Method and device for adding and deleting message VLAN (Virtual Local Area Network) label by FPGA (Field Programmable Gate Array)
By implementing the addition and deletion of VLAN tags in packets using FPGA hardware, the problems of heavy CPU load and high hardware cost in network cryptographic machines are solved. It enables flexible deployment and efficient and secure VLAN tag processing, and is suitable for scenarios such as enterprise-level networks, industrial control networks, internal and external network isolation in government/financial industries, and cloud data center network cryptographic machine clusters.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-03-10
AI Technical Summary
Existing technologies suffer from problems such as heavy CPU load when adding/deleting VLAN tags in network cryptographic machines, the need for additional switch deployment, limited deployment scenarios, and insufficient security.
The addition and deletion of VLAN tags in packets are implemented using FPGA hardware. Packet parsing, VLAN tag extraction, insertion or deletion are performed through FPGA. The IP-VLAN policy library and VLAN policy library are used for accurate matching and processing, reducing CPU load. It supports deployment on switch access ports and trunk ports and enhances security.
Reduce CPU load, lower hardware costs, improve network adaptability and data transmission security, and adapt to the performance requirements of high-traffic network environments.
Smart Images
Figure CN121644271A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of computer network communication, and in particular to a method and device for adding and deleting VLAN tags of messages by FPGA. BACKGROUND
[0002] As a key technology in the field of computer network communication, virtual local area network (VLAN) logically divides network devices by function, department or application scenario to form an independent broadcast domain, effectively reduces network broadcast storm, improves data transmission security and overall network efficiency, and is widely used in various enterprise-level networks, industrial control networks and other scenarios. In the conventional VLAN environment, the addition and deletion of VLAN tags (VLAN TAG) of network messages are mainly implemented by switches. The switch port is pre-configured with VLAN ID and VLAN TAG attributes. When the data frame passes through the port, the switch performs corresponding processing according to whether the message carries a VLAN TAG: if not, a default PVID is applied; if yes, it checks whether the port allows the VLAN to pass through. Different VLAN devices need to communicate through a three-layer route. When a network password machine is deployed in the network, the existing scheme usually adopts two ways to adapt to the VLAN environment: one is to create a virtual network card through the CPU's vconfig command to add a VLAN TAG to the local message generated by the network password machine; the other is to deploy an additional switch in front of the network password machine to assist in adding the VLAN TAG.
[0003] However, the existing technical solutions have obvious defects and cannot meet the actual needs of complex network environments. The method of creating a virtual network card by CPU will significantly increase the CPU's running burden due to the deployment of multiple virtual network cards, and will also increase the complexity of network management. Moreover, as the network data traffic grows, a high-performance CPU needs to be configured to ensure processing efficiency, which directly leads to an increase in hardware costs. The scheme of deploying an additional switch not only increases the hardware purchase and maintenance costs, causing resource waste, but also limits the deployment scenarios of the network password machine, which can only be deployed at the Access port of the switch and cannot be adapted to the Trunk port. If the switch is shared with other network environments, it will also damage the network isolation and reduce the data transmission security. In addition, both schemes do not specifically check the VLAN tags of internal and external network messages, which cannot further improve the security protection capability of the network password machine and restrict its network adaptability and application range.
[0004] Therefore, there is an urgent need for a method for adding and deleting VLAN tags of messages by FPGA to solve the problems of heavy CPU burden, the need for additional deployment of switches, limited deployment scenarios and insufficient security when the network password machine adds / deletes VLAN tags in the prior art. SUMMARY
[0005] To address these issues, this invention provides a method and apparatus for adding and deleting VLAN tags in packets using an FPGA. This solves the problems of heavy CPU load, the need for additional switches, limited deployment scenarios, and insufficient security in existing network cryptographic machines when adding / deleting VLAN tags, thereby improving network adaptability and data transmission security.
[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for adding and deleting VLAN tags in packets using an FPGA, characterized in that it includes:
[0007] After power-on, the FPGA resets and initializes its own Ethernet network interface; the CPU initializes the configuration management interface between itself and the FPGA; the CPU sends the initial entries of the IP-VLAN policy library and VLAN policy library to the FPGA through the configuration management interface.
[0008] The FPGA receives network packets through the Ethernet network interface, parses the network packets, and determines whether the network packets carry a VLAN tag.
[0009] If the network packet does not carry a VLAN tag, the FPGA extracts the destination IP address from the network packet as a feature value; the feature value is then searched and matched in the IP-VLAN policy database; if no match is found, the network packet is discarded; if a match is found, the VLAN tag addition level and VLAN tag ID are determined based on the corresponding rules in the IP-VLAN policy database; based on the determined VLAN tag addition level, a VLAN tag of the corresponding level is inserted between the MAC header and IP header of the network packet, and the network packet is reconstructed to generate a new network packet.
[0010] If the network packet carries a VLAN tag, the FPGA extracts VLAN tags of all levels in the network packet; the extracted VLAN tags are compared and matched in the VLAN policy library; if no match is found, the original format of the network packet is maintained; if a match is found, the extracted VLAN tags are selectively removed based on the corresponding retention or deletion rules in the VLAN policy library, and the network packet is reconstructed to generate a new network packet.
[0011] The FPGA transmits the new network message to the corresponding module of the network cryptographic machine to execute the setting operation of the network cryptographic machine.
[0012] As a preferred solution for implementing VLAN tag addition and deletion in FPGA, in the process of determining the number of VLAN tag addition levels based on the corresponding rules in the IP-VLAN policy library, the number of VLAN tag addition levels can be 0 or a positive integer. When the number of addition levels is 0, the VLAN tag addition operation is not performed on the network packets that do not carry VLAN tags. When the number of addition levels is a positive integer, a maximum of 3 levels of VLAN tags can be added to the network packets that do not carry VLAN tags.
[0013] As a preferred method for adding and deleting VLAN tags in packets using an FPGA, the CPU manages the IP-VLAN policy database and the VLAN policy database in the FPGA through the configuration management interface, including adding, deleting, modifying, and querying policy database entries.
[0014] As a preferred solution for FPGA-based methods of adding and deleting VLAN tags in packets, during the process of the FPGA performing operations on the network packets carrying VLAN tags based on the corresponding retention or deletion rules in the VLAN policy library, all extracted VLAN tags of all levels are fully compared with the rules in the VLAN policy library. After ensuring that each level of VLAN tag meets the requirements of the policy library, the corresponding retention or deletion processing is performed.
[0015] As a preferred solution for implementing the addition and deletion of VLAN tags in packets using FPGA, the IP-VLAN policy database stores the correspondence between IP addresses and VLAN tags, and supports two retrieval matching methods: exact matching and range matching, to determine whether to add a VLAN tag to the network packet that does not carry a VLAN tag.
[0016] This invention also provides an FPGA-based device for adding and deleting VLAN tags in packets, and a method for adding and deleting VLAN tags in packets based on the above-mentioned FPGA, comprising:
[0017] The FPGA and CPU initialization unit is used to reset and initialize the Ethernet network interface of the FPGA after power-on; initialize the configuration management interface between the CPU and the FPGA; and send the initial entries of the IP-VLAN policy library and VLAN policy library to the FPGA through the configuration management interface.
[0018] The network packet receiving and analysis unit is used by the FPGA to receive network packets through the Ethernet network interface, parse the network packets, and determine whether the network packets carry VLAN TAGs.
[0019] The VLAN TAG addition processing unit is used to: extract the destination IP address as a feature value from the network packet if the network packet does not carry a VLAN TAG; search and match the feature value in the IP-VLAN policy database; discard the network packet if no match is found; determine the VLAN TAG addition level and VLAN TAG ID based on the corresponding rule in the IP-VLAN policy database based on the determined VLAN TAG addition level; insert the corresponding level VLAN TAG between the MAC header and IP header of the network packet based on the determined VLAN TAG addition level and reconstruct the network packet to generate a new network packet.
[0020] The VLAN TAG deletion processing unit is used to: extract all levels of VLAN TAGs from the network packet if the network packet carries a VLAN TAG; compare and match the extracted VLAN TAGs in the VLAN policy database; if no match is found, maintain the original format of the network packet; if a match is found, selectively remove the extracted VLAN TAGs based on the corresponding retention or deletion rules in the VLAN policy database and reconstruct the network packet to generate a new network packet.
[0021] The new network message transmission unit is used by the FPGA to transmit the new network message to the corresponding module of the network cryptographic machine and execute the setting operation of the network cryptographic machine.
[0022] As a preferred embodiment of an FPGA-based device for adding and deleting VLAN tags in packets, in the VLAN TAG addition processing unit, during the process of determining the number of VLAN TAG addition levels based on the corresponding rules in the IP-VLAN policy library, the number of VLAN TAG addition levels can be 0 or a positive integer. When the number of addition levels is 0, the VLAN TAG addition operation is not performed on the network packets that do not carry VLAN TAGs. When the number of addition levels is a positive integer, a maximum of 3 levels of VLAN TAGs can be added to the network packets that do not carry VLAN TAGs.
[0023] As a preferred solution for an FPGA-based device for adding and deleting VLAN tags in packets, in the FPGA and CPU initialization unit, the CPU performs management operations on the IP-VLAN policy library and the VLAN policy library in the FPGA through the configuration management interface, including adding, deleting, modifying and querying policy library entries.
[0024] As a preferred solution for an FPGA-based device for adding and deleting VLAN tags in packets, the VLAN TAG deletion processing unit performs an operation on the network packet carrying the VLAN TAG based on the retention or deletion rules in the VLAN policy library. During this process, all extracted VLAN TAG levels are compared with the rules in the VLAN policy library to ensure that each VLAN TAG level meets the policy library requirements before performing the corresponding retention or deletion processing.
[0025] As a preferred solution for an FPGA-based device for adding and deleting VLAN tags in packets, the VLAN TAG adding processing unit stores the correspondence between IP addresses and VLAN tags in the IP-VLAN policy database, and supports two retrieval matching methods: exact matching and range matching, to determine whether to add a VLAN tag to the network packet that does not carry a VLAN tag.
[0026] The present invention has the following advantages:
[0027] First, reduce CPU load: The core VLAN tag addition / deletion, packet parsing and policy matching are handled by FPGA hardware, while the CPU is only responsible for policy library management, avoiding the performance loss caused by multiple virtual network cards.
[0028] Second, reduce hardware costs: No need to deploy additional switches, reducing hardware purchase and maintenance investment and avoiding resource waste.
[0029] Third, flexible deployment scenarios: It supports deployment on both Access and Trunk ports of switches, adapting to different network topology requirements and improving the environmental adaptability of network cryptographic machines.
[0030] Fourth, enhanced security: The system uses a dual-policy database to accurately verify and process VLAN tags in packets, while also checking internal and external network packet tags to strengthen network isolation and data protection.
[0031] Fifth, high processing efficiency: FPGA hardware accelerates the message processing flow, reduces network latency, and adapts to the performance requirements of high-traffic network environments. Attached Figure Description
[0032] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.
[0033] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.
[0034] Figure 1 This is a flowchart illustrating a method for adding and deleting VLAN tags in packets using an FPGA, as provided in Embodiment 1 of the present invention.
[0035] Figure 2 This is a schematic diagram illustrating the specific implementation process of a method for adding and deleting VLAN tags in packets using FPGA, as provided in Embodiment 1 of the present invention.
[0036] Figure 3 This is a schematic diagram of the architecture of an FPGA device for adding and deleting VLAN tags in a message, as provided in Embodiment 2 of the present invention. Detailed Implementation
[0037] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0038] The meanings of the English abbreviations used in this embodiment are as follows:
[0039] FPGA (Field Programmable Gate Array) is a programmable logic device that allows for the implementation of custom digital circuit functions through hardware programming. In this invention, the FPGA undertakes core hardware acceleration tasks such as packet parsing, VLAN tag extraction / insertion, policy base matching, and packet reconstruction, featuring low latency and high parallel processing characteristics while avoiding CPU resource consumption.
[0040] VLAN: Virtual Local Area Network. By dividing a physical network into multiple logically isolated broadcast domains, it enables flexible allocation and isolation of network resources, reducing broadcast storms and improving network security and management efficiency. This invention focuses on the processing of packet tags in a VLAN environment to meet the deployment requirements of network cryptographic machines.
[0041] IP-VLAN: A unique IP address and VLAN tag association strategy system in this invention. The IP-VLAN policy library stores the correspondence between IP addresses and VLAN tags and the operation rules, which are used to match and add corresponding VLAN tags to packets without VLAN tags.
[0042] VLAN TAG: A VLAN tag is a field in an Ethernet frame used to identify VLAN information and distinguish packets from different VLANs. This invention requires adding, deleting, and verifying VLAN tags in packets, and supports multi-level VLAN tag processing.
[0043] CPU: Central Processing Unit. In this invention, the CPU is only responsible for initializing FPGA configuration and managing the IP-VLAN policy library and VLAN policy library entries. It does not participate in real-time packet processing, thus reducing the CPU's operating burden.
[0044] Example 1
[0045] See Figure 1 and Figure 2 Embodiment 1 of the present invention provides a method for adding and deleting VLAN tags in packets using an FPGA, comprising the following steps:
[0046] S1. After power-on, the FPGA resets and initializes its own Ethernet network interface; the CPU initializes the configuration management interface between the CPU and the FPGA; the CPU sends the initial entries of the IP-VLAN policy library and VLAN policy library to the FPGA through the configuration management interface.
[0047] S2. The FPGA receives network packets through the Ethernet network interface, parses the network packets, and determines whether the network packets carry a VLAN TAG.
[0048] S3. If the network packet does not carry a VLAN TAG, the FPGA extracts the destination IP address from the network packet as a feature value; the feature value is searched and matched in the IP-VLAN policy library; if no match is found, the network packet is discarded; if a match is found, the VLAN TAG addition level and VLAN TAG ID are determined based on the corresponding rules in the IP-VLAN policy library; based on the determined VLAN TAG addition level, the corresponding VLAN TAG is inserted between the MAC header and IP header of the network packet and the network packet is reconstructed to generate a new network packet.
[0049] S4. If the network packet carries a VLAN tag, the FPGA extracts VLAN tags of all levels in the network packet; the extracted VLAN tags are compared and matched in the VLAN policy library; if no match is found, the original format of the network packet is maintained; if a match is found, the extracted VLAN tags are selectively removed based on the corresponding retention or deletion rules in the VLAN policy library, and the network packet is reconstructed to generate a new network packet.
[0050] S5. The FPGA transmits the new network message to the corresponding module of the network cryptographic machine and executes the setting operation of the network cryptographic machine.
[0051] In this embodiment, in step S1, after power-on, the FPGA is reset and initializes its own Ethernet network interface; the CPU initializes the configuration management interface between the CPU and the FPGA; the CPU sends the initial entries of the IP-VLAN policy library and the VLAN policy library to the FPGA through the configuration management interface.
[0052] Specifically, upon power-up, the FPGA first performs a reset operation, clearing residual data from its internal registers, caches, and other storage units to restore its initial operating state. It then initiates the Ethernet network interface initialization process, configuring the interface's communication parameters, such as speed and duplex mode, to ensure the interface has the ability to stably receive and send network data. Simultaneously, the CPU initiates the initialization of the configuration management interface between the CPU and the FPGA, establishing a reliable communication link. After interface initialization is complete, the CPU sends the pre-configured IP-VLAN policy library and initial VLAN policy library entries to the FPGA through this configuration management interface. Upon receiving this data, the FPGA stores the policy library data in its designated storage area, providing data support for policy matching in subsequent packet processing.
[0053] The CPU manages the IP-VLAN policy library and the VLAN policy library in the FPGA through the configuration management interface, and also performs operations such as adding, deleting, modifying and querying policy library entries.
[0054] In this embodiment, in step S2, the FPGA receives network packets through the Ethernet network interface, parses the network packets, and determines whether the network packets carry a VLAN TAG.
[0055] Specifically, the FPGA monitors network data in real time through the initialized Ethernet network interface. When a packet is detected being transmitted on the network, it receives the packet and temporarily stores it in an internal buffer. The FPGA then parses the stored network packet layer by layer. First, it parses the MAC header information. By checking if a VLAN tag field (TPID field) corresponding to the VLAN tag exists in the MAC header, it determines whether the network packet carries a VLAN tag. If a TPID field is detected, the packet is determined to carry a VLAN tag; otherwise, it is determined not to. The parsing result serves as the basis for subsequent branch processing.
[0056] In this embodiment, in step S3, if the network packet does not carry a VLAN TAG, the FPGA extracts the destination IP address from the network packet as a feature value; the feature value is searched and matched in the IP-VLAN policy library; if no match is found, the network packet is discarded; if a match is found, the VLAN TAG addition level and VLAN TAG ID are determined based on the corresponding rules in the IP-VLAN policy library; based on the determined VLAN TAG addition level, the corresponding VLAN TAG is inserted between the MAC header and IP header of the network packet and the network packet is reconstructed to generate a new network packet.
[0057] Specifically, if step S2 determines that the network packet does not carry a VLAN tag, the FPGA will continue to parse the IP header of the packet and extract the destination IP address as a key feature value. Then, the FPGA calls its internal retrieval module to compare the extracted destination IP address feature value with the stored IP-VLAN policy database. The policy database supports both exact matching and range matching to ensure comprehensiveness and accuracy. If no policy entry corresponding to the feature value is found after the search (i.e., a match is not found), the FPGA will directly discard the network packet to avoid invalid data consuming network resources. If a corresponding policy entry is found (i.e., a match is found), the VLAN tag addition level is determined according to the preset rules in the entry: level 0 or a positive integer level, and the corresponding VLAN tag ID. Finally, according to the Ethernet protocol specification, the FPGA sequentially inserts the corresponding level of VLAN tag field between the MAC header and IP header of the original network packet, completing the packet reconstruction and generating a new network packet carrying the target VLAN tag.
[0058] When the number of levels to be added is a positive integer, a maximum of 3 levels of VLAN tags can be added to the network packets that do not carry VLAN tags.
[0059] In this embodiment, in step S4, if the network packet carries a VLAN tag, the FPGA extracts all levels of VLAN tags in the network packet; the extracted VLAN tags are compared and matched in the VLAN policy library; if no match is found, the original format of the network packet is maintained; if a match is found, the extracted VLAN tags are selectively removed based on the corresponding retention or deletion rules in the VLAN policy library, and the network packet is reconstructed to generate a new network packet.
[0060] Specifically, if step S2 determines that the network packet carries a VLAN tag, the FPGA will perform deep parsing of the packet, extracting all levels of VLAN tags and recording the specific information of each level of VLAN tag. Subsequently, the FPGA will perform a full comparison of all extracted VLAN tag information with the rules in the VLAN policy library to ensure that each level of tag is verified. If no matching policy rule is found after the comparison, i.e., a match is not found, the FPGA will maintain the original format of the network packet without any additional processing. If a matching policy rule is found, the extracted VLAN tags will be selectively removed according to the explicit retention or deletion requirements in the rule. After removal, the packet length, checksum, and other fields will be readjusted to complete the reconstruction of the network packet and generate a new network packet that meets the policy requirements.
[0061] In this embodiment, in step S5, the FPGA transmits the new network message to the corresponding module of the network cryptographic machine and performs the setting operation of the network cryptographic machine.
[0062] Specifically, after generating a new network packet through step S3 or S4, the FPGA transmits the new network packet to the subsequent processing module of the network cryptographic machine through its internal data transmission channel. Upon receiving the packet, the network cryptographic machine performs encryption, decryption, and data forwarding control operations according to preset business logic, ensuring the security and reliability of network data during transmission and ultimately completing the entire packet processing flow.
[0063] The application scenarios of this invention are as follows:
[0064] In enterprise-level network cryptographic machine deployment scenarios, this invention supports flexible deployment on switch Access ports and Trunk ports without requiring additional switch configuration or CPU resource consumption. It can accurately add corresponding VLAN TAGs to local enterprise management messages and business data messages, while filtering illegal messages without TAGs, ensuring the security and adaptability of cross-VLAN data transmission.
[0065] In industrial control network security protection scenarios, this invention uses FPGA hardware acceleration to complete the addition and deletion of VLAN tags with low latency, adapting to the high traffic and high real-time requirements of industrial scenarios. At the same time, it uses dual policy libraries to verify message tags, preventing illegal VLAN packet intrusion and ensuring stable and secure industrial data transmission.
[0066] In the scenario of internal and external network isolation in the government / finance industry, this invention can perform bidirectional inspection and processing of VLAN tags for internal and external network packets. Internal network packets are encrypted and transmitted after adding VLAN TAGs according to the policy, while external network access packets need to be verified by the VLAN policy library before they can pass. This satisfies the cross-VLAN transmission requirements and strengthens the protection of internal and external network isolation.
[0067] In cloud data center network cryptographic machine cluster scenarios, this invention supports remote CPU management of policy libraries, which can flexibly add, delete, modify and query VLAN configuration rules. It can adapt to tenant VLAN adjustment needs without downtime. At the same time, the FPGA independently undertakes message processing tasks, avoiding the consumption of a large amount of CPU resources by multi-tenant data processing and improving the overall operating efficiency of the cluster.
[0068] In remote office VPN access scenarios, this invention can automatically add the corresponding VLAN tag of the enterprise intranet to the remote packets of VPN access, while removing the sensitive VLAN tags of the packets transmitted from the intranet to the outside, ensuring the adaptability and security of remote office data transmission, without affecting the stability and transmission rate of the VPN connection.
[0069] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.
[0070] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0071] Example 2
[0072] See Figure 3 Embodiment 2 of the present invention also provides an FPGA-based device for adding and deleting VLAN tags in packets, comprising:
[0073] The FPGA and CPU initialization unit 001 is used to reset the FPGA and initialize its own Ethernet network interface after power-on; the CPU initializes the configuration management interface between the CPU and the FPGA; and the CPU sends the initial entries of the IP-VLAN policy library and VLAN policy library to the FPGA through the configuration management interface.
[0074] The network packet receiving and analysis unit 002 is used by the FPGA to receive network packets through the Ethernet network interface, parse the network packets, and determine whether the network packets carry VLAN TAGs.
[0075] The VLAN TAG addition processing unit 003 is used to: extract the destination IP address as a feature value from the network packet if the network packet does not carry a VLAN TAG; search and match the feature value in the IP-VLAN policy database; if no match is found, discard the network packet; if a match is found, determine the VLAN TAG addition level and VLAN TAG ID based on the corresponding rule in the IP-VLAN policy database; based on the determined VLAN TAG addition level, insert the corresponding level of VLAN TAG between the MAC header and IP header of the network packet and reconstruct the network packet to generate a new network packet;
[0076] The VLAN TAG deletion processing unit 004 is used to extract all levels of VLAN TAGs from the network packet if the network packet carries a VLAN TAG; compare and match the extracted VLAN TAGs in the VLAN policy library; if no match is found, the original format of the network packet is maintained; if a match is found, the extracted VLAN TAGs are selectively removed based on the corresponding retention or deletion rules in the VLAN policy library, and the network packet is reconstructed to generate a new network packet.
[0077] The new network message transmission unit 005 is used by the FPGA to transmit the new network message to the corresponding module of the network cryptographic machine and execute the setting operation of the network cryptographic machine.
[0078] In this embodiment, in the VLAN TAG addition processing unit 003, during the process of determining the number of VLAN TAG addition levels based on the corresponding rules in the IP-VLAN policy library, the number of VLAN TAG addition levels can be 0 or a positive integer. When the number of addition levels is 0, the VLAN TAG addition operation is not performed on the network packets that do not carry VLAN TAGs. When the number of addition levels is a positive integer, a maximum of 3 levels of VLAN TAGs can be added to the network packets that do not carry VLAN TAGs.
[0079] In this embodiment, in the FPGA and CPU initialization unit 001, the CPU performs management operations on the IP-VLAN policy library and the VLAN policy library in the FPGA through the configuration management interface, including adding, deleting, modifying and querying policy library entries.
[0080] In this embodiment, in the VLAN TAG deletion processing unit 004, during the process of the FPGA performing operations on the network packet carrying the VLAN TAG based on the corresponding retention or deletion rules in the VLAN policy library, all extracted VLAN TAG levels are fully compared with the rules in the VLAN policy library. After ensuring that each level of VLAN TAG meets the requirements of the policy library, the corresponding retention or deletion processing is performed.
[0081] In this embodiment, the VLAN TAG adding processing unit 003 stores the correspondence between IP addresses and VLAN TAGs in the IP-VLAN policy database, and supports two retrieval matching methods: exact matching and range matching, to determine whether to add a VLAN TAG to the network packet that does not carry a VLAN TAG.
[0082] It should be noted that the information interaction and execution process between the modules of the above system are based on the same concept as the method embodiment in Embodiment 1 of this application, and the resulting technical effects are the same as those in the method embodiment of this application. For details, please refer to the description in the method embodiment shown above in this application, and it will not be repeated here.
[0083] Example 3
[0084] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium storing program code for an FPGA-based method of adding and deleting VLAN tags in packets. The program code includes instructions for executing the FPGA-based method of adding and deleting VLAN tags in packets according to Embodiment 1 or any possible implementation thereof.
[0085] Computer-readable storage media can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).
[0086] Example 4
[0087] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;
[0088] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor can call the program instructions to execute a method for adding and deleting VLAN tags in FPGA implementation according to Embodiment 1 or any possible implementation thereof.
[0089] Specifically, a processor can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.
[0090] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable system. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.
[0091] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing systems. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Optionally, they can be implemented using program code executable by a computing system, thereby storing them in a storage system for execution by the computing system. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.
[0092] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.
Claims
1. A method for adding and deleting VLAN tags of a packet by FPGA, characterized in that, The application relates to a network packet processing method and device based on FPGA and CPU. After power-on, the FPGA is reset and the Ethernet network interface of the FPGA is initialized; The CPU initializes a configuration management interface between the CPU and the FPGA; The CPU sends an IP-VLAN policy library and initial table items of a VLAN policy library to the FPGA through the configuration management interface; The FPGA receives a network packet through the Ethernet network interface, analyzes the network packet, and judges whether the network packet carries a VLAN TAG; If the network packet does not carry a VLAN TAG, the FPGA extracts a destination IP address from the network packet as a characteristic value; The characteristic value is searched and matched in the IP-VLAN policy library; If the matching is missed, the network packet is discarded; If the matching is hit, the adding number of VLAN TAGs and a VLAN TAG ID are determined based on corresponding rules in the IP-VLAN policy library; Based on the determined adding number of VLAN TAGs, corresponding number of VLAN TAGs are inserted between a MAC header and an IP header of the network packet, and the network packet is reconstructed to generate a new network packet; If the network packet carries a VLAN TAG, the FPGA extracts all number of VLAN TAGs in the network packet; The extracted VLAN TAGs are compared and matched in the VLAN policy library; If the matching is missed, the original format of the network packet is kept; if the matching is hit, the extracted VLAN TAGs are selectively removed and processed based on corresponding reservation or deletion rules in the VLAN policy library, and the network packet is reconstructed to generate a new network packet; The FPGA transmits the new network packet to a corresponding module of a network cryptographic machine to perform a setting operation of the network cryptographic machine.
2. The method for adding and deleting VLAN tags of a packet implemented by an FPGA according to claim 1, characterized in that, In the process of determining the adding number of VLAN TAGs based on corresponding rules in the IP-VLAN policy library, the adding number of VLAN TAGs is 0 or a positive integer; when the adding number is 0, no VLAN TAG adding operation is performed on the network packet without carrying a VLAN TAG; when the adding number is a positive integer, at most 3 levels of VLAN TAGs are added to the network packet without carrying a VLAN TAG.
3. The method for adding and deleting VLAN tags of a packet implemented by FPGA according to claim 2, characterized in that, The CPU performs management operations on the IP-VLAN policy library and the VLAN policy library in the FPGA through the configuration management interface, including adding, deleting, modifying and querying operations on policy library table items.
4. The method for adding and deleting VLAN tags of a packet implemented by FPGA according to claim 3, characterized in that, In the process of performing operations on the network packet carrying a VLAN TAG based on corresponding reservation or deletion rules in the VLAN policy library, all number of extracted VLAN TAGs are compared with rules in the VLAN policy library, and corresponding reservation or deletion processing is performed after each level of VLAN TAG meets the requirements of the policy library.
5. The method for adding and deleting VLAN tag of packet according to claim 4, wherein, The IP-VLAN policy library stores a correspondence between IP addresses and VLAN TAGs, and supports two retrieval matching modes of accurate matching and range matching, and is used to determine whether to add a VLAN TAG to the network message without carrying a VLAN TAG.
6. A device for adding and deleting VLAN tags of a packet by FPGA, adopting the method for adding and deleting VLAN tags of a packet by FPGA in any one of claims 1-5, characterized in that, The method comprises the following steps: An FPGA and CPU initialization unit is used to reset and initialize an Ethernet network interface of the FPGA after power-on; A configuration management interface between the CPU and the FPGA is used for the CPU to issue initial table items of the IP-VLAN policy library and the VLAN policy library to the FPGA through the configuration management interface; A network message receiving and analyzing unit is used for the FPGA to receive a network message through the Ethernet network interface, and analyze the network message to determine whether the network message carries a VLAN TAG; A VLAN TAG adding processing unit is used to extract a destination IP address from the network message as a feature value if the network message does not carry a VLAN TAG; The feature value is retrieved and matched in the IP-VLAN policy library; If the matching is not hit, the network message is discarded; If the matching is hit, the addition number of VLAN TAGs and a VLAN TAG ID are determined based on the corresponding rule in the IP-VLAN policy library; Based on the determined addition number of VLAN TAGs, a corresponding number of VLAN TAGs are inserted between a MAC header and an IP header of the network message to reconstruct the network message and generate a new network message; A VLAN TAG deleting processing unit is used to extract all the VLAN TAGs in the network message if the network message carries a VLAN TAG; The extracted VLAN TAGs are compared and matched in the VLAN policy library; If the matching is not hit, the original format of the network message is maintained; if the matching is hit, the extracted VLAN TAGs are selectively removed based on the corresponding retention or deletion rule in the VLAN policy library, and the network message is reconstructed to generate a new network message; A new network message transmitting unit is used for the FPGA to transmit the new network message to a corresponding module of a network cryptographic machine to perform a setting operation of the network cryptographic machine.
7. The device for adding and deleting VLAN tags of a packet implemented by FPGA according to claim 6, characterized in that, In the VLAN TAG adding processing unit, the addition number of VLAN TAGs is determined based on the corresponding rule in the IP-VLAN policy library, and the addition number of VLAN TAGs is 0 or a positive integer; when the addition number is 0, no VLAN TAG adding operation is performed on the network message without carrying a VLAN TAG; when the addition number is a positive integer, at most 3 levels of VLAN TAGs are added to the network message without carrying a VLAN TAG.
8. The device for adding and deleting VLAN tags of a packet implemented by FPGA according to claim 7, characterized in that, In the FPGA and CPU initialization unit, the CPU performs management operations on the IP-VLAN policy library and the VLAN policy library in the FPGA through the configuration management interface, including adding, deleting, modifying and querying policy library entries.
9. The device for adding and deleting VLAN tags of a packet implemented by FPGA according to claim 8, characterized in that, In the VLAN TAG deletion processing unit, in the operation process of the FPGA on the network message carrying the VLAN TAG based on the corresponding reservation or deletion rules in the VLAN policy library, all the extracted level VLAN TAGs are compared with the rules in the VLAN policy library in full, and after ensuring that each level VLAN TAG meets the requirements of the policy library, the corresponding reservation or deletion processing is performed.
10. The device for adding and deleting VLAN tags of a packet implemented by FPGA according to claim 9, wherein, In the VLAN TAG addition processing unit, the IP-VLAN policy library stores the corresponding relationship between the IP address and the VLAN TAG, and supports two retrieval matching modes of accurate matching and range matching, which are used to determine whether to add the VLAN TAG to the network message without carrying the VLAN TAG.