Method for deploying regular expression based on P4 in intelligent network card / DPU

Abstract

The invention discloses a method for deploying a regular expression based on P4 in an intelligent network card / DPU. The method specifically comprises the following steps that the regular expression defined by a user is compiled into a finite-state machine; a matching table structure and a state register are defined in the P4 program and used for storing a state conversion rule of the regular expression, and a current matching state is recorded; and mapping a matching logic and a state register defined by the P4 into a hardware module of the intelligent network card / DPU, and realizing high-speed state conversion and matching by utilizing the parallel processing capability of the intelligent network card / DPU. According to the method for realizing regular expression matching based on P4 in the intelligent network card or the DPU, the regular expression is converted into the finite-state machine, and the programmability and the hardware acceleration capability of the P4 language are combined, so that the network flow detection and analysis efficiency is greatly improved, and the network flow detection and analysis efficiency is improved. And an effective solution is provided for next-generation network security and performance optimization.

Description

Technical Field

[0001] The present invention relates to the technical field of computer networks, and particularly to a method for implementing regular expression deployment based on P4 within an intelligent network card / DPU. Background Art

[0002] In modern network environments, traffic detection and deep packet inspection (DPI) are important technologies for ensuring network security and performance optimization. Traditional regular expression matching algorithms are usually deployed on the CPU, with high computational overhead and limited performance, unable to meet the requirements of high-speed networks. Intelligent network cards and DPUs have powerful parallel processing capabilities and programmable features, enabling efficient packet processing through hardware acceleration.

[0003] P4 (Programming Protocol-independent Packet Processors) is a high-level language for data plane programming that can flexibly define and modify the data processing logic of network devices.

[0004] However, current P4-based network programming frameworks still have significant limitations in expressing complex state behaviors (such as regular expression matching). On the one hand, P4 itself lacks native support for state machine logic. Especially for matching tasks that require multi-step state tracking and updating, developers often need to rely on external hardware or complex programming means for supplementation. On the other hand, due to factors such as register resources, action execution order, and processing bandwidth, existing P4-based solutions often face performance bottlenecks when processing traffic feature matching with high complexity and long expressions.

[0005] In addition, most existing research on implementing regular expression matching on intelligent network cards or DPUs uses predefined matching templates or static state transition methods, lacking support for dynamic state management, resource compression, and real-time update mechanisms. This approach is difficult to achieve flexible and scalable matching logic while maintaining high performance, limiting its application capabilities in complex DPI scenarios. Summary of the Invention

[0006] The purpose of the present invention is to provide a method for implementing regular expression deployment based on P4 within an intelligent network card / DPU to overcome the deficiencies in the prior art.

[0007] To achieve the above objective, the present invention provides the following technical solutions: The present application discloses a method for implementing regular expression deployment based on P4 within an intelligent network card / DPU, specifically including the following steps: S1. Compile the user-defined regular expression into a finite state machine; S2. Define a matching table structure and a status register in the P4 program to store the state transition rules of the regular expression, obtain the matching logic defined by P4, and record the current matching status; S3. Map the matching logic and status register defined by P4 in step S2 to the hardware module of the smart network card / DPU, and utilize the parallel processing ability of the smart network card / DPU to achieve high-speed state transition and matching; S4. Output and feedback the matching result.

[0008] Preferably, step S1 specifically includes the following sub-steps: S11. Convert the regular expression into an abstract syntax tree through a parser; S12. Convert the abstract syntax tree into a non-deterministic finite automaton; S13. Convert the non-deterministic finite automaton into a deterministic finite state machine; S14. Optimize the deterministic finite state machine by merging equivalent states.

[0009] Preferably, the specific operation of step S12 is as follows: Map the basic operations of each regular expression to the states and transitions of the non-deterministic finite automaton; the basic operations include character matching, concatenation, and selection.

[0010] Preferably, the specific operation of step S13 is as follows: For each input character, find all possible transitions from the current state set and summarize them into a new state, map the state set of the non-deterministic finite automaton to the states of the deterministic finite state machine, and obtain the deterministic finite state machine.

[0011] Preferably, the specific operation of step S2 is as follows: Define a matching table structure in the P4 program, each state and input of the regular expression correspond to an entry in the matching table structure, and the entry includes the actions of state transition and matching result; introduce a dedicated status register in the P4 program to store the current matching status corresponding to each data stream or data packet to support continuous matching across data packets; further define an intelligent caching mechanism in the P4 program to cache high-frequency states and matching results to reduce repeated matching operations and improve the matching efficiency of the data plane.

[0012] Preferably, the specific operation of step S3 is as follows: S31. The monitoring module is used to monitor data, and the configuration module is used to configure the parameters of each module in the smart network card / DPU; S32. The transceiver receives the data and gives it to the MAC layer for layer 2 protocol parsing. After passing through the P4 function module, the operations of reading and updating the status register, searching for matching table entries, and judging cache hits are completed. The packets with successful matches are handed over to the offloading engine module for subsequent processing. Finally, the data transfer module sends the data to the host through the PCIe interface.

[0013] Preferably, in step S3, when the number of states of the finite state machine exceeds 256, or the total capacity of the required status registers exceeds 64 KB, by designing and expanding the register resources inside the intelligent network card / DPU based on FPGA, the capacity of BRAM or SRAM can be flexibly increased to more efficiently support the complex state machine matching process.

[0014] Preferably, the specific operations of step S4 are as follows: S41. When the packet enters the intelligent network card / DPU, the P4 function module first extracts specific fields in the packet. S42. According to the extracted fields, first query the intelligent cache table; if the cache is hit, directly execute the predefined actions of the cache; if the cache is not hit, read the current state of the status register, and sequentially match the state transition rules of the finite state machine according to the matching logic defined by P4 to complete the regular expression matching, and update the matching result to the cache table. S43. Execute the predefined actions on the packets with successful matches. S44. Feed back the matching result to the control plane through metadata.

[0015] Advantages of the present invention: 1. High efficiency: By utilizing the hardware acceleration capabilities of intelligent network cards or DPU, the present invention can achieve high-speed regular expression matching, which is particularly suitable for high-throughput network environments. Compared with traditional software implementations, hardware acceleration can significantly reduce processing latency and increase the number of packets processed per second. In addition, through the flexible expansion design of FPGA, the storage capacity of registers can be further enhanced to support the high-speed matching of complex state machines and achieve higher processing performance. This makes the solution have significant advantages in applications such as high-speed packet processing, deep packet inspection, and network intrusion detection, meeting the requirements of modern high-performance networks for low latency and high throughput.

[0016] 2. Flexibility: Due to the highly programmable nature of the P4 language, users can dynamically update or add regular expressions according to their needs without having to redesign or replace the hardware. This flexibility is especially suitable for dealing with rapidly changing network threats or protocol changes. Users can quickly adjust the regular expression matching strategy to adapt to different network environments and security requirements. At the same time, through the flexible reconfiguration of hardware registers by FPGA, the adaptability to complex matching tasks can be further enhanced. Compared with the fixed design of traditional hardware, the programmability of P4 provides greater flexibility for network operation and maintenance.

[0017] 3. Scalability: The present invention supports parallel matching of multiple regular expressions, can detect multiple traffic patterns simultaneously, and is suitable for complex and diverse network traffic detection scenarios. For example, when performing network traffic classification, malware detection, or DPI, multiple regular expressions can be matched simultaneously on a single data stream, thereby improving the efficiency and accuracy of traffic analysis. This parallel processing ability enables the system to maintain a high processing efficiency even in the face of a large number of concurrent traffic, and can flexibly cope with the expansion requirements of future traffic analysis tasks.

[0018] 4. Resource conservation: By transferring the regular expression matching task to the hardware data plane of the smart network card or DPU, the dependence on the host CPU is reduced. This not only reduces the occupancy of CPU resources, avoids the computing bottleneck that may occur in traditional software implementations, but also improves the overall resource utilization rate of the system. Through the flexible design and optimization of register resources by FPGA, the usage efficiency of hardware resources is further improved, effectively saving energy consumption and computing resources, and reducing the overall system cost.

[0019] The features and advantages of the present invention will be described in detail through embodiments in conjunction with the accompanying drawings. Description of the Drawings

[0020] Figure 1 is a flowchart for compiling a regular expression into a finite state machine; Figure 2 is an architecture diagram of a P4 smart network card / DPU; Figure 3 is a schematic flowchart of a P4 functional module. Detailed Embodiments

[0021] To make the objectives, technical solutions, and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below through the accompanying drawings and embodiments. However, it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the scope of the present invention. In addition, in the following description, the descriptions of well-known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present invention.

[0022] Based on the existing P4 framework, limited simple regular expression matching can be achieved. To implement the state machine matching of more regular expressions, through the flexible programmability of the FPGA intelligent network card, the present invention creatively introduces dedicated state registers under the standard P4 architecture to efficiently store and manage the state information during the data stream or packet matching process. By using this register, the real-time recording and updating of the packet matching state can be realized, significantly improving the support ability of the data plane for complex regular expression matching tasks. At the same time, the present invention further designs a state compression and intelligent caching mechanism for the register, greatly reducing the register resource occupancy and further improving the resource utilization rate of the P4 architecture. It will significantly improve the efficiency of network traffic analysis and processing while reducing the dependence on traditional CPU resources.

[0023] A method for implementing regular expression deployment based on P4 in an intelligent network card / DPU according to the present invention mainly includes the following steps: 1. Regular expression compilation (such as Figure 1 ) Compile the user-defined regular expression into a finite state machine (Finite State Machine, FSM), such as a deterministic finite state machine (DFA) and a non-deterministic finite automaton (NFA); Use an optimization algorithm to merge and minimize the states of the FSM to reduce the hardware resource occupancy.

[0024] Specifically, first, the regular expression needs to be converted into a tree structure, called an abstract syntax tree (AST), through a parser. This tree represents the hierarchical structure and operation order of the regular expression; second, convert the abstract syntax tree into a non-deterministic finite automaton (NFA). This process is usually carried out recursively, and each basic operation of the regular expression (such as character matching, concatenation, selection, etc.) is mapped to NFA states and transitions; when converting the NFA to a DFA, for each input character, find all possible transitions from the current state set and summarize them into a new state, mapping the state set of the NFA to the states of the DFA. The result of this conversion is a DFA that can jump between definite states, avoiding multiple choices in the NFA; after the DFA is constructed, there may be many redundant states, and the DFA can be optimized by merging equivalent states to reduce its scale; finally, through the above steps, we obtain a minimized DFA that can be used in the regular expression matching process.

[0025] 2. P4 language mapping: Define a matching table structure in the P4 program to store the state transition rules of the regular expression; Each combination of a state and an input symbol corresponds to an entry in the matching table, specifying the state transition action; a state register is introduced to record the current state of each flow or session, supporting continuous state transitions across data packets; meanwhile, an intelligent caching mechanism is defined to cache frequent states and matching results, optimizing the matching performance.

[0026] 3. Hardware mapping of intelligent network cards / DPUs (supporting intelligent network card architectures for P4 such as Figure 2 ): Map the matching logic defined by P4 to the hardware resources of intelligent network cards or DPUs, such as TCAM or SRAM; when the regular expression state machine is complex or has a large number of states, expand the internal BRAM or SRAM resources through the FPGA architecture, and utilize the parallel processing ability of intelligent network cards to achieve high-speed state transitions and matching.

[0027] Specifically, Figure 2 in it, the monitoring module is used to monitor data, the configuration module is used to configure the parameters of each module in the network card, the transceiver receives data and gives it to the MAC layer for layer 2 protocol parsing, passes through the P4 function module (such as Figure 3 ), then passes through the offloading engine to offload the work originally processed by the CPU such as verification and fragmentation, and finally the data transfer module sends the data to the host side through the PCIe interface. As Figure 3 , the packet and the metadata carrying information enter the packet parsing module, which decomposes the packet header, packet data, control information, and metadata; among them, the packet header, control information, and metadata enter the matching module for matching according to the P4 definition, and this module performs regular expression matching based on the state transition rules of the finite state machine. This part uses the state register to record the matching progress and combines with the P4 table entries to achieve state transitions, which is the key innovation point of this invention different from the traditional P4 data plane. The action module performs matching and action operations, the packet data is integrated in the final integration module along with the entire data stream, and the packet and the metadata to be reported are uploaded to the host.

[0028] 4. Result output: When a data packet enters the intelligent network card / DPU, specific fields (such as Payload) are extracted first.

[0029] Match the state transition rules of the FSM sequentially through the P4 table structure to complete the regular expression matching.

[0030] Execute predefined actions (such as discard, forward, or record) on the data packets that match successfully.

[0031] Feed the matching results back to the control plane through metadata.

[0032] Example: 1. Regular expression parsing: The user inputs a regular expression through the control plane. For example, a(b|c)*d can be decomposed into the following parts: a: Matches the character 'a'.

[0033] (b|c)*: Represents zero or more combinations of 'b' or 'c'.

[0034] d: Matches the character 'd'.

[0035] 2. Construct a finite state machine: State0: Initial state - Input 'a' -> Go to state 1, State1: After matching 'a', - Input 'b' or 'c' -> Go to state 2, - Input 'd' -> Go to state 4 (accepting state), State2: After matching 'b' or 'c', - Input 'b' or 'c' -> Remain in state 2 (loop), - Input 'd' -> Go to state 4 (accepting state), State4: After matching 'd', accepting state, - Matching successful, end.

[0036] What this state machine means is: From the initial state (state 0), receive the character 'a' and go to state 1.

[0037] In state 1, receive the character 'b' or 'c' and go to state 2, indicating to continue matching the (b|c)* part.

[0038] In state 2, when receiving more 'b' or 'c', it will stay in state 2 (loop).

[0039] In state 2 or state 1, receive the character 'd' and go to state 4, indicating successful matching.

[0040] 3. Map to P4 language: The control plane tool compiles the regular expression into an optimized DFA and generates the corresponding P4 configuration file; In P4, we can use match-action tables to implement these states and state transitions. Each table entry corresponds to a matching condition and the corresponding action. P4 allows defining multiple states and performing state transitions based on the value of the input character.

[0041] The following shows how to implement this regular expression matching in P4: / / Define the matching fields to be used in P4 header_typereg_expr_header_t{ bit<8>byte_0; / / Used to match the character 'a' bit<8>byte_1; / / Used to match the character 'b' or 'c' bit<8>byte_2; / / Used to match the character 'd' } structmetadata{ bit<1>match_done; / / Matching completion flag } / / Define the states of the state machine enumstate{ STATE_0, / / Initial state STATE_1, / / State after matching 'a' STATE_2, / / State after matching 'b' or 'c' STATE_4 / / Accepted state after matching 'd' } / / Matching-action table in the data plane tablereg_expr_table{ actions={ match_a; / / Match the character 'a' match_bc; / / Match the character 'b' or 'c' match_d; / / Match the character 'd' } key={ reg_expr_header_t.byte_0:exact;, reg_expr_header_t.byte_1:exact;, reg_expr_header_t.byte_2:exact; } size=1024; / / Determine the table size according to actual needs } / / Definition of matching actions actionmatch_a(){ if(reg_expr_header_t.byte_0==97){ / / The ASCII value of 'a' is 97 metadata.match_done = 0; } } actionmatch_bc() { if (reg_expr_header_t.byte_1 == 98 || reg_expr_header_t.byte_1 == 99) { / / 'b' or 'c' metadata.match_done = 0; } } actionmatch_d() { if (reg_expr_header_t.byte_2 == 100) { / / The ASCII value of 'd' is 100, metadata.match_done = 1; / / Matching completed, set the flag}} / / Control flow in the data plane controlingress { apply(reg_expr_table); if (metadata.match_done == 1) { / / If the match is successful, perform a certain action / / For example, forward the data packet to a specific destination, or discard the data packet, etc.}}.

[0042] 4. Map it to a P4 - enabled smart network card and write the table entry into the hardware resources of the smart network card or DPU 5. Running process: When a data packet passes through the smart network card or DPU, the P4 control plane checks each byte of the data packet and gradually matches it according to the state machine of the regular expression.

[0043] If the match is successful, metadata.match_done will be set to 1, indicating a successful match; otherwise, the state machine will remain in the current state or transfer to the next state.

[0044] Conclusion: The present invention provides a method for implementing regular expression matching based on P4 in an intelligent network card or DPU. By converting regular expressions into finite state machines and combining the programmability and hardware acceleration capabilities of the P4 language, the efficiency of network traffic detection and analysis is greatly improved. This method is particularly suitable for scenarios of rapid matching of regular expressions with a definite structure (which can be converted into finite state machines), and has wide applicability and advantages in high-performance network applications such as deep packet inspection, intrusion detection, and protocol identification.

[0045] It should be noted that this method is mainly applicable to regular expressions that can be constructed into finite state machines, and its applicability may be limited for some complex expressions that are not suitable for state machine modeling.

[0046] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, or improvements made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for implementing regular expression deployment based on P4 in a smart network card / DPU, characterized in that, The specific steps are as follows: S1. Compile the regular expression defined by the user into a finite state machine; S2. Define a matching table structure and a status register in the P4 program to store the state transition rules of the regular expression, obtain the matching logic defined by P4, and record the current matching status; S3. Map the matching logic and status register defined by P4 in step S2 to the hardware module of the smart network card / DPU, and utilize the parallel processing ability of the smart network card / DPU to achieve high-speed state transition and matching; S4. Output and feedback the matching result.

2. The method for implementing regular expression deployment based on P4 in a smart network card / DPU according to claim 1, characterized in that, Step S1 specifically includes the following sub-steps: S11. Convert the regular expression into an abstract syntax tree through a parser; S12. Convert the abstract syntax tree into a non-deterministic finite automaton; S13. Convert the non-deterministic finite automaton into a deterministic finite state machine; S14. Optimize the deterministic finite state machine by merging equivalent states.

3. The method for implementing regular expression deployment based on P4 in an intelligent network card / DPU according to claim 2, wherein The specific operation of step S12 is as follows: Map each basic operation of the regular expression to the states and transitions of the non-deterministic finite automaton; the basic operations include character matching, concatenation, and selection.

4. A method for implementing regular expression deployment based on P4 in an intelligent network card / DPU as described in claim 2, characterized in that, The specific operation of step S13 is as follows: For each input character, find all possible transitions from the current state set and summarize them into a new state, map the state set of the non-deterministic finite automaton to the states of the deterministic finite state machine, and obtain the deterministic finite state machine.

5. A method for implementing regular expression deployment based on P4 in an intelligent network card / DPU as claimed in claim 1, characterized in that, The specific operation of step S2 is as follows: Define a matching table structure in the P4 program. Each state and input of the regular expression correspond to an entry in the matching table structure, and the entry includes actions for state transition and matching results; Introduce a dedicated status register in the P4 program to store the current matching status corresponding to each data stream or data packet to support continuous matching across data packets; Further define an intelligent caching mechanism in the P4 program to cache high-frequency states and matching results to reduce repeated matching operations and improve the matching efficiency of the data plane.

6. The method for implementing regular expression deployment based on P4 in a smart network card / DPU as described in claim 1, wherein The specific operation of step S3 is as follows: S31. The monitoring module is used to monitor data, and the configuration module is used to configure the parameters of each module in the smart network card / DPU; S32. The transceiver receives the data and gives it to the MAC layer for layer 2 protocol parsing. After passing through the P4 function module, the operations of reading and updating the status register, searching the matching table phase, and judging cache hit are completed. The data packets with successful matching are handed over to the offloading engine module for subsequent processing, and the data transfer module finally sends the data to the host through the PCIe interface.

7. The method for implementing regular expression deployment based on P4 in an intelligent network card / DPU according to claim 1, characterized in that In step S3, when the number of states of the finite state machine exceeds 256, or the total capacity of the required status register exceeds 64KB, by designing and expanding the register resources inside the hardware based on the FPGA-based smart network card / DPU, the capacity of BRAM or SRAM can be flexibly increased to more efficiently support the complex state machine matching process.

8. A method for implementing regular expression deployment based on P4 in a smart network card / DPU as described in claim 1, characterized in that, The specific operation of step S4 is as follows: S41. When the data packet enters the smart network card / DPU, the P4 function module first extracts specific fields from the packet; S42. First, query the intelligent cache table according to the extraction fields. If the cache is hit, directly execute the predefined actions in the cache. If the cache is not hit, read the current state of the status register, and sequentially match the state transition rules of the finite state machine according to the matching logic defined by P4 to complete the regular expression matching, and update the matching result to the cache table this time. S43. Execute the predefined actions on the successfully matched data packets. S44. Feed back the matching result to the control plane through metadata.

Images