Gigabit IPSec large-scale security policy query method and device based on FPGA

Abstract

The present invention belongs to the technical field of computer network security, and specifically relates to a gigabit IPSec large-scale security policy query method and device based on FPGA. The method comprises: receiving multiple security policies issued by a user; receiving a five-tuple extracted by a user from a network message, monitoring whether there is a five-tuple input by the user within each time_tuple5 time range, and if so, filling it into tuple5_array, otherwise filling 0 as 1 five-tuple into tuple5_array; when there are num_tuple5 five-tuples in tuple5_array, performing a multi-level security policy query on the five-tuples in tuple5_array, and generating result(m)_array based on the final query result; judging the correctness of result(m)_array to filter out the valid query results therein and output them to the user in sequence.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network security, and more specifically, relates to a FPGA-based Gigabit IPSec large-scale security policy query method and device. Background Art

[0002] Security Policy (SP) defines how IP packets are processed. On devices that implement IPSec (Internet Protocol Security), the Security Policy Database (SPD) should be queried during all packet processing.

[0003] IPSec devices usually use the source IP address (or subnet, address range), destination IP address (or subnet, address range), protocol type, source port number, and destination port number of the IP packet to form a five-tuple to query security policies. The query speed of SPD affects the processing speed of IPSec devices for IP data packets, so how to efficiently query SPD through the five-tuple is a key issue.

[0004] Chinese patent document CN103198105A discloses an Ethernet IPSec security database search device and method, which uses a hash algorithm to compress a five-tuple, and uses the obtained hash value as the address of the SRAM to store the security policy. Performing SPD query based on the hash table may lead to matching conflict problems, that is, different matching rules may obtain the same hash table item. When a matching conflict occurs, the policy information is usually stored in the form of a linked list. However, when there are large-scale security policies, the possibility of encountering hash conflicts is greatly increased, which results in the need to traverse the entire linked list to query the security policy in many cases, which not only increases the complexity of the processing, but also reduces the query efficiency.

[0005] Based on this, the present invention designs a Gigabit IPSec large-scale security policy query method based on FPGA, which adopts a large-scale security policy query method based on FPGA (field programmable gate array) pipeline design, avoiding the hash value conflict problem caused by the policy query method based on hash operation. Summary of the invention

[0006] The present invention aims to overcome at least one defect of the above-mentioned prior art and provide a Gigabit IPSec large-scale security policy query method based on FPGA.

[0007] The invention also discloses a device loaded with a gigabit IPSec large-scale security policy query method based on FPGA.

[0008] The detailed technical scheme of the present invention is as follows: A Gigabit IPSec large-scale security policy query method based on FPGA, the method comprising: S1. Receive multiple security policies issued by users through the policy distribution module, and send them synchronously to the policy query module at each level; S2. Receive the quintuple extracted by the user from the network message through the quintuple sorting module, wherein the quintuple includes the source IP address, the destination IP address, the protocol type, the source port number and the destination port number; monitor whether there is a quintuple input by the user within each time_tuple5 time range, and if so, fill it into the quintuple array tuple5_array, otherwise fill 0 as 1 quintuple into the quintuple array tuple5_array; S3. When there are num_tuple5 quintuples in the quintuple array tuple5_array, perform security policy query on the quintuples in the quintuple array tuple5_array through the policy query module at each level, and generate a quintuple query result array result(m)_array based on the final query result; S4. Determine the correctness of the five-tuple query result array result(m)_array to filter out valid query results and output them to the user in sequence.

[0009] Preferably, according to the present invention, S1 specifically includes: S11, after receiving the security policy, the policy query modules at each level determine whether the currently received security policy belongs to the policy query module at this level; If it does not belong to the policy query module at this level, the security policy will be discarded; If it belongs to the policy query module at this level, then go to S12; Among them, a security policy can only belong to one security policy query module; S12. In the policy query modules at all levels, if the currently received security policy belongs to the security policy query module at this level and the security policy operation type is "add security policy", then enter S13; if the currently received security policy belongs to the security policy query module at this level and the security policy operation type is "delete security policy", then enter step S14; S13, mapping the write address wr_addr of the security policy database memory spd_ram according to the security policy sequence number sp_seq, writing the security policy into the security policy database memory spd_ram, and setting the content corresponding to the write address wr_addr in the policy validity array valid_array to 1, that is, valid_array[wr_addr]=1, indicating that the security policy in the write address wr_addr of the security policy database memory spd_ram is valid; The initial state of the content corresponding to each address in the policy validity array valid_array is 0; S14. Map the write address wr_addr of the security policy database memory spd_ram according to the security policy sequence number sp_seq, and set the content corresponding to the write address wr_addr in the policy validity array valid_array to 0, that is, valid_array[wr_addr]=0, indicating that the security policy in the write address wr_addr of the security policy database memory spd_ram is invalid.

[0010] Preferably, according to the present invention, in S11, judging whether the currently received security policy belongs to the current-level policy query module specifically includes: Determine whether the sequence number sp_seq of the currently received security policy is within the security policy sequence number range {sp_seq_local_min, sp_seq_local_max} allowed by the policy query module at this level; If so, it is determined that it belongs to the policy query module at this level; If not, it is determined that it does not belong to the policy query module at this level; Among them, sp_seq_local_min is the minimum security policy sequence number of the policy query module at this level, and sp_seq_local_min=(index-1)*512+1; sp_seq_local_max is the maximum security policy sequence number of the policy query module at this level, and sp_seq_local_max=index*512; index is the number of each level of policy query module, and its range is 1~m.

[0011] Preferably, according to the present invention, the content of the security policy includes a security policy sequence number sp_seq, a security policy operation type, an IPSec device deployment type, a message processing mode, an SA pointer, a minimum value of a five-tuple range, and a maximum value of a five-tuple range; The security policy sequence number sp_seq ranges from 1 to n; The security policy operation types include adding a security policy and deleting a security policy; The IPSec device deployment types include point-to-point deployment and subnet-to-subnet deployment, and when the deployment type is point-to-point deployment, the minimum value of the quintuple range is equal to the maximum value of the quintuple range, and the security policy query at this time is a precise query; when the deployment type is subnet-to-subnet deployment, the quintuple to be queried is within the range defined by the minimum value of the quintuple range and the maximum value of the quintuple range, and the security policy query at this time is a fuzzy query; The message processing methods include discarding, bypassing IPSec protocol processing, and using IPSec protocol processing; The SA pointer indicates the entry of the security association SA in the security association database SAD, and this field is required when the message processing method is to use the IPSec protocol for processing.

[0012] Preferably, in S3, the five-tuple in the five-tuple array tuple5_array is queried for security policy by the policy query module at each level, and a five-tuple query result array result(m)_array is generated based on the final query result, specifically including: In the first-level policy query module, after receiving the five-tuple array tuple5_array, the read address rd_addr of the security policy database memory spd_ram is traversed between 0 and 511. During the address traversal process, if the content corresponding to the read address rd_addr in the policy validity array valid_array is 1, that is, valid_array[rd_addr]=1, it means that the security policy stored at the current rd_addr address of the security policy database memory spd_ram is valid, then the security policy database memory spd_ram is read using the current rd_addr address, otherwise the security policy database memory spd_ram is not read; The query result of each quintuple in the quintuple array tuple5_array, the message processing method in the queried security policy, and the SA pointer in the queried security policy are combined into a query result set compare_result, and stored in the corresponding position of the quintuple query result array result(1)_array at this level; then the quintuple array tuple5_array and the quintuple query result array result(1)_array at this level are sent to the next level policy query module; In the second-level policy query module to the final-level policy query module, after receiving the five-tuple array tuple5_array and the five-tuple query result array result(i-1)_array sent by the previous-level policy query module, the read address rd_addr of the security policy database memory spd_ram is traversed between 0 and 511. In the process of traversing the address, if the content corresponding to the read address rd_addr in the policy validity array valid_array is 1, that is, valid_array[rd_addr]=1, it means that the security policy stored in the current rd_addr address of the security policy database memory spd_ram is valid, then the security policy database memory spd_ram is read using the current rd_addr address, otherwise the security policy database memory spd_ram is not read; The query result of each quintuple in the quintuple array tuple5_array, the message processing method in the queried security policy, and the SA pointer in the queried security policy are combined into a query result set compare_result, and stored in the corresponding position of the quintuple query result array result(i)_array at this level; then the quintuple array tuple5_array and the quintuple query result array result(i)_array at this level are sent to the next-level policy query module, or the quintuple query result array result(m)_array is generated according to the query result of the final-level policy query module; If a valid security policy has been found for a quintuple in the quintuple array tuple5_array in the previous-level policy query module, the query result in the previous-level policy query module is retained.

[0013] Preferably, according to the present invention, the query result of each quintuple in the quintuple array tuple5_array in S3 includes a security policy being queried and a security policy not being queried. When the query result is that the security policy is not queried, the message processing mode and SA pointer fields in the query result set compare_result are filled with 0; The method for determining whether a security policy has been queried is as follows: each time a security policy is read out, the quintuple in the quintuple array tuple5_array is compared with the maximum value and the minimum value of the quintuple range in the security policy; if a quintuple in the quintuple array tuple5_array is within the range defined by the maximum value and the minimum value of the quintuple range in the security policy, then it is considered that the quintuple has queried a security policy.

[0014] Preferably, in S4, judging the correctness of the five-tuple query result array result(m)_array to screen out valid query results and output them to the user in sequence specifically includes: The result judgment module judges the correctness of the five-tuple query result array result(m)_array. After receiving the five-tuple array tuple5_array and the five-tuple query result array result(m)_array sent by the final-level strategy query module, the result judgment module deletes the five-tuples of all 0 in the five-tuple array tuple5_array from the corresponding query results in the five-tuple query result array result(m)_array, and sends the remaining query results in the five-tuple query result array result(m)_array to the user in sequence as valid query results.

[0015] In another aspect of the present invention, a device for implementing a large-scale security policy query method of Gigabit IPSec based on FPGA is provided, the device comprising a policy distribution module, a quintuple sorting module, a policy query module and a result judgment module, wherein: The policy distribution module is used to receive multiple security policies issued by users and send them synchronously to the policy query modules at each level; The five-tuple sorting module is used to receive the five-tuple extracted by the user from the network message, and monitor whether there is a five-tuple input by the user within each time_tuple5 time range. If yes, fill it into the five-tuple array tuple5_array, otherwise fill 0 as 1 five-tuple into the five-tuple array tuple5_array; The policy query module is used to perform multi-level security policy query on the five-tuple in the five-tuple array tuple5_array, and generate a five-tuple query result array result(m)_array based on the final query result; The result judgment module is used to judge the correctness of the five-tuple query result array result(m)_array, so as to filter out the valid query results therein and output them to the user in sequence.

[0016] In another aspect of the present invention, there is also provided an electronic device, comprising: at least one processor; and A memory storing instructions, which, when executed by the at least one processor, enables the at least one processor to execute the FPGA-based Gigabit IPSec large-scale security policy query method as described above.

[0017] In another aspect of the present invention, a machine-readable storage medium is provided, which stores executable instructions, and when the instructions are executed, the machine executes the FPGA-based Gigabit IPSec large-scale security policy query method as described above.

[0018] Compared with the prior art, the present invention has the following beneficial effects: (1) The present invention adopts a large-scale security policy query method based on FPGA pipeline design, avoiding the hash value conflict problem caused by the policy query method based on hash operation; (2) The present invention divides the entire security policy query process into m-level pipelines, which can meet the speed requirements of Gigabit Ethernet. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is an execution flow chart of the FPGA-based Gigabit IPSec large-scale security policy query method of the present invention.

[0020] Figure 2 It is a flowchart of the five-tuple matching security policy in Example 1 of the present invention. DETAILED DESCRIPTION

[0021] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0022] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0023] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0024] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0025] Embodiment 1, Ginseng Figure 1 This embodiment provides a Gigabit IPSec large-scale security policy query method based on FPGA, the method comprising: S1. Receive multiple security policies issued by users through the policy distribution module, and send them synchronously to the policy query module at each level.

[0026] In this embodiment, the process of writing and deleting a security policy includes: S11, after receiving the security policy, the policy query modules at each level determine whether the currently received security policy belongs to the policy query module at this level; If it does not belong to the policy query module at this level, the security policy will be discarded; If it belongs to the policy query module at this level, then enter S12.

[0027] Furthermore, a security policy can only belong to one security policy query module.

[0028] Furthermore, the judgment principle of whether the security policy belongs to the policy query module at this level is as follows: judging whether the sequence number sp_seq of the currently received security policy is within the security policy sequence number range {sp_seq_local_min, sp_seq_local_max} allowed by the policy query module at this level; If so, it is determined that it belongs to the policy query module at this level; If not, it is determined that it does not belong to the policy query module at this level; Among them, sp_seq_local_min is the minimum security policy sequence number of the policy query module at this level, and sp_seq_local_min=(index-1)*512+1; sp_seq_local_max is the maximum security policy sequence number of the policy query module at this level, and sp_seq_local_max=index*512; index is the number of each level of policy query module, and its range is 1~m.

[0029] S12. In the policy query modules at all levels, if the currently received security policy belongs to the security policy query module at this level and the security policy operation type is "add security policy", then enter S13; if the currently received security policy belongs to the security policy query module at this level and the security policy operation type is "delete security policy", then enter step S14.

[0030] S13, mapping the write address wr_addr of the security policy database memory spd_ram according to the security policy sequence number sp_seq, writing the security policy into the security policy database memory spd_ram, and setting the content corresponding to the write address wr_addr in the policy validity array valid_array to 1, that is, valid_array[wr_addr]=1, indicating that the security policy in the write address wr_addr of the security policy database memory spd_ram is valid; Further, wr_addr = sp_seq - sp_seq_local_min.

[0031] S14, mapping the write address wr_addr of the security policy database memory spd_ram according to the security policy sequence number sp_seq, setting the content corresponding to the write address wr_addr in the policy validity array valid_array to 0, that is, valid_array[wr_addr]=0, indicating that the security policy in the write address wr_addr of the security policy database memory spd_ram is invalid; Further, wr_addr = sp_seq - sp_seq_local_min.

[0032] In this embodiment, the content of a single security policy includes a security policy sequence number sp_seq, a security policy operation type, an IPSec device deployment type, a message processing method, an SA pointer, a minimum value of a five-tuple range, and a maximum value of a five-tuple range.

[0033] The security policy sequence number sp_seq ranges from 1 to n.

[0034] The security policy operation types include adding a security policy and deleting a security policy.

[0035] The IPSec device deployment types include point-to-point deployment and subnet-to-subnet deployment, and when the deployment type is point-to-point deployment, the minimum value of the quintuple range is equal to the maximum value of the quintuple range, and the security policy query at this time is a precise query; when the deployment type is subnet-to-subnet deployment, the quintuple to be queried is within the range defined by the minimum value of the quintuple range and the maximum value of the quintuple range, and the security policy query at this time is a fuzzy query.

[0036] The message processing methods include discarding, bypassing IPSec protocol processing, and using IPSec protocol processing.

[0037] The SA pointer indicates the entry of the security association SA in the security association database SAD, and this field is required when the message processing method is to use the IPSec protocol for processing.

[0038] S2. Receive the quintuple extracted by the user from the network message through the quintuple sorting module, wherein the quintuple includes the source IP address sip, the destination IP address dip, the protocol type proocol, the source port number sport and the destination port number dport; monitor whether there is a quintuple input by the user within each time_tuple5 time range, and if so, fill it into the quintuple array tuple5_array, otherwise fill 0 as 1 quintuple into the quintuple array tuple5_array.

[0039] Specifically, the quintuple sorting module monitors whether there is a quintuple input within the set time period time_tuple5, and each time a quintuple sent by a user is received, the quintuple sorting module stores the quintuple in the quintuple array tuple5_array in the order of receipt, until num_tuple5 quintuples are collected in the quintuple array tuple5_array, and then sends it to the first-level policy query module.

[0040] Furthermore, the fixed time period time_tuple5 for monitoring the user sending the five-tuple is 672ns. It should be understood that in Gigabit Ethernet, the time required to transmit a minimum MAC frame plus the fixed minimum frame gap is 672ns, that is, the preamble plus the delimiter are 8 bytes in total, and the transmission requires 8*8ns=64ns; the minimum mac frame is 64 bytes, and the transmission requires 64*8ns=512ns; the minimum frame gap requires 96ns; then the time interval from receiving a mac frame to receiving the next mac frame is at least 64+512+96=672ns, so even if each MAC frame contains IP data packets, it is impossible to get two five-tuples within the time range of 672ns.

[0041] Furthermore, if the five-tuple sorting module does not receive the five-tuple sent by the user within the set time period time_tuple5, 0 is filled into the five-tuple array tuple5_array as a five-tuple.

[0042] S3. When there are num_tuple5 quintuples in the quintuple array tuple5_array, a security policy query is performed on the quintuples in the quintuple array tuple5_array through the policy query module at each level, and a quintuple query result array result(m)_array is generated based on the final query result.

[0043] The policy query module is responsible for identifying and executing the security policies issued by the policy distribution module. It is also responsible for performing security policy queries on the quintuples in the quintuple array tuple5_array input by the quintuple sorting module or the previous-level policy query module, and sending the quintuple array tuple5_array and the current-level quintuple query result array result(i)_array to the next-level policy query module.

[0044] The security policy database memory spd_ram in the policy query module stores num_sp security policies, and the security policy validity array valid_array stores security policy validity information corresponding to the address of spd_ram.

[0045] This implementation divides the quintuple query process into m-level pipelines, each level of which is a policy query module, with a total of m policy query modules. The policy distribution module receives multiple security policies issued by the user and sends them to policy query modules at each level. When there are n security policies SP in the security policy database SPD, m is the minimum number of policy query modules required to store n security policies, and m and n are both positive integers and n≥m.

[0046] Furthermore, the number of security policies num_sp stored in each level of policy query module is 512; spd_ram is a pseudo dual-port ram. Combined with the data width of the security policy and the reserved bit, the data width of the spd_ram in the policy query module is set to 252 bits. When the data depth is between 2 and 512, the number of brams consumed is the same. In order to maximize resource utilization, the depth of the pseudo dual-port ram is set to 512, that is, 512 security policies are stored in each policy query module.

[0047] Furthermore, the clock cycle of Gigabit Ethernet is 8ns, and the system clock cycle of the present invention is t_clk, t_clk≤8ns; when traversing and reading spd_ram in the policy query module, a total of 512 clock cycles t_clk are required, and the equivalent processing time of each quintuple is (512 / num_tuple) * t_clk. In order to meet the speed requirements of Gigabit Ethernet, num_tuple5 should satisfy (512 / num_tuple5) * t_clk ≤ 672 ns.

[0048] Ginseng Figure 2 , starting from the first-level policy query module receiving the five-tuple, after a time delay of m*512*t_clk, the first group of num_tuple5 five-tuple query results can be obtained, and then num_tuple5 five-tuple query results will be obtained every 512*t_clk clock cycles.

[0049] Specifically, in the first-level policy query module, after receiving the five-tuple array tuple5_array, the read address rd_addr of the security policy database memory spd_ram is traversed between 0 and 511. During the address traversal process, if the content corresponding to the read address rd_addr in the policy validity array valid_array is 1, that is, valid_array[rd_addr]=1, it means that the security policy stored in the current rd_addr address of the security policy database memory spd_ram is valid, then the security policy database memory spd_ram is read using the current rd_addr address, otherwise the security policy database memory spd_ram is not read.

[0050] The five-tuple ranges in the security policy read out in sequence are compared with num_tuple5 five-tuples at the same time, and the query result of each five-tuple, the message processing method in the matched security policy, and the SA pointer sa_ptr in the matched security policy form a query result set compare_result, which is stored in the corresponding position of the five-tuple query result array result(1)_array at this level; then the five-tuple array tuple5_array and the five-tuple query result array result(1)_array at this level are sent to the next-level policy query module.

[0051] In the second-level policy query module to the final-level policy query module, after receiving the five-tuple array tuple5_array and the five-tuple query result array result(i-1)_array sent by the previous-level policy query module, the read address rd_addr of the security policy database memory spd_ram is traversed between 0 and 511. During the address traversal process, if the content corresponding to the read address rd_addr in the policy validity array valid_array is 1, that is, valid_array[rd_addr]=1, indicating that the security policy stored in the current rd_addr address of the security policy database memory spd_ram is valid, the security policy database memory spd_ram is read using the current rd_addr address, otherwise the security policy database memory spd_ram is not read.

[0052] The five-tuple range in the security policy read out in sequence is compared with num_tuple5 five-tuples at the same time, and the query result of each five-tuple, the message processing method in the matched security policy, and the SA pointer sa_ptr in the matched security policy form a query result set compare_result, which are stored in the corresponding positions in the five-tuple query result array result(i)_array of this level; then the five-tuple array tuple5_array and the five-tuple query result array result(i)_array of this level are sent to the next-level policy query module, or the five-tuple query result array result(m)_array is generated according to the query result of the last-level policy query module.

[0053] If a valid security policy has been found for a quintuple in the quintuple array tuple5_array in the previous-level policy query module, the query result in the previous-level policy query module is retained.

[0054] In addition, when the matched message processing mode is "discard" or "bypass IPsec protocol processing", the SA pointer sa_ptr in the query result set compare_result is 0.

[0055] Furthermore, if the IPSec device deployment type read from the security policy database memory spd_ram is point-to-point deployment or subnet-to-subnet deployment, then when the source IP address sip, destination IP address dip, protocol type proocol, source port number sport and destination port number dport of any quintuple in the quintuple array tuple5_array are all mapped within the quintuple range in the respective security policies, the quintuple is determined to match successfully, and the current security policy is the security policy to be queried.

[0056] S4. Determine the correctness of the five-tuple query result array result(m)_array to filter out valid query results and output them to the user in sequence.

[0057] In this embodiment, the result judgment module judges the correctness of the five-tuple query result array result(m)_array. After receiving the five-tuple array tuple5_array and the five-tuple query result array result(m)_array sent by the final-level strategy query module, the result judgment module deletes the five-tuples of all 0 in the five-tuple array tuple5_array from the corresponding query results in the five-tuple query result result(m)_array, and sends the remaining query results in the five-tuple query result result(m)_array to the user in sequence as valid query results.

[0058] In summary, the FPGA-based Gigabit IPSec large-scale security policy query method of the present invention adopts a large-scale security policy query method based on FPGA pipeline design, which avoids the hash value conflict problem caused by the policy query method based on hash operation; and this method divides the entire security policy query process into m-level pipelines, which can meet the speed requirements of Gigabit Ethernet.

[0059] Embodiment 2, This embodiment provides a device for implementing a FPGA-based Gigabit IPSec large-scale security policy query method, the device includes a policy distribution module, a quintuple sorting module, a policy query module, and a result judgment module, wherein: The policy distribution module is used to receive multiple security policies issued by users and send them synchronously to the policy query modules at each level; The five-tuple sorting module is used to receive the five-tuple extracted by the user from the network message, and monitor whether there is a five-tuple input by the user within each time_tuple5 time range. If yes, fill it into the five-tuple array tuple5_array, otherwise fill 0 as 1 five-tuple into the five-tuple array tuple5_array; The policy query module is used to perform security policy query on the five-tuple in the five-tuple array tuple5_array. There are multiple levels of security policy query modules, and a five-tuple query result array result(m)_array is generated based on the final query result. The result judgment module is used to judge the correctness of the five-tuple query result array result(m)_array, so as to filter out the valid query results therein and output them to the user in sequence.

[0060] Embodiment 3, This embodiment also provides an electronic device, including: at least one processor; and A memory storing instructions, which, when executed by the at least one processor, enables the at least one processor to execute the FPGA-based Gigabit IPSec large-scale security policy query method as described above.

[0061] In this embodiment, the electronic device may include, but is not limited to: personal computers, server computers, workstations, desktop computers, laptop computers, notebook computers, mobile computing devices, smart phones, tablet computers, cellular phones, personal digital assistants (PDAs), handheld devices, messaging devices, wearable computing devices, consumer electronic devices, and the like.

[0062] Embodiment 4, This embodiment also provides a machine-readable storage medium storing executable instructions, which, when executed, enable the machine to execute the FPGA-based Gigabit IPSec large-scale security policy query method as described above.

[0063] Specifically, a system or device equipped with a readable storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer or processor of the system or device can read and execute instructions stored in the readable storage medium.

[0064] In this case, the program code itself read from the machine-readable medium can realize the function of any one of the above embodiments, and thus the machine-readable code and the machine-readable storage medium storing the machine-readable code constitute part of this specification.

[0065] Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD-RW), magnetic tapes, non-volatile memory cards, and ROMs. Optionally, the program code may be downloaded from a server computer or a cloud via a communication network.

[0066] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solution of the present invention, and are not intended to limit the specific implementation methods of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A Gigabit IPSec large-scale security policy query method based on FPGA, characterized in that: The method comprises: S1. Receive multiple security policies issued by users through the policy distribution module, and send them synchronously to the policy query module at each level; S2. Receive the quintuple extracted by the user from the network message through the quintuple sorting module, wherein the quintuple includes the source IP address, the destination IP address, the protocol type, the source port number and the destination port number; monitor whether there is a quintuple input by the user within each time_tuple5 time range, and if so, fill it into the quintuple array tuple5_array, otherwise fill 0 as 1 quintuple into the quintuple array tuple5_array; S3. When there are num_tuple5 quintuples in the quintuple array tuple5_array, perform security policy query on the quintuples in the quintuple array tuple5_array through the policy query module at each level, and generate a quintuple query result array result(m)_array based on the final query result; S4. Determine the correctness of the five-tuple query result array result(m)_array to filter out valid query results and output them to the user in sequence.

2. The FPGA-based Gigabit IPSec large-scale security policy query method according to claim 1, characterized in that: The S1 specifically includes: S11, after receiving the security policy, the policy query modules at each level determine whether the currently received security policy belongs to the policy query module at this level; If it does not belong to the policy query module at this level, the security policy will be discarded; If it belongs to the policy query module at this level, then go to S12; Among them, a security policy belongs to a security policy query module; S12. In the policy query modules at all levels, if the currently received security policy belongs to the security policy query module at this level and the security policy operation type is "add security policy", then enter S13; if the currently received security policy belongs to the security policy query module at this level and the security policy operation type is "delete security policy", then enter step S14; S13, mapping the write address wr_addr of the security policy database memory spd_ram according to the security policy sequence number sp_seq, writing the security policy into the security policy database memory spd_ram, and setting the content corresponding to the write address wr_addr in the policy validity array valid_array to 1, that is, valid_array[wr_addr]=1, indicating that the security policy in the write address wr_addr of the security policy database memory spd_ram is valid; The initial state of the content corresponding to each address in the policy validity array valid_array is 0; S14. Map the write address wr_addr of the security policy database memory spd_ram according to the security policy sequence number sp_seq, and set the content corresponding to the write address wr_addr in the policy validity array valid_array to 0, that is, valid_array[wr_addr]=0, indicating that the security policy in the write address wr_addr of the security policy database memory spd_ram is invalid.

3. The FPGA-based Gigabit IPSec large-scale security policy query method according to claim 2 is characterized in that: In S11, judging whether the currently received security policy belongs to the current-level policy query module specifically includes: Determine whether the sequence number sp_seq of the currently received security policy is within the security policy sequence number range {sp_seq_local_min, sp_seq_local_max} allowed by the policy query module at this level; If so, it is determined that it belongs to the policy query module at this level; If not, it is determined that it does not belong to the policy query module at this level; Among them, sp_seq_local_min is the minimum security policy sequence number of the policy query module at this level, and sp_seq_local_min=(index-1)*512+1; sp_seq_local_max is the maximum security policy sequence number of the policy query module at this level, and sp_seq_local_max=index*512; index is the number of each level of policy query module, and its range is 1~m.

4. The FPGA-based Gigabit IPSec large-scale security policy query method according to claim 1, characterized in that: The content of the security policy includes the security policy sequence number sp_seq, the security policy operation type, the IPSec device deployment type, the message processing mode, the SA pointer, the minimum value of the five-tuple range and the maximum value of the five-tuple range; The range of the security policy sequence number sp_seq is 1 to n; The security policy operation types include adding a security policy and deleting a security policy; The IPSec device deployment types include point-to-point deployment and subnet-to-subnet deployment, and when the deployment type is point-to-point deployment, the minimum value of the quintuple range is equal to the maximum value of the quintuple range, and the security policy query at this time is a precise query; when the deployment type is subnet-to-subnet deployment, the quintuple to be queried is within the range defined by the minimum value of the quintuple range and the maximum value of the quintuple range, and the security policy query at this time is a fuzzy query; The message processing methods include discarding, bypassing IPSec protocol processing, and using IPSec protocol processing; The SA pointer indicates the entry of the security association SA in the security association database SAD, and this field is required when the message processing method is to use the IPSec protocol for processing.

5. The FPGA-based Gigabit IPSec large-scale security policy query method according to claim 4, characterized in that: In S3, the five-tuple in the five-tuple array tuple5_array is queried for security policies by the policy query module at each level, and a five-tuple query result array result(m)_array is generated based on the final query result, which specifically includes: In the first-level policy query module, after receiving the five-tuple array tuple5_array, the read address rd_addr of the security policy database memory spd_ram is traversed between 0 and 511. During the address traversal process, if the content corresponding to the read address rd_addr in the policy validity array valid_array is 1, that is, valid_array[rd_addr]=1, it means that the security policy stored at the current rd_addr address of the security policy database memory spd_ram is valid, then the security policy database memory spd_ram is read using the current rd_addr address, otherwise the security policy database memory spd_ram is not read; The query result of each quintuple in the quintuple array tuple5_array, the message processing method in the queried security policy, and the SA pointer in the queried security policy are combined into a query result set compare_result, and stored in the corresponding position of the quintuple query result array result(1)_array at this level; then the quintuple array tuple5_array and the quintuple query result array result(1)_array at this level are sent to the next level policy query module; In the second-level policy query module to the final-level policy query module, after receiving the five-tuple array tuple5_array and the five-tuple query result array result(i-1)_array sent by the previous-level policy query module, the read address rd_addr of the security policy database memory spd_ram is traversed between 0 and 511. In the process of traversing the address, if the content corresponding to the read address rd_addr in the policy validity array valid_array is 1, that is, valid_array[rd_addr]=1, it means that the security policy stored in the current rd_addr address of the security policy database memory spd_ram is valid, then the security policy database memory spd_ram is read using the current rd_addr address, otherwise the security policy database memory spd_ram is not read; The query result of each quintuple in the quintuple array tuple5_array, the message processing method in the queried security policy, and the SA pointer in the queried security policy are combined into a query result set compare_result, and stored in the corresponding position of the quintuple query result array result(i)_array at this level; then the quintuple array tuple5_array and the quintuple query result array result(i)_array at this level are sent to the next-level policy query module, or the quintuple query result array result(m)_array is generated according to the query result of the final-level policy query module; If a valid security policy has been found for a quintuple in the quintuple array tuple5_array in the previous-level policy query module, the query result in the previous-level policy query module is retained.

6. The FPGA-based Gigabit IPSec large-scale security policy query method according to claim 5, characterized in that: The query result of each quintuple in the quintuple array tuple5_array in S3 includes the query result of finding a security policy and the query result of finding no security policy. When the query result is that the security policy is not found, the message processing mode and SA pointer fields in the query result set compare_result are filled with 0; The method for determining whether a security policy has been queried is as follows: each time a security policy is read out, the quintuple in the quintuple array tuple5_array is compared with the maximum value and the minimum value of the quintuple range in the security policy; if a quintuple in the quintuple array tuple5_array is within the range defined by the maximum value and the minimum value of the quintuple range in the security policy, then it is considered that the quintuple has queried a security policy.

7. The FPGA-based Gigabit IPSec large-scale security policy query method according to claim 1, characterized in that: In S4, the correctness of the five-tuple query result array result(m)_array is judged to select valid query results and output them to the user in sequence, which specifically includes: The result judgment module judges the correctness of the five-tuple query result array result(m)_array. After receiving the five-tuple array tuple5_array and the five-tuple query result array result(m)_array sent by the final-level strategy query module, the result judgment module deletes the five-tuples of all 0 in the five-tuple array tuple5_array from the corresponding query results in the five-tuple query result array result(m)_array, and sends the remaining query results in the five-tuple query result array result(m)_array to the user in sequence as valid query results.

8. A device for implementing a Gigabit IPSec large-scale security policy query method based on FPGA, characterized in that: The device includes a policy distribution module, a quintuple sorting module, a policy query module and a result judgment module, wherein: The policy distribution module is used to receive multiple security policies issued by users and send them synchronously to the policy query modules at each level; The five-tuple sorting module is used to receive the five-tuple extracted by the user from the network message, and monitor whether there is a five-tuple input by the user within each time_tuple5 time range. If yes, fill it into the five-tuple array tuple5_array, otherwise fill 0 as 1 five-tuple into the five-tuple array tuple5_array; The policy query module is used to perform multi-level security policy query on the five-tuple in the five-tuple array tuple5_array, and generate a five-tuple query result array result(m)_array based on the final query result; The result judgment module is used to judge the correctness of the five-tuple query result array result(m)_array, so as to filter out the valid query results therein and output them to the user in sequence.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and A memory storing instructions, which, when executed by the at least one processor, enable the at least one processor to execute the FPGA-based Gigabit IPSec large-scale security policy query method as described in any one of claims 1 to 7.

10. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores executable instructions, and when the instructions are executed, the machine executes the FPGA-based Gigabit IPSec large-scale security policy query method according to any one of claims 1 to 7.

Images