A parsing method for an efficient programmable network protocol parser

Abstract

The present invention relates to the field of network communication technology, and in particular to a parsing method of an efficient programmable network protocol parser. The method comprises configuring or dynamically adjusting the sliding window length of the parser based on the field position of the data packet; in the sliding window matching process, the parser performs a mask operation on the data in the sliding window, and compares the numerical values ​​of the fields in the sliding window; after the sliding window matching is successful, the parser modifies the data packet content according to preset rules. The present invention solves the problems of poor flexibility, insufficient complex matching capability, and inability to modify the data packet content in the prior art through a flexible sliding window matching mechanism, mask matching, size comparison, and data packet modification method.

Description

Technical Field

[0001] The present invention relates to the technical field of network communication, and in particular to a parsing method of a network protocol parser. Background Art

[0002] With the rapid development of network communication technology, there are many types of network protocols, and network equipment needs to be able to parse and process data packets of multiple protocols. Traditional parsers often implement parsing logic through hardware solidification, which is difficult to adapt to dynamically changing network needs, and requires hardware replacement to support new protocols, resulting in high costs and poor flexibility. Although the parsers in the prior art have certain programmability, they still have limitations in sliding window matching, mask matching, and flexible modification of data packets, making it difficult to meet the efficient processing requirements for protocol parsing in complex network environments. Summary of the invention

[0003] The purpose of the present invention is to provide a parsing method of an efficient programmable network protocol parser to solve the above technical problems;

[0004] The technical problem solved by the present invention can be achieved by adopting the following technical solutions:

[0005] A parsing method of an efficient programmable network protocol parser, comprising:

[0006] Configure or dynamically adjust the parser's sliding window length based on the field position of the data packet;

[0007] During the sliding window matching process, the parser performs a mask operation on the data in the sliding window and compares the numerical values ​​of the fields in the sliding window;

[0008] After the sliding window matches successfully, the parser modifies the data packet content according to preset rules.

[0009] Preferably, the sliding window length that can be dynamically configured by the parser includes at least:

[0010] 8-bit sliding window, used to match single-byte fields;

[0011] 16-bit sliding window, used to match double-byte fields;

[0012] 32-bit sliding window, used to match the first complex protocol field;

[0013] 64-bit sliding window, used to match the second most complex protocol field;

[0014] 128-bit sliding window, used to match the third complex protocol field.

[0015] Preferably, the parser starts from the header of the data packet and gradually slides according to the configured sliding window length to match the data packet.

[0016] Preferably, the sliding window length of the parser is dynamically adjusted during the parsing process according to changes in the field format of the data packet corresponding to the encountered network protocol.

[0017] Preferably, the network protocol includes at least IPv4 protocol and IPv6 protocol.

[0018] Preferably, the method by which the parser performs a mask operation on the data in the sliding window is to perform an ignore match or a fuzzy match on at least a portion of the preset bits.

[0019] Preferably, the parser performs mask operations by configuring mask values.

[0020] Preferably, after the sliding window of the parser is positioned at a specific field, the value of the field in the sliding window is read and the numerical value is compared with a preset condition.

[0021] Preferably, the preset conditions include thresholds for identifying data packet length and sequence numbers.

[0022] Preferably, after a successful match, the parser modifies the data packet to include the source address, the destination address and the protocol type.

[0023] Beneficial effects of the present invention: Due to the adoption of the above technical scheme, the present invention solves the problems of poor flexibility, insufficient complex matching capability and inability to modify data packet content existing in the prior art through flexible sliding window matching mechanism, mask matching, size comparison and data packet modification method. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a schematic diagram of sliding window matching in an embodiment of the present invention;

[0025] Figure 2 A flowchart of the steps of the analysis method in an embodiment of the present invention;

[0026] Figure 3 This is a schematic diagram of the parser header structure in an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the middle structure of the parser in an embodiment of the present invention;

[0028] Figure 5 Schematic diagram of the main structure of the parser in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0031] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but they are not intended to limit the present invention.

[0032] A parsing method for an efficient programmable network protocol parser, such as Figure 1 , Figure 2 As shown, including

[0033] Configure or dynamically adjust the parser's sliding window length based on the field position of the data packet;

[0034] During the sliding window matching process, the parser performs mask operations on the data in the sliding window and compares the numerical values ​​of the fields in the sliding window;

[0035] After the sliding window matches successfully, the parser modifies the data packet content according to the preset rules.

[0036] The present invention provides a function of configuring parsing rules through software, and the user can dynamically modify the working mode of the parser according to different network protocol requirements, avoiding the limitations brought by hardware-fixed parsing rules and being able to quickly adapt to changes and updates of the protocol.

[0037] The present invention uses a sliding window matching mechanism to enable the parser to process data packets of different lengths and structures and adapt to changes in protocol header and field lengths, thereby improving the parser's compatibility with multiple protocol formats.

[0038] The present invention provides complex matching functions such as MASK mask matching and numerical value comparison, and supports more sophisticated control and processing of specific bits or fields in data packets, thereby adapting to diverse protocol matching requirements, and is particularly suitable for complex network protocol scenarios.

[0039] By adopting a programmable configuration method, the present invention avoids the need for frequent hardware upgrades, reduces development and maintenance costs, and at the same time enables the parser to support multiple network protocols and application scenarios, with higher scalability and adaptability.

[0040] The sliding window matching of the present invention is as follows Figure 1As shown in the figure, below the packet header, multiple sliding window lengths are illustrated, including 16 bits, 32 bits, 64 bits, and 128 bits. Each sliding window length is pointed to the packet header with an arrow, indicating that the sliding window slides on the packet header for matching operations. The arrows point to different positions, showing that sliding windows of different lengths slide and match multiple times on the packet.

[0041] The present invention can flexibly match protocol fields of different lengths by automatically adjusting the sliding window length sliding on the data packet, thereby realizing the parsing of the network protocol. In this way, the parser can adapt to multiple protocol formats and improve the flexibility of parsing.

[0042] In a preferred embodiment, the sliding window length that can be dynamically configured by the parser includes at least:

[0043] 8-bit sliding window, used to match single-byte fields;

[0044] 16-bit sliding window, used to match double-byte fields;

[0045] 32-bit sliding window, used to match the first complex protocol field;

[0046] 64-bit sliding window, used to match the second most complex protocol field;

[0047] 128-bit sliding window, used to match the third complex protocol field.

[0048] Specifically, most of the existing network protocol parsers are based on hardware-fixed designs, and the parsing rules are pre-defined during the design, which makes it difficult to dynamically adjust according to actual application needs. If you need to support new protocols or modify existing protocol rules, you often need to replace the hardware or reprogram it, which not only increases the development and maintenance costs of the equipment, but also slows down the adaptation to new network protocols.

[0049] Traditional network equipment relies on hardware to implement parsing functions, and the parsing rules are directly written into the hardware logic. Once the design is completed, it cannot be easily changed. Although this method has advantages in performance, in an environment where network protocols are rapidly evolving, the rigid rules limit the flexibility of the system.

[0050] The present invention provides a function of configuring parsing rules through software, and the user can dynamically modify the working mode of the parser according to different network protocol requirements, avoiding the limitations brought by hardware-fixed parsing rules and being able to quickly adapt to changes and updates of the protocol.

[0051] The present invention uses a sliding window matching mechanism to enable the parser to process data packets of different lengths and structures and adapt to changes in protocol header and field lengths, thereby improving the parser's compatibility with multiple protocol formats.

[0052] The parser of the present invention supports a variety of sliding window lengths, including 8-bit, 16-bit, 32-bit, 64-bit and 128-bit sliding window matching mechanisms.

[0053] The sliding window length can be dynamically adjusted according to the different requirements of the network protocol to ensure flexible parsing of various fields in different protocol headers.

[0054] For example, some protocols require parsing of 8-bit fields, while other protocols may require 32-bit or longer field matching. The present invention enables the sliding window length to flexibly adapt to changes in the protocol through programmable configuration.

[0055] 8-bit sliding window: used to accurately match single-byte fields, commonly used in matching identifiers or status fields.

[0056] 16-bit sliding window: supports double-byte matching and is applicable to protocol fields that require double bytes, such as source port and destination port.

[0057] 32-bit sliding window: Suitable for more complex protocol fields, such as IPv4 addresses or the checksum field of some packets.

[0058] 64-bit sliding window: supports matching larger fields, such as IPv6 addresses or sequence numbers of large packets.

[0059] 128-bit sliding window: used for protocols with higher complexity, such as encryption fields or processing of fragmented packets.

[0060] In a preferred embodiment, the parser starts from the header of the data packet and gradually slides according to the configured sliding window length to match the data packet.

[0061] In a preferred embodiment, the sliding window length of the parser is dynamically adjusted during the parsing process according to changes in the field format of the data packet corresponding to the encountered network protocol.

[0062] Specifically, the programmable network protocol parser of the present invention solves the problems of poor flexibility, insufficient complex matching capability and inability to modify data packet content in the prior art through a flexible sliding window matching mechanism, mask matching, size comparison and data packet modification functions.

[0063] By supporting multiple sliding window lengths (8 bits, 16 bits, 32 bits, 64 bits, 128 bits), the parser can flexibly respond to the needs of various network protocols and adapt to changes in different protocol formats.

[0064] Users can dynamically adjust the sliding window length according to actual application needs, so as to quickly adapt to new protocols and format changes. This greatly improves the applicability of the parser in a rapidly changing network environment and enables rapid adaptation to emerging protocols.

[0065] In the test, by adjusting the sliding window length, the parser was able to increase the parsing success rate to more than 95% when processing complex protocol data packets, while the success rate of fixed sliding window parsers in the prior art is usually only around 70%.

[0066] In a preferred embodiment, the network protocol includes at least IPv4 protocol and IPv6 protocol.

[0067] Specifically, users can configure different sliding window lengths through software and flexibly set them according to the requirements of the protocol.

[0068] The parser starts from the header of the data packet and gradually slides according to the configured sliding window length to match the data packet.

[0069] The sliding window length can be automatically adjusted according to the different fields during the parsing process to ensure that it adapts to changes in the protocol header or field length.

[0070] For example, a 128-bit sliding window can be used when parsing the IPv6 protocol, while a 32-bit sliding window is used when parsing IPv4, which greatly improves the flexibility of the parser.

[0071] In a preferred embodiment, the method by which the parser performs a mask operation on the data in the sliding window is to perform an ignore match or a fuzzy match on at least a portion of the preset bits.

[0072] In a preferred embodiment, the parser performs mask operations by configuring mask values.

[0073] Specifically, sliding window matching is not limited to direct matching of fixed field positions, and the present invention combines a mask matching function. The parser can perform a mask operation on the data in the sliding window to match only key information.

[0074] For example, when processing a 32-bit IPv4 address, the sliding window can ignore some bits through the mask and only match the first 24 bits, while the lower 8 bits can be flexibly changed. Mask matching enhances the flexibility of the parser and allows partial fields to be ignored or fuzzy matched in the protocol.

[0075] In a preferred embodiment, after the sliding window of the parser is positioned at a specific field, the value of the field in the sliding window is read and the numerical value is compared with a preset condition.

[0076] The present invention enables the parser to perform more sophisticated matching operations by supporting MASK mask matching and size comparison functions.

[0077] Users can configure mask values ​​according to the specific needs of the protocol and focus only on key information, thereby improving the accuracy and efficiency of matching. The size comparison matching function can determine whether specific conditions are met based on the packet field value, further enhancing the function of the parser.

[0078] In practical applications, the use of mask matching parsers can effectively improve the data packet matching speed when processing IPv4 / IPv6 protocols, reducing the processing time by about 30%, while reducing the error rate and increasing the accuracy to 98%.

[0079] In a preferred embodiment, the preset condition includes a threshold value for identifying a data packet length and a sequence number.

[0080] Specifically, the present invention supports the function of combining sliding window matching with size comparison matching. In the sliding window matching process, the parser can compare the numerical values ​​of the fields in the sliding window to determine whether they meet certain conditions.

[0081] After the sliding window matches the packet length field, the parser can compare the field value with the set threshold to determine whether the packet is too large or too small, and decide on further processing operations accordingly. This function is applicable to the judgment of fields such as packet length and sequence number.

[0082] In a preferred embodiment, after a successful match, the parser modifies the data packet to include the source address, destination address, and protocol type.

[0083] The present invention solves the problem that the existing parser cannot modify the content of the data packet after matching, and allows specific fields or content in the data packet to be modified according to the rules after a successful match. It is suitable for scenarios such as protocol conversion and field update, and enhances the parser's ability to process network data.

[0084] Specifically, when the sliding window matches successfully, the parser can modify the data packet content according to preset rules.

[0085] After matching a specific protocol header field, you can modify the destination address or source address, etc. This packet modification function is suitable for scenarios such as protocol conversion and address rewriting, and improves the processing capabilities of network devices in dynamic environments.

[0086] Specifically, after a successful match, the parser can modify the data packet according to the configuration rules, such as modifying the source address, destination address or protocol type, etc. This function provides technical support for applications such as protocol conversion and address rewriting, making network devices more flexible and capable during data transmission.

[0087] In the Network Address Translation (NAT) scenario, the parser is able to modify the packet content in real time with a success rate of over 98%, effectively reducing the packet loss problem caused by address translation.

[0088] The present invention adopts modular architecture design, and the sliding window matching module works together with the mask matching and size comparison modules. Through modular design, the parser can flexibly combine different functional modules to adapt to various protocol requirements. Through software management and configuration between the modules, operations such as sliding window matching, mask matching and data modification can be performed simultaneously to ensure the high efficiency of data packet processing.

[0089] Since the present invention uses software programmable mode to replace the hardware fixed parsing logic, the parser can adapt to new protocols through software updates without changing the hardware, thereby significantly reducing development and maintenance costs. Equipment manufacturers can support multiple protocols through simple software upgrades, reducing dependence on expensive hardware upgrades.

[0090] By implementing programmable resolvers, enterprises can save approximately 40% of their budget on equipment updates and maintenance costs.

[0091] The present invention realizes efficient data processing in a high-traffic network environment by combining software and hardware, and the parser can maintain fast matching and modification capabilities when processing large-scale data packets.

[0092] The organizational structure of the programmable protocol parser used in the present invention is divided into three parts, namely the header (RuleHeader), the middle (Rule Offset) and the body (Rule Body). The specific structure is as follows Figures 3 to 5 As shown,

[0093] Figure 3 This is a diagram of the header structure, where the first column indicates the size, followed by the bit position from 0 to 31, and the last column indicates the offset;

[0094] The figure shows the configuration of different bits in the protocol analyzer to adapt to different network protocols. The present invention adjusts the sliding window length of the analyzer in this way, and the analyzer can flexibly process and analyze various network protocols, including

[0095] 1* indicates 8-bit adaptation is enabled;

[0096] 2* indicates 16-bit adaptation is enabled;

[0097] 3* indicates 32-bit adaptation is enabled;

[0098] 4* indicates 64-bit adaptation is enabled;

[0099] 5* indicates 128-bit adaptation is enabled.

[0100] Figure 4 A diagram showing the middle structure, wherein the first column indicates size, 0 to 31 indicate bit positions, and the last column indicates offset; under the "Size" column, there are multiple tags, for example, when the size is 4, there are "OM_8_0", "OM_8_1", "OM_8_2", "OM_8_3", and the corresponding offsets are 0 respectively, and the tags and offsets are used to locate and process data blocks of different lengths when parsing the protocol, so that the parser of the present invention can flexibly process various protocol formats.

[0101] Specifically, Figure 5 A diagram showing a main structure with an offset column and a column of numbers from 0 to 159, indicating bit positions.

[0102] Figure 5 The marks in, such as OM_128_0.MASK.L, OM_128_0.VALUE.L, etc., represent the mask (MASK) and value (VALUE) operation in the 128-bit operation mode, and are divided into left and right parts (L and H). By setting different masks and values, the present invention can achieve accurate matching of specific protocol fields.

[0103] Specific embodiment 1,

[0104] In some network protocols, the position of a specific field in a data packet may change with the protocol version, so the parser needs to flexibly adjust the matching window length. In this embodiment, the sliding window matching module specifies the sliding window length through software configuration, for example, the sliding window is configured to be 16 bytes long, and the parser starts from the first byte of the data packet and slides 16 bytes each time until the target data is matched.

[0105] For example, in the header parsing of the TCP / IP protocol, if you want to find the "source port number" field, you can configure the sliding window to slide 16 bytes from the header of the data packet until the source port number is found. The starting position and length of the sliding window match can be dynamically adjusted by software to adapt to different network protocols.

[0106] Specific embodiment 2, MASK mask matching embodiment,

[0107] In some scenarios, it is necessary to mask specific fields in the data packet to ignore certain bits and focus on matching the key parts. For example, in IP protocol parsing, some bits may change over time and cannot be determined, while other bits are fixed values.

[0108] In this embodiment, the parser performs mask matching by configuring the mask value. For example, a 32-bit field of a data packet needs to match the fixed value "0xF0F0F0F0", but the upper 4 bits can change. By setting the mask "0x0F0F0F0F", the changes in the upper 4 bits are covered up, and only the fixed part of the lower 4 bits is matched, and the parser can effectively parse the protocol packets that meet this rule.

[0109] Specific embodiment 3, data packet content modification embodiment,

[0110] In some cases, the parser needs to modify the content of a specific field of the data packet after a successful match. This embodiment shows how to modify the data packet after a successful match. For example, when the data packet passes through a firewall, the source IP address or the destination IP address can be modified.

[0111] Assume that in a network environment, the parser matches a specific source IP address (such as "192.168.0.1") and modifies the address to another IP address (such as "10.0.0.1") according to the rule requirements. After matching this source IP address, the parser automatically replaces the source IP address field in the data packet and continues to transmit the modified data packet to the destination. This data modification rule is flexibly configured through software to meet the needs of different scenarios.

[0112] The above description is only a preferred embodiment of the present invention, and does not limit the implementation mode and protection scope of the present invention. For those skilled in the art, it should be aware that all solutions obtained by equivalent substitutions and obvious changes made using the description and illustrations of the present invention should be included in the protection scope of the present invention.

Claims

1. A parsing method of an efficient programmable network protocol parser, characterized in that: include, Configure or dynamically adjust the parser's sliding window length based on the field position of the data packet; During the sliding window matching process, the parser performs a mask operation on the data in the sliding window and compares the numerical values ​​of the fields in the sliding window; After the sliding window matches successfully, the parser modifies the data packet content according to preset rules.

2. The parsing method of the efficient programmable network protocol parser according to claim 1, characterized in that: The sliding window length that can be dynamically configured by the parser at least includes: 8-bit sliding window, used to match single-byte fields; 16-bit sliding window, used to match double-byte fields; 32-bit sliding window, used to match the first complex protocol field; 64-bit sliding window, used to match the second most complex protocol field; 128-bit sliding window, used to match the third complex protocol field.

3. The parsing method of the efficient programmable network protocol parser according to claim 1, characterized in that: The parser starts from the header of the data packet and gradually slides according to the configured sliding window length to match the data packet.

4. The parsing method of the efficient programmable network protocol parser according to claim 1, characterized in that: The sliding window length of the parser is dynamically adjusted during the parsing process according to changes in the field format of the data packet corresponding to the encountered network protocol.

5. The parsing method of the efficient programmable network protocol parser according to claim 4, characterized in that: The network protocol includes at least IPv4 protocol and IPv6 protocol.

6. The parsing method of the efficient programmable network protocol parser according to claim 1, characterized in that: The method in which the parser performs a mask operation on the data in the sliding window is to perform an ignore match or a fuzzy match on at least a portion of the preset bits.

7. The parsing method of the efficient programmable network protocol parser according to claim 1, characterized in that: The parser performs mask operations by configuring mask values.

8. The parsing method of the efficient programmable network protocol parser according to claim 1, characterized in that: After the sliding window of the parser is positioned at a specific field, the value of the field in the sliding window is read and the numerical value is compared with the preset condition.

9. The parsing method of the efficient programmable network protocol parser according to claim 8, characterized in that: The preset conditions include thresholds for identifying data packet length and sequence numbers.

10. The parsing method of the efficient programmable network protocol parser according to claim 1, characterized in that: After the parser successfully matches, the content modified in the data packet includes the source address, the destination address and the protocol type.

Images