Bitmap-based data packet rule matching processing method and device, electronic equipment and storage medium

Abstract

The application relates to a bitmap-based data packet rule matching processing method and device, electronic equipment and a storage medium, which comprises the following steps: performing rule matching on a current data packet, and obtaining the identifiers of matched sub-rules; marking the bitmaps of a sub-rule bitmap table based on the identifiers of the matched sub-rules; identifying the combination rule identifiers corresponding to the matched sub-rules from a combination rule association table according to the identifiers of the matched sub-rules; identifying the combination rules corresponding to the matched sub-rules from a combination rule table according to the combination rule identifiers; identifying the identifiers of multiple sub-rules contained in each combination rule from each combination rule; and querying the bitmaps of the sub-rule bitmap table according to the identifiers of each sub-rule contained in each combination rule, and identifying the combination rules matched with the current data packet according to the query result. The above method can realize the fast determination of the combination rules of data packets by the bitmaps of sub-rules, a combination rule association table and a combination rule table in an FPGA.

Description

Technical Field

[0001] This application relates to the field of data packet processing technology, and in particular to a bitmap-based data packet rule matching processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the rapid development of network technology, the number of users is increasing, and network devices need to process more and more packets. Network devices can typically be configured with certain rules and corresponding actions; packets matching the rules are processed according to the corresponding actions. The types of network rules are also gradually becoming more diverse, such as common full-packet floating signature rules, fixed-position signature rules, precise 5-tuple rules, mask 5-tuple rules, audio / video rules, DNS rules, and so on. Some complex application scenarios require the combination of these rules to form combined rules. The use of combined rules has gradually become more complex with the evolution of business. Initially, the most common combination was the use of 5-tuple rules and keyword rules, which has gradually evolved into complex combinations of multiple rules, including combinations of multiple rules within a single rule. User needs have become increasingly complex, and the requirements for flexibility are becoming increasingly higher.

[0003] When implementing line-rate packet processing on an FPGA platform, the hardware constraints of the FPGA (such as on-chip memory resources and system clock frequency) prevent existing methods from completing all operations within a single packet processing window due to the exponential increase in the number of queries as rule complexity increases, resulting in packet loss and latency. Specifically, existing technologies are relatively effective when handling combined rules consisting of two rules, but difficulties arise when the types and number of combined rules increase. A common solution is to manually divide the combined rules into several groups, and then perform the final combined rule judgment only after each group is matched. This method has significant limitations on the types of combined rules, and the number of queries increases exponentially with the number of types, resulting in poor performance. Summary of the Invention

[0004] Therefore, it is necessary to provide a bitmap-based data packet rule matching processing method, apparatus, electronic device, and storage medium to address the aforementioned technical problems. This method enables rapid determination of data packet combination rules within an FPGA through three tables: a bitmap of sub-rules, a combination rule association table, and a combination rule table. Furthermore, it does not impose any restrictions on the types of sub-rules, thus improving performance.

[0005] According to a first aspect of certain exemplary embodiments of this application, a bitmap-based data packet rule matching processing method is provided, applied to an FPGA, comprising: performing rule matching on a received current data packet to obtain multiple matching sub-rules and acquiring the identifier of each matching sub-rule; constructing a sub-rule bitmap in the on-chip memory of the FPGA, reading the sub-rule bitmap, and setting the corresponding bitmap in the sub-rule bitmap based on the identifier of each matching sub-rule; querying a combination rule association table stored in the on-chip memory of the FPGA according to the identifier of each matching sub-rule, and identifying the combination rule identifier corresponding to each matching sub-rule from the combination rule association table; querying a combination rule table stored in the on-chip memory of the FPGA according to the combination rule identifier, identifying the combination rule corresponding to each matching sub-rule from the combination rule table, and identifying the identifiers of multiple sub-rules contained in each combination rule; querying the bitmap of the sub-rule bitmap according to the identifiers of each sub-rule contained in each combination rule, and identifying the combination rule matching the current data packet according to the query result.

[0006] Preferably, a bitmap-based data packet rule matching processing method further includes: receiving a user-configured combination rule association table and a combination rule table, and storing the combination rule association table and the combination rule table in the on-chip memory of the FPGA; wherein, the combination rule association table is configured with multiple combination rule identifiers, each combination rule identifier representing a corresponding combination rule, and each combination rule identifier is queried through the identifiers of the sub-rules contained in each combination rule; the combination rule table is configured with identifiers of multiple sub-rules contained in each combination rule, and the identifiers of multiple sub-rules contained in each combination rule are queried through each combination rule identifier.

[0007] Preferably, constructing a sub-rule bitmap in the on-chip memory of the FPGA includes: instantiating an on-chip memory table in the on-chip memory of the FPGA, configuring the bit width and depth of the bitmap of the on-chip memory table, and using the configured on-chip memory table as the sub-rule bitmap; setting bits in the corresponding bitmap of the sub-rule bitmap based on the identifier of each matching sub-rule, including: using the identifier of each matching sub-rule as the address of each storage bit in the query sub-rule bitmap, and setting the storage bits of the address corresponding to each matching sub-rule.

[0008] Preferably, a bitmap-based data packet rule matching processing method further includes: acquiring the FPGA's system master clock and the current data packet frequency; determining the number of sub-rules that each current data packet can support writing based on the system master clock and the current data packet frequency; if the number of matched sub-rules is greater than the number of sub-rules that each current data packet can support writing, configuring the number of write ports of the on-chip memory based on the number of matched sub-rules and the number of sub-rules that each current data packet can support writing; wherein, setting the storage bits of the address corresponding to each matched sub-rule includes: setting the storage bits of the address corresponding to each matched sub-rule through each write port of the on-chip memory.

[0009] Preferably, a bitmap-based packet rule matching processing method further includes: if the number of matched sub-rules is greater than the number of sub-rules that can be written to each current packet, then configuring the number of read ports of the on-chip memory based on the number of matched sub-rules and the number of sub-rules that can be written to each current packet; wherein, querying the combined rule association table according to the identifier of each matched sub-rule includes: querying the combined rule association table according to the identifier of each matched sub-rule and through each read port of the on-chip memory.

[0010] Preferably, identifying the combination rule that matches the current data packet based on the query result includes: if a set flag is found from the sub-rule bitmap based on the identifiers of all sub-rules in any combination rule, then any combination rule is taken as the combination rule that matches the current data packet.

[0011] Preferably, a bitmap-based data packet rule matching processing method further includes: after identifying the combined rule matched by the current data packet, clearing the bit marker of the sub-rule bitmap; and when receiving the next data packet, setting the corresponding bitmap in the sub-rule bitmap based on the identifier of the sub-rule matched by the next data packet.

[0012] According to a second aspect of certain exemplary embodiments of this application, a bitmap-based data packet rule matching processing apparatus is provided, applied to an FPGA, comprising: a matching module, configured to perform rule matching on a received current data packet, obtain multiple matching sub-rules, and acquire the identifier of each matching sub-rule; a bit-marking module, configured to construct a sub-rule bitmap in the on-chip memory of the FPGA, read the sub-rule bitmap, and mark the corresponding bitmap in the sub-rule bitmap based on the identifier of each matching sub-rule; a first identification module, configured to query a combination rule association table stored in the on-chip memory of the FPGA according to the identifier of each matching sub-rule, and identify the combination rule identifier corresponding to each matching sub-rule from the combination rule association table; a second identification module, configured to query a combination rule table stored in the on-chip memory of the FPGA according to the combination rule identifier, identify the combination rule corresponding to each matching sub-rule from the combination rule table, and identify the identifiers of multiple sub-rules contained in each combination rule; and a combination rule matching module, configured to query the bitmap of the sub-rule bitmap according to the identifier of each sub-rule contained in each combination rule, and identify the combination rule matching the current data packet according to the query result.

[0013] According to a third aspect of certain exemplary embodiments of this application, an electronic device is provided, including a memory and an FPGA, wherein the memory stores a hardware configuration program, and the FPGA loads and executes the hardware configuration program to implement the steps of any of the above methods.

[0014] According to a fourth aspect of certain exemplary embodiments of this application, a computer-readable storage medium is provided that stores a hardware configuration program thereon, which, when loaded into an FPGA and executed by the FPGA, implements the steps of any of the above methods.

[0015] The aforementioned bitmap-based data packet rule matching processing method, apparatus, electronic device, and storage medium include: performing rule matching on a received current data packet to obtain multiple matching sub-rules and acquiring the identifier of each matching sub-rule; constructing a sub-rule bitmap in the on-chip memory of an FPGA, reading the sub-rule bitmap, and setting the corresponding bitmap in the sub-rule bitmap based on the identifier of each matching sub-rule; querying a combination rule association table stored in the on-chip memory of the FPGA according to the identifier of each matching sub-rule, and identifying the combination rule identifier corresponding to each matching sub-rule from the combination rule association table; querying a combination rule table stored in the on-chip memory of the FPGA according to the combination rule identifier, identifying the combination rule corresponding to each matching sub-rule from the combination rule table, and identifying the identifiers of multiple sub-rules contained in each combination rule; querying the bitmap of the sub-rule bitmap according to the identifiers of each sub-rule contained in each combination rule, and identifying the combination rule matching the current data packet based on the query result.

[0016] Therefore, within the FPGA, a sub-rule bitmap is used to determine the inclusion relationship of combined rules in all hit sub-rules of a data packet. This avoids the problem of identifying combined rules through traversal polling. By using three tables—a sub-rule bitmap, a combined rule association table, and a combined rule table—the inclusion relationship of hundreds of thousands of combined rules among tens of millions of sub-rules can be quickly determined. Furthermore, there are no restrictions on the types of sub-rules. This allows for the matching of tens of millions of sub-rules and tens of thousands of combined rules within limited on-chip FPGA storage resources and a fixed clock cycle, meeting the real-time requirement of 100Gbps line-rate processing. This invention fully utilizes the parallel computing capabilities and configurable storage resources of the FPGA to achieve ASIC-level processing performance and programmability flexibility, which is difficult for general-purpose CPU platforms to match.

[0017] Furthermore, in existing technologies, the combination rules are pre-configured manually, and the combination rules remain fixed throughout the process, which significantly limits the types of combination rules. The bitmap-based packet rule matching method described above allows for flexible configuration of various types of combination rules through a combination rule table. Each type of combination rule is retrieved by querying the combination rule identifiers recorded in the combination rule association table. When processing packet rule matching, the corresponding type of combination rule can be identified by directly querying the combination rule identifiers in the combination rule association table using the sub-rules of packet matching. Therefore, it overcomes the limitations of traditional combination rule types and allows for flexible configuration of various combination rules when processing packet rule matching. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a bitmap-based data packet rule matching processing method according to some exemplary embodiments of this application; Figure 2 This is a schematic diagram of the combination rule association table in some exemplary embodiments of this application; Figure 3 This is a schematic diagram of a combination rule table in some exemplary embodiments of this application; Figure 4 This is a flowchart illustrating a bitmap-based packet rule matching method in a specific example of this application. Figure 5 To implement via FPGA Figure 4 A flowchart illustrating a bitmap-based data packet rule matching processing method; Figure 6 This is a structural block diagram of a bitmap-based data packet rule matching processing apparatus according to some exemplary embodiments of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] The following detailed descriptions are provided to aid the reader in gaining a comprehensive understanding of the methods, apparatus, electronic devices, storage media, and / or computer program products described herein. However, after understanding the disclosure of this application, various changes, modifications, and equivalents of the methods, apparatus, storage media, and / or computer program products described herein will become apparent. For example, the order of operations described herein is merely illustrative and is not limited to those orders set forth herein, but may be changed as will become clear after understanding the disclosure of this application, except for operations that must occur in a specific order. Furthermore, for clarity and conciseness, descriptions of features known in the art may be omitted.

[0021] The features described herein may be implemented in different forms and should not be construed as limited to the examples described herein. Rather, the examples described herein are provided only to illustrate some of the many feasible ways of implementing the methods, electronic devices, and / or storage media described herein, many of which will become clear upon understanding this application.

[0022] The terminology used herein is for the purpose of describing various examples only and is not intended to limit disclosure. Unless the context clearly indicates otherwise, the singular form is intended to include the plural form as well. The terms “comprising,” “including,” and “having” indicate the presence of the described features, quantities, operations, components, elements, and / or combinations thereof, but do not exclude the presence or addition of one or more other features, quantities, operations, components, elements, and / or combinations thereof. Unless otherwise stated, “ / ” means “or,” for example, A / B can mean A or B; “and / or” in the text is merely a description of the relationship between related objects, indicating that three relationships can exist, for example, A and / or B can mean: A alone, A and B simultaneously, and B alone. Furthermore, in the description of embodiments of the invention, “multiple” means two or more.

[0023] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains upon understanding this application. Unless expressly defined herein, terms (such as those defined in a general dictionary) shall be interpreted as having a meaning consistent with their meaning in the context of the relevant field and in this application, and shall not be interpreted in an idealized or overly formalistic manner.

[0024] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in some of the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0025] Furthermore, in the description of the examples, detailed descriptions of well-known related structures or functions will be omitted when it is believed that such detailed descriptions would lead to a vague interpretation of this application.

[0026] In the following description, embodiments will be described in detail with reference to the accompanying drawings. However, embodiments may be implemented in various forms and are not limited to the examples described herein.

[0027] The terminology in this application is explained as follows: FPGA: Field-Programmable Gate Array; DNS: Domain Name System; HOST: Host; SNI: Server Name Indication; ID: Identifier / Identity; bit: binary digit, often shortened to bit; RAM: Random Access Memory; PPS: Packets Per Second; Block RAM: Block Random Access Memory.

[0028] In some exemplary embodiments of this application, a bitmap-based data packet rule matching processing method is provided, applied to an FPGA. For example... Figure 1 As shown, a bitmap-based packet rule matching processing method includes the following steps: Step S101: Perform rule matching on the received current data packet to obtain multiple matching sub-rules and obtain the identifier of each matching sub-rule.

[0029] In this embodiment, the received current data packet is matched against all sub-rule types. For example, sub-rule types include mask quintuple rules, exact quintuple rules, full-packet floating signature rules, fixed signature rules, audio / video rules, DNS rules, HOST rules, SNI rules, etc. After determining the multiple matching sub-rules for the current data packet, the identifier of each matching sub-rule is obtained.

[0030] Specifically, each sub-rule is pre-assigned a unique ID, which serves as the identifier for each sub-rule. In subsequent rule combination judgments, the specific content of each sub-rule is no longer identified; only the IDs of all sub-rules matched by the data packet are carried.

[0031] Step S102: Construct a sub-rule bitmap in the on-chip memory of the FPGA, read the sub-rule bitmap, and set the corresponding bitmap in the sub-rule bitmap based on the identifier of each matching sub-rule.

[0032] In this embodiment, a sub-rule bitmap is pre-constructed in the on-chip memory of the FPGA. For example, constructing a sub-rule bitmap with a depth of 10 million bits on the FPGA consumes approximately 10 Mbits of on-chip RAM. The ID number of the sub-rule hit by the current data packet is used as the address, and the storage area of ​​the corresponding address in the sub-rule bitmap is marked as 1. Assuming that the current data packet hits 10 sub-rules, the storage bits of the addresses corresponding to the ID numbers of these 10 sub-rules are marked as 1.

[0033] In one embodiment, step S102 further includes the steps of: instantiating an on-chip memory table in the on-chip memory of the FPGA, configuring the bit width and depth of the bitmap of the on-chip memory table, and using the configured on-chip memory table as a sub-rule bitmap; wherein, step S102, based on the identifier of each matching sub-rule, sets the corresponding bitmap in the sub-rule bitmap, including: using the identifier of each matching sub-rule as the address of each storage bit in the query sub-rule bitmap, and setting the storage bit of the address corresponding to each matching sub-rule.

[0034] Furthermore, before the step of setting the storage bits of the addresses corresponding to each matched sub-rule, a bitmap-based data packet rule matching processing method further includes the steps of: obtaining the FPGA's system master clock and the current data packet frequency; determining the number of sub-rules that each current data packet can support writing based on the system master clock and the current data packet frequency; if the number of matched sub-rules is greater than the number of sub-rules that each current data packet can support writing, configuring the number of write ports of the on-chip memory based on the number of matched sub-rules and the number of sub-rules that each current data packet can support writing; wherein, the step of setting the storage bits of the addresses corresponding to each matched sub-rule includes: setting the storage bits of the addresses corresponding to each matched sub-rule through each write port of the on-chip memory.

[0035] In this embodiment, the FPGA's performance, average packet length, packet frequency, and system processing clock are configured. For example, the FPGA's performance is 100Gb, the average packet length is 500 bytes, the packet frequency is 25M PPS, and the system processing clock used by the FPGA is 250M PPS. Assuming that all sub-rule types have already been queried, for ease of explanation, we assume only four types of sub-rules: flexible quintuple rules (i.e., multiple flexible combinations of quintuples) totaling 8 million, masked rules (i.e., rules with masked quintuples) totaling 1 million, floating string feature code rules 1 million, 5G authentication account rules 1 million, etc. The total number of sub-rules of all types is 10 million, with shared sub-rule IDs ranging from ID00000001 to ID10000000. At the entry point into the combined rule query module, the FPGA obtains the ID of the sub-rule matched by each packet.

[0036] The process of building the sub-rule bitmap is as follows: A 10M-bit RAM table is instantiated inside the FPGA. The bit width can be 256 bits and the depth 40K, or the bit width can be 512 bits and the depth 20K. Each sub-rule's ID corresponds to 1 bit. The sub-rule bitmap can represent the hit status of 10,000,000 sub-rules. The bitmap corresponding to the IDs of all previously hit sub-rules is set to 1, providing a reference for subsequent combined rule hits.

[0037] Here, since each data packet corresponds to multiple sub-rule IDs, multiple write operations are required to the FPGA's RAM table. For example, if the FPGA system's main clock is 250 Mbps and the data packet frequency is 25 Mbps, then each data packet can support writing an average of 10 sub-rule ID bitmaps. If there are more than 10, a special handling method can be used, such as configuring two write ports in the FPGA's internal Block RAM to perform write operations in parallel, thereby doubling the performance and supporting a data packet frequency of 25 Mbps.

[0038] Step S103: Query the combination rule association table stored in the on-chip memory of the FPGA according to the identifier of each matching sub-rule, and identify the combination rule identifier corresponding to each matching sub-rule from the combination rule association table.

[0039] In this embodiment, the combined rule association table is addressed by the identifier of the sub-rule, and the entries in the combined rule association table are filled with the combined rule identifier. If there is a case where the identifier of a sub-rule is contained in multiple combined rules, it is handled by a chaining method, that is, a dedicated combined rule linked list storage area is constructed to store the combined rule association table.

[0040] Specifically, when the FPGA receives traffic, it first queries the combination rule association table for each data packet. Assuming that the current data packet matches 10 sub-rules, the combination rule association table needs to be queried 10 times in sequence, and each query of the combination rule association table results in a combination rule identifier.

[0041] In one example of this embodiment, after the step S102 of "obtaining the FPGA's system master clock and the current data packet frequency, and determining the number of sub-rules that each current data packet can support writing based on the system master clock and the current data packet frequency", and before the step S103 of "querying the combined rule association table stored in the on-chip memory of the FPGA based on the identifier of each matched sub-rule", a bitmap-based data packet rule matching processing method further includes the step of: if the number of multiple matched sub-rules is greater than the number of sub-rules that each current data packet can support writing, configuring the number of read ports of the on-chip memory based on the number of multiple matched sub-rules and the number of sub-rules that each current data packet can support writing; wherein, in the above step S104, querying the combined rule association table based on the identifier of each matched sub-rule includes: querying the combined rule association table based on the identifier of each matched sub-rule and through each read port of the on-chip memory.

[0042] Specifically, for querying the combined rule association table: the table entries are combined rule identifiers, and the combined rule identifier is retrieved through the identifier of the sub-rule. Furthermore, the identifier of each sub-rule can also find the identifier of the combined rule containing that sub-rule. Assuming that each combined rule contains an average of 3 sub-rules, then the combined rule identifier of each combined rule appears an average of 3 times, so the combined rule association table of 10,000 entries will be filled with 30,000 entries. At this point, a RAM table, namely the combined rule association table, is instantiated inside the FPGA. The number of entries in the combined rule association table is assumed to be 300,000, with a fill rate of 10%. The addressing method of this RAM table is: using the entry numbers ID00000001~ID10000000 in the sub-rule bitmap for hash compression. If there are partial hash collisions, they are handled using a linked list. A new linked list area is created to handle hash collisions or situations where different combined rules contain the same sub-rule in a linked manner.

[0043] It should be noted that, in order to avoid using a massive direct addressing table that far exceeds the on-chip storage capacity of the FPGA, the technical solution according to this application uses hash compression to map tens of millions of sub-rule IDs to an association table with a depth of only 300,000, thus solving the resource limitation of the FPGA. This is not a common practice in general computing.

[0044] Furthermore, it should be noted that in the technical solution according to this application, the distributed RAM or dedicated linked list storage area in the FPGA can be used to realize hardware processing of hash collisions, ensuring the determinism of the query path.

[0045] The number of queries to the combined rule association table: Each sub-rule requires one query to the combined rule association table. Similar to the queries to the sub-rule bitmap, query performance can be doubled using the dual-read interface of RAM. That is, if the number of matched sub-rules exceeds the number of sub-rules that can be written to in each current data packet, the number of read ports for the storage area of ​​the combined rule association table is configured based on the number of matched sub-rules and the number of sub-rules that can be written to in each current data packet.

[0046] Step S104: Query the combination rule table stored in the on-chip memory of the FPGA according to the combination rule identifier, identify the combination rule corresponding to each matching sub-rule from the combination rule table, and identify the identifiers of multiple sub-rules contained in each combination rule.

[0047] In this embodiment, a combined rule table is constructed, containing multiple combined rules. The combined rule table is addressed by the identifier of each combined rule. The entries in the combined rule table contain the identifiers of the sub-rules included in each combined rule. Theoretically, there is no limit to the number of sub-rule identifiers in each combined rule. Each sub-rule identifier can occupy 24 bits, representing a maximum of 16 million rules. The identifiers of 5 sub-rules occupy a total of 120 bits. If a combined rule contains more than 5 sub-rule identifiers, they can be supplemented using a linked list; that is, a separate linked list area is constructed to store the identifiers of the sub-rules included in the combined rule.

[0048] In one example of this embodiment, before step S103 above, a bitmap-based data packet rule matching processing method further includes the steps of: receiving a user-configured combination rule association table and a combination rule table, and storing the combination rule association table and the combination rule table in the on-chip memory of the FPGA; wherein, the combination rule association table is configured with multiple combination rule identifiers, each combination rule identifier representing a corresponding combination rule, and each combination rule identifier is queried through the identifier of the sub-rules contained in each combination rule; the combination rule table is configured with the identifiers of multiple sub-rules contained in each combination rule, and the identifiers of multiple sub-rules contained in each combination rule are queried through each combination rule identifier.

[0049] Specifically, the creation of the aforementioned combined rule association table and combined rule table is completed by the user when issuing rules. Items can be issued in the manner described above; no classification or other processing of sub-rules is required. For example, the combined rule association table is as follows: Figure 2 As shown, the combination rule table is as follows: Figure 3 As shown. In the combination rule association table, the combination rule identifier is represented by the ZID number, and the ID number in the combination rule table represents the identifier of the sub-rules contained in each combination rule.

[0050] Specifically, in combination Figure 2 and Figure 3 As shown, after retrieving the ZID number of a combined rule from the combined rule association table, the combined rule table is then queried using the ZID number to obtain the ID numbers of all sub-rules contained within that combined rule. The combined rule table uses the ZID number of the combined rule as an index for addressing. The query performance of the combined rule table can also support the requirement of 10 queries per data packet. If the vast majority of sub-rules are not contained in the combined rule, a single query will result in a miss. If performance is still insufficient, multiple combined rule tables can be instantiated. These tables have smaller table entries and consume fewer resources.

[0051] Step S105: Query the bitmap of the sub-rule bitmap according to the identifier of each sub-rule contained in each combination rule, and identify the combination rule that matches the current data packet according to the query result.

[0052] In one example of this embodiment, in step S105 above, identifying the combination rule that matches the current data packet based on the query result includes: if a set flag is found from the sub-rule bitmap based on the identifiers of all sub-rules in any combination rule, then any combination rule is taken as the combination rule that matches the current data packet.

[0053] Specifically, the combination rule table is queried based on the ZID number of the combination rule to obtain the combination rule, and then the ID numbers of each sub-rule contained in the combination rule are obtained. The ID numbers of each sub-rule are used as addresses to query the previously prepared sub-rule bitmap. The query results are used to determine whether the bitmap corresponding to the ID numbers of all sub-rules contained in the combination rule is 1. If the query results are all 1, it means that the combination rule is matched, and the matched combination rule is the combination rule that the current data packet matches. If the bitmap corresponding to the ID number of any sub-rule is 0, it means that the current data packet does not contain all the sub-rules required by the combination rule, and the current data packet does not match the combination rule.

[0054] Furthermore, after all the combination rules in the association tables have been queried, the priority of all matched combination rules is determined, and the FPGA outputs the combination rule with the highest priority. After the query is completed, the bitmap is cleared to prepare for the matching rule query of the next data packet.

[0055] In one example of this embodiment, after step S105 above, which identifies the combination rule that matches the current data packet based on the query result, a bitmap-based data packet rule matching processing method further includes the steps of: after identifying the combination rule that matches the current data packet, clearing the bit marker of the sub-rule bitmap; and when the next data packet is received, setting the bitmap corresponding to the sub-rule bitmap based on the identifier of the matching sub-rule of the next data packet.

[0056] Specifically, the sub-rule bitmap needs to be updated for each data packet. After the previous data packet is processed, the sub-rule bitmap needs to be cleared and then rewritten with the bitmap corresponding to the identifier of the sub-rule for the next data packet, in preparation for the rule matching process of the next data packet.

[0057] The aforementioned bitmap-based packet rule matching processing method uses a sub-rule bitmap within the FPGA to determine the inclusion relationship of combined rules in all hit sub-rules of a packet. This avoids the problem of identifying combined rules through traversal polling. By using three tables—sub-rule bitmap, combined rule association table, and combined rule table—it can quickly determine the inclusion relationship of hundreds of thousands of combined rules among tens of millions of sub-rules. It has no restrictions on the type of sub-rules, can achieve a throughput performance of 100Gb, and the FPGA resource consumption is within the chip's tolerance range, demonstrating superior performance.

[0058] Furthermore, in existing technologies, the combination rules are pre-configured manually, and the combination rules remain fixed throughout the process, which significantly limits the types of combination rules. The bitmap-based packet rule matching method described above allows for flexible configuration of various types of combination rules through a combination rule table. Each type of combination rule is retrieved by querying the combination rule identifiers recorded in the combination rule association table. When processing packet rule matching, the corresponding type of combination rule can be identified by directly querying the combination rule identifiers in the combination rule association table using the sub-rules of packet matching. Therefore, it overcomes the limitations of traditional combination rule types and allows for flexible configuration of various combination rules when processing packet rule matching.

[0059] The following is a specific example illustrating the bitmap-based packet rule matching method described above: like Figure 4As shown, the process first queries all types of subrules for the received current data packet, generating a bitmap in the subrule bitmap of the matched subrules. Then, it queries the combination rule association table based on the subrules to obtain the combination rules containing those subrules. Next, it queries the combination rule table based on the identifier of the combination rule, retrieving all subrules contained within the combination rule, and checks if the bitmaps of all subrules match. If so, the data packet is determined to have matched the combination rule. Then, it iterates through all the combination rules corresponding to the subrules to check for match, prioritizing the match results of all combination rules and outputting the highest priority combination rule. Finally, the subrule bitmap is cleared to await the writing of the bitmap of the matching subrules for the next data packet.

[0060] for Figure 4 A bitmap-based data packet rule matching processing method, the specific implementation of which in FPGA can be found in [link to relevant documentation]. Figure 5 As shown: Specifically, the FPGA is designed with a performance of 100Gb, an average packet length of 500 bytes, a data packet frequency of 25MPPS, and a system processing clock of 250M PPS.

[0061] Perform rule matching for all sub-rule types on the current data packet. Common sub-rule matching types include mask quintuple rules, exact quintuple rules, full packet floating signature rules, fixed signature rules, audio / video rules, DNS rules, HOST rules, SNI rules, etc. Here, it is required that all sub-rules be assigned a unified ID number. In subsequent rule combination judgments, the specific sub-rule content will no longer be identified, and only the ID numbers of all sub-rules matched by the data packet will be carried.

[0062] Then, the query for all sub-rule types is completed. Assume there are only four types of sub-rules, totaling 10 million, with shared sub-rule IDs ranging from ID00000001 to ID10000000. At the entry point into the combined rule query module, each data packet obtains the corresponding sub-rule ID that matches the specified rule.

[0063] The process of establishing the sub-rule bitmap: A 10M-bit RAM table is instantiated internally in the FPGA, with a bit width of 256 and a depth of 40K, or a bit width of 512 and a depth of 20K. Each sub-rule ID corresponds to 1 bit, which can represent the hit status of 10,000,000 rules. The bitmap corresponding to the ID numbers of all previously hit sub-rules is set to 1, providing a query basis for subsequent combined rule hits. It should be noted that, according to the technical solution of this application, when the sub-rule bitmap is instantiated internally in the FPGA, its bit width and depth are optimized according to the physical structure of the Block RAM in the FPGA (e.g., bit width 256 bits, depth 40K) to achieve optimal utilization of storage resources and the highest efficiency of parallel access.

[0064] For each data packet, the FPGA needs to update the sub-rule bitmap. After the previous data packet is processed, the sub-rule bitmap needs to be cleared and then rewritten with the bitmap corresponding to the ID number of the next data packet.

[0065] Since each data packet corresponds to multiple sub-rule IDs, multiple write operations to the RAM table are required. With a system master clock of 250 Mbps and a data packet frequency of 25 Mbps, each data packet supports writing an average of 10 rule IDs to the bitmap. Typically, each data packet will hit no more than 10 sub-rule data entries on average. If this number is exceeded, special handling methods can be used. For example, the FPGA's internal Block RAM can support simultaneous operation of two write ports, which can double the performance and is sufficient to support a data packet frequency of 25 Mbps.

[0066] Next, the association table for combined rules is searched: The table entries retrieve the ZID of the combined rule by looking up the ID of the sub-rule. For each combined rule containing a sub-rule, the ZID of the containing combined rule can be found. Assuming each combined rule contains an average of 3 sub-rules, the ZID of each combined rule appears an average of 3 times. Therefore, the association table for 10,000 combined rules will contain 30,000 entries. Specifically, a RAM table is instantiated inside the FPGA, with an assumed number of 300,000 entries and a fill rate of 10%. The RAM table is addressed using hash compression based on the sub-rule IDs from ID00000001 to ID10000000. If there are hash collisions, they are handled using a linked list. A new linked list area is created to handle hash collisions or situations where different combined rules contain the same sub-rule.

[0067] The number of queries to the combined rule association table: Each matched sub-rule in the data packet requires a query to the combined rule association table once. Similar to the sub-rule bitmap mentioned earlier, this query can also be performed via the dual-read interface of RAM to double the query performance. On average, each data packet is queried a maximum of 20 times. Generally speaking, this performance margin is quite large and can meet performance requirements.

[0068] After retrieving the ZID number of the combined rule from the combined rule association table, the combined rule table is then queried using the ZID number to obtain the ID numbers of all sub-rules contained in the combined rule. The combined rule table is addressed by using the ZID number of the combined rule as an index.

[0069] The query performance of the combined rule table can also support the query performance requirement of 10 queries per data packet. Moreover, the vast majority of sub-rules are not included in the combined rule, and a single query will result in a miss. If the performance is still insufficient, multiple combined rule tables can be instantiated. The table entries occupy a small address and consume less resources.

[0070] After obtaining the subrule IDs contained in the ZID of the combined rule, the bitmap of each subrule is checked to see if its ID has been set to 1. If so, it means the data packet has hit the corresponding subrule. By checking the IDs of all subrules contained in the ZID of the combined rule, it can be determined whether the combined rule has hit the target. If the bitmap corresponding to the ID of each subrule of the combined rule is 1, it means the combined rule has hit the target; otherwise, it is considered a miss.

[0071] For example, if a data packet hits three sub-rules with IDs ID0100000, ID1000000, and ID5000000, first, write 1 to the three positions at addresses 100000, 1000000, and 5000000 in the sub-rule bitmap; then, hash and compress these three values ​​to query the combined rule association table. Assume the compressed addresses are 1000, 5000, and 8000. If address 1000 has a value of 0, it means subrule ID0100000 does not belong to any combination rule. If address 5000 has a value of 200 and address 8000 has a value of 1000, then subrule ID1000000 may belong to combination rule ZID200, and subrule ID5000000 may belong to combination rule ZID1000. Then, using ZID200 to look up the combination rule table, we find that this combination rule contains IDs ID1000000 and ID5. 000000, using ID1000000 and ID5000000 respectively to query the sub-rule bitmap, the corresponding bits are all 1, so the combined rule is determined to be a hit; then using ZID1000 to query the combined rule table, we find that the combined rule contains IDs ID5000000 and ID8000000. Using ID5000000 and ID8000000 respectively to query the sub-rule bitmap, we find that the bitmap corresponding to ID8000000 is 0, so the combined rule is determined to be a miss; finally, the query results determine that the data packet hits the combined rule ZID200.

[0072] In summary, this application presents a bitmap-based data packet rule matching method that innovatively implements a universal matching operation for combined rules within an FPGA, effectively addressing the shortcomings of previous general-purpose combined rules. For example, matching based on mask rules and feature code rules using associated IDs is only suitable for pairwise combinations of two specific rule types and lacks universality. This bitmap-based data packet rule matching method, however, is not limited by the type and number of sub-rules during the combined rule matching process. It only requires uniformly numbering the sub-rule types, after which they can be arbitrarily combined. For instance, it supports complex combinations such as one mask quintuple + one precise quintuple + three full-packet floating feature codes + two fixed-position feature codes, and the number of sub-rules can be arbitrarily set, greatly improving the usability of combined rules.

[0073] This application presents a bitmap-based packet rule matching processing method. Within an FPGA, a sub-rule bitmap is used to determine the inclusion relationship of combined rules within all hit sub-rules of a packet. This avoids the problem of identifying combined rules through traversal polling. By using three tables—sub-rule bitmap, combined rule association table, and combined rule table—the method can quickly determine the inclusion relationship of hundreds of thousands of combined rules from tens of millions of sub-rules. Furthermore, it has no restrictions on the type of sub-rules, achieving a throughput performance of 100Gb, while keeping FPGA resource consumption within the chip's tolerance range, demonstrating superior performance.

[0074] It should be understood that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order constraint on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0075] In some exemplary embodiments of this application, such as Figure 6 As shown, a bitmap-based data packet rule matching processing device is provided and applied to an FPGA, including a matching module 601, a bit marker module 602, a first identification module 603, a second identification module 604, and a combined rule matching module 605. The matching module 601 is used to perform rule matching on the received current data packet, obtain multiple matching sub-rules, and acquire the identifier of each matching sub-rule; the bit-marking module 602 is used to construct a sub-rule bitmap in the on-chip memory of the FPGA, read the sub-rule bitmap, and mark the corresponding bitmap in the sub-rule bitmap based on the identifier of each matching sub-rule; the first identification module 603 is used to query the combination rule association table stored in the on-chip memory of the FPGA according to the identifier of each matching sub-rule, and identify the combination rule identifier corresponding to each matching sub-rule from the combination rule association table; the second identification module 604 is used to query the combination rule table stored in the on-chip memory of the FPGA according to the identifier of each combination rule, identify the combination rule corresponding to each matching sub-rule from the combination rule table, and identify the identifiers of multiple sub-rules contained in each combination rule; the combination rule matching module 605 is used to query the bitmap of the sub-rule bitmap according to the identifier of each sub-rule contained in each combination rule, and identify the combination rule matching the current data packet according to the query result.

[0076] In one embodiment, a bitmap-based data packet rule matching processing device further includes a receiving module for receiving a user-configured combination rule association table and a combination rule table, and storing the combination rule association table and the combination rule table in the on-chip memory of the FPGA; wherein, the combination rule association table is configured with multiple combination rule identifiers, each combination rule identifier representing a corresponding combination rule, and each combination rule identifier is queried through the identifiers of the sub-rules contained in each combination rule; the combination rule table is configured with identifiers of multiple sub-rules contained in each combination rule, and the identifiers of the multiple sub-rules contained in each combination rule are queried through each combination rule identifier.

[0077] In one embodiment, a bitmap-based data packet rule matching processing apparatus further includes a first configuration module, configured to instantiate an on-chip memory table in the on-chip memory of the FPGA, configure the bit width and depth of the bitmap of the on-chip memory table, and use the configured on-chip memory table as a sub-rule bitmap; and set the corresponding bitmap in the sub-rule bitmap based on the identifier of each matched sub-rule, including: using the identifier of each matched sub-rule as the address of each storage bit in the query sub-rule bitmap, and setting the storage bit of the address corresponding to each matched sub-rule.

[0078] In one embodiment, a bitmap-based data packet rule matching processing device further includes a second configuration module, used to acquire the FPGA's system master clock and the current data packet frequency; determine the number of sub-rules that can be written for each current data packet based on the system master clock and the current data packet frequency; if the number of matched sub-rules is greater than the number of sub-rules that can be written for each current data packet, then configure the number of write ports of the on-chip memory based on the number of matched sub-rules and the number of sub-rules that can be written for each current data packet; wherein, setting the storage bits of the address corresponding to each matched sub-rule includes: setting the storage bits of the address corresponding to each matched sub-rule through each write port of the on-chip memory.

[0079] In one embodiment, a bitmap-based packet rule matching processing apparatus further includes a third configuration module, configured to configure the number of read ports of the on-chip memory based on the number of matched sub-rules and the number of sub-rules that can be written to each current packet if the number of matched sub-rules is greater than the number of sub-rules that can be written to each current packet; wherein querying the combined rule association table according to the identifier of each matched sub-rule includes: querying the combined rule association table according to the identifier of each matched sub-rule and through each read port of the on-chip memory.

[0080] In one embodiment, identifying a combination rule that matches the current data packet based on the query result includes: if a set flag is found in the sub-rule bitmap based on the identifiers of all sub-rules in any combination rule, then any combination rule is taken as the combination rule that matches the current data packet.

[0081] In one embodiment, a bitmap-based data packet rule matching processing device further includes a clearing module, which is used to clear the set marker of the sub-rule bitmap after identifying the combined rule matched by the current data packet; and to set the corresponding bitmap in the sub-rule bitmap based on the identifier of the sub-rule matched by the next data packet when the next data packet is received.

[0082] For specific limitations regarding the bitmap-based packet rule matching processing device, please refer to the limitations of the bitmap-based packet rule matching processing method described above, which will not be repeated here. Each module in the aforementioned bitmap-based packet rule matching processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the electronic device, or stored in the memory of the electronic device in software form, so that the processor can call and execute the operations corresponding to each module.

[0083] In some exemplary embodiments of this application, an electronic device is provided, including a memory and an FPGA. The memory stores a hardware configuration program. When the FPGA loads and executes the hardware configuration program, it implements the steps of a bitmap-based data packet rule matching processing method in any of the above exemplary embodiments.

[0084] In some exemplary embodiments of this application, a computer-readable storage medium is provided that stores a hardware configuration program, which, when loaded onto an FPGA and executed by the FPGA, implements the steps of a bitmap-based data packet rule matching processing method as described in any of the exemplary embodiments above.

[0085] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0086] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0087] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A bitmap-based data packet rule matching processing method, characterized in that, The method is used for FPGA and includes: Perform rule matching on the received current data packet to obtain multiple matching sub-rules, and obtain the identifier of each matching sub-rule; A sub-rule bitmap is constructed in the on-chip memory of the FPGA. The sub-rule bitmap is read, and the corresponding bitmap in the sub-rule bitmap is set based on the identifier of each matching sub-rule. The combination rule association table stored in the on-chip memory of the FPGA is queried according to the identifier of each matching sub-rule, and the combination rule identifier corresponding to each matching sub-rule is identified from the combination rule association table. The combination rule table stored in the on-chip memory of the FPGA is queried according to the combination rule identifier. The combination rule corresponding to each matching sub-rule is identified from the combination rule table, and the identifiers of multiple sub-rules contained in each combination rule are identified from each combination rule. The bitmap of the sub-rule bitmap is queried based on the identifier of each sub-rule contained in each combination rule, and the combination rule matching the current data packet is identified based on the query result.

2. The method according to claim 1, characterized in that, The method further includes: Receive the user-configured combination rule association table and the combination rule table, and store the combination rule association table and the combination rule table in the on-chip memory of the FPGA; The combined rule association table is configured with multiple combined rule identifiers, each representing a corresponding combined rule, and each combined rule identifier can be queried through the identifiers of the sub-rules contained in each combined rule; The combined rule table configures the identifiers of multiple sub-rules contained in each combined rule, and the identifiers of multiple sub-rules contained in each combined rule can be queried through the identifiers of each combined rule.

3. The method according to claim 1, characterized in that, The construction of the sub-rule bitmap in the on-chip memory of the FPGA includes: An on-chip memory table is instantiated in the on-chip memory of the FPGA, and the bit width and depth of the bitmap of the on-chip memory table are configured. The configured on-chip memory table is used as the sub-rule bitmap. The step of setting the corresponding bitmap in the bitmap of the sub-rule bitmap based on the identifier of each matching sub-rule includes: The identifier of each matching sub-rule is used as the address of each storage bit in the sub-rule bitmap, and the storage bit corresponding to the address of each matching sub-rule is set.

4. The method according to claim 3, characterized in that, The method further includes: Obtain the system master clock and current data packet frequency of the FPGA; The number of sub-rules that each current data packet can support writing is determined based on the system master clock and the frequency of the current data packet; If the number of matched sub-rules is greater than the number of sub-rules that each current data packet can write, then the number of write ports of the on-chip memory is configured based on the number of matched sub-rules and the number of sub-rules that each current data packet can write. The step of setting the storage bits of the address corresponding to each matched sub-rule includes: setting the storage bits of the address corresponding to each matched sub-rule through each write port of the on-chip memory.

5. The method according to claim 4, characterized in that, The method further includes: If the number of matched sub-rules is greater than the number of sub-rules that each current data packet can write, then the number of read ports of the on-chip memory is configured based on the number of matched sub-rules and the number of sub-rules that each current data packet can write. The step of querying the combined rule association table based on the identifier of each matching sub-rule includes: querying the combined rule association table based on the identifier of each matching sub-rule and through each read port of the on-chip memory.

6. The method according to claim 1, characterized in that, The step of identifying the combination rules that match the current data packet based on the query results includes: If a set flag is found in the sub-rule bitmap based on the identifiers of all sub-rules in any combination rule, then that combination rule is taken as the combination rule for matching the current data packet.

7. The method according to claim 1, characterized in that, The method further includes: After identifying the combination rule that matches the current data packet, the set flags of the sub-rule bitmap are cleared; Upon receiving the next data packet, the corresponding bitmap in the sub-rule bitmap is set based on the identifier of the matching sub-rule of the next data packet.

8. A bitmap-based data packet rule matching processing device, characterized in that, The device is used for an FPGA and includes: The matching module is used to perform rule matching on the received current data packet, obtain multiple matching sub-rules, and obtain the identifier of each matching sub-rule; The bit setting module is used to construct a sub-rule bitmap in the on-chip memory of the FPGA, read the sub-rule bitmap, and set the corresponding bitmap in the sub-rule bitmap based on the identifier of each matching sub-rule. The first identification module is used to query the combination rule association table stored in the on-chip memory of the FPGA according to the identifier of each matching sub-rule, and identify the combination rule identifier corresponding to each matching sub-rule from the combination rule association table; The second identification module is used to query the combination rule table stored in the on-chip memory of the FPGA according to each combination rule identifier, identify the combination rule corresponding to each matching sub-rule from the combination rule table, and identify the identifiers of multiple sub-rules contained in each combination rule from each combination rule. The combined rule matching module is used to query the bitmap of the sub-rule bitmap based on the identifier of each sub-rule contained in each combined rule, and to identify the combined rule that matches the current data packet based on the query result.

9. An electronic device comprising a memory and an FPGA, wherein the memory stores a hardware configuration program, characterized in that, When the FPGA loads and executes the hardware configuration program, it implements the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a hardware configuration program stored thereon, characterized in that, When the hardware configuration program is loaded into the FPGA and executed by the FPGA, it implements the steps of the method described in any one of claims 1 to 7.

Images