network card parses and filters the message according to the configured security policy, avoiding the CPU load overhead caused by filtering the message.

[0017] (3) The network card directly writes the data portion of the network input message specified by the configured classification strategy to the storage medium, avoiding the CPU load overhead caused by data transfer and instruction control.

[0018] (4) The network card directly sends the designated storage data through the network via the storage instruction, thus avoiding the CPU load overhead caused by data transfer and instruction control.

[0019] (5) Compatible with three network forms, it can receive network input messages through one or more network forms at the same time, and can choose to send specific network output messages through a specific network form, which is flexible in application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a principle block diagram of the network card described in Example 1. DETAILED DESCRIPTION

[0021] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0022] Example 1 This embodiment discloses a network card with a network message processing function, such as Figure 1 As shown, it includes a host computer interface, a multi-channel DMA module, a policy storage module, a network message processing module, a storage data processing module, a network interface and a storage interface.

[0023] The host computer interface is a thunderbolt interface, which is used to realize the interactive communication between the host computer and the network card. The network interface includes Ethernet electrical port, 5G module interface and WiFi module interface, and the storage interface is an NVMe interface for connecting the hard disk. The above interfaces are all implemented using interface modules.

[0024] In this embodiment, the multi-channel DMA module, the policy storage module, the network message processing module, and the storage data processing module are all implemented based on FPGA, with FPGA as the core device. The specific introduction of each module is as follows: The multi-channel DMA module based on the Thunderbolt interface in the FPGA is divided into 1 configuration channel, n network message input channels (n is an integer greater than or equal to 1), 3 network message output channels (adjustable according to the network interface), 1 storage read channel, 1 storage write channel, and 1 storage instruction channel through the joint action of the FPGA and the host computer. Among them, the configuration channel is used for the host computer to send the initial strategy to the network card, including classification strategy, security strategy, and interface strategy; the network message input channel is used for the network card to transmit processed network messages to the host computer, and the correspondence between the message and the network message input channel is determined by the classification strategy; the network message output channel is used for the host computer to transmit the message to be sent to the network card, and the 3 network message output channels correspond to the 3 network interfaces (Ethernet electrical port, 5G network, and WIFI network) respectively; the storage write channel is used for the host computer to write the data to be stored in the NVMe storage to the network card; the storage read channel is used for the host computer to read the data in the NVMe storage from the network card; the storage instruction channel is used for the host computer and the network card to communicate instruction information.

[0025] The policy storage module is connected to the configuration channel, and is used to store the initial policy sent by the host computer to the network card into the policy storage module; the initial policy includes classification policy, security policy and interface policy. The classification policy determines the final destination of the network input message, that is, the received network message is written into different network input channels or directly written into the storage medium connected to the storage interface according to the classification policy. The security policy refers to the determination of whether the current message is allowed to pass according to the security policy after parsing the network input message. The interface policy determines the type of network communication enabled, including 5G network, WIFI network, Ethernet electrical port, and supports the use of 3 networks at the same time or a single network, or two of them. In this embodiment, the user can configure the above-mentioned policy through the host computer, and the user's configuration has the highest priority. At the same time, this method also introduces reinforcement learning technology, which continuously optimizes the user's configuration policy based on reinforcement learning, and makes judgments for the parts that the user policy does not cover according to the execution results and feedback of the policy.

[0026] The network message processing module includes a message input processing module and a message output processing module. The network interface is connected to the network input channel through the message input processing module to transmit the processed network message to the host computer. The network output channel is connected to the network interface through the message output processing module to realize the host computer to transmit the message to be sent to the network card.

[0027] Specifically, the message input processing module includes a network input queue, a network input security detection unit and a network input classification unit. The input end of the network input queue is connected to the network interface, and is used to store the messages of the network interface into the cache queue. The input end of the network input security detection unit is connected to the output end of the network input queue, and is used to parse and filter the messages output by the network input queue, and perform pass or discard operations on the messages according to the security policy. If the current message is a fragmented message, the network message is reassembled and then fragmented according to the MTU (maximum transmission unit) of the upper computer interface. The input end of the network input classification unit is connected to the output end of the network input security detection unit, and the output end of the network input classification unit is connected to the network input channel or the storage data processing module, and is used to send the processed messages to the corresponding network input channel or the storage data processing module according to the classification strategy.

[0028] The message output processing module includes a network output queue, a network output encapsulation unit and a network output classification unit. The network output queue is connected to the network output channel or the storage data processing module, and is used to store the messages transmitted from the network output channel or the storage data processing module into the cache queue. The input end of the network output encapsulation unit is connected to the output end of the network output queue, and is used to encapsulate the messages output by the network output queue. The input end of the network output classification unit is connected to the output end of the network output encapsulation unit, and the output end of the network output classification unit is connected to the network interface, and is used to send the network output message to the corresponding network interface (Ethernet electrical port, 5G network interface, WIFI network interface) according to the classification strategy.

[0029] The storage data processing module is connected between the storage write channel, the storage read channel, the storage instruction channel and the storage interface. The storage interface is connected to the storage medium, so that the host computer can write data to the storage medium or read data from the storage medium through the network card, and realize the command communication between the host computer and the network card; at the same time, the storage data processing module is also connected to the network message processing module, which is used to realize the network card directly write data to the storage medium or read data from the storage medium.

[0030] Specifically, the storage data processing module includes a storage write queue, a storage write processing unit, a storage read queue, a storage read processing unit and a storage instruction queue. The input end of the storage write queue is connected to the storage write channel or the message input processing module, and is used to receive the message written by the host computer through the storage write channel or the message input by the network interface through the message input processing module, and store the message in the cache queue, the input end of the storage write processing unit is connected to the output end of the storage write queue, the output end of the storage write processing unit is connected to the storage interface, the storage write processing unit encrypts the data in the message output by the storage write queue and then stores the encrypted data in the storage medium connected to the storage interface; the input end of the storage read processing unit is connected to the storage interface, and is used to read data from the storage medium connected to the storage interface, decrypt the data and encapsulate it into a message, the input end of the storage read queue is connected to the output end of the storage read processing unit, and the output end of the storage read queue is connected to the storage read channel or the message output processing module, and is used to store the data output by the storage read queue in the cache queue and send it to the host computer through the storage read channel or to the network interface through the message output processing module.

[0031] The key technologies involved in this embodiment include: message classification, writing the received network messages into different DMA channels according to the classification strategy issued by the CPU, so that the CPU can reduce most of the operations such as message parsing and classification; at the same time, classification is performed according to the strategy and has a certain degree of flexibility.

[0032] For network message processing, the network card automatically performs in-depth analysis on network messages and filters messages according to the security policies issued by the host computer. At the same time, AI-based policy management is introduced to continuously improve the initial security policies based on historical data.

[0033] The direct connection between the network card and the storage can be interconnected. Users can select certain types of messages that meet the requirements by issuing classification policies, and directly write them into the NVMe storage in the network card by the FPGA. If such messages are not received within a certain period of time, the FPGA sends a message to the CPU to inform the length and starting address of the data written to the hard disk. At the same time, the CPU can send a message to inform the FPGA to read these data from the hard disk for transmission. This mechanism can avoid the full participation of the CPU in the storage of network data, reducing the burden on the CPU.

[0034] Based on AI policy management, the strategies in the present invention mainly include interface strategy, classification strategy, security strategy, etc. Interface strategy refers to the type of network communication that is enabled, including 5G, WiFi, and Ethernet electrical port, and 3 can be selected for use at the same time. Classification strategy refers to the processing of network input messages, including writing to a matching DMA channel or writing to NVMe storage. Security policy refers to what kind of processing is done on the message. Users can configure the above strategies according to their needs, and continuously optimize the strategies based on AI. By using technologies such as reinforcement learning, the system can adjust the policy parameters according to the execution results and feedback of the strategy to improve the effectiveness of the strategy.

[0035] Multiple network communication modes communicate in parallel. Thanks to the parallel processing capability of FPGA and the high-speed communication capability of Thunderbolt interface, the present invention realizes the synchronous transmission and reception of three interfaces, namely 5G network, WIFI network, and Ethernet electrical port. The three network output channels in the multi-channel DMA module of the present invention can realize one-to-one correspondence with three interfaces, namely 5G network, WIFI network, and Ethernet electrical port. Users can send messages through different network interfaces by selecting the network output channel in the DMA channel. At the same time, instructions can be issued through the storage instruction channel in the multi-DMA channel to inform the network card device through which network interface to send the read storage data.

[0036] The data transmission process based on this network card includes: network input message transmission process (upload DMA channel): (1) The network input queue receives the network input message (source is 5G, WIFI, Ethernet electrical port); (2) The network input security detection unit performs in-depth analysis and filtering of the message format of the current message according to the security policy sent by the host computer, and reorganizes the fragmented message, discards the message that does not comply with the security policy, and sends the message that meets the requirements to the network input classification unit; (3) The network input classification unit queries the classification strategy for the current message. If the result shows that the multi-channel DMA module is uploaded, the message is written to the corresponding DMA network input channel; (4) The network input channel sends the message to the host computer through the Thunderbolt interface.

[0037] Network input message transmission process (write to storage): (1) The network input queue receives the network input message (source is 5G, WIFI, Ethernet electrical port); (2) The network input security detection unit performs in-depth analysis and filtering of the message format of the current message according to the security policy issued by the host computer, and reorganizes the fragmented messages, discards the messages that do not comply with the security policy, and sends the messages that meet the requirements to the network input message classification module; (3) The network input classification unit queries the classification policy for the current message. If the result shows that it is written to storage, the message is sent to the storage write queue; (4) The storage write queue sends the message to the storage write processing unit; (5) The storage write processing unit performs a secondary analysis of the message, encrypts the data in the message, and then writes it to the NVMe storage.

[0038] Network output message transmission process (DMA channel sent): (1) The host computer sends the message to the corresponding network output channel through the Thunderbolt interface; (2) The message in the network output channel is written into the network output queue; (3) The network output queue sends the message to the network output encapsulation unit; (4) The network output encapsulation unit encapsulates the message and then sends it to the network output classification unit; (5) The network output classification unit sends the message to the corresponding network interface (Ethernet electrical port, 5G network, WIFI network).

[0039] The host computer writes data to the storage: (1) The host computer sends a message encapsulated with data to the storage write channel through the Thunderbolt interface; (2) The storage write channel sends the message to the storage write queue; (3) The storage write queue sends the message to the storage write processing unit; (4) The storage write processing unit encrypts the data in the message and writes the encrypted data to the NVMe storage.

[0040] The host computer reads data from the storage: (1) The host computer sends instructions to the storage command channel through the Thunderbolt interface, telling the network card which interface to use, the address of the storage data to send, and the necessary message encapsulation information; (2) The storage command queue stores and parses the instruction information; (3) The storage read processing unit reads and decrypts the NVMe data, then encapsulates the decrypted data into a message and writes it to the storage read queue; (4) The storage read queue sends the message to the storage read channel; (5) The storage read channel sends the message to the host computer through the Thunderbolt interface.

[0041] The data in the storage is sent directly through the network: (1) The host computer sends instructions to the storage instruction channel through the Thunderbolt interface, telling the network card which interface to use, the address of the storage data to send, and the necessary message encapsulation information; (2) The storage instruction queue stores and parses the instruction information; (3) The storage read processing unit reads and decrypts the NVMe data, then encapsulates the decrypted data into a message and writes it to the storage read queue; (4) The storage read queue sends the message to the network output queue; (5) The network output queue sends the message to the network output encapsulation unit; (6) The network output encapsulation unit encapsulates the message into a network message and then sends it to the network output classification unit; (7) The network output classification unit sends the message to the corresponding network interface (Ethernet electrical port, 5G network, WIFI network).

[0042] The above description includes both data and messages. In this application, the relationship between data and messages is: data is the payload part encapsulated in the message.

[0043] The above-mentioned shard reorganization is a conventional technical means in this field, and its specific implementation method can be found in existing materials and will not be repeated here.

[0044] The above description is only the basic principle and preferred embodiments of the present invention. Improvements and substitutions made by those skilled in the art based on the present invention belong to the protection scope of the present invention.

Claims

1. A network card with network message processing function, characterized in that: It includes host computer interface, multi-channel DMA module, policy storage module, network message processing module, storage data processing module, network interface and storage interface; The host computer is connected to the multi-channel DMA module through the host computer interface to realize the communication between the host computer and the network card; The multi-channel DMA module includes a configuration channel, multiple network input channels, multiple network output channels, a storage write channel, a storage read channel, and a storage instruction channel; The policy storage module is connected to the configuration channel and is used to store the initial policy sent by the host computer to the network card; The initial strategy includes classification strategy, security strategy and interface strategy. The classification strategy determines the final destination of the network input message, that is, the received network message is written into different network input channels or directly into the storage medium connected to the storage interface according to the classification strategy. The security strategy refers to the determination of whether the current message is allowed to pass according to the security strategy after parsing the network input message. The interface strategy determines the type of network communication to be enabled. The network message processing module includes a message input processing module and a message output processing module. The network interface is connected to the network input channel through the message input processing module to transmit the processed network message to the host computer. The network output channel is connected to the network interface through the message output processing module to realize the host computer to transmit the message to be sent to the network card. The storage data processing module is connected between the storage write channel, the storage read channel, the storage instruction channel and the storage interface, and the storage interface is connected to the storage medium, so that the host computer can write data to the storage medium or read data from the storage medium through the network card, and realize the storage-related instruction intercommunication between the host computer and the network card; The storage data processing module is also connected to the network message processing module, and is used to enable the network card to directly write data to the storage medium or read data from the storage medium.

2. The network card with network message processing function according to claim 1, characterized in that: The message input processing module includes a network input queue, a network input security detection unit and a network input classification unit. The input end of the network input queue is connected to the network interface and is used to store the messages of the network interface into a cache queue. The input end of the network input security detection unit is connected to the output end of the network input queue and is used to parse and filter the messages output by the network input queue and perform pass or discard operations on the messages according to the security policy. The input end of the network input classification unit is connected to the output end of the network input security detection unit. The output end of the network input classification unit is connected to the network input channel or the storage data processing module and is used to send the processed messages to the corresponding network input channel or the storage data processing module according to the classification policy.

3. The network card with network message processing function according to claim 2, characterized in that: After the network input security detection unit parses and filters the network message, if the current message is a fragmented message, the network message is reassembled and then fragmented according to the maximum transmission unit of the host computer interface.

4. The network card with network message processing function according to claim 1, characterized in that: The message output processing module includes a network output queue, a network output encapsulation unit and a network output classification unit. The network output queue is connected to the network output channel or the storage data processing module, and is used to store the messages transmitted from the network output channel or the storage data processing module into the cache queue. The input end of the network output encapsulation unit is connected to the output end of the network output queue, and is used to encapsulate the messages output by the network output queue. The input end of the network output classification unit is connected to the output end of the network output encapsulation unit, and the output end of the network output classification unit is connected to the network interface, and is used to send the network output message to the corresponding network interface according to the classification strategy.

5. The network card with network message processing function according to claim 1, characterized in that: the storage data processing module includes a storage write queue, a storage write processing unit, a storage read queue, a storage read processing unit and a storage instruction queue; The input end of the storage write queue is connected to the storage write channel or the message input processing module, and is used to receive the message written by the host computer through the storage write channel or the message input by the network interface through the message input processing module, and store the message in the cache queue. The input end of the storage write processing unit is connected to the output end of the storage write queue, and the output end of the storage write processing unit is connected to the storage interface. The storage write processing unit encrypts the data in the output message of the storage write queue and then stores the encrypted data in the storage medium connected to the storage interface. The input end of the storage read processing unit is connected to the storage interface, and is used to read data from the storage medium connected to the storage interface, decrypt it, and then encapsulate it into a message. The input end of the storage read queue is connected to the output end of the storage read processing unit, and the output end of the storage read queue is connected to the storage read channel or the message output processing module. The data output by the storage read queue is encapsulated as a message and sent to the host computer through the storage read channel or sent to the network interface through the message output processing module.

6. The network card with network message processing function according to claim 1, characterized in that: Network interfaces include Ethernet electrical ports, WiFi module interfaces, and 5G module interfaces. Interface policies support enabling a single or multiple network interfaces at the same time.

7. The network card with network message processing function according to claim 1, characterized in that: The multi-channel DMA module, policy storage module, network message processing module and storage data processing module are implemented based on FPGA.

8. The network card with network message processing function according to claim 1, characterized in that: The user configures the initial strategy through the host computer, and the initial strategy configured by the user has the highest priority. At the same time, the configured strategy is optimized through reinforcement learning.

9. The network card with network message processing function according to claim 1, characterized in that: The host computer interface is a Thunderbolt interface.

10. The network card with network message processing function according to claim 1, characterized in that: The storage interface is an NVMe interface, which is connected to the hard disk.

Images