Cross-message HTTP domain name matching method and system on network offloading device

Abstract

The application relates to the technical field of network traffic processing, and discloses a cross-message HTTP domain name matching method and system on a network distribution device. The method comprises the following steps: receiving and analyzing a TCP segment message, obtaining payload data and quintuple information, and then performing first domain name retrieval through preset head and tail anchor points. If the head and tail anchor points are simultaneously identified in a single message, the domain name information is directly extracted to complete matching. If only one of the anchor points is identified, the message is marked as a to-be-recombined message and is sent to a TCP segment recombination step. During recombination, the recombination table item of the FPGA integrated HBM is accessed based on the quintuple hash value, the payload data is written into the corresponding position, the recombined payload data is output when a preset output condition is met, and finally, second domain name retrieval is performed on the recombined data. After the head and tail anchor points are identified, the domain name is extracted to complete matching. The method realizes accurate matching of cross-message domain names under a 400G large bandwidth, takes into account single-message line-speed processing performance, solves the problem of cross-message domain name missing matching, and is suitable for network environments in which multiple websites share an IP.

Description

Technical Field

[0001] This application relates to the field of network traffic processing technology, specifically to a cross-message HTTP domain name matching method and system on a network traffic splitting device. Background Technology

[0002] Hypertext Transfer Protocol (HTTP) is the fundamental protocol for internet data communication. Domain names, as the core element of HTTP request messages, are a crucial basis for network traffic filtering devices. The current deployment model where multiple websites share internet protocol addresses makes domain name matching the primary method of traffic filtering. However, some illegal websites distribute domain name information across Transmission Control Protocol (TCP) segment payloads, posing challenges to domain name matching and blocking of illegal traffic.

[0003] The existing Hypertext Transfer Protocol (HTTP) domain name matching schemes for network traffic offloading devices have the following main drawbacks: The architecture based on FPGAs, multi-core x86 processors, and double data rate fourth-generation memory is prone to traffic loss and domain name mismatch due to limitations in mirror interface bandwidth and policies, and its deployment cost and difficulty are also high; while the architecture based on multi-core x86 processors and double data rate fourth-generation memory can achieve full traffic processing, it requires multiple servers to meet the 400 Gbps bandwidth requirement, resulting in extremely low cost-effectiveness; the architecture based on FPGAs and double data rate fourth-generation memory can achieve 400 Gbps single-message domain name matching, but due to the capacity limitations of FPGA peripherals, it cannot complete message framing, leading to cross-message domain name mismatch issues.

[0004] In summary, existing technologies are insufficient to achieve accurate cross-message domain name matching while meeting the processing performance of 400 Gbits per second high-bandwidth network traffic. There is an urgent need for a domain name matching method that balances processing performance, matching accuracy, and deployment economy. Summary of the Invention

[0005] The purpose of this application is to provide a cross-message HTTP domain name matching method and system on a network traffic splitting device to solve the problems mentioned in the background art.

[0006] According to a first aspect of this application, a method for cross-message HTTP domain name matching on a network traffic splitting device is provided, comprising the following steps:

[0007] S1 receives and parses TCP segment packets to obtain payload data and a five-tuple containing source IP address, destination IP address, source port, destination port, and protocol number;

[0008] S2, based on the preset first anchor point and last anchor point, perform the first domain name retrieval on the net load data;

[0009] S3, if the first anchor point and the last anchor point are identified simultaneously in the payload data, then extract the domain name information from the payload data and perform domain name matching on the domain name information;

[0010] S4. If only the first anchor point is identified in the payload data but not the last anchor point, or only the last anchor point is identified but not the first anchor point, then the TCP segment message is marked as a message to be reassembled, and the five-tuple information and payload data of the message to be reassembled are sent to the TCP segment reassembly step.

[0011] The TCP segment reassembly includes: calculating a hash value based on the five-tuple information of the packet to be reassembled; using the hash value as the addressing address to access the reassembly entry in the high-bandwidth memory (HBM) integrated in the FPGA; writing the payload data of the packet to be reassembled into the payload storage area of ​​the reassembly entry at the position corresponding to the sequence number offset; and outputting the reassembly payload data from the reassembly entry when the reassembly payload in the reassembly entry meets the preset output conditions.

[0012] S5, perform a secondary domain name search on the recombined payload data. If the first anchor point and the last anchor point are identified simultaneously in the recombined payload data, extract domain name information from the recombined payload data and perform domain name matching on the domain name information.

[0013] Preferably, the TCP segment reassembly step further includes: when a SYN packet is detected during the TCP connection three-way handshake process, calculating a hash value based on the five-tuple information of the SYN packet, using the hash value as the address to create a new reassembly entry in HBM, and recording a base sequence number in the reassembly entry, wherein the base sequence number is the sequence number of the SYN packet plus 1.

[0014] Preferably, writing the payload data into the reassembly entry at the position corresponding to the sequence number offset includes: calculating the difference between the sequence number of the current TCP segment and the reference sequence number to obtain the sequence number offset; writing the payload data into the payload storage area at the position starting at the sequence number offset; when the byte flag corresponding to the writing position is marked as valid, determining that the current segment is a retransmission segment, and discarding the payload data.

[0015] Preferably, the reorganization entry further includes a byte valid bitmap, consecutive valid prefix length, missing segment timeout count, and first gap position;

[0016] The byte validity bitmap is used to identify whether each byte or byte segment in the payload storage area has been written with valid data.

[0017] The consecutive valid prefix length represents the length of consecutive valid data determined by the byte valid bitmap, starting from the beginning address of the payload storage area;

[0018] The missing segment timeout count is used to record the waiting time of the first data gap after the consecutive valid prefix length;

[0019] The first gap position is used to record the boundary position of the first data gap in the net load storage area.

[0020] Preferably, the byte valid bitmap includes a coarse-grained segment bitmap, which divides the payload storage area into multiple byte segments of equal length. Each byte segment corresponds to a bitmap identifier. When the bitmap identifier is a first value, it indicates that all bytes in the byte segment have been written with valid data. When it is a second value, it indicates that there are bytes in the byte segment that have not been written with valid data.

[0021] Preferably, the update rule for the consecutive valid prefix length is as follows: when the payload data is written such that the bitmap identifiers of multiple consecutive byte segments starting from the starting address in the coarse-grained segment bitmap are all of the first value, the consecutive valid prefix length is updated to the total number of bytes of the multiple consecutive byte segments.

[0022] Preferably, the preset output conditions include the recombined payload length reaching a preset length threshold, and the output of recombined payload data from the recombined entry includes:

[0023] Compare the length of the consecutive valid prefixes with the preset length threshold;

[0024] If the length of the continuous valid prefix is ​​greater than or equal to the preset length threshold, output recombined payload data with a length of the preset length threshold starting from the starting address of the payload storage area;

[0025] If the length of the consecutive valid prefix is ​​less than the preset length threshold, the missing segment timeout count is started. When the missing segment timeout count exceeds the preset timeout threshold, reconstructed payload data with a length equal to the length of the consecutive valid prefix is ​​output from the starting address of the payload storage area, and a missing segment degradation flag is added.

[0026] Preferably, the preset output condition further includes simultaneously collecting the first anchor hit marker and the last anchor hit marker from the initial domain name retrieval in the reorganization entry, and the output of reorganization payload data from the reorganization entry includes:

[0027] Determine whether the positions indicated by the first anchor point hit mark and the last anchor point hit mark are both within the interval defined by the continuous effective prefix length;

[0028] If so, output the recombined net load data covering the smallest continuous interval from the first anchor point hit mark position to the tail anchor point hit mark position.

[0029] Preferably, performing a secondary domain name retrieval on the recombined net payload data includes:

[0030] If the recombined payload data carries the missing segment degradation flag, the search range will be limited to an interval starting from the starting address of the recombined payload data and having a length equal to the length of the continuous valid prefix.

[0031] Domain name information is extracted from the recombined payload data only when both the first anchor point and the last anchor point are identified simultaneously within the search range.

[0032] A second aspect of this application also provides a cross-message HTTP domain name matching system on a network traffic splitting device, comprising:

[0033] The message receiving and parsing module is used to receive and parse TCP segment messages, obtain payload data and a five-tuple containing source IP address, destination IP address, source port, destination port, and protocol number;

[0034] The initial domain name retrieval module is used to perform an initial domain name retrieval on the payload data based on preset first and last anchor points;

[0035] The first domain name matching module is used to extract domain name information from the payload data and perform domain name matching on the domain name information if the first anchor point and the last anchor point are identified simultaneously in the payload data.

[0036] The message marking and reassembly module is used to mark the TCP segment message as a message to be reassembled if only the first anchor point is identified in the payload data but the last anchor point is not identified, or only the last anchor point is identified but the first anchor point is not identified, and then send the five-tuple information and payload data of the message to be reassembled into the TCP segment reassembly module.

[0037] The TCP segment reassembly module includes:

[0038] A hash calculation unit is used to calculate a hash value based on the five-tuple information of the message to be reassembled;

[0039] The reorganization entry access unit is used to access the reorganization entry in the high-bandwidth memory (HBM) integrated in the field-programmable gate array (FPGA) using the hash value as the addressing address.

[0040] The payload writing unit is used to write the payload data of the message to be reassembled into the payload storage area of ​​the reassembly entry at the position corresponding to the sequence number offset.

[0041] The recombination payload output unit is used to output recombination payload data from the recombination entry when the recombination payload in the recombination entry meets the preset output conditions.

[0042] The secondary domain name retrieval module is used to perform secondary domain name retrieval on the recombined net load data;

[0043] The second domain name matching module is used to extract domain name information from the recombined payload data and perform domain name matching on the domain name information if the first anchor point and the last anchor point are identified simultaneously in the recombined payload data.

[0044] This application utilizes an FPGA and DDR4 hardware architecture with HBM to achieve high-performance cross-packet HTTP domain name matching under 400G high-bandwidth network traffic through hardware-level protocol parsing, anchor scanning, hash calculation, and TCP segment reassembly. The dual-search matching scheme ensures both line-speed retrieval of single-packet domain names and accurate retrieval of cross-packet domain names, solving the problem of full coverage for both single-packet and cross-packet domain name matching. HBM-based TCP segment reassembly leverages its high bandwidth and high throughput characteristics to achieve a reassembly performance of 180Mpps. Furthermore, through refined parameter design of the reassembly table entries, it solves the problems of secondary retrieval misjudgments caused by TCP out-of-order segment retransmissions and the long-term occupation of HBM table entries, improving the accuracy of cross-packet domain name matching and the controllability of hardware resources. This method does not require the cooperation of multi-core x86 servers, reducing the deployment cost and difficulty of network traffic splitting devices. It also effectively addresses the traffic filtering needs of illegal domain name information hidden across TCP segment packets, improving the timeliness and accuracy of domain name blocking, and is well-suited for complex network environments where multiple websites share IP addresses. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0046] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0047] Figure 1 A schematic diagram illustrating a cross-message HTTP domain name matching method on a network traffic splitting device provided in this application embodiment;

[0048] Figure 2 This is a schematic diagram of the TCP segment reassembly process for a message to be reassembled, provided in an embodiment of this application.

[0049] Figure 3 A schematic diagram of a cross-message HTTP domain name matching system structure on a network traffic splitting device provided in this application embodiment;

[0050] Figure 4 This is a schematic diagram of the recombination module structure provided in an embodiment of this application. Detailed Implementation

[0051] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] It should be noted that all user information (including but not limited to user device information, user personal information, object information corresponding to device usage data, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, device usage data, etc.) involved in all embodiments of this application are information and data authorized by the user or fully authorized by all parties.

[0053] This method is suitable for high-bandwidth network traffic processing scenarios in network traffic offloading devices. It is adapted to network environments where multiple websites share Internet Protocol (IP) addresses and the domain name information of Hypertext Transfer Protocol (HTTP) request messages is distributed across Transmission Control Protocol (TCP) segment payloads. It can effectively address the traffic filtering requirements where illegal domain name information is hidden across TCP segments. The hardware implementation of this method is generally based on an architecture of a Field Programmable Gate Array (FPGA) with integrated high-bandwidth memory (HBM) and double data rate (DDR4) memory. The FPGA needs to implement high-speed access to TCP segments, hardware-level protocol parsing, anchor scanning, and hash calculation functions. The HBM needs to have multi-pseudo-channel parallel processing capabilities to support high-performance TCP segment reassembly. The DDR4 needs to be used to store the domain name rule base and support high-speed hash addressing. The overall hardware architecture can meet the line-speed processing performance requirements of HTTP domain name extraction and matching for 400G single packets.

[0054] For example, all processing steps of this method can be implemented by FPGA hardware circuits without software intervention. Each functional module achieves seamless data transmission through hardware logic, ensuring unblocked processing speed under 400G bandwidth. The collaborative work of each module is based on the internal data flow control logic of the hardware, without the need for external instruction scheduling.

[0055] The implementation process of the cross-message HTTP domain name matching method on the network traffic splitting device described in this application will be described in detail below with reference to specific embodiments. It should be noted that this embodiment is only used to explain this application and is not intended to limit the scope of protection of this application. Conventional adjustments or substitutions of each step by those skilled in the art without departing from the concept of this application should be included in the protection scope of this application.

[0056] like Figure 1 As shown in the figure, this application discloses a schematic diagram of a cross-message HTTP domain name matching method on a network traffic splitting device, including the following method steps:

[0057] S1 receives and parses TCP segment packets to obtain payload data and a five-tuple containing source IP address, destination IP address, source port, destination port, and protocol number;

[0058] S2, based on the preset first anchor point and last anchor point, perform the first domain name retrieval on the net load data;

[0059] S3, if the first anchor point and the last anchor point are identified simultaneously in the payload data, then extract the domain name information from the payload data and perform domain name matching on the domain name information;

[0060] S4. If only the first anchor point is identified in the payload data but not the last anchor point, or only the last anchor point is identified but not the first anchor point, then the TCP segment message is marked as a message to be reassembled, and the five-tuple information and payload data of the message to be reassembled are sent to the TCP segment reassembly step.

[0061] The TCP segment reassembly includes: calculating a hash value based on the five-tuple information of the packet to be reassembled; using the hash value as the addressing address to access the reassembly entry in the high-bandwidth memory (HBM) integrated in the FPGA; writing the payload data of the packet to be reassembled into the payload storage area of ​​the reassembly entry at the position corresponding to the sequence number offset; and outputting the reassembly payload data from the reassembly entry when the reassembly payload in the reassembly entry meets the preset output conditions.

[0062] S5, perform a secondary domain name search on the recombined payload data. If the first anchor point and the last anchor point are identified simultaneously in the recombined payload data, extract domain name information from the recombined payload data and perform domain name matching on the domain name information.

[0063] In some embodiments, for step S1, the reception and parsing of TCP segment packets. The FPGA's packet access port receives TCP segment packets from the network. The transmission bandwidth of the access port can be configured to 400G, matching the original transmission rate of the network traffic. The received TCP segment packets are directly sent to the packet buffer module inside the FPGA. The buffer depth of this module can be dynamically adjusted according to the read / write rate of the HBM to ensure unblocked temporary storage of packet data and avoid packet loss due to subsequent processing rate fluctuations.

[0064] The FPGA's protocol parsing module reads TCP segment data from the message buffer module, extracting the first few bytes of each segment for parsing. For example, it can be configured to extract the first 256 bytes. This byte count is based on statistical results of the protocol header lengths of mainstream HTTP request messages in the network, covering all fields in the protocol headers of the data link layer, network layer, and transport layer. The protocol parsing module uses hardware logic to sequentially identify the boundaries of each layer's protocol header, extracting the source IP address, destination IP address, and protocol number from the network layer, and the source port, destination port, and sequence number from the transport layer. Simultaneously, it identifies the starting position of the payload data in the TCP segment, separating the payload data from the segment and temporarily storing it in the FPGA's on-chip memory.

[0065] After the resolution module completes the resolution, it integrates the source IP address, destination IP address, source port, destination port, and protocol number into a five-tuple of information. This information establishes a one-to-one correspondence with the payload data and is sent together to the subsequent domain name retrieval module. The identifier of the association is implemented by a unique message number generated by the hardware logic to ensure that the data correspondence in subsequent processing steps is accurate.

[0066] In some embodiments, steps S2 and S3 involve initial domain name retrieval based on the first and last anchor points. The FPGA's anchor point scanning module performs the initial domain name retrieval on the output payload data. This embodiment addresses the technical problem in the prior art that it is impossible to simultaneously achieve fast single-message domain name retrieval and accurate cross-message domain name marking at 400G line speed. Through hardware-level anchor point feature matching, it ensures high performance for single-message retrieval while providing accurate marking for cross-message TCP segment reassembly, avoiding the waste of hardware resources caused by invalid reassembly and improving overall processing efficiency.

[0067] The first anchor point is a combination of characteristic characters representing the beginning position of the domain name in the HTTP request message. It can be preset according to the HTTP protocol specification and the characteristics of HTTP request messages in the actual network. It serves as the starting identifier for domain name retrieval, and the length of this characteristic character combination can be adjusted according to the actual application scenario and supports dynamic updates. The last anchor point is a combination of characteristic characters representing the ending position of the domain name in the HTTP request message. It is also preset according to the HTTP protocol specification and the actual network characteristics. It serves as the ending identifier for domain name retrieval and, together with the first anchor point, defines the boundaries of domain name information.

[0068] The anchor point scanning module is implemented using dedicated logic circuitry on an FPGA, employing a byte-level parallel scanning architecture. Its scanning rate matches the 400G bandwidth message processing rate, eliminating scanning latency. The scanning module internally stores preset combinations of first and last anchor point feature characters. During scanning, it performs full-data-byte-level matching on the payload data, simultaneously identifying the positions of the first and last anchor points within the payload data. The matching process is precise, without error tolerance, avoiding false anchor point hits due to partial matching of feature characters.

[0069] During the scanning process, the anchor point scanning module executes three mutually exclusive processing logics based on the matching results of the first and last anchor points. These three logics cover all possibilities of anchor point matching, ensuring that no points are missed:

[0070] If both the first and last anchor points are identified in the payload data, the TCP segment is determined to be a single packet containing complete HTTP domain name information. The scanning module extracts the ending position of the first anchor point and the starting position of the last anchor point, and calculates the length and starting address of the domain name information in the payload data. The calculation formula is as follows:

[0071]

[0072] in, The length of the domain name information in bytes within the payload data. This is the offset address of the next byte in the payload data after the first anchor point, i.e., the starting address of the domain name information. This is the offset address of the tail anchor point's starting position within the payload data, i.e., the ending address of the domain name information. The scanning module will... and The message is marked as a single message domain name matching completed in the message association information, and the payload data and domain name location information are sent together to the subsequent domain name extraction and matching module.

[0073] If only the first anchor point is identified in the payload data but not the last anchor point, or only the last anchor point is identified but not the first anchor point, it is determined that the domain name information of the TCP segment message may be transmitted across TCP segment messages. The scanning module marks the message as a message to be reassembled, extracts the identified anchor point type and location information and writes it into the message association information, and sends the five-tuple information of the message to be reassembled, the payload data and the association information together into the subsequent TCP segment reassembly module.

[0074] If the first anchor point is not identified in the payload data, regardless of whether the last anchor point is identified, the scanning module determines that the TCP segment packet does not have valid HTTP domain name start information, and directly sends a discard command to the packet cache module to clear all data of the packet from the on-chip storage area without performing any subsequent processing, so as to avoid invalid data occupying the hardware resources of FPGA, HBM and DDR4.

[0075] In some embodiments, the FPGA's domain name extraction module receives the single-message data and domain name location information output by the initial domain name retrieval module, and then... and Complete domain name information is extracted from the payload data. The extraction process involves hardware-level addressing and data copying, with the copying rate matching the read / write rate of the on-chip storage area, resulting in no data extraction delay.

[0076] The extracted domain name information is sent to the hash calculation module of the FPGA. This module performs a hash calculation on the domain name information to obtain the domain name hash value. The hash algorithm can be configured as a Cyclic Redundancy Check (CRC) algorithm or other easily implemented hardware hash algorithms. The choice of algorithm is determined based on the FPGA's logic resource utilization and the uniqueness requirement of the hash calculation. The hash calculation formula is:

[0077]

[0078] in, This is the domain name hash value. The default hash algorithm is used. This is the complete domain name information extracted.

[0079] The domain name matching module of the FPGA will As the addressing address, high-speed hash addressing is performed on the DDR4 memory. The DDR4 memory pre-stores a domain name rule base, which contains the hash values ​​of the domain names to be filtered and their corresponding traffic processing strategies. This domain name rule base can be dynamically updated by the user through the configuration interface of the network traffic distribution device; the update process does not affect the normal execution of domain name matching. The domain name matching module determines the appropriate domain name based on the addressing result. If a domain name does not exist in the domain name rule base, the domain name is considered a match, and the corresponding processing strategy is retrieved from the rule base; if it does not exist, the domain name is considered a mismatch, and the message is processed according to the preset default strategy.

[0080] All of the above operations are implemented by hardware logic, with a processing rate synchronized with the 400G bandwidth packet access rate, ensuring high performance in single packet domain name matching without processing delay.

[0081] In some embodiments, for step S4, the TCP segment reassembly module of the FPGA receives the packet to be reassembled output by the first domain name retrieval module. This embodiment addresses the technical problems in the prior art where the FPGA+DDR4 architecture cannot achieve cross-packet TCP segment reassembly and cross-packet domain name mismatch. At the same time, through the refined parameter design of the reassembly table entries, and to solve the problems of misjudgment of secondary domain name retrieval and long-term occupation of HBM entries caused by TCP out-of-order segment retransmission under 400G high concurrency, the high bandwidth and high throughput characteristics of HBM are utilized to achieve high-performance reassembly of TCP segment packet payload. The reassembly performance can reach 180Mpps, which meets the processing performance requirements of 400G high bandwidth.

[0082] All TCP segment reassembly operations are implemented using HBM integrated on the FPGA. Five-tuple hash addressing is used to achieve unique association of reassembly entries. Fine-grained reassembly entry parameters enable continuous and effective management of payload data. Precise output of the reassembled payload is achieved through preset output conditions. Please refer to [link / reference]. Figure 2 , Figure 2 This is a schematic diagram of the TCP segment reassembly process for a packet to be reassembled, provided in an embodiment of this application. The overall process includes creating a reassembly entry, five-tuple hash addressing, sequence number offset calculation, payload data writing, reassembly entry parameter updating, preset output condition judgment, and reassembly payload data output.

[0083] Specifically, in S201, a new reassembly entry is created based on the SYN packet. When the FPGA's protocol parsing module detects a SYN packet during the TCP connection three-way handshake process, the hash calculation module performs a hash calculation on the five-tuple information of the SYN packet to obtain the five-tuple hash value. The calculation formula is as follows:

[0084]

[0085] in, This is the hash value of the 5-tuple. To facilitate the implementation of hash algorithms on hardware that is the same as or different from that used for domain name hash calculation, The source IP address The destination IP address For the source port, For destination port, This is the protocol number.

[0086] The TCP segment reassembly module will As the addressing address, a corresponding reassembly entry is created in HBM. The reassembly entry is a fixed-length storage area allocated in HBM, which can be configured to 256 bytes, for example. The core information initially written into the entry is the base sequence number. , The calculation formula is:

[0087]

[0088] in, This is the transport layer sequence number of the SYN packet. Following the TCP protocol's sequence number increment rule, it is incremented by 1 and used as the base sequence number for subsequent TCP segment payload reassembly.

[0089] The reorganization entry also initially sets four core parameters: byte valid bitmap, consecutive valid prefix length, missing segment timeout count, and first gap position. In the initial state, all the flag bits of the byte valid bitmap are the second value, the consecutive valid prefix length is 0, the missing segment timeout count is 0, and the first gap position is 0.

[0090] Optionally, when the TCP segment reassembly module receives the packet to be reassembled and addresses the HBM using the 5-tuple hash value, if the corresponding reassembly entry does not exist, it further checks whether the packet is a SYN packet:

[0091] If the SYN flag in the TCP flag of the packet is 1, then a new reassembly entry is created according to the above procedure, and the sequence number of the SYN packet plus 1 is used as the base sequence number.

[0092] If the message is not a SYN message, it is determined that the correct base sequence number cannot be determined. The message to be reassembled is discarded directly, or the message is temporarily stored in a temporary buffer and a timer is started to wait for subsequent SYN messages to arrive.

[0093] In S202, the five-tuple hash addressing of the packet to be reassembled is performed. For TCP segment packets marked as packets to be reassembled, the hash calculation module performs the same hash calculation as the above steps on its five-tuple information, obtaining the same five-tuple hash value. The TCP segment reassembly module is used to... As the addressing address, access the corresponding reassembly entry in HBM to establish a unique association between the message to be reassembled and the reassembly entry.

[0094] The associated information carries anchor point hit markers identified during the initial domain name retrieval phase: if only the first anchor point is identified in the packet, the associated information includes the first anchor point hit marker and the first anchor point's location; if only the last anchor point is identified in the packet, the associated information includes the last anchor point hit marker and the last anchor point's location. After accessing the reassembly table entry via the 5-tuple hash value, the TCP segment reassembly module writes the anchor point hit markers and their locations carried in the packet into the preset anchor point marker storage area in the reassembly table entry. If the reassembly table entry already contains anchor point hit markers of the same type, it chooses to overwrite or retain the one that arrived first, depending on actual needs.

[0095] For example, HBM is configured with 16 pseudo channels, which can process TCP segment reassemblies of 4 different 5-tuple information in parallel. That is, it can simultaneously perform payload writing and parameter update operations on 4 different reassembly entries. The performance of reading and writing 4×256B entries can reach 180Mpps, which meets the parallel processing requirements of 400G high bandwidth.

[0096] In S203, the sequence number offset is calculated. The TCP segment reassembly module extracts the transport layer sequence number from the association information of the segment to be reassembled. Calculate the sequence number and its relationship with the baseline sequence number in the recombinant entry. The difference is used to obtain the sequence number offset. The calculation formula is:

[0097]

[0098] in, This is the starting address of the payload data of the packet to be reassembled in the payload storage area of ​​the reassembly table entry. The payload storage area is a dedicated region in the reassembly table entry for storing TCP segment payload data, with a starting address of 0 and an address offset of [missing information]. One-to-one correspondence.

[0099] The calculation ensures that out-of-order TCP segments are written to the correct location in the payload storage area, providing a basis for subsequent out-of-order packet correction. The calculation process is implemented by a hardware adder, with no computational delay.

[0100] In S204, the payload data of the message to be reassembled is written and retransmission filtering is performed. The TCP segment reassembly module calculates the payload data based on the reassembly data. Write the payload data of the message to be reassembled into the payload storage area of ​​the reassembly table entry. The starting address is the location of the data to be written. The writing process is a high-speed data transfer at the hardware level, matching the read and write speed of HBM.

[0101] Before writing the payload data, the reassembly module first queries the byte valid bitmap flag corresponding to the write position. If the flag is already at the first value, it determines that the current packet to be reassembled is a retransmitted packet or a duplicate out-of-order packet, and directly discards the payload data of the packet without performing the write operation to avoid data errors in the payload storage area caused by duplicate data. If the flag is at the second value, the payload data write operation is performed, and after the write is completed, the corresponding byte valid bitmap flag is updated to the first value.

[0102] Through TCP segment retransmission filtering and out-of-order correction, out-of-order packets are processed according to... Once written to the correct location, retransmitted messages are discarded directly, ensuring the validity and uniqueness of data in the payload storage area.

[0103] In S205, the core parameters of the reorganized table entry are defined and updated. The byte valid bitmap, consecutive valid prefix length, missing segment timeout count, and first gap position in the reorganized table entry are the core parameters for achieving continuous and valid management of payload data. Through the coordinated updating of these parameters, the continuity of data in the payload storage area can be accurately determined, fundamentally avoiding misjudgment problems caused by non-continuous data being sent to secondary domain name retrieval.

[0104] The byte valid bitmap is used to identify whether each byte segment in the payload storage area has been written with valid data. It includes a coarse-grained segment bitmap, which divides the payload storage area into multiple byte segments of equal length. For example, it can be configured as 16B or 32B per byte segment. Each byte segment corresponds to a bitmap identifier bit. When the identifier bit is the first value, it indicates that all bytes in the byte segment have been written with valid data. When the identifier bit is the second value, it indicates that there are bytes in the byte segment that have not been written with valid data.

[0105] The formula for calculating the number of bits in a coarse-grained segment map is:

[0106]

[0107] in, This refers to the number of bits in the coarse-grained segment map. The total length of the payload storage area in bytes. The length in bytes for each byte segment. This is a rounding-up function. This design enables rapid determination of the data write status in the payload storage area while keeping HBM storage overhead under control.

[0108] After the payload data is written, the reassembly module updates the corresponding bitmap flag to the first value only when all bytes of the byte segment have been written with valid data. If only part of the byte segment is written, the flag remains unchanged at the second value.

[0109] Length of consecutive valid prefixes This represents the length of consecutive valid data in bytes, starting from address 0 of the payload storage area and determined by the coarse-grained segment bitmap. Its value is a non-negative integer, with the maximum value being the total length of the payload storage area in bytes. .

[0110] The update rule is as follows: when the payload data is written such that the flag bits of multiple consecutive byte segments starting from address 0 in the coarse-grained segment bitmap are all at the first value, the reassembly module will... Updated to the total byte length of the consecutive byte segments, calculated using the following formula:

[0111]

[0112] in, This represents the number of consecutive valid byte segments starting from address 0. The length in bytes for each byte segment. If the payload data is written to a non-contiguous region and existing data gaps are not filled, then... It remains unchanged.

[0113] This provides a basis for limiting the scanning scope of subsequent secondary domain name searches, ensuring that secondary searches are only performed within continuous and valid data ranges, and avoiding misjudgments caused by non-continuous data.

[0114] First gap position Used for recording The first data gap is located at the boundary of the payload storage area, and its value is the starting address of the byte segment corresponding to the gap. The calculation formula is as follows:

[0115]

[0116] When the reassembly module detects When the coarse-grained segment bitmap identifier of the next byte segment is the second value, it is determined that the first data gap has occurred in the payload storage area, and the data gap will be... Update to the value calculated using the formula above.

[0117] Segment Timeout Count This is used to record the waiting time for the first data gap, and its counting unit is the TCP segment reception cycle. After being updated, the reorganization module is activated. The initial value is 1. Whenever a reassembled packet belonging to this TCP connection is received and the data gap is not filled, Add 1; if the received reassembled message fills the data gap, then... If this is advanced, the reorganization module will... Clear to zero, and re-detect and update. .

[0118] preset timeout threshold The value is determined by the user based on the statistical results of network latency characteristics and TCP retransmission mechanism. The value range can be configured from 1 to 10 TCP packet reception cycles. The setting of this threshold balances the occupancy time of HBM entries with the integrity of the reassembled payload data.

[0119] In S206, the judgment of preset output conditions for the reassembled payload is performed. The TCP segment reassembly module monitors the payload data status in the reassembly table in real time. When one of the preset output conditions is met, the reassembled payload data is output. The preset output conditions include two types: the reassembled payload length reaches a preset length threshold, and both the first anchor point hit mark and the tail anchor point hit mark are collected in the reassembly table simultaneously. The two conditions are ORed, and output is triggered when either condition is met.

[0120] The recombined net load length reaches the preset length threshold. The reassembled payload output length is determined by the user based on the statistical results of the domain name length distribution of HTTP request messages in the network. Its value range is configurable from 128B to 2048B and is stored in the reassembled module's configuration register, supporting dynamic adjustment. The reassembled module calculates the total length of valid data already written to the payload storage area in real time. When this length reaches... At that time, the reorganization net load output condition is triggered.

[0121] When both the first and last anchor point hit tags are collected from multiple reassembled packets belonging to the same TCP connection, with some packets carrying the first anchor point hit tag and others carrying the last anchor point hit tag, and both tags are collected into the corresponding reassembly table entries, the reassembly payload output condition is triggered. This condition ensures that reassembly payload data is output promptly when the domain name information boundaries across packets are identified, improving the timeliness of cross-packet domain name matching.

[0122] In S207, the reorganized payload data is output. The reorganization module executes the reorganized payload data output operation according to the triggered preset output conditions, following the principle of continuity priority. Different output conditions correspond to different output logic. At the same time, a degradation output strategy is designed for missing segment scenarios to ensure the timely release of HBM table entry resources.

[0123] Specifically, for outputs where the recombined payload length reaches a preset length threshold, the recombining module first compares... and The size relationship, if It is determined that there exists a length of [length missing] in the net load storage area. The output is a continuous valid data, starting from address 0 of the payload storage area and with a length of [missing information]. The recombined net load data; if If the length of continuous valid data in the payload storage area does not reach the preset threshold, the spliced ​​non-continuous data will not be directly output, and the process will be initiated. Perform segment timeout counting, when Exceeding the preset timeout threshold At that time, a degraded output is performed, starting from address 0 of the payload storage area and having a length of [missing information]. The continuous and valid recombined payload data is used to attach a missing segment downgrade flag to the data. This flag is a binary identifier used to inform the subsequent secondary domain name retrieval module that there are missing segments in the data.

[0124] For the output containing the first and last anchor point hit markers, the reassembly module first extracts the positions of the first and last anchor point hit markers in the payload storage area, and determines whether both positions are located within the payload storage area. If all data points within a continuous valid data interval are within that interval, it is determined that there is continuous valid data covering the domain name information boundary. The recombined payload data is output within the smallest continuous interval covering the first anchor point hit mark position to the last anchor point hit mark position, ensuring that the output data contains complete domain name information. If the last anchor point hit mark position falls within... After the corresponding gap is identified, it is determined that the domain name information boundary contains discontinuous data. The reorganization payload data is not output temporarily, and the gap is waited for to be filled or the missing segment timeout occurs.

[0125] After the reassembled payload data is output, if it is a normal output, the reassembly module retains the reassembly entry and continues to receive the reassembly packets for the TCP connection; if it is a segment loss and degradation output, the reassembly module releases the reassembly entry and clears the data in the payload storage area to avoid resource exhaustion caused by the HBM entry being occupied for a long time.

[0126] In some embodiments, for step S5, a secondary domain name retrieval of the reassembled payload data is performed, along with cross-message domain name matching. The FPGA's anchor scanning module performs a secondary domain name retrieval on the reassembled payload data output by the TCP segment reassembly module. This secondary retrieval, together with the initial domain name retrieval, constitutes a dual retrieval and matching scheme. This solves the technical problem of missed matching of cross-message domain name information in the prior art. By utilizing the continuous valid data range limitation of the reassembled payload, the accuracy of cross-message domain name retrieval is ensured, achieving full coverage of single-message and cross-message domain name matching.

[0127] The scanning logic for secondary domain name retrieval is completely consistent with that for primary domain name retrieval, both based on precise byte-level matching of the first and last anchor points. The scanning module is implemented using the same FPGA anchor point scanning hardware circuit, with the only differences being the input data and the retrieval scope limitations, specifically including:

[0128] If the recombined payload data does not carry a missing segment degradation flag, the scanning module performs a full byte-level scan of the recombined payload data, matching the first and last anchor points. If two anchor points are identified simultaneously, the anchor point positions are extracted and processed according to the formula. Calculate the length and starting address of the domain name information, and send the domain name location information to the domain name extraction module; if two anchor points are not identified at the same time, it is determined that the TCP connection has no valid HTTP domain name information, discard the reassembled payload data and release the corresponding HBM table entry.

[0129] If the recombined payload data carries a segment degrade flag, the scanning module will limit the search scope to a length starting from the beginning address of the recombined payload data. Within a continuous valid interval, the matching of the first and last anchor points is performed only within that interval. If two anchor points are identified simultaneously, the domain name location information is extracted and sent to the domain name extraction module. If two anchor points are not identified simultaneously, it is determined that the missing segment data of the TCP connection causes the domain name information to be incomplete. The reconstructed payload data is discarded and the corresponding HBM table entry is released.

[0130] The domain name extraction module extracts complete domain name information from the reconstructed payload data based on the domain name location information output by the secondary domain name retrieval. The extraction process is consistent with single-message domain name extraction, involving hardware-level addressing and data copying. The extracted domain name information is then sent to the hash calculation module, calculated according to the formula... The domain name hash value is calculated. The domain name matching module uses this hash value as the address to access the domain name rule base in DDR4. It judges whether there is a match according to the same logic as the single message domain name matching. If there is a match, the corresponding processing strategy is extracted. If there is no match, the default strategy is used.

[0131] For the same TCP connection, once the cross-packet domain name matching is completed, the TCP segment reassembly module updates the matching result to the corresponding HBM entry. All subsequent traffic of this TCP connection can directly follow the matching result and execute the corresponding processing strategy without repeating domain name retrieval and TCP segment reassembly, thus improving the processing efficiency of traffic for the same connection.

[0132] Therefore, this method, based on an FPGA and DDR4 hardware architecture with HBM, achieves high-performance cross-packet HTTP domain name matching under 400G high-bandwidth network traffic through hardware-level protocol parsing, anchor scanning, hash calculation, and TCP segment reassembly. The dual-search matching scheme ensures both line-speed fast retrieval of single-packet domain names and accurate retrieval of cross-packet domain names, solving the problem of full coverage for both single-packet and cross-packet domain name matching. HBM-based TCP segment reassembly leverages its high bandwidth and high throughput characteristics to achieve a reassembly performance of 180Mpps. Simultaneously, through refined parameter design of the reassembly table entries, it solves the problems of secondary retrieval misjudgments caused by TCP out-of-order segment retransmissions and the long-term occupation of HBM table entries, improving the accuracy of cross-packet domain name matching and the controllability of hardware resources. This method does not require the cooperation of multi-core x86 servers, reducing the deployment cost and difficulty of network traffic splitting devices. It also effectively addresses the traffic filtering needs of illegal domain name information hidden across TCP segment packets, improving the timeliness and accuracy of domain name blocking, and is well-suited for complex network environments where multiple websites share IP addresses.

[0133] It should be noted that although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart can be performed in a different order. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0134] Please see Figure 3 , Figure 3 This application provides a structural block diagram of a cross-message HTTP domain name matching system on a network traffic splitting device. The system specifically includes:

[0135] The message receiving and parsing module 301 is used to receive and parse TCP segment messages to obtain payload data and a five-tuple containing source IP address, destination IP address, source port, destination port, and protocol number.

[0136] The initial domain name retrieval module 302 is used to perform an initial domain name retrieval on the payload data based on preset first and last anchor points;

[0137] The first domain name matching module 303 is used to extract domain name information from the payload data and perform domain name matching on the domain name information if the first anchor point and the last anchor point are identified simultaneously in the payload data.

[0138] The message marking and reassembly module 304 is used to mark the TCP segment message as a message to be reassembled if only the first anchor point is identified in the payload data but not the tail anchor point, or only the tail anchor point is identified but not the first anchor point, and then send the five-tuple information and payload data of the message to be reassembled to the TCP segment reassembly module 305.

[0139] Among them, such as Figure 4 As shown, Figure 4 This is a schematic diagram of the reassembly module structure provided in an embodiment of this application. The TCP segment reassembly module 305 includes:

[0140] The hash calculation unit 3051 is used to calculate the hash value based on the five-tuple information of the message to be reassembled;

[0141] The reorganization entry access unit 3052 is used to access the reorganization entry in the high-bandwidth memory HBM integrated in the field programmable gate array (FPGA) using the hash value as the addressing address.

[0142] The payload writing unit 3053 is used to write the payload data of the message to be reassembled into the payload storage area of ​​the reassembly entry at the position corresponding to the sequence number offset.

[0143] The recombination payload output unit 3054 is used to output recombination payload data from the recombination entry when the recombination payload in the recombination entry meets the preset output conditions.

[0144] Secondary domain name retrieval module 306 is used to perform secondary domain name retrieval on the recombined net load data;

[0145] The second domain name matching module 307 is used to extract domain name information from the recombined payload data and perform domain name matching on the domain name information if the first anchor point and the last anchor point are identified simultaneously in the recombined payload data.

[0146] It should be noted that the working process of each module in the cross-message HTTP domain name matching system on the network traffic splitting device described in this embodiment can refer to the working process of the cross-message HTTP domain name matching method on the network traffic splitting device described in the above embodiment, and the technical effect achieved is the same as that of the cross-message HTTP domain name matching method on the network traffic splitting device described in the above embodiment, so it will not be repeated here.

[0147] The above description represents the preferred embodiments of the present invention. It should be noted that, for those skilled in the art, various improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for cross-message HTTP domain name matching on a network traffic splitting device, characterized in that, Includes the following steps: S1 receives and parses TCP segment packets to obtain payload data and a five-tuple containing source IP address, destination IP address, source port, destination port, and protocol number; S2, based on the preset first anchor point and last anchor point, perform the first domain name retrieval on the net load data; S3, if the first anchor point and the last anchor point are identified simultaneously in the payload data, then extract the domain name information from the payload data and perform domain name matching on the domain name information; S4. If only the first anchor point is identified in the payload data but not the last anchor point, or only the last anchor point is identified but not the first anchor point, then the TCP segment message is marked as a message to be reassembled, and the five-tuple information and payload data of the message to be reassembled are sent to the TCP segment reassembly step. The TCP segment reassembly includes: calculating a hash value based on the five-tuple information of the packet to be reassembled; using the hash value as the addressing address to access the reassembly entry in the high-bandwidth memory (HBM) integrated in the FPGA; writing the payload data of the packet to be reassembled into the payload storage area of ​​the reassembly entry at the position corresponding to the sequence number offset; and outputting the reassembly payload data from the reassembly entry when the reassembly payload in the reassembly entry meets the preset output conditions. S5, perform a secondary domain name search on the recombined payload data. If the first anchor point and the last anchor point are identified simultaneously in the recombined payload data, extract domain name information from the recombined payload data and perform domain name matching on the domain name information.

2. The cross-message HTTP domain name matching method on a network traffic splitting device according to claim 1, characterized in that, The TCP segment reassembly step further includes: when a SYN packet is detected during the TCP connection three-way handshake process, calculating a hash value based on the five-tuple information of the SYN packet, using the hash value as the address to create a new reassembly entry in HBM, and recording a base sequence number in the reassembly entry, wherein the base sequence number is the sequence number of the SYN packet plus 1.

3. The cross-message HTTP domain name matching method on a network traffic splitting device according to claim 2, characterized in that, Writing the payload data to the position corresponding to the sequence number offset in the reassembly table includes: calculating the difference between the sequence number of the current TCP segment and the base sequence number to obtain the sequence number offset; writing the payload data to the position in the payload storage area starting at the sequence number offset; when the byte flag corresponding to the writing position is marked as valid, determining that the current segment is a retransmission segment and discarding the payload data.

4. The cross-message HTTP domain name matching method on a network traffic splitting device according to claim 3, characterized in that, The reorganization entry also includes a byte valid bitmap, the length of consecutive valid prefixes, the segment timeout count, and the position of the first gap; The byte validity bitmap is used to identify whether each byte or byte segment in the payload storage area has been written with valid data. The consecutive valid prefix length represents the length of consecutive valid data determined by the byte valid bitmap, starting from the beginning address of the payload storage area; The missing segment timeout count is used to record the waiting time of the first data gap after the consecutive valid prefix length; The first gap position is used to record the boundary position of the first data gap in the net load storage area.

5. The cross-message HTTP domain name matching method on a network traffic splitting device according to claim 4, characterized in that, The byte valid bitmap includes a coarse-grained segment bitmap, which divides the payload storage area into multiple byte segments of equal length. Each byte segment corresponds to a bitmap identifier. When the bitmap identifier is a first value, it indicates that all bytes in the byte segment have been written with valid data. When it is a second value, it indicates that there are bytes in the byte segment that have not been written with valid data.

6. The cross-message HTTP domain name matching method on a network traffic splitting device according to claim 5, characterized in that, The update rule for the consecutive valid prefix length is as follows: when the payload data is written such that the bitmap identifiers of multiple consecutive byte segments starting from the starting address in the coarse-grained segment bitmap are all of the first value, the consecutive valid prefix length is updated to the total number of bytes of the multiple consecutive byte segments.

7. The cross-message HTTP domain name matching method on a network traffic splitting device according to claim 6, characterized in that, The preset output conditions include the recombined payload length reaching a preset length threshold. The recombined payload data output from the recombined entries includes: Compare the length of the consecutive valid prefixes with the preset length threshold; If the length of the continuous valid prefix is ​​greater than or equal to the preset length threshold, output recombined payload data with a length of the preset length threshold starting from the starting address of the payload storage area; If the length of the consecutive valid prefix is ​​less than the preset length threshold, the missing segment timeout count is started. When the missing segment timeout count exceeds the preset timeout threshold, reconstructed payload data with a length equal to the length of the consecutive valid prefix is ​​output from the starting address of the payload storage area, and a missing segment degradation flag is added.

8. A cross-message HTTP domain name matching method on a network traffic splitting device according to claim 7, characterized in that, The preset output conditions also include simultaneously collecting the first anchor hit marker and the last anchor hit marker from the initial domain name retrieval in the reorganization entry, and the output of reorganization payload data from the reorganization entry includes: Determine whether the positions indicated by the first anchor point hit mark and the last anchor point hit mark are both within the interval defined by the continuous effective prefix length; If so, output the recombined net load data covering the smallest continuous interval from the first anchor point hit mark position to the tail anchor point hit mark position.

9. A cross-message HTTP domain name matching method on a network traffic splitting device according to claim 8, characterized in that, Performing secondary domain name retrieval on the recombined net load data includes: If the recombined payload data carries the missing segment degradation flag, the search range will be limited to an interval starting from the starting address of the recombined payload data and having a length equal to the length of the continuous valid prefix. Domain name information is extracted from the recombined payload data only when both the first anchor point and the last anchor point are identified simultaneously within the search range.

10. A cross-message HTTP domain name matching system on a network traffic splitting device, characterized in that, include: The message receiving and parsing module is used to receive and parse TCP segment messages, obtain payload data and a five-tuple containing source IP address, destination IP address, source port, destination port, and protocol number; The initial domain name retrieval module is used to perform an initial domain name retrieval on the payload data based on preset first and last anchor points; The first domain name matching module is used to extract domain name information from the payload data and perform domain name matching on the domain name information if the first anchor point and the last anchor point are identified simultaneously in the payload data. The message marking and reassembly module is used to mark the TCP segment message as a message to be reassembled if only the first anchor point is identified in the payload data but the last anchor point is not identified, or only the last anchor point is identified but the first anchor point is not identified, and then send the five-tuple information and payload data of the message to be reassembled into the TCP segment reassembly module. The TCP segment reassembly module includes: A hash calculation unit is used to calculate a hash value based on the five-tuple information of the message to be reassembled; The reorganization entry access unit is used to access the reorganization entry in the high-bandwidth memory (HBM) integrated in the field-programmable gate array (FPGA) using the hash value as the addressing address. The payload writing unit is used to write the payload data of the message to be reassembled into the payload storage area of ​​the reassembly entry at the position corresponding to the sequence number offset. The recombination payload output unit is used to output recombination payload data from the recombination entry when the recombination payload in the recombination entry meets the preset output conditions. The secondary domain name retrieval module is used to perform secondary domain name retrieval on the recombined net load data; The second domain name matching module is used to extract domain name information from the recombined payload data and perform domain name matching on the domain name information if the first anchor point and the last anchor point are identified simultaneously in the recombined payload data.

Images