Line speed bit mask message matching method and device based on FPGA (Field Programmable Gate Array)

Abstract

The invention discloses a line speed bit mask message matching method based on an FPGA (Field Programmable Gate Array), the FPGA comprises at least one block RAM (Random Access Memory), the block RAM comprises a plurality of storage addresses, and the method comprises the following steps: acquiring N matching rules, each matching rule comprising a rule number, a keyword and a mask; and executing configuration of the matching rules in the block RAM according to the N matching rules: for each matching rule, determining at least one storage address corresponding to the matching rule according to an effective bit of a mask in the matching rule and a corresponding keyword, and determining a bit to be configured in N bits of the storage address according to a rule number of the matching rule, writing an effective bit value in the bit; and taking quintuple information in the received message as a storage address of the block RAM, reading a plurality of effective bit values corresponding to the storage address, and determining a rule number of each matching rule hit by the message based on each effective bit value. According to the invention, bit mask rule matching of the message can be realized at a line speed.

Description

Technical Field

[0001] This application relates to the technical field of packet matching, and in particular to a method and device for line-speed bit mask packet matching based on FPGA. Background Art

[0002] When performing specific processing on specific packets in a network, it is usually necessary to configure packet rules on network devices. In related technical solutions, after receiving a packet, the network device extracts five-tuple information from the packet and uses a mask five-tuple matching method and a hash algorithm to perform packet rule matching to achieve fast data packet matching, but this will reduce the accuracy of packet matching. The mask rule function is usually implemented by a TCAM chip (ternary content addressable memory). For application scenarios of packet processing with low requirements for the number of rules, since the chip is relatively expensive, it increases the cost of the product and there is a bandwidth bottleneck that cannot achieve line-speed matching. Summary of the Invention

[0003] The purpose of this application is to provide a method and device for line-speed bit mask packet matching based on FPGA, which can achieve packet rule matching at line speed and reduce the cost of the product.

[0004] In a first aspect, this application provides a method for line-speed bit mask packet matching based on FPGA. The FPGA includes at least one block RAM, and the block RAM includes multiple storage addresses. The storage space corresponding to the storage address has N bit positions. The method includes: Obtain N preset matching rules. Each matching rule includes a rule number, a keyword, and a mask corresponding to the keyword. The rule number is from 0 to N-1, and N is a natural number; Perform configuration of the matching rules in the block RAM according to the N matching rules. The steps of configuring the matching rules include: for each matching rule, determine at least one storage address corresponding to the matching rule according to the valid bits of the mask and the corresponding keyword in the matching rule, determine the bit positions to be configured in the N bit positions of the storage address according to the rule number of the matching rule, and write an effective bit value used to represent the matching rule taking effect in the bit positions to be configured; Parse the received packet to generate five-tuple information, use the five-tuple information as the storage address of the block RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule numbers of the respective matching rules hit by the received packet based on each effective bit value.

[0005] Second aspect, the present application provides a wire-speed bit mask packet matching device based on FPGA. The FPGA includes at least one block RAM, and the block RAM includes multiple storage addresses. The storage space corresponding to the storage address has N bit positions. The device includes: An acquisition module, configured to acquire N preset matching rules. Each matching rule includes a rule number, a keyword, and a mask corresponding to the keyword. The rule number ranges from 0 to N-1, and N is a natural number. A rule configuration module, configured to perform configuration of the matching rules in the block RAM according to the N matching rules. The steps of the configuration of the matching rules include: for each matching rule, determine at least one storage address corresponding to the matching rule according to the valid bits of the mask and the corresponding keyword in the matching rule, determine the bit positions to be configured in the N bit positions of the storage address according to the rule number of the matching rule, and write an effective bit value used to represent the matching rule taking effect in the bit positions to be configured. A packet matching module, configured to parse the received packet to generate five-tuple information, use the five-tuple information as the storage address of the block RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule numbers of the respective matching rules hit by the received packet based on the respective bit positions corresponding to the respective effective bit values.

[0006] Third aspect, the present application provides a communication device, including the wire-speed bit mask packet matching device based on FPGA as described above.

[0007] According to the preset matching rules, the present application realizes the configuration of the matching rules in the block RAM, can directly use the five-tuple information as the read address of the block RAM, perform rule matching search in the block RAM, can realize wire-speed rule matching of packets, and can improve the accurate matching of packets. Using the block RAM inside the FPGA to implement the storage function of the matching rules and the rule matching function of the packets, without adopting the technical solution of an external TCAM, can reduce the cost of the product. Description of the Drawings

[0008] Figure 1 It is the first flowchart of the wire-speed bit mask packet matching method based on FPGA provided by the embodiment of the present application; Figure 2 It is the second flowchart of the wire-speed bit mask packet matching method based on FPGA provided by the embodiment of the present application; Figure 3 It is the third flowchart of the wire-speed bit mask packet matching method based on FPGA provided by the embodiment of the present application; Figure 4 It is the fourth flowchart of the wire-speed bit mask packet matching method based on FPGA provided by the embodiment of the present application; Figure 5The fifth flowchart of the FPGA-based wire-speed bit mask packet matching method provided by the embodiments of the present application; Figure 6 The sixth flowchart of the FPGA-based wire-speed bit mask packet matching method provided by the embodiments of the present application; Figure 7 The seventh flowchart of the FPGA-based wire-speed bit mask packet matching method provided by the embodiments of the present application; Figure 8 The eighth flowchart of the FPGA-based wire-speed bit mask packet matching method provided by the embodiments of the present application; Figure 9 The system block diagram of the FPGA-based wire-speed bit mask packet matching device provided by the embodiments of the present application; Figure 10 The system block diagram of the communication device provided by the embodiments of the present application. Detailed implementation manners

[0009] The following will describe the present application in detail in conjunction with the specific implementation manners shown in the drawings. However, these implementation manners do not limit the present application, and any structural, method, or functional transformation made by those of ordinary skill in the art based on these implementation manners is included in the protection scope of the present application.

[0010] Please refer to Figure 1 , the embodiments of the present application provide an FPGA-based wire-speed bit mask packet matching method, and this method includes steps S101 - S103.

[0011] S101, obtain N preset matching rules. Each matching rule includes a rule number, a keyword, and a mask corresponding to the keyword. The rule number ranges from 0 to N - 1, and N is a natural number.

[0012] The N matching rules configured by the user can be obtained through software commands. Each matching rule includes a rule number, a keyword, and a mask corresponding to the keyword. The user can configure various types of keywords and corresponding masks according to requirements. The keyword can be understood as five-tuple information or signature information, and the mask is the mask corresponding to the five-tuple or signature. The five-tuple information includes source IP address, destination IP address, source port, destination port, and protocol number. Correspondingly, the mask includes source IP address mask, destination IP address mask, source port mask, destination port mask, and protocol number mask; the signature information is a series of bytes that conform to a certain feature in the packet parsed by the user. The field lengths of the keyword and the mask are the same. The keyword represents the specific value of each matching rule, and the value of each bit in the mask indicates whether the same bit in the keyword is valid, that is, which values in the keyword need to be matched, and is used to indicate the valid bits in the keyword.

[0013] The FPGA includes at least one Block RAM (Block Random Access Memory). The Block RAM is the memory inside the FPGA. The Block RAM includes multiple storage addresses, and the storage space corresponding to the storage address has N bits.

[0014] Exemplarily, the number of bits of the storage space corresponding to each storage address in the Block RAM is the same as the number of preset matching rules. Assume N is 72, and the rule numbers of the matching rules are identified by 0 - 71. The storage space corresponding to each storage address is 72 bits, represented by bits 0 - 71. When bit0 is 1, it means rule 0 takes effect; when bit0 is 0, it means rule 0 does not take effect. When bit1 is 1, it means rule 1 takes effect; when bit1 is 0, it means rule 1 does not take effect, and so on. Assume the value range of the keyword is 0x00 - 0xFF. Therefore, the Block RAM can select a RAM with a 256 * 72 storage space. The depth of the Block RAM is related to the byte length of the keyword, and the number of bits of the storage space corresponding to each storage address in the Block RAM is the same as the number of preset matching rules. Therefore, the storage space size of the Block RAM can be determined according to the byte length of the keyword and the number of matching rules. It can be understood that if the byte length of the keyword is relatively large and the byte length of the address of a single Block RAM cannot be satisfied, the configuration of the rules can be implemented through multiple Block RAMs, and the number of required Block RAMs can be determined according to the byte length of the keyword. For example, if the byte length of the keyword is 4 bytes and the storage depth of the Block RAM supported by the FPGA is 2 bytes, the configuration of the rules can be implemented through 2 identical Block RAMs.

[0015] S102. Perform the configuration of the matching rules in the Block RAM according to the N matching rules. The configuration steps include: for each matching rule, determine at least one storage address corresponding to the matching rule according to the valid bits of the mask and the corresponding keyword in the matching rule, determine the bits to be configured among the N bits of the storage address according to the rule number of the matching rule, and write the effective bit value representing the matching rule taking effect into the bits to be configured.

[0016] In this embodiment, according to N preset matching rules, the matching rules are converted based on the mask matching rule to implement the configuration of the five-tuple matching rule in the block RAM, so that the rule matching of the keywords in the packet can be realized through the matching rules stored in the block RAM. Specifically, for each matching rule, at least one storage address corresponding to the matching rule is determined according to the valid bits of the mask and the corresponding keyword in the matching rule, and the bit positions to be configured in the N-bit positions of the storage address are determined according to the rule number of the matching rule. A valid bit value indicating the effectiveness of the matching rule is written in the bit positions to be configured. For example, if the value of the rule number of the matching rule is 2, the bit positions to be configured in the N-bit positions are 2, and the valid bit value is 1, that is, the bit value 1 is written in bit position 2.

[0017] Exemplarily, assume that the configuration of matching rule 1 is: the rule number is 1, the keyword is 0x20, and the corresponding mask is 0x2F. The binary form of the mask 0x2F is 00101111. In the mask, a bit value of 0 indicates ignore, and a bit value of 1 indicates match. Therefore, the values of bit positions 7, 6, and 4 in the mask 0x2F are 0, that is, the ignored bit positions are 7, 6, and 4. The binary form of the keyword 0x20 is 00100000. Based on the mask rule, after the keyword 0x20 and the mask 0x2F are corresponded, it can be seen that as long as the data conforms to the format of **1*0000, it can satisfy the matching rule 1. Therefore, in the configuration of the matching rule in the block RAM, the valid bit value is configured in bit 1 of each storage address that meets the **1*0000 format. For example, the bit 1 of the storage positions with the storage addresses of 00100000, 00110000, 01100000, etc. is configured to 1. Therefore, after the configuration of the five-tuple matching rule based on the block RAM, when the keyword in the packet that conforms to the **1*0000 format is looking up the rule in the block RAM, if the bit value read from bit 1 of the corresponding storage address is 1, it means that rule 1 is hit. For example, if the keyword in the packet is 0x20, and the bit value read from bit 1 of the storage address 0x20 in the block RAM is 1, it is determined that the packet hits rule 1. This method can directly search for the keyword in the packet in the block RAM to achieve the purpose of accurate packet matching.

[0018] S103, Parse the received packet to generate five-tuple information, use the five-tuple information as the storage address of the block RAM, read the multiple valid bit values corresponding to the storage address, and determine the rule numbers of the matching rules hit by the received packet based on the bit positions corresponding to the respective valid bit values.

[0019] Obtain the received message, parse the message, and obtain the five-tuple information or signature information in the message. The five-tuple information includes the source IP address, destination IP address, source port, destination port, and protocol number. Based on the five-tuple information, perform rule matching. Use the five-tuple information as the storage address of the block RAM, that is, use the five-tuple information as the read address of the block RAM, read out the bit values of each corresponding bit, and determine each effective bit value according to the read bit values. According to the above solution, the bit position where the effective bit value is located corresponds to the rule number of the matching rule. Therefore, based on each bit position corresponding to each effective bit value, the rule numbers of each matching rule hit by the message can be determined. When the matching is successful, process the message according to the processing action defined in the successfully matched rule. For example, when the processing action is to pass, perform corresponding forwarding; when the processing action is not to pass, discard the message.

[0020] When multiple rules are hit, arbitration can be performed based on the priorities of each matching rule, and the final result can be determined based on the high or low priorities stored in the rules. Usually, the matching rule with a higher priority level is output. The priority of the matching rule can be set according to the actual needs of the user.

[0021] Exemplarily, assume that the effective bit value is set to 1, and the above-mentioned block RAM has 72 bits. If the values of bits 1, 6, and 8 read from a storage address of the block RAM corresponding to the five-tuple information are 1, it indicates that the rules matched by the five-tuple are rules 1, 6, and 8. Assume that the priority of the matching rules defined by the user is: the smaller the rule number, the higher the priority. Therefore, the rule number matched by the five-tuple is 1; assume that the priority of the matching rules defined by the user is: the larger the rule number, the higher the priority. Therefore, the rule number matched by the five-tuple is 8.

[0022] In the embodiments of the present application, according to a preset matching rule, the matching rule is converted based on the mask matching rule, so as to implement the configuration of the matching rule in the block RAM. The rule matching of the keyword in the message can be realized through the matching rule stored in the block RAM. The five-tuple information can be directly used as the read address of the block RAM to perform the search of the rule matching in the block RAM, and the rule matching of the message can be quickly realized. The block RAM is the internal memory of the FPGA. Compared with the data reading and writing of the external memory, its reading and writing speed is faster, which can further improve the speed of rule matching. Using the five-tuple information as the read address of the block RAM can improve the accuracy of message matching compared with the hash matching algorithm in the prior art. Using the internal block RAM of the FPGA to store the matching rule to implement the rule matching function of the message, without adopting the TCAM technical solution, can reduce the cost of the product. For the application scenario of message processing with low requirements for the number of matching rules, such as the message filtering of the intelligent network card, this solution has the advantage of low cost.

[0023] As Figure 2 shown, in an embodiment of the present application, according to the valid bits of the mask and the corresponding keywords in the matching rule, at least one storage address corresponding to the matching rule is determined, including steps S201-S203.

[0024] S201, obtain the keyword and the corresponding mask in the matching rule, and determine multiple valid bits in the mask. Among them, the value of each bit in the mask represents whether the same bit in the keyword is valid. The valid bit is the bit with the mask value of 1, and the non-valid bit is the bit with the mask value of 0; S202, in each bit of the keyword, represent the bits with the same positions as the non-valid bits with undetermined values, and keep the values of the bits with the same positions as the valid bits unchanged. The value of the undetermined value is 0 or 1; S203, determine different bit value combinations according to the different values of the undetermined values of each bit and the bit values of the bits that remain unchanged, and represent each storage address of the block RAM corresponding to the matching rule with different bit value combinations.

[0025] Exemplarily, the configuration of matching rule 0 is as follows: the rule number is 0, the keyword is 0x80, and the corresponding mask is 0xF0. The binary form of mask 0xF0 is 11110000. The invalid bits with bit value 0 in the mask are bit 3, bit 2, bit 1, and bit 0, and the valid bits with bit value 1 are bit 7, bit 6, bit 5, and bit 4. The binary form of keyword 0x80 is 10000000. Therefore, the bits 3, 2, 1, and 0 in 0x80 are represented by undetermined values, and the undetermined values are represented by *, and the bit values of bits 7, 6, 5, and 4 in 0x80 remain unchanged, that is, the bit values of bits 7, 6, 5, and 4 are still 1, 0, 0, and 0. The binary formats of multiple storage addresses of the corresponding block RAM are 1000****. The undetermined value * can take values of 0 or 1, and different values of the undetermined value * can form multiple combinations. For example, 10000000, 10000001, 10000010, 10000011, etc. That is, the storage addresses of the block RAM are 0x80 to 0x8F.

[0026] In a specific embodiment of the present application, the configuration of matching rule 0 is: the rule number is 0, the keyword is 0x80, and the corresponding mask is 0xF0; the configuration of matching rule 1 is: the rule number is 1, the keyword is 0x82, and the corresponding mask is 0xFF; the configuration of matching rule 71 is: the rule number is 71, the keyword is 0x00, and the corresponding mask is 0x00. The address of the block RAM is 0x00 to 0xFF, and the bit positions are 0 to 71. The matching rules in the block RAM are configured based on the above Figure 2 shown implementation manner. According to matching rule 0, the storage addresses of the block RAM are determined to be 0x80 to 0x8F. According to matching rule 1, the storage address of the block RAM is determined to be 0x82. According to matching rule 71, the storage addresses of the block RAM are determined to be 0x00 to 0xFF. Therefore, the following operations are performed on the matching rules in the block RAM. Write 1 to bit 0 of the storage addresses from 0x80 to 0x8F, write 1 to bit 1 of the storage address 0x82, and write 1 to bit 71 of the storage addresses from 0x00 to 0xFF. That is, the matching rules of the block RAM are: 0x00 to 0x7F: 0x80_0000_0000_0000_0000; 0x80 to 0x81: 0x80_0000_0000_0000_0001; 0x82: 0x80_0000_0000_0000_0003; 0x83 to 0x8F: 0x80_0000_0000_0000_0001; 0x90 to 0xFF: 0x80_0000_0000_0000_0000; For the block RAM configured based on the above rules, assuming that the protocol number in the obtained packet is 0x82, using 0x82 as the read address of the block RAM, and the read value is 0x80_0000_0000_0000_0003, it can be determined that the packet hits matching rules 0, 1, and 71.

[0027] When matching packets, multiple rules can be combined, and packet matching can be performed based on the combined rules to meet packet filtering in various application scenarios. For example, combined matching of source port and protocol number rules, combined matching of destination port and protocol number, etc. As Figure 3 shown, in an embodiment of the present application, the FPGA includes a first block RAM, a second block RAM, and a third block RAM. The keywords are the high eight bits of the source port, the low eight bits of the source port, and the protocol number, and the masks respectively correspond to the high eight-bit mask of the source port, the low eight-bit mask of the source port, and the protocol number mask. The steps for configuring the matching rules specifically include steps S301 - S303.

[0028] S301, for each first matching rule corresponding to the high eight bits of the source port, determine each first valid bit in the high eight-bit mask of the source port according to the first matching rule. According to each first valid bit and the high 8 bits of the source port, determine each storage address of the first block RAM corresponding to the first matching rule. Use the rule number of the first matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value indicating the effectiveness of the first matching rule in the bits to be configured; S302, for each second matching rule corresponding to the low eight bits of the source port, determine each second valid bit in the low eight-bit mask of the source port according to the second matching rule. According to each second valid bit and the low 8 bits of the source port, determine each storage address of the second block RAM corresponding to the second matching rule. Use the rule number of the second matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value indicating the effectiveness of the second matching rule in the bits to be configured; S303, for each third matching rule corresponding to the protocol number, determine each third valid bit according to the protocol number mask in the third matching rule. According to each third valid bit and the protocol number, determine each storage address of the third block RAM corresponding to the third matching rule. Use the rule number of the third matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value indicating the effectiveness of the third matching rule in the bits to be configured.

[0029] In the embodiments of the present application, the keyword in the matching rule is the source port keyword, and the mask corresponds to the source port mask. The address of the block RAM supports a byte length, that is, 0x00 to 0xFF. The byte length of the source port is two bytes. Therefore, two identical block RAMs are required to implement the configuration of the matching rule of the source port, that is, the first RAM and the second block RAM in the embodiments of the present application. Based on the implementation manners of steps S301 and S302, the configuration of the matching rule of the source port is completed in the first RAM and the second block RAM. It can be understood that in this embodiment, two block RAMs, namely the first RAM and the second block RAM, are used to implement the configuration of the matching rule of the source port. In the implementation manner of the matching rule configuration of the source port, the number of block RAMs required is an example. The number of block RAMs can be determined according to the byte length of the address of a single block RAM and the byte length of the source port, and can be specifically set according to the actual situation, which is not limited herein.

[0030] In the embodiments of the present application, the keyword in the matching rule is the protocol number, and the mask corresponds to the protocol number mask. The address of the block RAM supports a byte length, that is, 0x00 to 0xFF. The byte length of the protocol number is one byte. Therefore, one block RAM is required to implement the configuration of the matching rule of the protocol number, that is, the third block RAM in the embodiments of the present application. Based on the implementation manner of step S303, the configuration of the matching rule of the protocol number is completed in the third block RAM.

[0031] As Figure 4 shown, in an embodiment of the present application, based on at least one valid bit value, the rule numbers of at least one matching rule hit by the received packet are determined, including steps S401 - S405.

[0032] S401, Parse the received packet to obtain the source port and protocol number in the packet; S402, Use the high 8-bit data of the source port as the storage address of the first block RAM, read the multiple valid bit values corresponding to the storage address, and based on each valid bit value, determine the rule numbers of the respective first matching rules hit by the high 8-bit data of the source port. This rule number is represented by the first rule number; S403, Use the low 8-bit data of the source port as the storage address of the second block RAM, read the multiple valid bit values corresponding to the storage address, and based on each valid bit value, determine the rule numbers of the respective second matching rules hit by the low 8-bit data of the source port. This rule number is represented by the second rule number; S404, Use the protocol number in the packet as the storage address of the third block RAM, read the multiple valid bit values corresponding to the storage address, and based on each valid bit value, determine the rule numbers of the respective third matching rules hit by the protocol number. This rule number is represented by the third rule number; S405. Based on each first rule number, each second rule number, and each third rule number, determine at least one rule number that simultaneously matches the first matching rule, the second matching rule, and the third matching rule. Based on the priority of the matching rules, determine the rule number with the highest priority from the at least one rule number as the rule number of the matching rule hit by the received message.

[0033] In the embodiments of the present application, based on the above Figure 3 configuration of the matching rules for the source ports of the first block of RAM and the second block of RAM in the shown embodiment, and the configuration of the matching rules for the protocol numbers in the third block of RAM, the combination of the source port and the protocol number in the message is used for rule matching. Specifically, the high 8-bit data of the source port in the message is used as the storage address of the first block of RAM, and each first rule number that conforms to the matching rule is obtained. The low 8-bit data of the source port in the message is used as the storage address of the second block of RAM, and each second rule number that conforms to the matching rule is obtained. The protocol number in the message is used as the storage address of the third block of RAM, and each third rule number that conforms to the matching rule is obtained. Based on each first rule number, each second rule number, and each third rule number, determine at least one rule number that simultaneously matches the first matching rule, the second matching rule, and the third matching rule. Based on the priority of the matching rules, determine the rule number with the highest priority from the at least one rule number as the rule number of the matching rule hit by the received message. In this embodiment, through the first block of RAM, the second block of RAM, and the third block of RAM, the rule configuration for the source port and the protocol number is realized, the matching of the matching rules combined by the source port and the protocol number can be realized, and the data filtering of the matching rules combined by the source port and the protocol number in the message is realized.

[0034] As Figure 5 shown, in an embodiment of the present application, the FPGA includes a fourth block of RAM, a fifth block of RAM, and a sixth block of RAM. The keywords are the high eight bits of the destination port, the low eight bits of the destination port, and the protocol number, and the masks respectively correspond to the high eight-bit mask of the destination port, the low eight-bit mask of the destination port, and the protocol number mask. The steps of the configuration of the matching rules specifically include S501 - S503.

[0035] S501. For each fourth matching rule corresponding to the high eight bits of the destination port, determine each fourth valid bit in the high eight-bit mask of the destination port according to the fourth matching rule. According to each fourth valid bit and the high 8 bits of the destination port, determine each storage address of the fourth block of RAM corresponding to the fourth matching rule. Use the rule number of the fourth matching rule to determine the bit positions to be configured among the N bit positions of each storage address, and write the effective bit value representing the activation of the fourth matching rule in the bit positions to be configured; S502. For the fifth matching rule corresponding to the lower eight bits of each destination port, determine each fifth valid bit in the lower eight-bit mask of the destination port according to the fifth matching rule. According to each fifth valid bit and the lower 8 bits of the destination port, determine each storage address of the fifth block of RAM corresponding to the fifth matching rule. Use the rule number of the fifth matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value representing the fifth matching rule taking effect in the bits to be configured. S503. For the sixth matching rule corresponding to each protocol number, determine each sixth valid bit according to the protocol number mask in the sixth matching rule. According to each sixth valid bit and the protocol number, determine each storage address of the sixth block of RAM corresponding to the sixth matching rule. Use the rule number of the sixth matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value representing the sixth matching rule taking effect in the bits to be configured.

[0036] In the embodiment of the present application, the keyword in the matching rule is the destination port keyword, and the mask corresponds to the destination port mask. The address of the block RAM supports a length of one byte, that is, 0x00~0xFF. The byte length of the destination port is two bytes. Therefore, two identical blocks of RAM are required to implement the configuration of the matching rule of the destination port, that is, the fourth RAM and the fifth block of RAM in the embodiment of the present application. Based on the implementation manners of steps S501 and S502, the configuration of the matching rule of the destination port is completed in the fourth RAM and the fifth block of RAM.

[0037] In the embodiment of the present application, the keyword in the matching rule is the protocol number, and the mask corresponds to the protocol number mask. The address of the block RAM supports a length of one byte, that is, 0x00~0xFF. The byte length of the protocol number is two bytes. Therefore, one block of RAM is required to implement the configuration of the matching rule of the protocol number, that is, the sixth block of RAM in the embodiment of the present application. Based on the implementation manner of step S503, the configuration of the matching rule of the protocol number is completed in the sixth block of RAM.

[0038] As Figure 6 shown, in an embodiment of the present application, based on at least one effective bit value, determining the rule numbers of at least one matching rule hit by the received packet includes steps S601-S605.

[0039] S601. Analyze the received packet to obtain the destination port and protocol number in the packet. S602. Use the high 8-bit data of the destination port as the storage address of the fourth block of RAM, read the multiple effective bit values corresponding to the storage address, and based on each effective bit value, determine the rule numbers of each fourth matching rule hit by the high 8-bit data of the destination port. This rule number is represented by the fourth rule number. S603: Using the low 8-bit data of the destination port as the storage address of the fifth block of RAM, read multiple valid bit values corresponding to the storage address, and determine, based on each valid bit value, the rule numbers of the respective fifth matching rules hit by the low 8-bit data of the destination port. This rule number is represented by the fifth rule number. S604: Using the protocol number in the packet as the storage address of the sixth block of RAM, read multiple valid bit values corresponding to the storage address, and determine, based on each valid bit value, the rule numbers of the respective fourth matching rules hit by the protocol number. This rule number is represented by the sixth rule number. S605: Based on the respective fourth rule numbers, fifth rule numbers, and sixth rule numbers, determine at least one rule number that simultaneously hits the fourth matching rule, the fifth matching rule, and the sixth matching rule. Based on the priority of the matching rules, determine the rule number with the highest priority from the at least one rule number, and use it as the rule number of the matching rule hit by the received packet.

[0040] In the embodiments of the present application, based on the configuration of the matching rules for the destination port of the fourth block of RAM and the fifth block of RAM in the above Figure 5 shown embodiment, and the configuration of the matching rules for the protocol number in the sixth block of RAM, the combination of the destination port and the protocol number in the packet is used for rule matching. Specifically, use the high 8-bit data of the destination port in the packet as the storage address of the fourth block of RAM to obtain the respective fourth rule numbers that conform to the matching rules, use the low 8-bit data of the destination port in the packet as the storage address of the fifth block of RAM to obtain the respective fifth rule numbers that conform to the matching rules, use the protocol number in the packet as the storage address of the sixth block of RAM to obtain the respective sixth rule numbers that conform to the matching rules. Based on the respective fourth rule numbers, fifth rule numbers, and sixth rule numbers, determine at least one rule number that simultaneously hits the fourth matching rule, the fifth matching rule, and the sixth matching rule. Based on the priority of the matching rules, determine the rule number with the highest priority from the at least one rule number, and use it as the rule number of the matching rule hit by the received packet. In this embodiment, through the fourth block of RAM, the fifth block of RAM, and the sixth block of RAM, the rule configuration for the destination port and the protocol number is realized, and the data filtering of the matching rules combined by the destination port and the protocol number in the packet is realized.

[0041] As Figure 7As shown in the figure, in one embodiment of the present application, the FPGA includes 16 seventh block RAMs, and the keyword is one of the source IP address keyword, the destination IP address keyword, and the fixed position signature keyword, and the mask corresponds to one of the source IP address mask, the destination IP address mask, and the fixed position signature mask. The source IP address keyword, the source IP address mask, the destination IP address keyword, the destination IP address mask, the fixed position signature keyword, and the fixed position signature mask are all 128 bits. The steps of configuring the matching rule specifically include: S701: Divide the keyword and the corresponding mask into 16 groups of keywords and 16 groups of masks respectively in the order of bits from high to low with one byte as a group. For each group of keywords, configure the matching rule corresponding to the group of keywords into the corresponding seventh block RAM among the 16 seventh block RAMs according to the steps of configuring the matching rule, so as to implement the configuration of the matching rules for the 16 seventh block RAMs; S702: Analyze the received packet to obtain the keyword in the packet. Divide the keyword in the packet into 16 groups of keywords in the order of bits from high to low with one byte as a group. Input each group of keywords into the corresponding seventh block RAM among the 16 seventh block RAMs in turn, and determine the matching rule hit by the received packet based on the priority of the matching rule.

[0042] In the above embodiment, a configuration method for the matching rule based on the source IP address keyword, the destination IP address keyword, and the fixed position signature keyword is given. The byte lengths of the source IP address, the destination IP address, and the fixed position signature are the same, so the rule configuration methods are basically similar. Taking the source IP address as an example for illustration.

[0043] Exemplarily, the keyword in the matching rule is the source IP address keyword, and the mask corresponds to the source IP address mask. The address of the block RAM supports a length of one byte, that is, 0x00~0xFF. The byte length of the source IP address is 16 bytes. Therefore, 16 block RAMs are required to implement the configuration of the matching rule for the source IP address, that is, the seventh block RAM in the embodiments of the present application, and 16 seventh block RAMs are required. Based on the implementation manner of step S701, the matching rule for the source IP address is configured for each group in the 16 seventh block RAMs. Based on the configuration of the matching rule for the source IP address in the 16 seventh block RAMs in the above implementation manner, the source IP address in the packet is subjected to rule matching. Specifically, the source IP address in the packet is sequentially divided into 16 groups of source IP addresses in the order from the high bit to the low bit. Each group of source IP addresses is simultaneously input into the corresponding seventh block RAM in the 16 seventh block RAMs, that is, the first group of source IP addresses is input into the first seventh block RAM, and the first group of source IP addresses is used as the read address of the first seventh block RAM to read the rule number that conforms to the matching rule. The second group of source IP addresses is input into the second seventh block RAM, and the second group of source IP addresses is used as the read address of the second seventh block RAM to read the rule number that conforms to the matching rule, and so on. The rule matching of the 16 groups of source IP addresses is completed, the rule number matched by each group of source IP addresses is obtained, and arbitration is performed based on the priorities of the respective matching rules, and the matching rule with the higher priority level is output, thereby determining the rule number of the matching rule hit by the received packet. In this embodiment, the rule configuration for the source IP address, destination IP address, and fixed-position signature is realized, and the data filtering of the matching rules for the source IP address, destination IP address, and fixed-position signature in the packet is realized.

[0044] For the destination IP address and the fixed-position signature, the configuration of their rules is similar and can be configured according to the above implementation manner, which will not be elaborated here. It can be understood that the user can combine the rules of the source IP address, destination IP address, and fixed-position signature according to requirements. The required number of block RAMs is also determined based on the numbers required for the above three. For example, when combining the rules of the source IP address and the destination IP, a total of 32 block RAMs are required.

[0045] According to the above embodiments, the configuration of the matching rule for the combination of the source port and the protocol number, the configuration of the matching rule for the combination of the destination port and the protocol number, the configuration of the matching rule for the source IP address, the configuration of the matching rule for the destination IP address, and the configuration of the matching rule for the fixed-position signature are described. It can be understood that in practical applications, the above several rules can be independently matched, or the above several rules can be arbitrarily combined to meet different scenario applications.

[0046] In the above embodiments, the configuration of the matching rules is implemented by using the block RAM of the FPGA. When the resources of the block RAM are insufficient, the LUT RAM (Look-Up Table Random Access Memory) inside the FPGA can be used to implement the configuration of the matching rules.

[0047] As Figure 8 shown, in an embodiment of the present application, the FPGA further includes K LUT RAMs. Each LUT RAM includes multiple storage addresses, and the storage space corresponding to the storage address has M bits. The method further includes: Step S801: Divide the keyword and the mask into K groups of sub-keywords and sub-masks in groups of M bits respectively, and construct K matching rule sub-tables from the K groups of sub-keywords and the corresponding sub-masks. Each matching rule sub-table includes N matching rules, and each matching rule includes a rule number, a sub-keyword, and a sub-mask. For each matching rule sub-table, perform the steps of configuring the matching rules so that the matching rules of the matching rule sub-table are implemented in the corresponding LUT RAM, thereby implementing the configuration of the matching rules of the K LUT RAMs; Step S802: Divide the five-tuple information into K groups of sub-five-tuple information in groups of M bits, input the K groups of sub-five-tuple information into the K LUT RAMs, and determine the matching rule hit by the received packet based on the priority of the matching rules.

[0048] In this embodiment, the keyword and the mask are split by bytes into multiple groups of sub-keywords and sub-masks, and then multiple matching rule sub-tables can be obtained. The configuration of the matching rules is implemented for each matching rule sub-table in the corresponding LUT RAM. During the process of matching the received packet, the five-tuple information in the packet is divided into K groups of sub-five-tuple information in groups of M bits, and the K groups of sub-five-tuple information are input into the K LUT RAMs, and the matching rule hit by the received packet can be determined.

[0049] Exemplarily, the source port is taken as an example for illustration. Assume that the depth supported by the LUT RAM is 16, and the number of bits supported by the LUT RAM is 4 bits, that is, M is 4. The byte length of the source port is two bytes. Therefore, 4 LUT RAMs are required to implement the configuration of the matching rules, that is, K is 4. The source port and the source port mask are respectively divided into 4 groups of sub-source ports and sub-source port masks, and 4 sub-tables of matching rules are correspondingly obtained. Each sub-table of matching rules includes N matching rules, and each matching rule includes a rule number, a sub-source port, and a sub-source port mask. For each sub-table of matching rules, the steps of configuring the matching rules are performed according to the above embodiments, so that the matching rules in the sub-table of matching rules are implemented in the corresponding LUT RAM, thereby implementing the configuration of the matching rules for 4 LUT RAMs. The source port in the received packet is obtained, and the source port is divided into 4 groups of sub-source port information. The 4 groups of word source ports are respectively input into 4 LUT RAMs for rule matching. Each LUT RAM outputs the rule number of the matching rule hit by the packet. Based on the priority of the matching rules, the rule number with the highest priority is selected from the rule numbers of the matching rules output by the 4 LUT RAMs, and thus the rule number of the matching rule hit by the received packet can be determined.

[0050] In one embodiment of the present application, if the resources of the LUT RAM inside the FPGA cannot meet the configuration of the matching rules, the LUT DFF (LUT flip-flop) inside the FPGA can be used to implement the configuration of the rules, and the configuration of the rules is implemented by means of byte splitting. The specific scheme is basically similar to the configuration of the above LUT RAM, and will not be elaborated here.

[0051] Based on the same inventive concept, an embodiment of the present application further provides a device for matching line speed bit mask packets based on an FPGA. The implementation solution provided by this device to solve the problem is similar to the implementation solution described in the above method. Therefore, the specific limitations in one or more embodiments of the device for matching line speed bit mask packets based on an FPGA provided below can refer to the limitations on the method for matching line speed bit mask packets based on an FPGA in the above text, and will not be elaborated here.

[0052] Please refer to Figure 9 , an embodiment of the present application provides a device for matching line speed bit mask packets based on an FPGA. The FPGA includes at least one block RAM, and the block RAM includes a plurality of storage addresses. The storage space corresponding to the storage address has N bits. The device further includes: An obtaining module 901, configured to obtain N preset matching rules, each matching rule including a rule number, a keyword, and a mask corresponding to the keyword, the rule number being 0 to N-1, and N being a natural number; A rule configuration module 902 is used to perform the configuration of matching rules in the block RAM according to N matching rules. The steps for the configuration of matching rules include: for each matching rule, determine at least one storage address corresponding to the matching rule according to the valid bits of the mask and the corresponding keyword in the matching rule, determine the bits to be configured among the N bits of the storage address according to the rule number of the matching rule, and write an effective bit value used to represent the effective state of the matching rule in the bits to be configured. A packet matching module 903 is used to parse the received packet to generate five-tuple information, use the five-tuple information as the storage address of the block RAM, read multiple effective bit values corresponding to the storage address, and determine the rule numbers of the matching rules hit by the received packet based on the bits corresponding to each effective bit value.

[0053] Further, the rule configuration module 902 is specifically used for: Obtain the keyword and the corresponding mask in the matching rule, and determine multiple valid bits in the mask. Among them, the value of each bit in the mask represents whether the same bit in the keyword is valid, and the valid bit is the bit with a mask value of 0. Among the bits of the keyword, represent the bits at the same bit positions as the valid bits with undetermined values, and keep the bit values of the remaining bits unchanged. The undetermined value can be 0 or 1. Determine different combinations of bit values based on different values of the undetermined values of each bit and the bit values of the bits that remain unchanged, and represent multiple storage addresses of the block RAM with different combinations of bit values.

[0054] Further, the FPGA includes a first block RAM, a second block RAM, and a third block RAM. The keyword is the high eight bits of the source port, the low eight bits of the source port, and the protocol number, and the masks correspond to the high eight-bit mask of the source port, the low eight-bit mask of the source port, and the protocol number mask respectively. The rule configuration module 902 is specifically used for: For each first matching rule corresponding to the high eight bits of the source port, determine each first valid bit in the high eight-bit mask of the source port according to the first matching rule, determine each storage address of the first block RAM corresponding to the first matching rule according to each first valid bit and the high 8 bits of the source port, determine the bits to be configured among the N bits of each storage address according to the rule number of the first matching rule, and write an effective bit value used to represent the effective state of the first matching rule in the bits to be configured. For the second matching rule corresponding to the lower eight bits of each source port, determine each second valid bit in the lower eight-bit mask of the source port according to the second matching rule. According to each second valid bit and the lower 8 bits of the source port, determine each storage address of the second block of RAM corresponding to the second matching rule. Use the rule number of the second matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value representing the effectiveness of the second matching rule into the bits to be configured; For the third matching rule corresponding to each protocol number, determine each third valid bit according to the protocol number mask in the third matching rule. According to each third valid bit and the protocol number, determine each storage address of the third block of RAM corresponding to the third matching rule. Use the rule number of the third matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value representing the effectiveness of the third matching rule into the bits to be configured.

[0055] Further, the packet matching module 903 is specifically configured to: Parse the received packet to obtain the source port and protocol number in the packet; Use the high 8-bit data of the source port as the storage address of the first block of RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule numbers of the first matching rules hit by the high 8-bit data of the source port based on each effective bit value. This rule number is represented by the first rule number; Use the low 8-bit data of the source port as the storage address of the second block of RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule numbers of the second matching rules hit by the low 8-bit data of the source port based on each effective bit value. This rule number is represented by the second rule number; Use the protocol number as the storage address of the third block of RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule numbers of the third matching rules hit by the protocol number based on each effective bit value. This rule number is represented by the third rule number; Based on each first rule number, each second rule number, and each third rule number, determine at least one rule number that simultaneously hits the first matching rule, the second matching rule, and the third matching rule. Based on the priority of the matching rules, determine the rule number with the highest priority from at least one rule number as the rule number of the matching rule hit by the received packet.

[0056] Further, the FPGA includes a fourth block of RAM, a fifth block of RAM, and a sixth block of RAM. The keywords are the high eight bits of the destination port, the low eight bits of the destination port, and the protocol number, and the masks correspond to the high eight-bit mask of the destination port, the low eight-bit mask of the destination port, and the protocol number mask respectively. The rule configuration module 902 is specifically configured to: For the fourth matching rule corresponding to the high eight bits of each destination port, determine each fourth valid bit in the high eight-bit mask of the destination port according to the fourth matching rule. According to each fourth valid bit and the high 8 bits of the destination port, determine each storage address of the fourth block of RAM corresponding to the fourth matching rule. Use the rule number of the fourth matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value indicating the effectiveness of the fourth matching rule into the bits to be configured; For the fifth matching rule corresponding to the low eight bits of each destination port, determine each fifth valid bit in the low eight-bit mask of the destination port according to the fifth matching rule. According to each fifth valid bit and the low 8 bits of the destination port, determine each storage address of the fifth block of RAM corresponding to the fifth matching rule. Use the rule number of the fifth matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value indicating the effectiveness of the fifth matching rule into the bits to be configured; For the sixth matching rule corresponding to each protocol number, determine each sixth valid bit according to the protocol number mask in the sixth matching rule. According to each sixth valid bit and the protocol number, determine each storage address of the sixth block of RAM corresponding to the sixth matching rule. Use the rule number of the sixth matching rule to determine the bits to be configured among the N bits of each storage address, and write the effective bit value indicating the effectiveness of the sixth matching rule into the bits to be configured.

[0057] Furthermore, the packet matching module 903 is specifically configured to: Parse the received packet to obtain the destination port and protocol number in the packet; Use the high 8-bit data of the destination port as the storage address of the fourth block of RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule numbers of the fourth matching rules hit by the high 8-bit data of the destination port based on each effective bit value. This rule number is represented by the fourth rule number; Use the low 8-bit data of the destination port as the storage address of the fifth block of RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule numbers of the fifth matching rules hit by the low 8-bit data of the destination port based on each effective bit value. This rule number is represented by the fifth rule number; Use the protocol number as the storage address of the sixth block of RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule numbers of the sixth matching rules hit by the protocol number based on each effective bit value. This rule number is represented by the sixth rule number; Based on each fourth rule number, each fifth rule number, and each sixth rule number, determine at least one rule number that simultaneously hits the fourth matching rule, the fifth matching rule, and the sixth matching rule. Based on the priority of the matching rules, determine the rule number with the highest priority from the at least one rule number, and use it as the rule number of the matching rule hit by the received packet.

[0058] Further, the FPGA includes 16 seventh block RAMs. The keyword is one of the source IP address keyword, the destination IP address keyword, and the fixed position signature keyword, and the mask corresponds to one of the source IP address mask, the destination IP address mask, and the fixed position signature mask. The source IP address keyword, the source IP address mask, the destination IP address keyword, the destination IP address mask, the fixed position signature keyword, and the fixed position signature mask are all 128 bits. The rule configuration module 902 is specifically configured to: divide the keyword and the corresponding mask into 16 groups of keywords and 16 groups of masks respectively, with one byte as a group in the order from the high bit to the low bit. For each group of keywords, according to the steps of configuring the matching rules, configure the matching rules corresponding to the group of keywords into the corresponding seventh block RAM among the 16 seventh block RAMs to implement the configuration of the matching rules for the 16 seventh block RAMs. The packet matching module 903 is specifically configured to: parse the received packet, obtain the keyword in the packet, divide the keyword in the packet into 16 groups of keywords with one byte as a group in the order from the high bit to the low bit, input each group of keywords into the corresponding seventh block RAM among the 16 seventh block RAMs, and determine the matching rule hit by the received packet based on the priority of the matching rules.

[0059] Further, the FPGA includes K LUT RAMs. The LUT RAM includes multiple storage addresses, and the storage space corresponding to the storage address has M bits. The rule configuration module 902 is specifically configured to: divide the keyword and the mask into K groups of sub-keywords and sub-masks respectively, with M bits as a group, and construct K matching rule sub-tables from the K groups of sub-keywords and the corresponding sub-masks. Each matching rule sub-table includes N matching rules, and each matching rule includes a rule number, a sub-keyword, and a sub-mask. For each matching rule sub-table, execute the steps of configuring the matching rules to enable the matching rules of the matching rule sub-table to implement the configuration of the matching rules in the corresponding LUT RAM, thereby implementing the configuration of the matching rules for the K LUT RAMs. The packet matching module 903 is specifically configured to: divide the five-tuple information into K groups of sub-five-tuple information with M bits as a group, input the K groups of sub-five-tuple information into the K LUT RAMs, and determine the matching rule hit by the received packet based on the priority of the matching rules.

[0060] As an example, please refer to Figure 10, which shows a schematic structural diagram of a communication device provided by an embodiment of the present application. The network device includes a line - speed bit - mask packet matching device 1001 based on FPGA, a communication interface 1002, a processor 1003, a memory 1004, and a bus 1005. The processor 1003, the memory 1004, the communication interface 1002, and the line - speed bit - mask packet matching device 1001 based on FPGA are communicatively connected to each other through the bus 1005. The memory 1004 can be used to store computer programs, and the computer programs can include instructions and data. In the embodiments of the present application, the memory 1004 can be various types of storage media, such as random access memory, static random access memory, non - volatile RAM, DDR, etc. The memory 1004 can include a hard disk and / or memory. The processor 1003 can be a general - purpose processor. The general - purpose processor can be a processor that executes specific steps and / or operations by reading and executing the computer programs stored in a memory (such as the memory 1004), and the general - purpose processor is used to process the data output by the line - speed bit - mask packet matching device 1001 based on FPGA. The general - purpose processor can be, for example but not limited to, a central processing unit. In addition, the processor 1003 can also be a dedicated processor. The dedicated processor can be a processor specifically designed to execute specific steps and / or operations. The dedicated processor can be, for example but not limited to, ASIC and FPGA, etc. In addition, the processor 1003 can also be a combination of multiple processors, such as a multi - core processor. The communication interface 1002 can include input / output interfaces, physical interfaces, and logical interfaces, etc., which are used to implement the interconnection of devices inside the network device, as well as interfaces for implementing the interconnection between the network device and other devices (such as network devices). The physical interface can be a gigabit Ethernet interface, which can be used to implement the interconnection between the network device and other devices. The logical interface is an interface inside the network device, which can be used to implement the interconnection of devices inside the network device. The bus 1005 can be any type of communication bus used to implement the interconnection of the processor 1003, the memory 1004, the communication interface 1002, and the line - speed bit - mask packet matching device 1001 based on FPGA. For example, the structure of the system bus - based line - speed bit - mask packet matching device 1001 can refer to Figure 9 the shown embodiment, which will not be elaborated here. The interconnection between any one of the processor 1003, the memory 1004, and the communication interface 1002 and the line - speed bit - mask packet matching device 1001 specifically means the interconnection between this any one device and the devices in the line - speed bit - mask packet matching device 1001.

[0061] The embodiments disclosed in this application also provide a computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When it runs on a computer, the computer is caused to execute the FPGA-based wire-speed bit mask packet matching method described in any one of the above embodiments.

[0062] Although the preferred embodiments of this application have been disclosed for illustrative purposes, those of ordinary skill in the art will recognize that various improvements, additions, and substitutions are possible without departing from the scope and spirit of this application disclosed by the appended claims.

Claims

1. A line-speed bit mask message matching method based on FPGA, characterized in that: The FPGA includes at least one block RAM, the block RAM includes a plurality of storage addresses, the storage space corresponding to the storage address has N bits, and the method includes: Obtain N preset matching rules, each matching rule including a rule number, a keyword, and a mask corresponding to the keyword, the rule number is 0 to N-1, and N is a natural number; Performing configuration of matching rules in the block RAM according to the N matching rules, the configuration of the matching rules comprising: for each matching rule, determining at least one storage address corresponding to the matching rule according to the valid bits of the mask in the matching rule and the corresponding keyword, determining the bit to be configured among the N bits of the storage address according to the rule number of the matching rule, and writing the effective bit value used to indicate that the matching rule is effective in the bit to be configured; The received message is parsed to generate quintuple information, the quintuple information is used as the storage address of the block RAM, multiple valid bit values ​​corresponding to the storage address are read, and the rule numbers of each matching rule hit by the received message are determined based on each bit position corresponding to each valid bit value.

2. The FPGA-based line-speed bit mask message matching method according to claim 1, characterized in that: Determining at least one storage address corresponding to the matching rule according to the valid bits of the mask in the matching rule and the corresponding keywords includes: Obtain a keyword and a corresponding mask in the matching rule, and determine a plurality of valid bits in the mask, wherein the value of each bit in the mask represents whether the same bit in the keyword is valid, the valid bit is a bit with a mask value of 1, and the invalid bit is a bit with a mask value of 0; In each bit position of the keyword, each bit position having the same bit position as each ineffective bit is represented by a pending value, and the value of each bit position having the same bit position as each effective bit remains unchanged, and the value of the pending value is 0 or 1; Different bit value combinations are determined based on different values ​​of the pending values ​​of each bit and the bit values ​​of the bits that remain unchanged, and the different bit value combinations are used to represent multiple storage addresses of the block RAM corresponding to the matching rule.

3. The FPGA-based line-speed bit mask message matching method according to claim 1, characterized in that: The FPGA includes a first RAM, a second RAM, and a third RAM, the keywords are the high eight bits of the source port, the low eight bits of the source port, and the protocol number, the masks correspond to the high eight bits of the source port, the low eight bits of the source port, and the protocol number mask, respectively, and the steps of configuring the matching rule specifically include: For the first matching rule corresponding to the upper eight bits of each source port, determine each first valid bit in the upper eight bits mask of the source port according to the first matching rule, determine each storage address of the first block of RAM corresponding to the first matching rule according to each first valid bit and the upper eight bits of the source port, determine the bit to be configured in the N bits of each storage address according to the rule number of the first matching rule, and write the effective bit value used to indicate that the first matching rule is effective in the bit to be configured; For each second matching rule corresponding to the lower eight bits of the source port, determine each second valid bit in the lower eight bits mask of the source port according to the second matching rule, determine each storage address of the second block RAM corresponding to the second matching rule according to each second valid bit and the lower 8 bits of the source port, determine the bit to be configured in the N bits of each storage address according to the rule number of the second matching rule, and write the effective bit value used to indicate that the second matching rule is effective in the bit to be configured; For each third matching rule corresponding to a protocol number, each third valid bit is determined according to the protocol number mask in the third matching rule, and each storage address of the third block RAM corresponding to the third matching rule is determined according to each third valid bit and the protocol number, and the bit to be configured among the N bits of each storage address is determined according to the rule number of the third matching rule, and the effective bit value used to characterize the effectiveness of the third matching rule is written into the bit to be configured.

4. The FPGA-based line-speed bit mask message matching method according to claim 3, characterized in that: Determining a rule number of at least one matching rule hit by the received message based on the at least one valid bit value includes: Parsing the received message to obtain the source port and protocol number in the message; Using the high 8 bits of the source port as the storage address of the first RAM, reading multiple valid bit values ​​corresponding to the storage address, and determining the rule number of each first matching rule hit by the high 8 bits of the source port based on each valid bit value, the rule number being represented by the first rule number; Using the lower 8 bits of the source port as the storage address of the second RAM, reading multiple valid bit values ​​corresponding to the storage address, and determining the rule number of each second matching rule hit by the lower 8 bits of the source port based on each valid bit value, the rule number being represented by a second rule number; Using the protocol number as the storage address of the third RAM, reading multiple valid bit values ​​corresponding to the storage address, and determining the rule number of each third matching rule hit by the protocol number based on each valid bit value, the rule number is represented by a third rule number; Based on each first rule number, each second rule number and each third rule number, determine at least one rule number that simultaneously hits the first matching rule, the second matching rule and the third matching rule; based on the priority of the matching rule, determine the rule number with the highest priority from at least one rule number as the rule number of the matching rule hit by the received message.

5. The FPGA-based line-speed bit mask message matching method according to claim 1, characterized in that: The FPGA includes a fourth RAM, a fifth RAM, and a sixth RAM, the keywords are the high eight bits of the destination port, the low eight bits of the destination port, and the protocol number, the masks correspond to the high eight bits of the destination port, the low eight bits of the destination port, and the protocol number mask, respectively, and the steps of configuring the matching rule specifically include: For each fourth matching rule corresponding to the upper eight bits of the destination port, determine each fourth valid bit in the upper eight bits mask of the destination port according to the fourth matching rule, determine each storage address of the fourth RAM corresponding to the fourth matching rule according to each fourth valid bit and the upper eight bits of the destination port, determine the bit to be configured in the N bits of each storage address according to the rule number of the fourth matching rule, and write the effective bit value used to indicate that the fourth matching rule is effective in the bit to be configured; For each fifth matching rule corresponding to the lower eight bits of the destination port, determine each fifth valid bit in the lower eight bits mask of the destination port according to the fifth matching rule, determine each storage address of the fifth RAM corresponding to the fifth matching rule according to each fifth valid bit and the lower eight bits of the destination port, determine the bit to be configured in the N bits of each storage address according to the rule number of the fifth matching rule, and write the effective bit value used to indicate that the fifth matching rule is effective in the bit to be configured; For the sixth matching rule corresponding to each protocol number, each sixth valid bit is determined according to the protocol number mask in the sixth matching rule, and each storage address of the sixth block RAM corresponding to the sixth matching rule is determined according to each sixth valid bit and the protocol number, and the bit to be configured among the N bits of each storage address is determined according to the rule number of the sixth matching rule, and the effective bit value used to characterize the effectiveness of the sixth matching rule is written into the bit to be configured.

6. The FPGA-based line-speed bit mask message matching method according to claim 5, characterized in that: Determining a rule number of at least one matching rule hit by the received message based on the at least one valid bit value includes: Parsing the received message to obtain the destination port and protocol number in the message; Using the high 8 bits of the destination port as the storage address of the fourth RAM, reading multiple valid bit values ​​corresponding to the storage address, and determining the rule number of each fourth matching rule hit by the high 8 bits of the destination port based on each valid bit value, the rule number being represented by a fourth rule number; Using the lower 8 bits of the destination port as the storage address of the fifth RAM, reading multiple valid bit values ​​corresponding to the storage address, and determining the rule number of each fifth matching rule hit by the lower 8 bits of the destination port based on each valid bit value, the rule number being represented by the fifth rule number; Using the protocol number as the storage address of the sixth RAM block, reading multiple valid bit values ​​corresponding to the storage address, and determining the rule number of each sixth matching rule hit by the protocol number based on each valid bit value, the rule number is represented by the sixth rule number; Based on each fourth rule number, each fifth rule number and each sixth rule number, determine at least one rule number that simultaneously hits the fourth matching rule, the fifth matching rule and the sixth matching rule, and based on the priority of the matching rule, determine the rule number with the highest priority from at least one rule number as the rule number of the matching rule hit by the received message.

7. The FPGA-based line-speed bit mask message matching method according to claim 1, characterized in that: The FPGA includes 16 seventh blocks of RAM, the keyword is one of a source IP address keyword, a destination IP address keyword, and a fixed position feature code keyword, the mask corresponds to one of a source IP address mask, a destination IP address mask, and a fixed position feature code mask, the source IP address keyword, the source IP address mask, the destination IP address keyword, the destination IP address mask, the fixed position feature code keyword, and the fixed position feature code mask are all 128 bits, and the steps of configuring the matching rule specifically include: The keywords and the corresponding masks are divided into 16 groups of keywords and 16 groups of masks in the order of bits from high to low, respectively, with one byte as a group. For each group of keywords, according to the steps of configuring the matching rule, the matching rule corresponding to the group of keywords is configured to the corresponding seventh block RAM of the 16 seventh blocks RAM, so as to realize the configuration of the matching rule of the 16 seventh blocks RAM; Parse the received message, obtain the keywords in the message, divide the keywords in the message into 16 groups of keywords in order of bit positions from high to low, with one byte as a group, input each group of keywords into each corresponding seventh block RAM in the 16 seventh blocks RAM, and determine the matching rule hit by the received message based on the priority of the matching rule.

8. The FPGA-based line-speed bit mask message matching method according to claim 1, characterized in that: The FPGA further includes K LUT RAMs, the LUT RAMs include multiple storage addresses, the storage space corresponding to the storage addresses has M bits, and the steps of configuring the matching rules include: The keyword and mask are respectively divided into K groups of sub-keywords and sub-masks with M bits as a group, and the K groups of sub-keywords and corresponding sub-masks are constructed into K matching rule sub-tables, each matching rule sub-table includes N matching rules, and each matching rule includes a rule number, a sub-keyword and a sub-mask. For each matching rule sub-table, a matching rule configuration step is performed so that the matching rules of the matching rule sub-table are configured in the corresponding LUT RAM, thereby realizing the configuration of the matching rules of the K LUT RAMs; The quintuple information is divided into K groups of sub-quintuple information in groups of M bits, the K groups of sub-quintuple information are input into K LUT RAMs, and the matching rule hit by the received message is determined based on the priority of the matching rule.

9. A line-speed bit mask message matching device based on FPGA, characterized in that: The FPGA includes at least one block RAM, the block RAM includes a plurality of storage addresses, the storage space corresponding to the storage address has N bits, and the device includes: An acquisition module, used to acquire N preset matching rules, each matching rule including a rule number, a keyword and a mask corresponding to the keyword, the rule number is 0 to N-1, and N is a natural number; A rule configuration module, configured to perform configuration of matching rules in the block RAM according to the N matching rules, wherein the steps of configuring the matching rules include: for each matching rule, determining at least one storage address corresponding to the matching rule according to the valid bits of the mask in the matching rule and the corresponding keywords, determining the bit to be configured among the N bits of the storage address according to the rule number of the matching rule, and writing an effective bit value used to indicate that the matching rule is effective in the bit to be configured; A message matching module is used to parse the received message to generate quintuple information, use the quintuple information as the storage address of the block RAM, read multiple valid bit values ​​corresponding to the storage address, and determine the rule numbers of each matching rule hit by the received message based on each bit position corresponding to each valid bit value.

10. A communication device, characterized in that: It includes the FPGA-based line-speed bit mask message matching device as described in claim 9.

Images