UPF function acceleration method based on programmable hardware

Abstract

The invention discloses a UPF function acceleration method based on programmable hardware, belongs to the field of 5G mobile communication networks, unloads a UPF function which is realized by relying on a CPU in a server traditionally to a data processing unit DPU, makes full use of the architecture advantage of software and hardware cooperative processing of the DPU, and realizes significant reduction of data packet processing time delay and improvement of system throughput performance. The matching rules with the dependency relationship are analyzed and reconstructed to generate independent rules which can be issued independently, so that redundancy and conflicts of a hardware rule table are reduced. Meanwhile, a traffic classification mechanism is used, network traffic is divided into large and small streams which are respectively mapped to hardware and software paths for processing, and the performance advantage of software and hardware co-processing is exerted to the maximum extent. According to the method, the data packet processing capability can be obviously optimized in a high-load scene, the delay bottleneck is effectively reduced, and the overall throughput rate and the resource utilization rate of the system are improved.

Description

Technical Field

[0001] The present invention belongs to the field of 5G mobile communication networks and relates to in-network programming technology for smart network cards. Background Art

[0002] With the widespread development and adoption of fifth-generation mobile communication technology (5G), people's daily communication experience has been significantly enhanced. Compared with previous communication technologies, 5G not only provides higher network bandwidth and faster data rates, but also lower latency and higher reliability. However, these technological advances have also brought with them an explosive growth in network data traffic. The emergence of a large number of emerging services such as high-definition video, augmented reality (AR), virtual reality (VR), connected vehicles, and the Industrial Internet of Things (IIoT) has posed unprecedented challenges to network bandwidth, latency, reliability, and service isolation. The traditional fourth-generation mobile communication network (4G) architecture has been unable to adapt to such rapidly growing and diverse service demands.

[0003] In 4G networks, data processing network elements (NEs) simultaneously handle user data forwarding and control plane management, resulting in a relatively complex network architecture. To address these bottlenecks and more efficiently handle data traffic in 5G networks, the 3GPP (3rd Generation Partnership Project) officially released 3GPP Release 15 in June 2018, the first official 5G network architecture specification.

[0004] 3GPP Release 15 clearly introduced the concept of Control and User Plane Separation (CUPS). The core idea of ​​this architecture is to separate the data forwarding and control functions in traditional network architectures into two independent network functional entities, thereby improving network flexibility, scalability, and maintainability. In this context, 3GPP formally defined a new network functional entity—the User Plane Function (UPF)—to replace the traditional 4G network element.

[0005] The UPF is specifically responsible for user data forwarding, routing, QoS (Quality of Service) policy enforcement, and billing data generation. Compared to traditional network nodes, the UPF offers greater deployment flexibility and can be deployed closer to the user, significantly reducing network latency. It also supports network virtualization and containerized deployment, enabling more flexible response to the needs of diverse services and application scenarios. The emergence of the UPF has greatly enhanced the overall performance of 5G networks, meeting the demands of ultra-high-volume, ultra-low-latency, and ultra-high-reliability services, and providing strong support for digital transformation and innovation across various industries.

[0006] With the continuous evolution of 5G, there is increasing emphasis on edge computing, especially in the 6G network architecture. As a core component, edge computing is gradually becoming a key bearer form of the mobile core network. This requires UPF to have higher throughput performance, lower latency, and stronger dynamic scalability.

[0007] In cloud-native core network architectures, UPF is typically deployed on x86-based server platforms and optimized for performance through software acceleration frameworks such as DPDK, VPP, and eBPF. However, in real-world scenarios with high-density user access and highly dynamic traffic, UPF still faces significant performance bottlenecks such as excessive CPU resource consumption, frequent context switching, and low cache hit rates. Recent research has attempted to offload UPF functions to hardware acceleration platforms such as P4 switches and SmartNICs, aiming to further improve network performance while ensuring flexibility. However, while P4 switches offer significant throughput advantages, their high cost and power consumption limit their large-scale deployment in edge scenarios. FPGA solutions, while offering excellent flexibility and customization, are also limited in their practical application due to their high development complexity and high cost. Furthermore, the current maximum throughput of mainstream P4 SmartNICs is approximately 50 Gbps, which is insufficient to meet the processing performance requirements of 100 Gbps and above for future 6G edge UPFs. In comparison, DPU (data processing unit) has higher throughput performance, lower cost and power consumption, and excellent programmability, making it an ideal hardware platform for 6G edge UPF deployment. Summary of the Invention

[0008] The purpose of this invention is to meet the high throughput, low latency, and large-scale user access requirements of UPF in 6G edge networks. By offloading the UPF from the server to the DPU, server CPU resources are freed up. The DPU can then quickly process and forward data packets on the data plane, reducing end-to-end latency and improving throughput.

[0009] To achieve the above objectives, the present invention provides a method for accelerating UPF functions based on programmable hardware. The specific technical solutions of the present invention are as follows:

[0010] The UPF function acceleration method based on programmable hardware is to offload the UPF function in the server to the DPU, send the data stream to the DPU hardware interface, and let the DPU perform data packet processing. Specifically, it includes the following steps:

[0011] Before data flow transmission begins, various rules in the user plane function UPF, including packet detection rules PDR, forwarding action rules FAR, usage reporting rules URR, and QoS enforcement rules QER, are stored in a configuration file in JSON format. When the program starts, all rules are loaded into the ARM memory on the DPU by parsing the configuration file;

[0012] A traffic processing mechanism that integrates software and hardware is introduced to hierarchically process data flows by combining software and hardware paths. When new traffic that does not match the hardware forwarding rules arrives, the data packet first enters the DPU's hardware processing module. The hardware processing module automatically guides the data packet to the software path through the RSS mechanism. This is the ARM-based processing system inside the DPU. The ARM processor matches the data packet with the flow table rules. If an existing rule is matched, the new rule is sent to the hardware to enable rapid matching and processing of subsequent traffic. After the rule is sent, the ARM processor encapsulates, decapsulates, and forwards the current data packet. For traffic that has already been matched by the rules, the hardware path can directly complete high-speed matching without software intervention, and encapsulates or decapsulates the data packet according to the rule instructions before forwarding it.

[0013] When subsequent data packets enter the DPU hardware again, the hardware will divert the data to the corresponding hardware processing pipeline based on the data uplink or downlink traffic direction, and match it with the pre-issued PDR rules. For the matched uplink data flow, the hardware will perform decapsulation operations based on the FAR rules associated with the PDR, restore the data packet to a standard single-layer UDP format, and complete forwarding through the specified egress port; for the downlink data flow, if the PDR match is completed, a GTP-U tunnel header will be added to the original data packet and forwarded through the specified port.

[0014] Furthermore, the method of the present invention also includes: introducing a rule reading module into the ARM architecture-based processing system inside the DPU, which adopts the storage form of a hash table, uses the IP address of each user equipment UE as the key of the hash table, and uses the PDR rule data of the corresponding UE as the value to achieve efficient indexing and management of the rules.

[0015] Furthermore, the method described in the present invention also includes: introducing a data packet parsing module into the ARM architecture-based processing system inside the DPU, which extracts the five-tuple key field information including the source IP address, destination IP address, source port, destination port and protocol type, as well as the specific structural information of the data packet through structured parsing of the data packet header, to provide support for subsequent rule matching and processing.

[0016] Furthermore, the method described in the present invention also includes: introducing a rule matching module into the ARM architecture-based processing system inside the DPU, which uses an efficient hash table search mechanism to perform precise matching and fuzzy matching on key fields such as the source IP address, destination IP address, source port number, and destination port number of the data packet to quickly determine whether there is a corresponding PDR rule entry for the data packet, and ultimately determine the optimal matching rule corresponding to the data packet.

[0017] Furthermore, the method described in the present invention also includes: introducing a traffic classification module into the ARM architecture-based processing system inside the DPU, and efficiently classifying the traffic through a data structure based on Count-Min Sketch. When the data packet arrives at the control plane, the module extracts its external IP address as the flow identifier, and uses multiple sets of independent hash functions to map the identifier to a two-dimensional counting matrix, and the counter values ​​of the corresponding positions are incrementally updated; the system estimates the frequency of occurrence of the data flow in real time based on the minimum value in the counters mapped by each hash path. When the estimated value exceeds the set threshold, the flow is judged as a large flow, and the corresponding hardware path unloading mechanism is triggered to achieve rapid processing and path optimization of large flows.

[0018] Furthermore, the method described in the present invention also includes: introducing a rule processing module into the ARM architecture-based processing system inside the DPU, which is used to dynamically determine whether the rules need to be unloaded from the control plane to the data plane fast path based on the judgment result of the traffic classification module on the data flow scale, and execute the rule dependency removal algorithm before the rules are issued, generate isolation rules without rule dependencies, and issue them to the hardware.

[0019] Among them, the rule dependency removal algorithm first determines the dependency rule set, and makes a judgment by comparing the values ​​of the bits with the best matching rule mask of 1 with the corresponding bits of other rules. According to the dependency rule set, a concretization matrix is ​​constructed to identify potential conflicting bits; at the bit with the best matching rule mask of 0, if the mask of the dependency rule at this position is 1, and the bit value is inconsistent with the actual bit value of the current data stream, then the bit is marked as a potential conflicting bit; after the concretization matrix is ​​constructed, the algorithm efficiently selects bits, traverses the concretization matrix row by row, and skips the conflicting rows covered by the current mask; for the conflicting rows that have not been covered, the algorithm quickly extracts the conflicting position corresponding to its least significant bit through bit operations, and adds it to the set of candidate bits, while updating the current mask to mark that the conflicting row has been covered, and repeats the traversal until all necessary bits are selected; finally, according to the selected concretization bit, an isolation rule is generated according to the best matching rule, the corresponding bit of the best matching rule mask is set to 1, and the corresponding bit position of the rule IP is set to a value consistent with the current data stream.

[0020] Furthermore, the method described in the present invention also includes: introducing a data packet forwarding module into the ARM architecture-based processing system inside the DPU, which adopts the high-performance data packet sending mechanism provided by the data plane development kit DPDK to realize rapid processing and forwarding of data packets. With the help of DPDK's user-state polling mode and zero-copy mechanism, the data packet forwarding module can significantly reduce the delay and system overhead in the data packet processing process, and effectively improve the data plane throughput performance of UPF.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] The present invention offloads the UPF function in the 5G core network to the DPU, proposes a software-hardware collaborative processing architecture, and introduces a rule dependency resolution algorithm and a traffic identification mechanism. Compared with existing solutions, this software-hardware combined architecture can give full play to the hardware acceleration capabilities and accelerate the data packet processing process. The traffic identification mechanism can accurately distinguish between large and small flows, and adopts a "hot flow hardware processing, cold flow software processing" diversion strategy, which not only improves the efficiency of large flow processing, but also reduces the frequent issuance of small flow rules, saving valuable hardware resources. The rule dependency resolution algorithm strips off the dependencies between rules and generates isolated independent rules. While ensuring the accuracy of rule matching, it effectively reduces the issuance of redundant rules and further improves the resource utilization of hardware. The above mechanisms work together to significantly improve the data forwarding throughput performance of UPF. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is the overall workflow diagram of the present invention;

[0024] Figure 2 This is a comparison chart of the average throughput of the present invention and the traditional method;

[0025] Figure 3 This is a comparison chart of throughput changes over time between the present invention and the traditional method; DETAILED DESCRIPTION

[0026] In order to more clearly illustrate the technical solution of the present invention, a detailed description will be given below with reference to the accompanying drawings and examples.

[0027] The present invention proposes a method for accelerating the UPF function based on programmable hardware, which is as follows:

[0028] A DPU-based processing architecture combining hardware and software collaboration was proposed, leveraging the synergy between the fast and slow paths within the DPU platform. In the slow path, the DPU's ARM processor leverages DPDK to implement user-mode packet parsing and forwarding, significantly reducing the overhead of frequent switching between kernel and user modes. In the fast path, only successfully matched rules are forwarded to the DPU's BlueField-2 hardware, which accelerates packet processing, effectively reducing forwarding latency and ensuring high throughput performance.

[0029] A fast rule dependency elimination algorithm is proposed to calculate the dependency-free rules in a very short time, effectively solving the problem of hardware resource waste caused by the complex dependencies between UPF rules, minimizing the storage requirements of redundant rules in the hardware, and improving the utilization efficiency of hardware resources.

[0030] A sketch-based traffic classification mechanism was designed to achieve efficient and accurate classification of network traffic. Considering the significant locality of network traffic, a small number of hot flows account for the majority of the traffic load, and these hot flows typically only match a small number of rules. Therefore, rules matching large flows are offloaded to the hardware path for accelerated processing, while small flow rules are handled by the software path. This avoids the waste of hardware resources and damage to forwarding performance caused by frequent offloading of small flow rules, thereby improving system throughput and hardware resource utilization.

[0031] The steps of the method include:

[0032] 1) Before data transmission begins, various user plane function (UPF) rules, including packet detection rules (PDR), forwarding action rules (FAR), usage reporting rules (URR), and QoS enforcement rules (QER), are stored in a configuration file in JSON format. When the program starts, it parses this configuration file and loads all the rules into the ARM memory on the DPU for subsequent packet matching and processing.

[0033] 2) When a new data flow arrives at the system, the packet first enters the DPU's hardware processing module. Since the hardware hasn't yet configured the corresponding matching rules, the packet, after passing through a ten-stage processing pipeline, is uploaded to the control plane via the Receive Side Scaling (RSS) mechanism. Based on the DPDK framework, the control plane continuously receives pending packets using a polling method and performs rule table lookups to determine whether the data flow matches a loaded rule entry. For successfully matched data flows, the system then counts packets and performs traffic statistics, and completes the necessary processing and forwarding operations, also performed by DPDK. When the cumulative number of packets in a data flow exceeds a preset threshold, the flow is identified as a large flow, and the control plane triggers the large flow rule offloading mechanism. This mechanism selects the optimal matching rule based on the current packet's characteristics, analyzes other rules it depends on, and jointly generates corresponding isolation rules. Finally, the isolation rules are distributed to the hardware, enabling fast-path forwarding of the data flow and preventing subsequent packets from being repeatedly uploaded to the control plane, significantly improving overall processing efficiency and system throughput.

[0034] 3) When subsequent data packets enter the DPU hardware again, the hardware will automatically identify the direction of the data packet (i.e., uplink traffic or downlink traffic) based on the data packet header information and characteristic fields, and divert it to the corresponding hardware processing pipeline. In the hardware pipeline, the data packet will be matched with the pre-issued PDR rules. For successfully matched uplink data flows, the hardware performs decapsulation operations based on the FAR rules associated with the PDR, that is, removes the GTP-U (GPRS Tunneling Protocol-UserPlane) tunnel header, restores the data packet to a standard single-layer UDP format, and completes forwarding through the designated egress port. For downlink data flows, after the data packet completes the PDR match in the Ingress stage, the Egress stage will perform encapsulation operations based on the FAR rules, add a GTP-U tunnel header in front of the original data packet, and then forward it out of the device through the designated port. The entire process is completed efficiently in the hardware path of the DPU, avoiding control plane intervention, thereby significantly improving the timeliness of data forwarding and system throughput performance.

[0035] Example:

[0036] The network architecture constructed in this paper uses a server equipped with a 100Gbps NVIDIA BlueField-2 DPU and a 100Gbps Mellanox ConnectX-6 network card as the UPF system under test, and another server equipped with a 100Gbps Mellanox ConnectX-5 network card as the traffic generator. The traffic generation server is installed with DPDK and generates mobile network traffic based on the Pkt-Gen tool. The two servers are directly connected via a 100Gbps high-speed fiber to ensure that the network transmission in the test environment is bottleneck-free.

[0037] Figure 1 The overall architecture of the present invention is demonstrated, consisting of two parts: the control plane (software implementation) and the data plane (programmable hardware implementation). Its data processing flow is divided into two categories: the fast path and the slow path: the data packets of the fast path are directly processed and forwarded in the data plane without going through the CPU, thus having higher forwarding efficiency; the slow path is suitable for data packets that cannot match the existing rules in the data plane and require further processing by the CPU. In the fast path, when the data packet can successfully match the rules deployed in the data plane, it can be processed and forwarded directly in the hardware without being sent to the control plane, which greatly improves the forwarding performance. In the slow path, data packets that do not hit any rules will be forwarded to the control plane through the RSS mechanism. The control plane then performs processing operations such as parsing, rule search, traffic classification, rule generation and offloading on the data packet, and finally completes the sending of the data packet through DPDK.

[0038] The DPU-based hardware-software collaborative processing architecture proposed in the present invention includes multiple modules in the control plane, and each module works together to implement functions, including a rule reading module, a data packet parsing module, a rule matching module, a traffic classification module, a rule processing module and a data packet forwarding module.

[0039] The rule reading module is responsible for loading and managing various UPF rules, storing them in the ARM CPU memory using an efficient data structure. Specifically, this module uses a hash table storage format, with each user equipment (UE) IP address as the hash table key and the corresponding UE's PDR rule data as the value, to achieve efficient indexing and management of rules. When a data packet arrives, a hash table query using the UE's IP address as the key enables fast rule location with O(1) time complexity, significantly reducing the latency of packet rule matching.

[0040] The packet parsing module is responsible for analyzing and processing packets transmitted from the data plane to the control plane. This module analyzes the structure of the packet header to extract key fields, including the five-tuple (source IP address, destination IP address, source port, destination port, and protocol type), as well as the packet's structure. This provides support for subsequent rule matching and processing.

[0041] The rule matching module is responsible for matching packet detection rules based on the key fields extracted by the packet parsing module. Specifically, this module uses an efficient hash table lookup mechanism to perform both exact and fuzzy matching on key fields such as the source IP address, destination IP address, source port number, and destination port number of a packet. This allows the module to quickly determine whether a corresponding PDR rule entry exists for the packet and ultimately determine the optimal matching rule for the packet.

[0042] The traffic classification module is responsible for real-time statistics and analysis of the traffic to which the data packet belongs, and determines the traffic type (i.e., "large flow" or "small flow") based on the statistical results of the traffic scale. To this end, the present invention proposes a real-time traffic classification mechanism based on the Count-MinSketch algorithm. The core strategy of this mechanism is to define the data flow whose cumulative number of data packets exceeds the threshold as a "large flow" by setting a data packet number threshold, and define the data flow whose cumulative number of data packets is lower than the threshold as a "small flow". Specifically, when the data packet arrives at the control plane, the traffic classification module first extracts the external IP address of the data packet as a keyword, uses multiple independent hash functions to map the keyword to the two-dimensional counter matrix of Count-Min Sketch, and updates the value of the corresponding counter. Subsequently, the module performs real-time frequency estimation of the number of data packets in the traffic based on the current minimum value of all corresponding counters. Once the estimated frequency of a data flow exceeds the predefined threshold, the system can determine it as a "large flow" in real time.

[0043] The main function of the rule processing module is to determine whether the rules need to be offloaded from the control plane to the fast path of the data plane based on the traffic scale determination result of the traffic classification module, and further generate corresponding isolation rules to achieve efficient packet processing. When the traffic classification module determines that a data flow is a large flow and triggers the rule offloading operation, the rule processing module first analyzes whether other rules have potential dependencies based on the optimal matching rule determined by the rule matching module. The dependency identification standard is: on the bit where the optimal matching rule mask has a value of 1, if the corresponding bit value of other rules is the same as that of the optimal matching rule, then these rules are determined to have a dependency relationship with the optimal matching rule.

[0044] After determining the set of dependent rules, the algorithm further constructs a concretization matrix to identify which bit modifications can effectively resolve the dependencies between the rules. The concretization matrix is ​​constructed as follows: For a bit position where the mask value of the best matching rule is 0, if the mask value of a dependent rule at that position is 1, and the corresponding bit value is inconsistent with the actual bit value of the current data stream, the bit position is marked as a potential conflict bit and marked with a 1 in the concretization matrix.

[0045] After completing the construction of the concretization matrix, the algorithm will select bits suitable for concretization operations based on the matrix information. In order to achieve a reasonable balance between algorithm accuracy and execution efficiency, the present invention combines the hardware characteristics of the ARM architecture in the DPU and uses the inline function __builtin_clz provided by the GCC compiler to propose an efficient concretization bit selection algorithm. The algorithm first traverses the concretization matrix row by row, skipping the conflicting rows that have been covered by the current mask; for the conflicting rows that have not been covered, the algorithm quickly extracts the conflicting position corresponding to its least significant bit through bit operations, and adds it to the set of bits to be selected, while updating the current mask to mark that the conflicting row has been covered. After completing the selection of all necessary bits, the algorithm performs a final traversal of the concretization matrix to verify whether the currently selected mask effectively covers all conflicting rows, and returns the final processing result accordingly.

[0046] In the final step, the algorithm replaces the bit values ​​corresponding to the optimal matching rule with the actual bit values ​​of the current data stream based on the selected specific bit positions, generating the final isolation rule. The corresponding bits of the optimal matching rule mask are set to 1, and the corresponding bits of the rule IP are set to values ​​consistent with the current data stream. This proposed algorithm effectively reduces computational latency during rule generation while slightly sacrificing matching accuracy, significantly improving overall system throughput and meeting the stringent real-time and performance requirements of edge network scenarios.

[0047] The packet forwarding module is primarily responsible for efficiently forwarding packets that successfully match rules within the control plane. This module leverages the high-performance packet transmission mechanism provided by the Data Plane Development Kit (DPDK) to enable rapid packet processing and forwarding. Leveraging DPDK's user-mode polling mode and zero-copy mechanism, the packet forwarding module significantly reduces latency and system overhead during packet processing, effectively improving the UPF's data plane throughput performance.

[0048] To demonstrate the effectiveness of the present invention, the present invention is compared with Free5GC, a pure software UPF system implemented based on the x86 architecture, and UPF-ACCEL, a pure hardware UPF system implemented based on the BlueField DPU. Figure 2The average throughput performance of the present invention, Free5GC, and UPF-ACCEL under different workload conditions is demonstrated. Experimental results show that under various transmission loads, the present invention exhibits better throughput capabilities, especially in high-speed transmission scenarios. Under a load of 100Gbps, the present invention achieves a throughput performance close to line speed, reaching 94Gbps, while Free5GC and UPF-ACCEL only reach 40Gbps and 82Gbps, respectively. In addition, Figure 3 The throughput variation over time under a 100Gbps load is shown. This method has a faster performance ramp-up capability, quickly reaching a peak throughput close to 100Gbps. In comparison, Free5GC and UPF-ACCEL have slower throughput ramp-ups and take longer to reach stable performance.

[0049] Based on the above implementation methods, the present invention offloads the UPF functions that traditionally rely on the CPU in the server to the data processing unit (DPU), making full use of the architectural advantages of the DPU's software and hardware collaborative processing, thereby achieving a significant reduction in packet processing latency and an improvement in system throughput performance. By parsing and reconstructing the matching rules with dependencies, independent non-dependent rules that can be issued independently are generated, reducing the redundancy and conflict of the hardware rule table. At the same time, a traffic classification mechanism is used to divide network traffic into large and small flows, which are mapped to hardware and software path processing respectively, maximizing the performance advantages of software and hardware collaborative processing. The present invention can significantly optimize packet processing capabilities in high-load scenarios, effectively reduce delay bottlenecks, and improve the overall system throughput and resource utilization.

[0050] It should be further explained that the above implementation modes are only used to understand the technical solutions of the present invention, and are not used to limit the scope of protection of the present invention. Any obvious adjustments and improvements made to the technical solutions of the present invention that belong to the technical concept of the present invention should also fall within the scope of protection of the present invention.

Claims

1. A UPF function acceleration method based on programmable hardware, characterized in that: This method offloads the UPF function in the server to the DPU, sends the data stream to the DPU hardware interface, and the DPU performs data packet processing. Specifically, it includes the following steps: Before data flow transmission begins, various rules in the user plane function UPF, including packet detection rules PDR, forwarding action rules FAR, usage reporting rules URR, and QoS enforcement rules QER, are stored in a configuration file in JSON format. When the program starts, all rules are loaded into the ARM memory on the DPU by parsing the configuration file; A traffic processing mechanism that integrates software and hardware is introduced to hierarchically process data flows by combining software and hardware paths. When new traffic that does not match the hardware forwarding rules arrives, the data packet first enters the DPU's hardware processing module. The hardware processing module automatically guides the data packet to the software path through the RSS mechanism. This is the ARM-based processing system inside the DPU. The ARM processor matches the data packet with the flow table rules. If an existing rule is matched, the new rule is sent to the hardware to enable rapid matching and processing of subsequent traffic. After the rule is sent, the ARM processor encapsulates, decapsulates, and forwards the current data packet. For traffic that has already been matched by the rules, the hardware path can directly complete high-speed matching without software intervention, and encapsulates or decapsulates the data packet according to the rule instructions before forwarding it. When subsequent data packets enter the DPU hardware again, the hardware will divert the data to the corresponding hardware processing pipeline based on the data uplink or downlink traffic direction, and match it with the pre-issued PDR rules. For the matched uplink data flow, the hardware will perform decapsulation operations based on the FAR rules associated with the PDR, restore the data packet to a standard single-layer UDP format, and complete forwarding through the specified egress port; for the downlink data flow, if the PDR match is completed, a GTP-U tunnel header will be added to the original data packet and forwarded through the specified port.

2. The method according to claim 1, characterized in that The method also includes: introducing a rule reading module into the ARM architecture-based processing system inside the DPU, which adopts a hash table storage format, uses the IP address of each user equipment UE as the key of the hash table, and uses the PDR rule data corresponding to the UE as the value to achieve efficient indexing and management of the rules.

3. The method according to claim 1, characterized in that The method also includes: introducing a data packet parsing module into the ARM architecture-based processing system inside the DPU, which extracts five-tuple key field information including source IP address, destination IP address, source port, destination port and protocol type, as well as specific structural information of the data packet through structured parsing of the data packet header, to provide support for subsequent rule matching and processing.

4. The method according to claim 1, wherein The method also includes: introducing a rule matching module into the ARM architecture-based processing system inside the DPU. The module uses an efficient hash table search mechanism to perform precise matching and fuzzy matching on key fields such as the source IP address, destination IP address, source port number, and destination port number of the data packet to quickly determine whether there is a corresponding PDR rule entry for the data packet, and ultimately determine the optimal matching rule corresponding to the data packet.

5. The method according to claim 1, wherein The method also includes: introducing a traffic classification module into the ARM architecture-based processing system inside the DPU, efficiently classifying traffic through a data structure based on Count-Min Sketch, extracting the external IP address of a data packet as a flow identifier when the data packet arrives at the control plane, and mapping the identifier to a two-dimensional counting matrix using multiple sets of independent hash functions, and incrementally updating the counter values ​​at corresponding positions; the system estimates the frequency of occurrence of the data flow in real time based on the minimum value of the counters mapped by each hash path, and when the estimated value exceeds a set threshold, the flow is determined to be a large flow, thereby triggering a corresponding hardware path offload mechanism to achieve rapid processing and path optimization of the large flow.

6. The method according to claim 1, characterized in that The method also includes: introducing a rule processing module into the ARM architecture-based processing system inside the DPU, which is used to dynamically determine whether the rules need to be unloaded from the control plane to the fast path of the data plane based on the judgment result of the traffic classification module on the data flow scale, and executing a rule dependency removal algorithm before the rules are issued to generate isolation rules without rule dependencies, and issue them to the hardware.

7. The method according to claim 6, characterized in that The rule dependency removal algorithm first determines the dependent rule set, and then determines whether the values ​​of the bits where the best matching rule mask is 1 are the same as the corresponding bits of other rules. Based on the dependent rule set, a concretization matrix is ​​constructed to identify potential conflicting bits. For a bit where the best matching rule mask is 0, if the mask of the dependent rule at that position is 1, and the bit value is inconsistent with the actual bit value of the current data stream, then the bit is marked as a potential conflicting bit. After the concretization matrix is ​​constructed, the algorithm efficiently selects bits, traverses the concretization matrix row by row, and skips the conflicting rows that have been covered by the current mask; for the conflicting rows that have not been covered, the algorithm quickly extracts the conflicting position corresponding to its least significant bit through bit operations, and adds it to the set of candidate bits, while updating the current mask to mark that the conflicting row has been covered, repeating the traversal until all necessary bits are selected; finally, based on the selected concretization bit, the isolation rule is generated according to the optimal matching rule, the corresponding bit of the optimal matching rule mask is set to 1, and the corresponding bit position of the rule IP is set to the value consistent with the current data stream.

8. The method according to claim 1, characterized in that The method also includes: introducing a packet forwarding module into the ARM architecture-based processing system inside the DPU. The module adopts the high-performance packet sending mechanism provided by the data plane development kit DPDK to achieve rapid processing and forwarding of data packets. With the help of DPDK's user-mode polling mode and zero-copy mechanism, the packet forwarding module can significantly reduce the delay and system overhead in the packet processing process, and effectively improve the data plane throughput performance of the UPF.

Images