A parallel feature extraction based encrypted network card bypass transmission architecture

Abstract

This invention discloses a bypass transmission architecture for encrypted network interface cards (NICs) based on parallel feature extraction. The architecture includes: a packet stream input interface, a control path unit, a data path unit, a decision window merging unit, a fragmentation-aware incremental checksum correction engine unit, and a security control unit. This invention can reduce forwarding latency, improve transmission determinism and resource utilization, and enhance packet forwarding efficiency in high-speed network scenarios. By using a deterministic delay storage module that matches worst-case latency, timing synchronization between control flow and data flow is achieved, reducing the risk of timing races and rule misjudgments. Simultaneously, the fragmentation-aware incremental checksum correction engine reduces the risks of insufficient fragmentation packet compatibility, checksum miscalculations, and resulting packet loss in traditional solutions.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and in particular to an encrypted network interface card bypass transmission architecture based on parallel feature extraction. Background Technology

[0002] Some existing encrypted network interface cards (NICs) employ a serial processing pipeline architecture. Upon packet entry, header information extraction, security rule lookup, full encryption / decryption, and finally verification and correction are performed before forwarding. While this architecture provides unified security protection for traffic, with increasing network bandwidth upgrades and enhanced service latency sensitivity, the serial architecture faces the challenge of balancing performance and security in high-speed network scenarios. Although static bypass forwarding schemes have been proposed to bypass the encryption engine and forward some traffic directly using preset rules, the following technical problems remain: 1. High forwarding latency and limited throughput performance. Some non-sensitive traffic still needs to pass through the serial pipeline, and complex packets may cause pipeline stalls and throughput jitter. 2. Serial coupling of data and control flows can easily lead to head-of-line congestion and bus backpressure. Packet forwarding relies on parsing and judgment results, which can easily cause forwarding jitter or packet loss risks in high-concurrency short packet scenarios. 3. IP (Internet Protocol) fragmented packet processing carries protocol compliance risks. Insufficient fragmentation status identification can easily lead to fragmentation packet loss and reassembly failure due to miscalculation of checksums. 4. High hardware resource consumption: When relying on a large-capacity full-packet FIFO (First In First Out) cache, resource consumption increases with cache depth and packet concurrency. 5. Insufficient bypass security fallback mechanism: Difficult to handle abnormal scenarios such as malformed packet attacks. 6. Insufficient parallel parsing timing alignment capability: Differences in parsing cycles for different packets can easily lead to timing races, resulting in rule misjudgments and missed judgments. Summary of the Invention

[0003] This invention aims to at least partially solve one of the technical problems in related technologies. To this end, this invention proposes an encrypted network interface card bypass transmission architecture based on parallel feature extraction. This architecture includes: a packet stream input interface, a control path unit, a data path unit, a decision window merging unit, a fragment-aware incremental verification and correction engine unit, and a security control unit.

[0004] The message stream input interface is connected to the control path unit and the data path unit, and is used to provide network message input from the same source to the control path unit and the data path unit; The control path unit is a side-mounted parallel parsing architecture, which includes a flow parsing module, a fragmentation finite state machine, and an access control engine. The flow parsing module is used to extract the packet five-tuple information in parallel from the complete packet or the first fragment, and to extract the network layer field, protocol number, and fragmentation status information from subsequent fragments. The fragmentation finite state machine is used to identify the MF flag bit and fragmentation offset of the IP fragmentation status. The access control engine is used to look up tables in parallel based on the five-tuple information and the IP fragmentation status, and output a judgment signal. The data path unit is equipped with a deterministic delay storage module. The delay depth of the deterministic delay storage module is determined based on the maximum parsing delay of the control path unit under preset working conditions, and is not less than the maximum parsing delay. The data path unit does not actively apply back pressure to the upstream due to the control path decision waiting, and completes the timing delay. The decision window aggregation unit is located at the output of the deterministic delay storage module and includes a MUX multiplexing module and a control logic module. The control logic module receives the decision signal and generates a bypass selection signal. The MUX multiplexing module completes the hardware switching of the forwarding path according to the bypass selection signal when the decision signal is aligned with the delayed message data. The fragmentation-aware incremental check correction engine unit receives the original checksum, TTL change, and network layer fields and available transport layer fields corresponding to the packet fragmentation status. Based on the IP fragmentation status, it executes the corresponding checksum update logic and outputs the updated checksum information. The security control unit is used to prevent the corresponding message from entering the bypass forwarding path and to invalidate the output validity flag of the corresponding message when an abnormal message is detected, parsing timeout occurs, or the judgment fails.

[0005] In addition, the encrypted network interface card bypass transmission architecture based on parallel feature extraction in this embodiment of the invention may also have the following additional technical features: According to one embodiment of the present invention, the control path unit and the data path unit work synchronously and in parallel, and there is no serial waiting between the parsing and determination process of the control path and the delayed transmission process of the data path unit.

[0006] According to one embodiment of the present invention, the deterministic delay storage module adopts a resource adaptive implementation method. When the preset maximum parsing delay is less than 64 clock cycles, it is implemented using a shift register based on lookup table resources; when the preset maximum parsing delay is greater than or equal to 64 clock cycles, it is implemented using a ring buffer based on block memory.

[0007] According to an embodiment of the present invention, the fragmentation finite state machine is specifically used to: after converting the IP fragmentation offset field into a byte offset, when the byte offset is non-zero and less than a preset minimum legal fragmentation offset threshold, determine it as a malformed packet and generate a malformed packet identification signal, the malformed packet identification signal being denoted as is_malformed.

[0008] According to one embodiment of the present invention, the shard-aware incremental checksum correction engine unit is further configured with a dual-branch checksum update: The first update strategy is used for complete messages and first fragments, updating at least the network layer checksum and updating the transport layer checksum when the transport layer fields or pseudo-header related fields change. The second update strategy is used for subsequent fragmentation, which only updates the network layer checksum and skips the transport layer checksum correction.

[0009] According to one embodiment of the present invention, the security control unit adopts a fault-oriented security mechanism as the default processing mechanism; when an abnormal fragment offset, parsing timeout, or malformed message is detected, bypass pass-through is prohibited, and the message is sent to an encrypted path or a discard path.

[0010] According to an embodiment of the present invention, the execution process of the atomic commit and rollback logic is as follows: at the end of the packet (EOP), the final judgment result, the exception identifier and the output valid identifier are verified. When the verification fails, the output valid identifier corresponding to the packet is set to invalid to block the packet from entering the sending path or the host reading path.

[0011] According to one embodiment of the present invention, the MUX multiplexer supports switching between bypass forwarding path, encryption processing path and drop path. When a packet hits the fast path bypass rule, the MUX multiplexer switches to the bypass forwarding path, so that the packet hitting the fast path bypass rule bypasses the encryption core and enters the subsequent output path.

[0012] According to one embodiment of the present invention, at a preset interface rate, the data path unit does not actively pause upstream message input due to control path parsing or decision waiting, and maintains data flow and decision signal alignment through a deterministic delay storage module.

[0013] According to an embodiment of the present invention, the architecture further includes: a pipeline alignment enhancement unit, wherein the pipeline alignment enhancement unit is a shift register array with a fixed depth, so that the determination results of different packet lengths are aligned with the corresponding data streams within a preset timing window.

[0014] The parallel feature extraction-based encrypted network interface card bypass transmission architecture of this invention can reduce forwarding latency caused by head-of-line congestion and bus backpressure, improve transmission determinism and resource utilization, and enhance packet forwarding efficiency in high-speed network scenarios. By using a deterministic delay storage module that matches worst-case latency, timing synchronization between control flow and data flow is achieved, reducing the risk of timing races and rule misjudgments. Simultaneously, a fragmentation-aware incremental checksum correction engine is provided to reduce the risks of insufficient fragmentation packet compatibility, checksum miscalculations, and resulting packet loss in traditional solutions. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of an encrypted network card bypass transmission architecture based on parallel feature extraction according to an embodiment of the present invention. Detailed Implementation

[0017] To facilitate understanding of the technical solution of the present invention, the embodiments are described below with reference to the accompanying drawings. The described embodiments are only some embodiments of the present invention and are not intended to limit the scope of protection of the present invention.

[0018] The following details illustrate the implementation of this invention. Those skilled in the art can adjust these details according to practical applications without departing from the technical solution of this invention.

[0019] It should be understood that the present invention can be implemented in different forms and should not be construed as being limited to the embodiments set forth herein. These embodiments are provided to make the disclosure clear and complete.

[0020] The specific structures described below are used to illustrate the technical solutions proposed by this invention. Optional embodiments of this invention are described in detail below; furthermore, this invention may have other implementation methods.

[0021] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0022] The following is a reference appendix. Figure 1 This invention describes an encrypted network interface card bypass transmission architecture based on parallel feature extraction, according to an embodiment of the present invention.

[0023] Figure 1This is a schematic diagram of an encrypted network card bypass transmission architecture based on parallel feature extraction according to an embodiment of the present invention.

[0024] like Figure 1 As shown, an encrypted network interface card bypass transmission architecture based on parallel feature extraction includes: a packet stream input interface 10, a control path unit 20, a data path unit 30, a decision window merging unit 40, a fragmentation-aware incremental verification and correction engine unit 50, and a security control unit 60. Each of these units is a hardware logic module or a configurable hardware module.

[0025] The message stream input interface 10 is connected to the control path unit 20 and the data path unit 30, and is used to provide the control path unit 20 and the data path unit 30 with the same source of network message input.

[0026] In one implementation, the message stream input interface 10 can be an AXI-Stream interface. After receiving the message stream from the AXI-Stream (Advanced eXtensible Interface Stream) bus, the same message is synchronously copied into two data streams of the same source: one is sent to the control path unit 20 and parallel parsing and security determination are started; the other is synchronously sent to the data path unit 30 and enters the deterministic delayed transmission process.

[0027] The control path unit 20 adopts a side-mounted parallel parsing architecture, comprising a flow parsing module, a fragmentation finite state machine, and an access control engine. For complete packets or the first fragment, the flow parsing module extracts the 5-tuple; for subsequent fragments, the flow parsing module extracts the network layer fields, protocol number, fragment identifier, and offset, and the access control engine applies the subsequent fragmentation processing strategy. The fragmentation finite state machine is used to identify the MF (More Fragments) flag and fragment offset of the IP fragmentation state, and the access control engine uses it to perform parallel table lookups based on the 5-tuple information and the IP fragmentation state, outputting a decision signal.

[0028] Specifically, the access control engine may also include a configurable rule table, priority arbitration logic, and action encoding registers. The configurable rule table stores the five-tuple, fragmentation status, exception identifier, and corresponding processing action; processing actions include bypass forwarding, encryption processing, and discarding. Rule items can be written via a software configuration interface or on-chip control registers to adjust the bypass decision strategy in different business scenarios.

[0029] It should be noted that the parallel parsing method referred to in this invention means that the control path and the data path work in parallel when the message comes from the same source, rather than waiting for the parsing to be completed in a single path before deciding whether to forward it.

[0030] Specifically, the 5-tuple information includes: source IP address, destination IP address, source port, destination port, and transport layer protocol number.

[0031] As an example, the fragmentation finite state machine distinguishes packet types—complete packets, IP header fragments, and subsequent IP fragments—by parsing the MF flag and Fragment Offset field in the IPv4 (Internet Protocol version 4) header. The access control engine, based on the five-tuple information, fragmentation status, and anomaly flags, performs parallel access control rule lookups and outputs three types of decision signals: allow bypass, force drop, and force encryption.

[0032] The data path unit 30 is equipped with a deterministic delay storage module. The delay depth of the deterministic delay storage module is determined based on the maximum parsing delay of the control path unit 20 under preset operating conditions, and is not less than the maximum parsing delay. The data path unit 30 does not actively apply back pressure to the upstream due to control path decision waiting, and completes the timing delay; when the downstream is unavailable, it can still perform necessary flow control according to the interface protocol.

[0033] Specifically, the delay depth of the deterministic delay storage module can be configured through parameters or registers and can work in conjunction with the interface flow control adaptation unit; under the condition of meeting the preset interface rate and timing constraints, the data path can continuously receive message data according to the interface clock.

[0034] The decision window aggregation unit 40 is located at the exit of the deterministic delay storage module and includes a MUX multiplexing module and a control logic module. The control logic module receives the decision signal and generates a bypass selection signal (which can be denoted as Bypass_Select). The MUX multiplexing module completes the hardware switching of the forwarding path according to the bypass selection signal when the decision signal is aligned with the delayed message data.

[0035] Specifically, the decision window converging unit 40 is connected to the data path unit 30.

[0036] As an example, the control logic module receives the judgment signal output by the control path unit 20, generates a bypass selection signal through combinational logic, and controls the MUX (Multiplexer) to complete the path switching according to the bypass selection signal when the packet header arrives at the delay module output.

[0037] The fragmentation-aware incremental checksum correction engine unit 50 receives the original checksum, TTL change, and network layer fields and available transport layer fields corresponding to the packet fragmentation status. Based on the IP fragmentation status, it executes the corresponding checksum update logic and outputs the updated checksum information.

[0038] In one implementation, the updated verification information may meet the requirements of RFC 1071.

[0039] Specifically, the incremental verification and correction engine unit 50 for slice awareness is connected to the control path unit 20.

[0040] As an example, incremental complement correction logic can be used to perform checksum compensation for header change fields such as TTL decrement, without recalculating the entire packet checksum. In one implementation, checksum boundary values ​​can be processed according to RFC 1071 and related checksum rules. For example, for boundary scenarios where the UDP checksum calculation result is 0x0000, it can be mapped to 0xFFFF, thereby reducing the risk of processing errors in protocol boundary scenarios.

[0041] The security control unit 60 is used to prevent the corresponding message from entering the bypass forwarding path and to invalidate the output validity flag of the corresponding message when an abnormal message is detected, parsing timeout occurs, or the judgment fails.

[0042] Specifically, the safety control unit 60 is connected to the control path unit 20, the data path unit 30, the decision window merging unit 40, and the slice-aware incremental verification and correction engine unit 50, respectively, to provide security for bypass transmission.

[0043] The parallel feature extraction-based encrypted network interface card bypass transmission architecture of this invention can reduce forwarding latency caused by head-of-line congestion and bus backpressure, improve transmission determinism and resource utilization, and enhance packet forwarding efficiency in high-speed network scenarios. Furthermore, by using a deterministic delay storage module that matches worst-case latency, it achieves timing synchronization between control flow and data flow, reducing the risk of timing races and rule misjudgments. Simultaneously, it is equipped with a fragmentation-aware incremental checksum correction engine, reducing the risks of insufficient fragmentation packet compatibility, checksum miscalculations, and resulting packet loss in traditional solutions.

[0044] In some embodiments, the control path unit 20 and the data path unit 30 operate synchronously and in parallel, and there is no serial waiting between the parsing and determination process of the control path and the delayed transmission process of the data path unit 30.

[0045] Specifically, after a message enters the message stream input interface 10, it is copied into two identical data streams by the same source and timer: one stream is sent to the control path to initiate the five-tuple parsing, fragmentation status identification, and ACL (Access Control List) rule lookup process; the other stream is synchronously sent to the deterministic delay storage module of the data path to initiate a fixed-period transmission process. The fixed delay depth of the deterministic delay module of the data path is not less than the maximum parsing delay of the control path under preset operating conditions, and a safety margin can be added according to the interface timing. After the data stream enters the delay module, it completes the delayed transmission at a fixed period and is not paused due to the intermediate state waiting of the control path; when upstream and downstream interfaces are unavailable, necessary flow control can still be performed according to the interface protocol.

[0046] In this embodiment, the risks of head-of-line blocking, bus backpressure, and timing races caused by serial waiting can be reduced. Under the premise of ensuring the complete execution of the safety judgment throughout the process, forwarding latency can be reduced and transmission determinism and resource utilization can be improved.

[0047] In some embodiments, the deterministic delay storage module adopts a resource adaptive implementation method. When the preset maximum parsing delay is less than 64 clock cycles, it is implemented using a shift register based on lookup table resources; when the preset maximum parsing delay is greater than or equal to 64 clock cycles, it is implemented using a ring buffer based on block memory.

[0048] Specifically, when the preset maximum parsing delay is less than 64 clock cycles, the FPGA's LUT can be configured as a distributed shift register, reducing the occupation of dedicated block storage and flip-flop resources. In short-latency scenarios, a fixed-period delay can be achieved, reducing read / write address overhead and timing jitter. When the preset maximum parsing delay is greater than or equal to 64 clock cycles, a ring buffer architecture is used to set the fixed offset of the read / write address to the corresponding delay period, ensuring that the message data read / write interval corresponds to the preset delay depth.

[0049] In this embodiment, while ensuring latency determinism and timing synchronization accuracy, the FPGA resources are adapted to different scenarios, which reduces resource waste in short-latency scenarios and improves timing convergence in long-latency scenarios, thereby increasing the resource utilization of the solution.

[0050] In some embodiments, the fragmentation finite state machine is specifically used to: after converting the IP fragmentation offset field into a byte offset, when the byte offset is non-zero and less than a preset minimum legal fragmentation offset threshold, determine it as a malformed packet and generate a malformed packet identification signal, which can be denoted as is_malformed.

[0051] In one example, the preset minimum valid fragment offset threshold is 8 bytes; the threshold can be set according to the minimum header length of the transport layer that needs to be protected.

[0052] In this embodiment, malformed fragmented packets can be identified during hardware processing, reducing the risk of malformed packets being bypassed and passing through, and minimizing the impact on the forwarding efficiency of normal packets.

[0053] In some embodiments, the fragment-aware incremental checksum correction engine unit 50 also provides a dual-branch checksum update: The first update strategy is used for complete messages and first fragments, updating at least the network layer (L3) checksum and updating the transport layer (L4) checksum when the transport layer fields or pseudo-header related fields change.

[0054] It should be noted that for complete packets and IP header fragments, such packets typically have complete network layer (L3) and transport layer (L4) headers. Decreasing the TTL (Time To Live) field will affect the IP header checksum; when there are changes in transport layer fields or pseudo-header related fields at the same time, the first update strategy can also update the transport layer checksum.

[0055] The second update strategy is used for subsequent fragmentation, which only updates the network layer (L3) checksum and skips the transport layer (L4) checksum correction.

[0056] It should be noted that the second update strategy, after identifying a subsequent fragment, only enables network layer checksum update to complete the incremental update of the IP header checksum. At the same time, it skips the transport layer checksum correction step through hardware logic to avoid miscalculation of fragments without transport layer headers, thereby reducing the risk of fragment packet loss and reassembly failure due to checksum errors.

[0057] In this embodiment, the risk of packet loss and reassembly failure caused by miscalculation of transport layer checksums in non-first fragments can be reduced by traditional solutions. At the same time, the forwarding efficiency can be improved by incremental correction logic, thereby enhancing the protocol compliance and compatibility of fragmented packets.

[0058] In some embodiments, the security control unit employs a fault-oriented security mechanism as the default processing mechanism; when an abnormal fragment offset, parsing timeout, or malformed packet is detected, bypass pass-through is prohibited, and the packet is sent to an encrypted path or a discard path. The default path is either an encrypted path or a discard path, and the system only switches to a bypass path when the signal is deemed valid, the bypass rule is met, and no abnormal identifier is detected.

[0059] Specifically, the security control unit may also include an anomaly statistics register and a status export interface to record the number of malformed packets, parsing timeouts, bypass hits, encrypted path forwardings, and packet drops, so that upper-layer software can monitor the operational status and adjust policies.

[0060] In this embodiment, fault-oriented security logic can identify and intercept various abnormal messages, prohibit their bypass transmission, reduce the risk of abnormal messages being transmitted through bypass paths, and maintain the forwarding efficiency of normal messages.

[0061] In some embodiments, the execution process of atomic commit and rollback logic is as follows: at the end of the packet (EOP), the final judgment result, the exception identifier, and the output validity identifier are verified. If the verification fails, the output validity identifier corresponding to the packet is set to invalid to block the packet from entering the sending path or the host reading path.

[0062] Specifically, firstly, regarding the timing and scope of verification: the final security verification is set at the EOP node at the end of the packet. This node marks the completion of complete packet reception and feature collection. At this point, the final judgment result of the access control engine, the anomaly flag of the fragmentation state machine, packet parsing compliance, checksum validity, and other security signals can be verified. Secondly, regarding hardware-level atomic rollback operations: in one implementation based on descriptor submission, output invalidation can be achieved by rewriting the valid bits of the corresponding descriptor; in other implementations, it can also be achieved by outputting a valid identifier or sending an authorization identifier. Finally, regarding the performance optimization design of asynchronous memory overwriting: the physical memory erasure and overwriting of illegal packets can be completed asynchronously by the background hardware logic, reducing the impact on the forwarding of normal packets and balancing the needs of security protection and high forwarding performance.

[0063] In this embodiment, the security verification of the packet tail supplements the shortcomings of the traditional bypass scheme that only verifies the header once. Hardware-level atomic rollback can promptly block the host's read permission for illegal packets. At the same time, the asynchronous memory overlay design can reduce the impact on mainline forwarding, achieving a balance between secure management of the entire packet lifecycle and high-performance forwarding.

[0064] In some embodiments, the MUX multiplexer supports switching between bypass forwarding path, encryption processing path, and drop path. When a packet hits the fast path bypass rule, the MUX multiplexer switches to the bypass forwarding path, allowing the packet to bypass the encryption core and enter the subsequent output path.

[0065] In this embodiment, hardware multipath selection reduces path switching overhead, and when a packet hits the fast path bypass rule, it can bypass the encryption core to achieve transparent transmission, thereby improving forwarding efficiency.

[0066] In some embodiments, at a preset interface rate, the data path unit 30 does not actively pause upstream message input due to control path parsing or decision waiting, and maintains data flow and decision signal alignment through a deterministic delay storage module.

[0067] It is worth mentioning that after the data stream enters the data path, it enters the deterministic delayed storage module at a fixed periodic rhythm. The transmission process is not actively paused due to the progress of the control path parsing, intermediate states, and waiting for the judgment results, thereby reducing the risk of head-of-line blocking caused by the state machine waiting for the judgment results. When the upstream and downstream interfaces are unavailable, necessary flow control can still be performed according to the interface protocol.

[0068] In this embodiment, the data path unit 30 can reduce head-of-line blocking problems caused by control flow decision waiting, improve forwarding stability in multiple scenarios, and enhance the determinism and reliability of high-speed network transmission.

[0069] In some embodiments, the encrypted network interface card bypass transmission architecture based on parallel feature extraction further includes a pipeline alignment enhancement unit. The pipeline alignment enhancement unit is a shift register array with a fixed depth, which aligns the determination results of packets of different lengths with the corresponding data streams within a preset timing window.

[0070] In this embodiment, the pipeline alignment enhancement unit uses a fixed-depth shift register array to align the control flow discrimination overhead with the data flow transmission cycle, thereby reducing the risk of timing misalignment caused by differences in parsing cycles of different messages.

[0071] Furthermore, the encrypted network interface card bypass transmission architecture based on parallel feature extraction in this application can be implemented using hardware description languages ​​such as Verilog. Specifically, it may include a core module of a parallel bypass acceleration engine, a resource adaptive deterministic delay unit, an IP fragmentation-aware state machine, an incremental check and correction module, and atomic rollback and bypass control logic. In the atomic rollback and bypass control logic, the MUX multiplexer is set to the encrypted path by default. Only when the decision window is activated, the fast path bypass rule is hit, and the packet is not malformed, does it switch to the bypass forwarding path and match the corresponding network layer (L3) / transport layer (L4) check and update logic.

[0072] Although exemplary embodiments have been described herein with reference to the accompanying drawings, it should be understood that the above exemplary embodiments are merely illustrative and are not intended to limit the scope of this application. Various changes and modifications can be made therein by those skilled in the art without departing from the scope and spirit of this application.

[0073] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0074] In the several embodiments provided in this application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed.

[0075] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known structures and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0076] Similarly, it should be understood that, in order to simplify this application and aid in understanding one or more of the various inventive aspects, features of this application are sometimes grouped together in a single embodiment, figure, or description thereof in the description of exemplary embodiments of this application. However, the structure of this application should not be interpreted as reflecting an intention that the claimed application requires more features than are expressly recited in each claim. Rather, as reflected in the corresponding claims, its inventive point lies in solving the corresponding technical problem with features fewer than all the features of a single disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of this application.

[0077] Those skilled in the art will understand that, apart from the mutual exclusion of features, any combination of all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any device so disclosed may be employed. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0078] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

[0079] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some modules according to the embodiments of this application.

[0080] It should be noted that the above embodiments are illustrative of this application and not limiting of it, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims.

[0081] The above description is merely a specific embodiment or illustration of the embodiments of this application. The scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. The scope of protection of this application shall be determined by the scope of the claims.

Claims

1. A bypass transmission architecture for encrypted network interface cards based on parallel feature extraction, characterized in that, The architecture includes: a message stream input interface, a control path unit, a data path unit, a decision window merging unit, a fragment-aware incremental verification and correction engine unit, and a security control unit; The message stream input interface is connected to the control path unit and the data path unit, and is used to provide network message input from the same source to the control path unit and the data path unit; The control path unit is a side-mounted parallel parsing architecture, which includes a flow parsing module, a fragmentation finite state machine, and an access control engine. The flow parsing module is used to extract the packet five-tuple information in parallel from the complete packet or the first fragment, and to extract the network layer field, protocol number, and fragmentation status information from subsequent fragments. The fragmentation finite state machine is used to identify the MF flag bit and fragmentation offset of the IP fragmentation status. The access control engine is used to look up tables in parallel based on the five-tuple information and the IP fragmentation status, and output a judgment signal. The data path unit is equipped with a deterministic delay storage module. The delay depth of the deterministic delay storage module is determined based on the maximum parsing delay of the control path unit under preset working conditions, and is not less than the maximum parsing delay. The data path unit does not actively apply back pressure to the upstream due to the control path decision waiting, and completes the timing delay. The decision window aggregation unit is located at the output of the deterministic delay storage module and includes a MUX multiplexing module and a control logic module. The control logic module receives the decision signal and generates a bypass selection signal. The MUX multiplexing module completes the hardware switching of the forwarding path according to the bypass selection signal when the decision signal is aligned with the delayed message data. The fragmentation-aware incremental check correction engine unit receives the original checksum, TTL change, and network layer fields and available transport layer fields corresponding to the packet fragmentation status. Based on the IP fragmentation status, it executes the corresponding checksum update logic and outputs the updated checksum information. The security control unit is used to prevent the corresponding message from entering the bypass forwarding path and to invalidate the output validity flag of the corresponding message when an abnormal message is detected, parsing timeout occurs, or the judgment fails.

2. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, The control path unit and the data path unit work synchronously and in parallel, and there is no serial waiting between the parsing and determination process of the control path and the delayed transmission process of the data path unit.

3. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, The deterministic delay storage module adopts a resource adaptive implementation method. When the preset maximum parsing delay is less than 64 clock cycles, it is implemented using a shift register based on lookup table resources; when the preset maximum parsing delay is greater than or equal to 64 clock cycles, it is implemented using a ring buffer based on block memory.

4. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, The fragmentation finite state machine is specifically used to: after converting the IP fragmentation offset field into a byte offset, when the byte offset is non-zero and less than a preset minimum legal fragmentation offset threshold, determine it as a malformed packet and generate a malformed packet identification signal, which can be denoted as is_malformed.

5. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, The segmented incremental verification and correction engine unit also features a dual-branch checksum update: The first update strategy is used for complete messages and first fragments, updating at least the network layer checksum and updating the transport layer checksum when the transport layer fields or pseudo-header related fields change. The second update strategy is used for subsequent fragmentation, which only updates the network layer checksum and skips the transport layer checksum correction.

6. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, The security control unit adopts a fault-oriented security mechanism as the default processing mechanism; when abnormal fragment offset, parsing timeout or malformed message is detected, bypass pass-through is prohibited and the message is sent to the encrypted path or the discard path.

7. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, The execution process of atomic commit and rollback logic is as follows: at the end of the packet (EOP), the final judgment result, the exception flag, and the output validity flag are verified. If the verification fails, the output validity flag corresponding to the packet is set to invalid to block the packet from entering the sending path or the host reading path.

8. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, The MUX multiplexer supports switching between bypass forwarding path, encryption processing path, and drop path. When a packet hits the fast path bypass rule, the MUX multiplexer switches to the bypass forwarding path, allowing packets that hit the fast path bypass rule to bypass the encryption core and enter the subsequent output path.

9. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, At the preset interface rate, the data path unit does not actively pause upstream message input due to control path parsing or decision waiting, and maintains data flow and decision signal alignment through the deterministic delay storage module.

10. The encrypted network interface card bypass transmission architecture based on parallel feature extraction according to claim 1, characterized in that, The architecture also includes a pipeline alignment enhancement unit, which is a shift register array with a fixed depth, so that the determination results of different packet lengths are aligned with the corresponding data streams within a preset timing window.

Images