TCP mirror image stream processing device based on FPGA

Abstract

The invention provides an FPGA (Field Programmable Gate Array)-based TCP (Transmission Control Protocol) mirror image stream processing device. The FPGA-based TCP mirror image stream processing device is characterized in that a network receiving module receives data, packages the data into a data packet and outputs the data packet to a verification module, a connection management module and a load extraction module for parallel processing; the verification module is used for judging whether the data packet is a target data packet or not and whether the data packet is complete or not and feeding back to the connection management module; the connection management module is used for judging whether the data packet should be received and matching the connection to which the data packet should be received belongs; the load extraction module is used for extracting the TCP load in the data packet; and the data transmission module transmits the TCP load to the service module based on parallel processing results of the three modules. According to the TCP mirror image stream processing device provided by the invention, parallel processing of TCP data inspection, connection matching and load extraction can be realized on multiple connections at the same time, and finally results are merged, so that the data processing efficiency can be effectively improved, the throughput rate of mirror image stream analysis is improved, and the delay is reduced.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a TCP mirror stream processing device based on FPGA. Background Art

[0002] Currently, the processing of TCP (Transmission Control Protocol) mirror streams is basically done by software parsing. The processor (CPU) needs to copy network packets from the network interface device to the host memory, which will cause a large transmission delay. The processing delay will be affected by the system load.

[0003] Existing CPUs are suitable for processing serial complex instruction operations, but not for large-scale parallel fixed-mode calculations. Therefore, traditional TCP / IP based on software parsing has problems such as low throughput and high latency. FPGA (Field Programmable Gate Array) is a programmable integrated circuit with high flexibility and powerful parallel processing capabilities. FPGA can define its internal logic functions according to requirements. It contains a large number of logic units that can work in parallel and can handle multiple tasks at the same time. The hardware architecture of FPGA enables it to achieve low-latency data processing, so it is very suitable for processing TCP mirror streams.

[0004] It should be noted that the above introduction to the technical background is only for the convenience of providing a clear and complete description of the technical solutions of the present application and for the convenience of understanding by those skilled in the art. It cannot be considered that the above technical solutions are well known to those skilled in the art simply because they are described in the background technology section of the present application. Summary of the invention

[0005] The purpose of the present invention is to provide a TCP mirror stream processing device based on FPGA, which supports out-of-order reordering, pseudo-retransmission message filtering, supports parallel processing of multiple mirror streams, decapsulates messages while receiving network messages to reduce processing delays, solves message sequence number wraparound to support long-term operation, and can be used in many scenarios such as TCP connection active-active hot backup, network fault detection, and network security.

[0006] In order to solve the above problems, the following provides a TCP mirror stream processing device based on FPGA, which is composed of a network receiving module, an FPGA module and a service module, wherein the FPGA module includes a verification module, a connection management module, a load extraction module, and a data transmission module; The network receiving module is used to receive network data and encapsulate it into network data packets, and output them to the verification module, connection management module and load extraction module for parallel processing respectively; The verification module is used to determine whether the network data packet is the target data packet and whether it is complete, and feed back the verification result to the connection management module; The connection management module is used to determine whether the network data packet should be received, and match the connection to which the network data packet that should be received belongs; The load extraction module is used to extract the TCP load in the network data packet; The data transmission module transmits the TCP payload to the service module based on the parallel processing results of the verification module, the connection management module and the payload extraction module.

[0007] The TCP mirror stream processing device provided by the present invention can realize parallel processing of TCP data inspection, connection matching and load extraction, and finally merge the results, which can effectively improve data processing efficiency, improve the throughput of mirror stream parsing, and reduce delay.

[0008] The verification module determines whether the network data packet is a target data packet by successively determining whether the network data packet is an IP data packet and whether the load of the IP data packet is a TCP data segment; the verification module verifies whether the target data packet is complete by performing an IP header check and a TCP data segment check on the target data packet. The verification module performs verification work and outputs verification results, and by screening and verifying the network data packets, the target data packets are screened out and the integrity of the data packets is ensured.

[0009] The connection management module includes at least one group of connection registers; the connection registers are used to store four-tuple information of different TCP mirror streams, and the four-tuple information is source IP address, source port, destination IP address and destination port; multiple groups of the connection registers are numbered to obtain connection indexes, and the connection indexes are also correspondingly associated with pointer information; the connection management module extracts the four-tuple information of the network data packet and matches it with the connection registers; after the match is successful, the connection management module obtains the load length and sequence number of the TCP data segment of the network data packet, and outputs it to the data transmission module together with the matching connection index and the pointer information; the data transmission module transmits the TCP load to the business module based on the load length, sequence number, matching connection index and the pointer information of the TCP data segment.

[0010] The connection management module also includes at least one group of configuration registers; the configuration registers are used to store source IP addresses, source ports, destination IP addresses, destination ports and aging time; the connection management module matches the four-tuple information that does not match the connection registers with the configuration registers; after a successful match, the four-tuple information is stored in the unoccupied connection registers; if a match fails, the current network data packet is discarded. The connection registers are automatically formed based on the configuration registers, thereby realizing the monitoring of each TCP mirror stream.

[0011] The data transmission module includes a load writing module, a load reading module and a storage module; the load writing module is used to write the TCP load into the storage module, and the address range of the write is determined based on the load length of the received TCP data segment, the sequence number and the pointer information; the load reading module is used to read the continuously received TCP load from the storage module and transmit it to the service module after byte alignment, and the read address range is confirmed based on the sequence number, the connection index and the pointer information. The mapping relationship with the storage address of each TCP load is established by using the load length, sequence number, required connection index and corresponding pointer information of each TCP data segment, so as to achieve orderly and complete reception and transmission of all TCP loads.

[0012] The connection management module also includes at least one set of blacklist registers, which are used to store four-tuple information; the connection management module extracts the four-tuple information of the network data packet and matches it with the blacklist register first; after a successful match, the current network data packet is discarded; if a match fails, the connection management module continues to match the connection register. By setting a blacklist to filter some TCP mirror streams that are not expected to be parsed, the effective utilization of resources is improved.

[0013] It also includes a load analysis module connected to the load extraction module; the load analysis module analyzes the TCP load based on preset rules and stores the obtained four-tuple information in the blacklist register; the four-tuple information stored in the blacklist register will be deleted after a predetermined aging time. It supports preset TCP mirror stream load data rules, can selectively parse mirror streams with target characteristics, and can also improve the effective utilization of resources.

[0014] The pointer information includes continuously received data pointers and selectively received data pointer groups.

[0015] The system also includes a disorderly reordering module, which realizes disorderly reception and reordering of the TCP load based on the SACK mechanism. The SACK working principle is applied to realize disorderly reception and reordering, which can adapt to a more complex network environment.

[0016] The out-of-order reordering module supports the sequence number wrapping function; the sequence number wrapping function verifies the sequence number, the continuously received data pointer and the highest two bits of the selectively received data pointer group. Special processing is performed when comparing the sequence number and the pointer to solve the sequence number wrapping problem, and the operation can be long-term.

[0017] Compared with the prior art, the beneficial effects of the present invention mainly include the following: 1) supporting the simultaneous processing of multiple TCP connection mirror streams; 2) using FPGA logic to implement simultaneous processing of operations such as verification, connection management, load extraction and address alignment, and finally merging the results, with high parallel processing logic and low latency; 3) by setting blacklist and load analysis capabilities, it can selectively parse mirror streams with target characteristics, filter some TCP mirror streams that are not expected to be parsed, and improve the effective utilization of resources; 4) it can run for a long time, solve the problem of sequence number wraparound, support connection aging to avoid long-term resource occupation of semi-connections; 5) it supports out-of-order reordering to adapt to more complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the specific embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A schematic diagram of the structure of a TCP mirror stream processing device based on FPGA provided by the present invention.

[0020] Figure 2 A schematic diagram of the structure of another FPGA-based TCP mirror stream processing device provided by the present invention. DETAILED DESCRIPTION

[0021] The above and other technical contents, features and effects of the present invention will be clearly presented in the following detailed description of a preferred embodiment with reference to the drawings. The directional terms mentioned in the following embodiments, such as up, down, left, right, front or back, etc., are only referenced to the directions of the attached drawings. Therefore, the directional terms used are used to illustrate and not to limit the present invention.

[0022] The following will describe the various embodiments of the present application in detail with reference to the accompanying drawings. However, it will be appreciated by those skilled in the art that in the various embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solution claimed in the present application can be implemented.

[0023] TCP is a connection-oriented, reliable, byte-stream-based transport layer communication protocol. TCP mirroring is a process based on the TCP protocol, which usually refers to the process of copying TCP traffic on one or more source ports to one or more target ports or services in a network environment. It can copy and forward TCP traffic on a specific port to a specified target port or service without interfering with normal network traffic, and can be applied to TCP connection active-active hot backup, network fault detection, and network security.

[0024] The steps in the following embodiments do not correspond one to one with the summary of the invention.

[0025] Example 1 Figure 1 The figure shows a schematic diagram of the structure of a TCP mirror stream processing device based on FPGA provided by the present invention.

[0026] refer to Figure 1 The present invention provides a TCP mirror stream processing device based on FPGA, which is composed of a network receiving module, an FPGA module and a service module; wherein the FPGA module includes a verification module, a connection management module, a load extraction module, a load analysis module, a disorder reordering module and a data transmission module; the data transmission module includes a load writing module, a load reading module and a storage module.

[0027] The network receiving module is used to receive network data and encapsulate it into network data packets, and output them to the verification module, connection management module and load extraction module for parallel processing; the verification module is used to determine whether the network data packet is the target data packet and whether it is complete, and feed back the verification result to the connection management module; the connection management module is used to determine whether the network data packet should be received, and match the connection to which the network data packet that should be received belongs; the load extraction module is used to extract the TCP load in the network data packet; the data transmission module transmits the TCP load to the business module based on the parallel processing results of the verification module, connection management module and load extraction module.

[0028] The network receiving module is used to receive network data from an external device, and encapsulate the received bit stream into a network data packet and output it to the verification module, the connection management module and the load extraction module for parallel processing. It can be understood that the present application does not limit the source of the data received by the network receiving module (i.e., the external device). After receiving the data, it generally performs error detection on the received Ethernet frame (such as FCS, Frame Check Sequence, frame check sequence), marks the correctness, and then submits it to the subsequent verification module to integrate the results to ensure the integrity of the received data.

[0029] refer to Figure 1 As shown, the network receiving module will output the obtained network data packets to the verification module, the connection management module and the load extraction module at the same time. After receiving the data packets, the above three modules will process them separately. The three modules process them in parallel with each other, and the results of the parallel processing will be merged in the subsequent process.

[0030] It can be understood that a network data packet is the basic unit of information transmission during network transmission. It is a data unit consisting of information such as the source physical address, the destination physical address, and the frame type. Usually, a data packet includes a header and a payload. The header generally contains instructions related to the data in the data packet, such as the source address, the destination address, the protocol, and the sequence number. The source address is used to indicate the source of the information packet, the destination address points to the receiving IP address, and the sequence number is used to identify the order and position of the data packet; and the payload is usually called data, which is the actual data information carried by the data packet to the destination. Data packets can usually be classified, such as IP packets (Internet Protocol Packets), ARP packets (Address Resolution Protocol Packets), and RARP packets (Reverse Address Resolution Protocol Packets).

[0031] For the verification module, when the verification module receives a network data packet, it will verify the data packet to determine whether it is the target data packet and whether the received data packet is complete, and feed back the verification result to the connection management module.

[0032] It can be understood that TCP mirror data is usually encapsulated in an IP data packet for transmission, that is, the IP data packet consists of two parts: an IP data packet header and an IP data packet payload, wherein the IP data packet payload is the TCP data segment; and the TCP data segment also consists of two parts, namely the TCP header and the TCP payload.

[0033] Specifically, the processing object of the device provided by the present application is TCP mirror data, so the network data packet with TCP data segment (i.e., target data packet) must be screened out first; in order to smoothly implement the subsequent processing flow, it is also necessary to confirm that the received data is complete and correct. Therefore, the verification module will first detect whether the received network data packet is an IP data packet, and if not, the network data packet will be discarded (i.e., the verification result is no); if it is an IP data packet, it will further determine whether the load of the IP data packet is a TCP data segment and perform an IP header check, and if not, the network data packet will be discarded (i.e., the verification result is no); if the load is a TCP data segment, a TCP data segment check is performed on the data packet to ensure the integrity of the data, and if it passes, it means that the verification result is yes, otherwise, the network data packet will be discarded (i.e., the verification result is no); finally, the verification module will combine the results obtained by the above process with the received FCS verification result, and then feed back the final verification result to the connection management module. It can be understood that the judgment methods involved in the above steps, such as whether the network data packet is an IP data packet and whether the payload of the IP data packet is a TCP data segment, can be performed based on the identification data at a specific position in the network data packet; the verification result is used to indicate whether it passes, expressed as yes or no, such as 0 for no and 1 for yes.

[0034] As for the connection management module, it is parallel to the verification module. The connection management module is used to determine whether the received data packet is legal, whether the load of the TCP data segment should be received and match the connection to which the TCP data segment belongs.

[0035] Specifically, three types of registers may be provided in the connection management module, including a configuration register, a connection register, and a blacklist register, and each single register may be provided with one or more groups according to actual requirements.

[0036] For configuration registers, each group of configuration registers can store information including source IP address, source port, destination IP address, destination port and aging time; the specific amount of information stored in each group of configuration registers can be confirmed according to actual conditions (including at least one four-tuple information), for example, all four-tuple information can be stored, or only the source IP address and source port can be configured, or only the destination IP address and destination port can be configured, etc.; the configuration of the aging time is also optional; multiple groups of configuration registers in the connection management module are numbered with non-negative integers, which are called configuration indexes.

[0037] For the connection register, it is used to store the four-tuple information (i.e., source IP address, source port, destination IP address, and destination port) of different TCP mirror streams respectively; the register groups are numbered and distinguished by non-negative integers, which are called connection indexes. The connection index not only includes the four-tuple information of a TCP mirror stream, but also has some other information associated with it, such as pointer information, which usually includes a continuously received data pointer (recv_ptr) and / or a selectively received data pointer group (sack_ptr[]). It can be understood that for the configuration register, because it is not necessary to fully specify the four-tuple information, there may be multiple links for each group of configuration registers, that is, multiple groups of connection registers need to be used accordingly. In other embodiments, the configuration register may not be set, for example, when the support for multiple mirror streams is abandoned, or a configuration detects multiple connections and other features.

[0038] The blacklist register is used to store the quadruple information that is not of interest. It is understandable that in other embodiments, the blacklist register may not be set; if a blacklist register is set, the quadruple information stored therein may be set according to actual needs.

[0039] After receiving the network data packet, the connection management module will extract the four-tuple information of the network data packet according to the protocol, and compare it with the values ​​of the configuration register, connection register and blacklist register. First, match it with the value in the blacklist register. If it matches successfully with a certain group of blacklist registers (that is, the values ​​of the four-tuple are equal), the current network data packet should be discarded; if it does not match with any blacklist register, it will match with the connection register. If it matches successfully with a certain group of connection registers, read other information corresponding to the connection index, including the data pointer (recv_ptr) that has been continuously received or the data pointer group (sack_ptr[]) that has been selectively received; if it does not match with any connection single register, it will match with the configuration register. If it matches successfully with a certain group of configuration registers, the extracted four-tuple will be stored in the unoccupied connection register group; if it cannot be matched in the end, the current network data packet will be discarded. It is understood that when the connection management module extracts the four-tuple information of the network data packet, if the network data packet is a TCP / IP packet, the four-tuple information can be extracted normally and used in the subsequent process; if the type of the network data packet is wrong, the extracted information is not the four-tuple information, and the subsequent matching will fail and be discarded. It is understood that in other embodiments, if the configuration register and / or the blacklist register is not set, the corresponding comparison process will be skipped.

[0040] When the match with a certain group of connection registers is successful, the total length of the IP data packet, the length of the IP data packet header, the length of the TCP header and other fields are extracted to calculate the load length (tcp_pload_len) of the TCP data segment: the load length (tcp_pload_len) of the TCP data segment is equal to the total length of the IP data packet minus the length of the IP data packet header minus the length of the TCP header; extract the sequence number (seq) of the TCP data segment. The connection management module will output the load length and sequence number of the obtained TCP data segment, the matched connection index and the corresponding pointer information to the data transmission module; the data transmission module transmits the TCP load to the business module based on the load length, sequence number, matched connection index and pointer information of the received TCP data segment. Specifically, if the load length is not 0, the connection management module will output seq, tcp_pload_len and pointer information (recv_ptr and / or sack_ptr[]) to the reordering module, and output seq, tcp_pload_len, recv_ptr and / or sack_ptr[] and the matched connection index to the load writing module.

[0041] If the RST or FIN field of the received TCP data segment is set, the corresponding connection register group is marked as unoccupied and the corresponding connection resources are released. The FIN (Finish) and RST (Reset) fields are flags in the TCP header, which are used to control the termination and exception handling of the connection. When the RST or FIN field of the TCP data segment is set, it usually indicates that the connection is abnormal or can be terminated.

[0042] In this embodiment, the aging time can be configured in the configuration register of the connection management module. When the aging time is set, the connection management module will record the current system timestamp when receiving a data packet. If no data packet is received after the automatic aging time, the corresponding connection resources will be released.

[0043] The connection management module also receives the processing result of the load analysis module (the process of obtaining the processing result will be described below) and adds certain specific four-tuple information to the blacklist register based on the processing result. That is, the mirror stream information that matches the four-tuple but is not expected to be processed will be stored in the blacklist register and deleted from the blacklist after a predetermined aging time (the aging time refers to the retention time of the four-tuple information in the blacklist register, which can be confirmed according to the business or process of time).

[0044] It should be noted that the verification module, the connection management module and the load extraction module are processed in parallel with each other, and the results of the parallel processing will be merged. Therefore, the connection management module will receive the verification result of the verification module, and the verification result must pass, otherwise the processing result of the connection management module will also be discarded. For example, the connection matching process of the connection management module will work simultaneously with the verification logic of the verification module, but the update of the occupied status of a certain connection index and the update of the recv_ptr pointer also need to be verified, otherwise the processing result will be discarded.

[0045] For the load extraction module, it processes the network data packets sent by the network receiving module together with the verification module and the connection management module at the same time. The three are parallel. The load extraction module is used to extract the effective load of the TCP data segment, perform address alignment on the load data stream, and transmit the processed data stream to the load writing module.

[0046] In this embodiment, a load analysis module is also provided, and the load analysis module is connected to the load extraction module, and can analyze the TCP load obtained by the load extraction module, and feed back the analysis results to the connection management module. Specifically, for example, according to the characteristics of the business data, some rules can be preset in the load analysis module to detect whether the TCP load meets these rules, so as to write the four-tuple information of the data packet of no interest into the blacklist register. By presetting the TCP mirror stream load data rules in the load analysis module, the mirror stream with target characteristics can be selectively parsed, and some TCP mirror streams that are not expected to be parsed can be filtered, which greatly improves the processing efficiency. Of course, in other embodiments, the load analysis module may not be provided.

[0047] The device is also provided with a reordering module, which can realize the reordering and reordering of TCP loads based on the SACK mechanism. As described above, the reordering module receives the processing results (including the seq, tcp_pload_len, recv_ptr and sack_ptr[] of the TCP data segment) from the connection management module. In the reordering module, the data packets are received and reordered out of order through the seq, tcp_pload_len and the current recv_ptr and sack_ptr[] information of the current TCP data segment.

[0048] When the seq of the currently received data packet is not equal to the current recv_ptr, it indicates that the network data packet may be out of order during transmission, or TCP retransmission may have occurred. First, seq+tcp_pload_len can be recorded as seq_nxt. sack_ptr[] is three groups of pointer pairs (s0_ptr_l, s0_ptr_r; s1_ptr_l, s1_ptr_r; s2_ptr_l, s2_ptr_r), where s*_ptr_l in each pointer pair is the seq of a TCP data segment received at a certain time, and the pointer value s*_ptr_r is the seq+tcp_pload_len of a TCP data segment. When equal values ​​appear in several pointer pairs, the pointer pairs need to be merged. If the current seq is equal to s0_ptr_r and seq_nxt is equal to s1_ptr_l, then the pointer pairs s0 and s1 are merged. If seq is not equal to recv_ptr, recv_ptr remains unchanged. If seq is equal to recv_ptr, seq_nxt is equal to s0_ptr_l, recv_ptr will be updated to s0_ptr_r, and if seq_nxt is not equal to s0_ptr_l, recv_ptr will be updated to s0_ptr_r. The updated recv_ptr will be fed back to the load reading module, and the updated recv_ptr and sack_ptr[] will be synchronized to the connection management module. It can be understood that since the verification module, the connection management module and the load extraction module are parallel, the update process can only be updated after the verification of the verification module is passed, that is, when the verification is passed, the connection management module will update recv_ptr and sack_ptr[], and will also feed back the updated recv_ptr to the load reading module.

[0049] To support the scenario of message sequence number wrapping, the highest two bits of the sequence number, the continuously received data pointer, and the selectively received data pointer group are used for verification. This is because the size of the receiving window is limited, and a 30-bit sequence number, a continuously received data pointer, and a selectively received data pointer group can be used to meet the requirement. The fields in the sequence number, the continuously received data pointer, and the selectively received data pointer group are all 32 bits, so the highest two bits can be used for verification. Specifically, when the highest two bits of recv_ptr are both 1 and the highest two bits of seq are both 0, the highest bit of recv_ptr is regarded as 0, and the highest bit of seq is regarded as 1 for comparison, and the sack_ptr[] pointer group is processed in the same way.

[0050] It can be understood that for each link we monitor, if the mirrored link itself does not support selective confirmation, the reordering module is not needed or does not work; when the mirrored link supports selective confirmation, in order to ensure the complete processing of the mirrored link, the reordering module is necessary.

[0051] The payload writing module is responsible for writing the legal TCP payload to the corresponding address of the memory. The data that can be written to the memory is determined based on seq, tcp_pload_len, and sack_ptr[]. The write address is determined based on seq and the connection index. A legal TCP payload means that the TCP payload is a data segment that has not been received before and does not exceed the receive window.

[0052] The load reading module reads the continuously received data from the memory. The address range of the data is determined by seq, recv_ptr and connection index, the data is read from the memory and byte aligned, and the aligned data is transmitted to the business module.

[0053] The business module configures the configuration registers in the connection management module, receives the effective load and performs corresponding operations according to the actual business scenario.

[0054] Embodiment 2 like Figure 2 Shown is a structural schematic diagram of another FPGA-based TCP mirror stream processing device provided by the present invention.

[0055] This device is basically the same as the first embodiment, except that the reordering module is omitted. It can be understood that when the mirrored link itself does not support selective confirmation, the reordering module is not required.

[0056] Specifically, in this embodiment, after the connection management module receives the network data packet, it will extract the four-tuple information of the network data packet according to the protocol, and compare it with the values ​​of the configuration register, the connection register, and the blacklist register. When the match with a certain group of connection registers is successful, other information corresponding to the connection index will be read. At this time, the pointer information associated with the connection index only includes the continuously received data pointer (recv_ptr), and there is no selectively received data pointer group (sack_ptr[]). When the match with a certain group of connection registers is successful, the total length of the IP data packet, the IP data packet header length, the TCP header length and other fields are extracted, and the load length (tcp_pload_len) of the TCP data segment is calculated: The connection management module will output the payload length and sequence number of the obtained TCP data segment, the matching connection index and the corresponding pointer information to the data transmission module; the data transmission module transmits the TCP payload to the business module based on the payload length, sequence number, matching connection index and pointer information of the received TCP data segment. Specifically, if the payload length is not 0, the connection management module will output seq, tcp_pload_len and pointer information recv_ptr to the payload reading module, and seq, tcp_pload_len, recv_ptr and the matching connection index to the payload writing module.

[0057] In this embodiment, the connection management module checks whether seq is equal to recv_ptr, and if so, updates recv_ptr. Similarly, the connection management module will update recv_ptr only after the check is passed, and will feed back the updated recv_ptr to the load reading module.

[0058] In order to facilitate the description, some common English nouns or letters used in the present invention are only used for exemplary reference rather than restrictive interpretation or specific usage, and the protection scope of the present invention should not be limited by their possible Chinese translations or specific letters.

[0059] It should also be noted that, in this document, relational terms such as "first" and "second" are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

Claims

1. A TCP mirror stream processing device based on FPGA, characterized in that: It is composed of a network receiving module, an FPGA module and a service module, wherein the FPGA module includes a verification module, a connection management module, a load extraction module, and a data transmission module; The network receiving module is used to receive network data and encapsulate it into network data packets, and output them to the verification module, connection management module and load extraction module for parallel processing respectively; The verification module is used to determine whether the network data packet is the target data packet and whether it is complete, and feed back the verification result to the connection management module; The connection management module is used to determine whether the network data packet should be received, and match the connection to which the network data packet that should be received belongs; The load extraction module is used to extract the TCP load in the network data packet; The data transmission module transmits the TCP payload to the service module based on the parallel processing results of the verification module, the connection management module and the payload extraction module.

2. The FPGA-based TCP mirror stream processing device according to claim 1, characterized in that: The verification module determines whether the network data packet is a target data packet by sequentially determining whether the network data packet is an IP data packet and whether the load of the IP data packet is a TCP data segment; The verification module performs IP header verification and TCP data segment verification on the target data packet to confirm whether the target data packet is complete.

3. The FPGA-based TCP mirror stream processing device according to claim 1, characterized in that: The connection management module includes at least one set of connection registers; The connection register is used to store four-tuple information of different TCP mirror streams, wherein the four-tuple information is a source IP address, a source port, a destination IP address, and a destination port; multiple groups of the connection registers are numbered to obtain a connection index, and the connection index is also associated with pointer information; The connection management module extracts the quadruple information of the network data packet and matches it with the connection register; After the match is successful, the connection management module obtains the load length and sequence number of the TCP data segment of the network data packet, and outputs them together with the matched connection index and the pointer information to the data transmission module; The data transmission module transmits the TCP payload to the service module based on the payload length, sequence number, matching connection index and pointer information of the TCP data segment.

4. The FPGA-based TCP mirror stream processing device according to claim 3, characterized in that: The connection management module also includes at least one set of configuration registers; The configuration register is used to store the source IP address, source port, destination IP address, destination port and aging time; The connection management module matches the quadruple information that does not match the connection register with the configuration register; After the match is successful, the four-tuple information is stored in the unoccupied connection register; If the match fails, the current network data packet is discarded.

5. The FPGA-based TCP mirror stream processing device according to claim 3, characterized in that: The data transmission module includes a load writing module, a load reading module and a storage module; The payload writing module is used to write the TCP payload into the storage module, and the written address range is determined based on the payload length of the received TCP data segment, the sequence number and the pointer information; The load reading module is used to read the continuously received TCP load from the storage module and transmit it to the service module after byte alignment. The read address range is confirmed based on the sequence number, the connection index and the pointer information.

6. The FPGA-based TCP mirror stream processing device according to claim 4, characterized in that: The connection management module further comprises at least one set of blacklist registers, wherein the blacklist registers are used to store quadruple information; The connection management module extracts the quadruple information of the network data packet and matches it with the blacklist register first; After the match is successful, the current network data packet is discarded; If the match fails, continue to match with the connection register.

7. The FPGA-based TCP mirror stream processing device according to claim 6, characterized in that: Also included is a load analysis module connected to the load extraction module; The load analysis module analyzes the TCP load based on preset rules and stores the obtained four-tuple information in the blacklist register; The four-tuple information stored in the blacklist register will be deleted after a predetermined aging time.

8. The FPGA-based TCP mirror stream processing device according to claim 3, characterized in that: The pointer information includes continuously received data pointers and selectively received data pointer groups.

9. The FPGA-based TCP mirror stream processing device according to claim 8, characterized in that: It also includes a disorderly reordering module, which implements disorderly reception and reordering of the TCP load based on the SACK mechanism.

10. The FPGA-based TCP mirror stream processing device according to claim 9, characterized in that: The out-of-order re-arrangement module supports a sequence number wrap-around function; The sequence number wrap function is checked by the sequence number, the continuously received data pointer and the most significant two bits of the selectively received data pointer group.

Images