FPGA-based server name indication (SNI) identification method and device

Abstract

This application discloses a Server Name Indicator (SNI) identification method and apparatus based on FPGA. It receives Ethernet data packets and, for the current clock cycle, acquires a 72-byte data stream. Using a 9-byte sliding window, it truncates the data stream one byte at a time, resulting in 64 sub-data streams. For each sub-data stream, it matches it against a preset 9-byte Server Name Indicator (SNI) feature code. If a match is successful, the matched sub-data stream is acquired. The length of the hostname is determined based on the last two bytes of the matched sub-data stream, and the byte position of the hostname field in the Ethernet data packet is determined. The hostname string is extracted from the Ethernet data packet. If the extracted hostname string value meets a preset string threshold, the corresponding hostname is output. This application can efficiently identify the hostname in Ethernet data packets at line speed.

Description

Technical Field

[0001] This application relates to the field of message parsing technology, and in particular to a method and apparatus for identifying Server Name Indicator (SNI) based on FPGA. Background Technology

[0002] The usual method for parsing the SNI (Server Name Indication) from an HTTPS (Hypertext Transfer Protocol) message requires parsing the Client Hello message during the TLS (Transport Layer Security) handshake process. The SNI is an extension field of the TLS protocol.

[0003] In related technologies, the parsing and identification of SNIs follow the message structure meticulously, proceeding layer by layer from Layer 2 to Layer 3 protocols until the Client Hello message is identified. From the Client Hello message, the TLS record layer header is then parsed step by step. Next, the Handshake protocol header is parsed for the TLS record layer data, extracting information such as handshake type, length, and client random number. Finally, for the Handshake protocol data, the extension fields are traversed to find the SNI extension fields. Because the TLS extension field format involves multiple nested TLVs, a complex state machine is required for implementation. Furthermore, the position of the SNI extension field within the entire Client Hello message is often uncertain, leading to inconsistent processing times for different messages and making it difficult to achieve line-rate processing capabilities matching the message reception rate. Simultaneously, the Client Hello message carries multiple record layers and extensions. Even with a complex pipeline structure, the location of record and extension headers must be sequentially implemented. Since only the message header tuple data is processed, SNIs with excessively deep nesting layers cannot be quickly identified. Summary of the Invention

[0004] The purpose of this application is to provide an FPGA-based Server Name Indicator (SNI) identification method, which can solve the technical problem in the prior art that requires layer-by-layer nested parsing of Ethernet packets to obtain the Server Name Indicator (SNI), reduces the implementation difficulty of logic design, and can quickly and effectively identify the host name in Ethernet packets.

[0005] In a first aspect, this application provides a Server Name Indication (SNI) identification method based on FPGA, the method comprising:

[0006] Receive Ethernet packets and convert them into a 64-byte data stream so that 64 bytes of data are received per clock cycle;

[0007] For the current clock cycle,

[0008] A 72-byte data stream is obtained. A sliding window of 9 bytes in length is used to truncate the data stream, starting from the first byte and moving one byte at a time, to obtain 64 sub-data streams, each with a length of 9 bytes.

[0009] For each sub-data stream, the sub-data stream is matched with a preset 9-byte Server Name Indicator (SNI) signature. If the match is successful, the matched sub-data stream is obtained. The Server Name Indicator (SNI) signature includes: a 2-byte extended type field, a 2-byte extended length field, a 2-byte server name list field, a 1-byte name type field, and a 2-byte hostname length field, arranged in sequence. The value of the extended type field is 0x0000, and the value of the name type field is 0x00.

[0010] The length of the hostname is determined based on the value of the last two bytes in the successfully matched sub-data stream. The byte position of the hostname field in the Ethernet packet is determined. The hostname string is then extracted from the Ethernet packet based on the length and byte position of the hostname.

[0011] If the value of the extracted hostname string meets the preset string threshold, output the corresponding hostname.

[0012] Optionally, for the current clock cycle, acquire a 72-byte data stream, including:

[0013] Get the 64-byte data stream received in the current clock cycle;

[0014] Determine whether a 64-byte data stream carries a Start of Packet (SOP) identifier.

[0015] If carried, add 8 bytes of 0xFFFFFFFFFFFFFFFF to the beginning of the 64-byte data stream to form a 72-byte data stream;

[0016] If not carried, the last 8 bytes of data from the 72-byte data stream acquired in the previous clock cycle are added to the beginning of the 64-byte data stream to form a 72-byte data stream.

[0017] Optionally, for each set of sub-data streams, the sub-data stream is matched with a preset 9-byte Server Name Indicator (SNI) signature. If a match is successful, the successfully matched sub-data stream is retrieved, including:

[0018] For each set of sub-data streams,

[0019] The sub-data stream is divided into five fields in sequence: the first field, the second field, the third field, the fourth field, and the fifth field. The length of the first field is 2 bytes, the length of the second field is 2 bytes, the length of the third field is 2 bytes, the length of the fourth field is 1 byte, and the length of the fifth field is 2 bytes.

[0020] If the values ​​of the first field and the fourth field are both 0, set the type matching indicator value to 1;

[0021] If the value of the second field minus the value of the third field equals 2, and the value of the third field minus the value of the fifth field equals 3, set the length matching indicator value to 1;

[0022] If the type matching indicator value is 1 and the length matching indicator value is 1, it is determined that the sub-data stream successfully matches the preset 9-byte server name indicator SNI feature code, and the successfully matched sub-data stream is obtained.

[0023] Optionally, for each set of sub-data streams, the sub-data stream is matched with a preset 9-byte Server Name Indicator (SNI) signature. If a match is successful, the successfully matched sub-data stream is retrieved, including:

[0024] If multiple successfully matched sub-data streams are acquired within the current clock cycle, and the 72-byte data stream does not carry an End-of-Packet (EOP) marker, then the last successfully matched sub-data stream is selected as the successfully matched sub-data stream for the current clock cycle.

[0025] And / or,

[0026] If multiple successfully matched sub-data streams are acquired within the current clock cycle, and the 72-byte data stream carries an End-of-Packet (EOP) marker, then the first successfully matched sub-data stream is selected as the successfully matched sub-data stream for the current clock cycle.

[0027] And / or,

[0028] For Ethernet packets, if there are multiple clock cycles in which sub-data streams are successfully matched, the sub-data stream that is successfully matched in the last clock cycle is taken as the successfully matched sub-data stream in that Ethernet packet.

[0029] Optionally, the length of the hostname is determined based on the value of the last two bytes in the successfully matched sub-data stream, and the byte position of the hostname field in the Ethernet packet is determined, including:

[0030] Determine whether the 64-byte data stream received in the current clock cycle carries a Start of Packet (SOP) identifier. If it does, start packet counting from 0 and increment the packet count by 1 in response to each clock cycle.

[0031] Determine whether the 64-byte data stream received in the current clock cycle carries an End of Packet (EOP) marker. If it does, stop packet counting and acquire Ethernet packets.

[0032] Optionally, the length of the hostname is determined based on the value of the last two bytes in the successfully matched sub-data stream, and the byte position of the hostname field in the Ethernet packet is determined, including:

[0033] If a successfully matched sub-data stream exists in the current clock cycle, obtain the corresponding packet count value and the byte offset value of the first byte of the first field of the successfully matched sub-data stream in the 64-byte data stream;

[0034] The length of the hostname is determined based on the value of the fifth field in the successfully matched sub-data stream;

[0035] Based on the packet count, byte offset, and hostname length, determine the byte position of the last byte of the hostname field in the Ethernet packet.

[0036] Optionally, based on the packet count value, byte offset value, and hostname length, the byte position of the last byte of the hostname field in the Ethernet packet is determined, including:

[0037] The last byte of the hostname field is located at byte position M in the Ethernet packet as follows:

[0038] M = y * 64 + x + 9 + z;

[0039] Where y represents the packet count, x represents the byte offset, z represents the length of the hostname, 64 represents the number of valid bytes per clock cycle, and 9 represents the length of the Server Name Indicator (SNI) signature.

[0040] Optionally, the hostname string can be extracted from the Ethernet packet based on the length and byte position of the hostname, including:

[0041] If the last byte of the hostname field is less than or equal to the length of the Ethernet packet in the entire data packet, the hostname string is extracted from the Ethernet packet based on the length of the hostname and the byte position of the last byte of the hostname field in the Ethernet packet; otherwise, it is determined that there is no Server Name Indicator (SNI) in the Ethernet packet.

[0042] Secondly, this application provides an FPGA-based Server Name Indication (SNI) identification device, the device comprising:

[0043] The receiving module is used to receive Ethernet packets and convert them into a 64-byte data stream so that 64 bytes of data stream are received each clock cycle.

[0044] The data interception module is used to acquire a 72-byte data stream for the current clock cycle. It intercepts the data stream by moving one byte at a time from the first byte using a 9-byte sliding window, resulting in 64 sub-data streams, each with a length of 9 bytes.

[0045] The matching module is used to match each sub-data stream with a preset 9-byte Server Name Indicator (SNI) signature. If the match is successful, the matched sub-data stream is obtained. The Server Name Indicator (SNI) signature includes: a 2-byte extended type field, a 2-byte extended length field, a 2-byte server name list field, a 1-byte name type field, and a 2-byte hostname length field arranged in sequence. The value of the extended type field is 0x0000, and the value of the name type field is 0x00.

[0046] The extraction module is used to determine the length of the hostname based on the value of the last two bytes in the successfully matched sub-data stream, determine the byte position of the hostname field in the Ethernet packet, and extract the hostname string from the Ethernet packet based on the length and byte position of the hostname.

[0047] The output module is used to output the corresponding hostname if the value of the extracted hostname string meets the preset string threshold.

[0048] Thirdly, this application provides a communication device, including the FPGA-based Server Name Indication (SNI) identification device as described above.

[0049] This application performs Server Name Indication (SNI) signature matching on the received Ethernet data stream for each clock cycle to identify the matching data stream. The hostname is then extracted from the matching data stream to achieve server name indication identification in the Ethernet data packet. This method avoids layer-by-layer nested parsing of Ethernet data packets and does not require complex logic pipeline structures. Instead, it performs pipelined processing on the Ethernet data packets each clock cycle, directly identifying the hostname in the acquired data using SNI to capture the hostname. This scheme has a simple logical design structure, reducing the difficulty of logic implementation and enabling fast and effective identification of hostnames in Ethernet data packets. Attached Figure Description

[0050] Figure 1A first flowchart of an FPGA-based Server Name Indication (SNI) identification method provided in this application embodiment;

[0051] Figure 2 A second flowchart of the FPGA-based Server Name Indication (SNI) identification method provided in this application embodiment;

[0052] Figure 3 A third flowchart of the FPGA-based Server Name Indication (SNI) identification method provided for embodiments of this application;

[0053] Figure 4 A fourth flowchart of the FPGA-based Server Name Indication (SNI) identification method provided in this application embodiment;

[0054] Figure 5 A system block diagram of an FPGA-based Server Name Indication (SNI) identification device provided in an embodiment of this application;

[0055] Figure 6 A system block diagram of a communication device provided in an embodiment of this application. Detailed Implementation

[0056] The present application will be described in detail below with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present application. Any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the protection scope of the present application.

[0057] Please refer to Figure 1 This application provides a Server Name Indicator (SNI) resolution method based on FPGA, which includes steps S101-S105.

[0058] S101 receives Ethernet packets and converts them into a 64-byte data stream so that 64 bytes of data stream are received per clock cycle.

[0059] S102, for the current clock cycle, acquire a 72-byte data stream, and extract it by moving one byte at a time from the first byte of the data stream using a sliding window of 9 bytes in length, to obtain 64 sub-data streams, where the length of each sub-data stream is 9 bytes;

[0060] S102, for each group of sub-data streams, match the sub-data stream with a preset 9-byte Server Name Indicator (SNI) signature. If the match is successful, obtain the successfully matched sub-data stream. The Server Name Indicator (SNI) signature includes: a 2-byte extended type field, a 2-byte extended length field, a 2-byte server name list field, a 1-byte name type field, and a 2-byte hostname length field arranged in sequence. The value of the extended type field is 0x0000, and the value of the name type field is 0x00.

[0061] S104, determine the length of the hostname and the byte position of the hostname field in the Ethernet packet based on the value of the last two bytes in the successfully matched sub-data stream, and extract the hostname string from the Ethernet packet based on the length and byte position of the hostname;

[0062] S105, if the value of the extracted hostname string meets the preset string threshold, output the corresponding hostname.

[0063] In the Client Hello message sent by the client, the Server Name Indicator (SNI) field is located within the TLS Extension fields. The TLS Extension fields include: a 2-byte (bytes 0 and 1) Extension Type field, indicating the type of TLS extension; when the Extension Type field is 0x0000, it indicates the Server Name; a 2-byte (bytes 2 and 3) Extension Length field, indicating the length of the extension data; the total length of subsequent fields is 15 bytes; a 2-byte (bytes 4 and 5) Server Name List Length field, indicating the number of bytes in the server name list, supporting multiple names; a 1-byte (byte 6) Name Type field, indicating the name type; when the Name Type field is 0x00, it indicates the hostname; and a 2-byte HostName Length field, indicating the length of the hostname string. As can be seen from the above, the Server Name Indicator (SNI) field has the following characteristics: The SNI field consists of 9 bytes, namely a 2-byte Extended Type field, a 2-byte Extended Length field, a 2-byte Server Name List field, a 1-byte Name Type field, and a 2-byte Hostname Length field. Among them, the Extended Type field is fixed at 0x0000, the Name Type field is fixed at 0x00, the value of the Hostname Length field is equal to the value of the Extended Length field minus 2, and the value of the Server Name List field is equal to the value of the Hostname Length field minus 3. Therefore, based on the aforementioned characteristics of Server Name Indication (SNI), this application sets a 9-byte Server Name Indication (SNI) feature code. The Server Name Indication (SNI) feature code includes: a 2-byte extended type field, a 2-byte extended length field, a 2-byte server name list field, a 1-byte name type field, and a 2-byte hostname length field arranged sequentially. The value of the extended type field is 0x0000, and the value of the name type field is 0x00. The received data is matched using this Server Name Indication (SNI) feature code to determine whether the received data contains an SNI field, and the hostname string is extracted from the successfully matched data, thereby realizing the identification of Server Name Indication (SNI).

[0064] Specifically, it receives Ethernet packets and converts them into a 64-byte data stream. For example, the FPGA chip receives 100G Ethernet packets, uses a 300MHz system clock, and converts the Ethernet packets into a 64-byte data stream, receiving 64 bytes of data per clock cycle.

[0065] For the current clock cycle, a 72-byte data stream is acquired. Using a sliding window of 9 bytes, the stream is truncated one byte at a time, starting from the first byte, resulting in 64 sub-data streams, each 9 bytes long. Each clock cycle, a 72-byte data stream is processed using the sliding window. For example, for a 72-byte data stream, it is represented sequentially as bytes 0, 1, 2, 3, 4, 5, 6, 7, 8, 9..., 63, 64, 65, 66, 67, 68, 69, 70, 71. Starting from byte 0, the data is truncated in 9-byte segments. Bytes 0, 1, 2, 3, 4, 5, 6, 7, 8 represent the first sub-data stream. Then, starting from byte 1, bytes 1, 1, 2, 3, 4, 5, 6, 7, 9 represent the second sub-data stream, and so on. 63, 64, 65, 66, 67, 68, 69, 70, 71 form the 64th sub-data stream. The length of each sub-data stream is 9 bytes.

[0066] For each acquired sub-data stream, it is matched against a preset 9-byte Server Name Indicator (SNI) signature. If a match is successful, the successfully matched sub-data stream is obtained. As described above, the last two bytes of the successfully matched sub-data stream correspond to the hostname length field. The length of the hostname is determined based on the value of the last two bytes. The byte position of the hostname field within the Ethernet packet is determined based on the byte position of the sub-data stream. Therefore, the hostname string can be extracted from the Ethernet packet based on the hostname length and byte position. If the extracted hostname string value meets a preset string threshold, the hostname string is output. For example, the string threshold is 0x20~0x80. By determining whether the hostname string value is within 0x20~0x80, it is possible to identify whether the hostname conforms to the domain name specification, thereby reducing false matching of Ethernet packets and improving the matching accuracy of Ethernet packets.

[0067] In a specific embodiment of this application, 2 million Ethernet packets were captured using a wired network. Based on the above implementation method, the packet hit rate can reach 99.9%. The only reason for the failure to hit was because there were two sliced ​​packets and the Server Name Indicator (SNI) field was distributed in two packets. This shows that the implementation method can meet the requirements in the application of existing networks and is feasible.

[0068] In this embodiment, for each clock cycle of the received Ethernet data packets, the Server Name Indication (SNI) signature is matched against the received data stream to obtain the matching data stream. The hostname is then obtained from the matching data stream to identify the Server Name Indication in the Ethernet data packets. This method avoids nested parsing of Ethernet data packets and does not require a complex logic pipeline structure. By pipelined processing of Ethernet data packets in each clock cycle, the Server Name Indication (SNI) is directly applied to the acquired data to capture the hostname in the Ethernet data packets. This method has a simple logical structure, reduces the difficulty of logic implementation, and can quickly and effectively identify the hostname in Ethernet data packets with bandwidths of 100G or higher.

[0069] One embodiment of this application, such as Figure 2 As shown, for the current clock cycle, a 72-byte data stream is acquired, including steps S201-S204.

[0070] S201, obtain the 64-byte data stream received in the current clock cycle;

[0071] S202, determine whether the 64-byte data stream carries a Start of Packet (SOP) identifier;

[0072] S203, if carried, add 8 bytes of 0xFFFFFFFFFFFFFFFF to the beginning of the 64-byte data stream to form a 72-byte data stream;

[0073] S204, if not carried, adds the last 8 bytes of data from the 72-byte data stream acquired in the previous clock cycle to the beginning of the 64-byte data stream to form a 72-byte data stream.

[0074] The system receives Ethernet packets and converts them into a 64-byte data stream. Within the current clock cycle, it receives the 64-byte data stream and determines whether it carries a Start Of Packet (SOP) or End Of Packet (EOP). The SOP indicates that this is the first 64 bytes of Ethernet data, and the EOP indicates that it is the last 64 bytes. If it is the first 64 bytes, it appends 8 bytes of 0xFFFFFFFFFFFFFFFF to the beginning of the first 64 bytes, forming a 72-byte data stream. If it is not the first 64 bytes, it appends the last 8 bytes of the 72-byte data stream acquired in the previous clock cycle to the beginning of the 64-byte data stream, forming a 72-byte data stream.

[0075] In this embodiment, by concatenating the last 8 bytes of the data stream from the previous clock cycle and the 64 bytes of the data stream received in the current clock cycle into a 72-byte data stream, the Server Name Indication (SNI) signature code is prevented from appearing in the last 8 bytes of the data stream from the previous clock cycle and the first 8 bytes of the data stream from the current clock cycle, thus avoiding missed matches and reducing the success rate of matching.

[0076] One embodiment of this application, such as Figure 3 As shown, for each group of sub-data streams, the sub-data stream is matched with a preset 9-byte server name indicator (SNI) feature code. If the match is successful, the successfully matched sub-data stream is obtained, including steps S301-S304.

[0077] S301, for each group of sub-data streams, the sub-data stream is divided into a first field, a second field, a third field, a fourth field, and a fifth field in sequence, wherein the length of the first field is 2 bytes, the length of the second field is 2 bytes, the length of the third field is 2 bytes, the length of the fourth field is 1 byte, and the length of the fifth field is 2 bytes.

[0078] S302, If the values ​​of the first field and the fourth field are both 0, set the type matching indicator value to 1;

[0079] S303, if the value of the second field minus the value of the third field equals 2, and the value of the third field minus the value of the fifth field equals 3, set the length matching indicator value to 1;

[0080] S304, if the type matching indicator value is 1 and the length matching indicator value is 1, it is determined that the sub-data stream is successfully matched with the preset 9-byte server name indicator SNI feature code, and the successfully matched sub-data stream is obtained.

[0081] Within the current clock cycle, a 72-byte data stream is acquired. Using a sliding window of 9 bytes, the stream is truncated one byte at a time, starting from the first byte, resulting in 64 sub-data streams, each 9 bytes long. For each sub-data stream, it is sequentially divided into a 2-byte first field, a 2-byte second field, a 2-byte third field, a 1-byte fourth field, and a 2-byte fifth field. For example, the 72-byte data stream is represented as bytes 0, 1, 2, 3, 4, 5, 6, 7, 8, 9…, 63, 64, 65, 66, 67, 68, 69, 70, 71. Starting from byte 0, data is truncated in 9-byte increments. Bytes 0, 1, 2, 3, 4, 5, 6, 7, 8 represent the first sub-data stream, with bytes 0 and 1 as the first field, bytes 2 and 3 as the second field, bytes 4 and 5 as the third field, byte 6 as the fourth field, and bytes 7 and 8 as the fifth field.

[0082] As described above, the first field corresponds to the extended type field, the second field corresponds to the extended length field, the third field corresponds to the server name list field, the fourth field corresponds to the name type field, and the fifth field corresponds to the hostname length field. The fixed value of the extended type field is 0x0000, and the fixed value of the name type field is 0x00. Therefore, by judging whether the values ​​of the first field and the fourth field are fixed values, that is, if the values ​​of the first field and the fourth field are both 0, the type matching indicator value is set to 1 to indicate that the first field matches the extended type field in the server name indicator SNI signature, and the fourth field matches the name type field in the server name indicator SNI signature; otherwise, the type matching indicator value is set to 0 to indicate that the first field and the fourth field do not match the extended type field and the name type field in the server name indicator SNI signature.

[0083] As described above, in the Server Name Indicator (SNI) field, the value of the Hostname Length field equals the value of the Extended Length field minus 2, and the value of the Server Name List field equals the value of the Hostname Length field minus 3. Therefore, by checking whether the values ​​of the second, third, and fifth fields satisfy the above relationship, we can determine whether the positions of each field in the sub-data stream match the positions of the corresponding fields in the Server Name Indicator (SNI) signature. Read the values ​​of the second, third, and fifth fields. If the difference between the second and third fields equals 2, and the difference between the third and fifth fields equals 3, set the length matching indicator value to 1; otherwise, set it to 0. If both the type matching indicator value and the length matching indicator value are 1, it is determined that the sub-data stream successfully matches the preset 9-byte Server Name Indicator (SNI) signature, and the successfully matched sub-data stream is obtained.

[0084] In this embodiment, by dividing the sub-data stream into 5 fields and matching each field with the Server Name Indication (SNI) signature, it can be determined whether the sub-data stream matches the signature, thereby realizing the matching function of the Server Name Indication (SNI) signature of the sub-data stream.

[0085] In one embodiment of this application, if multiple successfully matched sub-data streams exist within the current clock cycle, and the 72-byte data stream does not carry an End-of-Packet (EOP) marker, the last successfully matched sub-data stream is selected as the successfully matched sub-data stream within the current clock cycle. If multiple successfully matched sub-data streams exist within the current clock cycle, and the 72-byte data stream carries an EOP marker, the first successfully matched sub-data stream is selected as the successfully matched sub-data stream within the current clock cycle. For the entire Ethernet packet, if multiple successfully matched sub-data streams exist within multiple clock cycles, the sub-data stream that matched in the last clock cycle is selected as the successfully matched sub-data stream in that Ethernet packet. An arbitration mode is used to determine the successfully matched sub-data stream in the Ethernet packet.

[0086] In one embodiment of this application, the length of the hostname is determined based on the value of the last two bytes in the successfully matched sub-data stream, and the byte position of the hostname field in the Ethernet packet is determined, including: determining whether the 64-byte data stream received in the current clock cycle carries a Start of Packet Identifier (SOP); if so, packet counting is started from 0, and the packet count is incremented by 1 in response to each clock cycle; determining whether the 64-byte data stream received in the current clock cycle carries an End of Packet Identifier (EOP); if so, packet counting is stopped, and the Ethernet packet is acquired.

[0087] One embodiment of this application, such as Figure 4 As shown, the length of the hostname is determined based on the value of the last two bytes in the successfully matched sub-data stream, and the byte position of the hostname field in the Ethernet packet is determined, including steps S401-S403.

[0088] S401, If ​​there is a successfully matched sub-data stream in the current clock cycle, obtain the corresponding packet count value and the byte offset value of the first byte of the first field of the successfully matched sub-data stream in the 64-byte data stream;

[0089] S402, determine the length of the hostname based on the value of the fifth field in the successfully matched sub-data stream;

[0090] S403 determines the byte position of the last byte of the hostname field in the Ethernet packet based on the packet count value, byte offset value, and hostname length.

[0091] At the start of each clock cycle, a 64-byte data stream is received, and packet counting is performed to obtain the packet count value. If a matching sub-data stream exists in the current clock cycle, the corresponding packet count value is obtained. Based on the packet count value, the position of this 64-byte data stream within the Ethernet packet can be determined, i.e., which 64-byte data stream it belongs to. Based on which group of 64-byte data streams the matching sub-data stream belongs to, the position of the first byte of the first field of the matching sub-data stream within the 64-byte data stream can be determined, thus determining the byte offset value of the first byte of the first field within the 64-byte data stream. The byte offset value ranges from 0 to 63. The length of the hostname is determined based on the value of the fifth field in the matching sub-data stream. Based on the packet count value and the byte offset value, the position of the first byte of the first field of the matching sub-data stream within the Ethernet packet can be determined. Furthermore, based on the length of the hostname and the length of the sub-data stream (9 bytes), the byte position of the last byte of the hostname field within the Ethernet packet can be determined, allowing the hostname to be further extracted from the Ethernet packet.

[0092] For example, the last byte of the hostname field in the Ethernet packet is represented by the following byte position M:

[0093] M = y * 64 + x + 9 + z;

[0094] Where y represents the packet count, x represents the byte offset, z represents the length of the hostname, 64 represents the number of valid bytes per clock cycle, and 9 represents the length of the Server Name Indicator (SNI) signature.

[0095] One embodiment of this application extracts a hostname string from an Ethernet data packet based on the length and byte position of the hostname. This includes: if the last byte of the hostname field is less than or equal to the length of the Ethernet data packet in the entire packet, extracting the hostname string from the Ethernet data packet based on the length of the hostname and the byte position of the last byte of the hostname field in the entire packet; if the last byte of the hostname field is greater than the length of the Ethernet data packet in the entire packet, determining that the Ethernet data packet does not contain a Server Name Indicator (SNI). For example, the last 9 bytes of data in the Ethernet data packet may match the SNI signature, but these 9 bytes represent the end of the Ethernet data packet, and the remaining portion does not contain a hostname string. Therefore, in this case, it is determined that the Ethernet data packet does not contain a SNI.

[0096] In this embodiment, comparing the last byte of the hostname field with the length of the Ethernet packet in the entire data packet can reduce the mismatch processing of Ethernet packets, improve the matching accuracy of Ethernet packets, and enable the correct hostname to be parsed from the Ethernet packet.

[0097] Based on the same inventive concept, this application also provides an FPGA-based Server Name Indication (SNI) identification device. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the FPGA-based Server Name Indication (SNI) identification device provided below can be found in the limitations of the FPGA-based Server Name Indication (SNI) identification method described above, and will not be repeated here.

[0098] Please refer to Figure 5 This application provides an FPGA-based Server Name Indication (SNI) identification device, which includes:

[0099] The receiving module 501 is used to receive Ethernet packets and convert the Ethernet packets into a data stream with a data width of 64 bytes so that 64 bytes of data stream are received each clock cycle.

[0100] The data interception module 502 is used to acquire a 72-byte data stream for the current clock cycle, and to intercept the data stream by moving one byte at a time from the first byte of the data stream using a sliding window of 9 bytes in length, to obtain 64 sets of sub-data streams, wherein the length of each sub-data stream is 9 bytes.

[0101] The matching module 503 is used to match each sub-data stream with a preset 9-byte Server Name Indicator (SNI) feature code. If the match is successful, the matched sub-data stream is obtained. The Server Name Indicator (SNI) feature code includes: a 2-byte extended type field, a 2-byte extended length field, a 2-byte server name list field, a 1-byte name type field, and a 2-byte hostname length field arranged in sequence. The value of the extended type field is 0x0000, and the value of the name type field is 0x00.

[0102] Extraction module 504 is used to determine the length of the hostname based on the value of the last two bytes in the successfully matched sub-data stream, determine the byte position of the hostname field in the Ethernet packet, and extract the hostname string from the Ethernet packet based on the length and byte position of the hostname.

[0103] The output module 505 is used to output the corresponding hostname if the value of the extracted hostname string meets the preset string threshold.

[0104] Preferably, the data capture module 502 is specifically used for:

[0105] Get the 64-byte data stream received in the current clock cycle;

[0106] Determine whether a 64-byte data stream carries a Start of Packet (SOP) identifier.

[0107] If carried, add 8 bytes of 0xFFFFFFFFFFFFFFFF to the beginning of the 64-byte data stream to form a 72-byte data stream;

[0108] If not carried, the last 8 bytes of data from the 72-byte data stream acquired in the previous clock cycle are added to the beginning of the 64-byte data stream to form a 72-byte data stream.

[0109] Preferably, the matching module 503 is specifically used for:

[0110] For each set of sub-data streams,

[0111] The sub-data stream is divided into five fields in sequence: the first field, the second field, the third field, the fourth field, and the fifth field. The length of the first field is 2 bytes, the length of the second field is 2 bytes, the length of the third field is 2 bytes, the length of the fourth field is 1 byte, and the length of the fifth field is 2 bytes.

[0112] If the values ​​of the first field and the fourth field are both 0, set the type matching indicator value to 1;

[0113] If the value of the second field minus the value of the third field equals 2, and the value of the third field minus the value of the fifth field equals 3, set the length matching indicator value to 1;

[0114] If the type matching indicator value is 1 and the length matching indicator value is 1, it is determined that the sub-data stream successfully matches the preset 9-byte server name indicator SNI feature code, and the successfully matched sub-data stream is obtained.

[0115] Preferably, the matching module 503 is specifically used for:

[0116] If multiple successfully matched sub-data streams are acquired within the current clock cycle, and the 72-byte data stream does not carry an End-of-Packet (EOP) marker, then the last successfully matched sub-data stream is selected as the successfully matched sub-data stream for the current clock cycle.

[0117] And / or,

[0118] If multiple successfully matched sub-data streams are acquired within the current clock cycle, and the 72-byte data stream carries an End-of-Packet (EOP) marker, then the first successfully matched sub-data stream is selected as the successfully matched sub-data stream for the current clock cycle.

[0119] And / or,

[0120] For Ethernet packets, if there are multiple clock cycles in which sub-data streams are successfully matched, the sub-data stream that is successfully matched in the last clock cycle is taken as the successfully matched sub-data stream in that Ethernet packet.

[0121] Preferably, the extraction module 504 is specifically used for:

[0122] Determine whether the 64-byte data stream received in the current clock cycle carries a Start of Packet (SOP) identifier. If it does, start packet counting from 0 and increment the packet count by 1 in response to each clock cycle.

[0123] Determine whether the 64-byte data stream received in the current clock cycle carries an End of Packet (EOP) marker. If it does, stop packet counting and acquire Ethernet packets.

[0124] Preferably, the extraction module 504 is specifically used for:

[0125] If a successfully matched sub-data stream exists in the current clock cycle, obtain the corresponding packet count value and the byte offset value of the first byte of the first field of the successfully matched sub-data stream in the 64-byte data stream;

[0126] The length of the hostname is determined based on the value of the fifth field in the successfully matched sub-data stream;

[0127] Based on the packet count, byte offset, and hostname length, determine the byte position of the last byte of the hostname field in the Ethernet packet.

[0128] For example, the byte position M of the last byte of the hostname field in the Ethernet packet is represented as:

[0129] M = y * 64 + x + 9 + z;

[0130] Where y represents the packet count, x represents the byte offset, z represents the length of the hostname, 64 represents the number of valid bytes per clock cycle, and 9 represents the length of the Server Name Indicator (SNI) signature.

[0131] Preferably, the extraction module 504 is specifically used for:

[0132] If the last byte of the hostname field is less than or equal to the length of the Ethernet packet in the entire data packet, the hostname string is extracted from the Ethernet packet based on the length of the hostname and the byte position of the last byte of the hostname field in the Ethernet packet; otherwise, it is determined that there is no Server Name Indicator (SNI) in the Ethernet packet.

[0133] As an example, please refer to Figure 6This diagram illustrates the structure of a communication device according to an embodiment of this application. The network device includes an FPGA-based Server Name Indication (SNI) identification device 601, a communication interface 602, a processor 603, a memory 604, and a bus 605. The processor 603, memory 604, communication interface 602, and FPGA-based Server Name Indication (SNI) identification device 601 are communicatively connected to each other via the bus 605. The memory 604 can be used to store computer programs, which may include instructions and data. In this embodiment, the memory 604 can be various types of storage media, such as random access memory, static random access memory, non-volatile RAM, DDR, etc. The memory 604 may include a hard disk and / or RAM. The processor 603 can be a general-purpose processor, which can be a processor that performs specific steps and / or operations by reading and executing the computer program stored in the memory (e.g., memory 604). The general-purpose processor is used to process the data output by the FPGA-based Server Name Indication (SNI) identification device 601. The general-purpose processor may be, for example, but is not limited to, a central processing unit (CPU). Furthermore, processor 603 can also be a dedicated processor, which can be a processor specifically designed to perform specific steps and / or operations. Dedicated processors can be, for example, but not limited to, ASICs and FPGAs. Additionally, processor 603 can also be a combination of multiple processors, such as a multi-core processor. Communication interface 602 can include input / output interfaces, physical interfaces, and logical interfaces for interconnecting devices within the network device, as well as interfaces for interconnecting the network device with other devices (e.g., network devices). The physical interface can be a gigabit Ethernet interface, which can be used to interconnect the network device with other devices. The logical interface is an interface within the network device, which can be used to interconnect devices within the network device. Bus 605 can be of any type, used to interconnect processor 603, memory 604, communication interface 602, and FPGA-based server name indicator (SNI) identification device 601. For example, the structure of the FPGA-based server name indicator (SNI) identification device 601 can be referenced. Figure 5 The illustrated embodiment will not be described in detail here. Specifically, the interconnection of any device among the processor 603, memory 604, and communication interface 602 with the FPGA-based Server Name Indication (SNI) identification device 601 can mean that any of these devices is interconnected with devices within the FPGA-based Server Name Indication (SNI) identification device 601.

[0134] The embodiments disclosed in this application also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the steps of the FPGA-based Server Name Indication (SNI) identification method described in any of the above embodiments.

[0135] Although preferred embodiments of the present application have been disclosed for illustrative purposes, those skilled in the art will recognize that various modifications, additions, and substitutions are possible without departing from the scope and spirit of the present application as disclosed in the appended claims.

Claims

1. A server name indicator (SNI) identification method based on FPGA, characterized in that, The method includes: Receive Ethernet packets and convert them into a 64-byte data stream so that 64 bytes of data stream are received each clock cycle. For the current clock cycle, A 72-byte data stream is acquired, and a 9-byte sliding window is used to truncate the data stream, moving one byte at a time from the first byte, resulting in 64 sub-data streams, each sub-data stream being 9 bytes long. For each sub-data stream, the sub-data stream is matched with a preset 9-byte Server Name Indicator (SNI) signature. If the match is successful, the matched sub-data stream is obtained. The Server Name Indicator (SNI) signature includes: a 2-byte extended type field, a 2-byte extended length field, a 2-byte server name list field, a 1-byte name type field, and a 2-byte hostname length field arranged in sequence. The value of the extended type field is 0x0000, and the value of the name type field is 0x00. The length of the hostname is determined based on the value of the last two bytes in the successfully matched sub-data stream, the byte position of the hostname field in the Ethernet packet is determined, and the hostname string is extracted from the Ethernet packet based on the length and byte position of the hostname. If the value of the extracted hostname string meets the preset string threshold, the corresponding hostname is output; Specifically, for each sub-data stream, the sub-data stream is matched with a preset 9-byte Server Name Indicator (SNI) signature. If a match is successful, the successfully matched sub-data stream is retrieved, including: If multiple successfully matched sub-data streams are acquired within the current clock cycle, and the 72-byte data stream does not carry an End-of-Packet (EOP) marker, then the last successfully matched sub-data stream is selected as the successfully matched sub-data stream for the current clock cycle. And / or, If multiple successfully matched sub-data streams are acquired within the current clock cycle, and the 72-byte data stream carries an End-of-Packet (EOP) marker, then the first successfully matched sub-data stream is selected as the successfully matched sub-data stream for the current clock cycle. And / or, For Ethernet packets, if there are multiple clock cycles in which sub-data streams are successfully matched, the sub-data stream that is successfully matched in the last clock cycle is taken as the successfully matched sub-data stream in that Ethernet packet.

2. The FPGA-based Server Name Indication (SNI) identification method according to claim 1, characterized in that, For the current clock cycle, acquire a 72-byte data stream, including: Get the 64-byte data stream received in the current clock cycle; Determine whether the 64-byte data stream carries a Start of Packet (SOP) identifier; If carried, add 8 bytes of 0xFFFFFFFFFFFFFFFF to the beginning of the 64-byte data stream to form a 72-byte data stream; If not carried, the last 8 bytes of data from the 72-byte data stream acquired in the previous clock cycle are added to the beginning of the 64-byte data stream to form a 72-byte data stream.

3. The FPGA-based Server Name Indication (SNI) identification method according to claim 2, characterized in that, For each sub-data stream, match it with a preset 9-byte Server Name Indicator (SNI) signature. If a match is found, retrieve the matched sub-data stream, including: For each set of sub-data streams, The sub-data stream is divided into five fields in sequence: the first field, the second field, the third field, the fourth field, and the fifth field. The length of the first field is 2 bytes, the length of the second field is 2 bytes, the length of the third field is 2 bytes, the length of the fourth field is 1 byte, and the length of the fifth field is 2 bytes. If the values ​​of the first field and the fourth field are both 0, set the type matching indicator value to 1; If the value of the second field minus the value of the third field equals 2, and the value of the third field minus the value of the fifth field equals 3, set the length matching indicator value to 1; If the type matching indicator value is 1 and the length matching indicator value is 1, it is determined that the sub-data stream successfully matches the preset 9-byte server name indicator SNI feature code, and the successfully matched sub-data stream is obtained.

4. The FPGA-based Server Name Indication (SNI) identification method according to claim 1, characterized in that, The length of the hostname is determined based on the value of the last two bytes in the successfully matched sub-data stream, and the byte position of the hostname field in the Ethernet packet is determined, including: Determine whether the 64-byte data stream received in the current clock cycle carries a Start of Packet (SOP) identifier. If it does, start packet counting from 0 and increment the packet count by 1 in response to each clock cycle. Determine whether the 64-byte data stream received in the current clock cycle carries an End of Packet (EOP) marker. If it does, stop packet counting and acquire Ethernet packets.

5. The FPGA-based Server Name Indication (SNI) identification method according to claim 4, characterized in that, The length of the hostname is determined based on the value of the last two bytes in the successfully matched sub-data stream, and the byte position of the hostname field in the Ethernet packet is determined, including: If a successfully matched sub-data stream exists in the current clock cycle, obtain the corresponding packet count value and the byte offset value of the first byte of the first field of the successfully matched sub-data stream in the 64-byte data stream; The length of the hostname is determined based on the value of the fifth field in the successfully matched sub-data stream; Based on the packet count value, byte offset value, and hostname length, determine the byte position of the last byte of the hostname field in the Ethernet packet.

6. The FPGA-based Server Name Indication (SNI) identification method according to claim 5, characterized in that, Based on the packet count value, byte offset value, and hostname length, determine the byte position of the last byte of the hostname field in the Ethernet packet, including: The last byte of the hostname field is located at byte position M in the Ethernet packet as follows: M = y * 64 + x + 9 + z; Where y represents the packet count, x represents the byte offset, z represents the length of the hostname, 64 represents the number of valid bytes per clock cycle, and 9 represents the length of the Server Name Indicator (SNI) signature.

7. The FPGA-based Server Name Indication (SNI) identification method according to claim 5, characterized in that, Extracting the hostname string from the Ethernet packet based on the length and byte position of the hostname, including: If the last byte of the hostname field is less than or equal to the length of the Ethernet packet in the entire data packet, the hostname string is extracted from the Ethernet packet based on the length of the hostname and the byte position of the last byte of the hostname field in the Ethernet packet; otherwise, it is determined that there is no Server Name Indicator (SNI) in the Ethernet packet.

8. A server name indicator (SNI) identification device based on FPGA, characterized in that, The device includes: The receiving module is used to receive Ethernet packets and convert the Ethernet packets into a data stream with a data width of 64 bytes, so that 64 bytes of data stream are received each clock cycle; The data interception module is used to acquire a 72-byte data stream for the current clock cycle, and to intercept the data stream by moving one byte at a time from the first byte of the data stream using a sliding window of 9 bytes in length, thereby obtaining 64 sets of sub-data streams, wherein the length of each sub-data stream is 9 bytes. The matching module is used to match each sub-data stream with a preset 9-byte Server Name Indicator (SNI) feature code. If the match is successful, the matched sub-data stream is obtained. The Server Name Indicator (SNI) feature code includes: a 2-byte extended type field, a 2-byte extended length field, a 2-byte server name list field, a 1-byte name type field, and a 2-byte hostname length field arranged in sequence. The value of the extended type field is 0x0000, and the value of the name type field is 0x00. The extraction module is used to determine the length of the hostname based on the value of the last two bytes in the successfully matched sub-data stream, determine the byte position of the hostname field in the Ethernet packet, and extract the hostname string from the Ethernet packet based on the length and byte position of the hostname. The output module is used to output the corresponding hostname if the value of the extracted hostname string meets a preset string threshold. Specifically, the matching module is used for: Specifically, for each sub-data stream, the sub-data stream is matched with a preset 9-byte Server Name Indicator (SNI) signature. If a match is successful, the successfully matched sub-data stream is retrieved, including: If multiple successfully matched sub-data streams are acquired within the current clock cycle, and the 72-byte data stream does not carry an End-of-Packet (EOP) marker, then the last successfully matched sub-data stream is selected as the successfully matched sub-data stream for the current clock cycle. And / or, If multiple successfully matched sub-data streams are acquired within the current clock cycle, and the 72-byte data stream carries an End-of-Packet (EOP) marker, then the first successfully matched sub-data stream is selected as the successfully matched sub-data stream for the current clock cycle. And / or, For Ethernet packets, if there are multiple clock cycles in which sub-data streams are successfully matched, the sub-data stream that is successfully matched in the last clock cycle is taken as the successfully matched sub-data stream in that Ethernet packet.

9. A communication device, characterized in that, Includes the FPGA-based Server Name Indication (SNI) identification device as described in claim 8.

Images