A 10G network bottom message high-speed screening and intercepting system and method based on FPGA architecture

Abstract

This application relates to a 10G network underlying packet high-speed filtering and interception system and method based on FPGA architecture, including a client MAC module, set at the data link layer, for receiving raw data packets in Ethernet frame format sent by the physical layer, inserting a count value as the identity identifier of the raw data packet to obtain an extended data packet; a risk control module, set at the data link layer and associated with the transport layer, for generating detection results and matching the detection results with the corresponding identity identifier; a MAC parsing module, set at the data link layer and associated with the transport layer, for parsing the extended data packet and obtaining the packet length field of the TCP packet; a forwarding control module, set at the data link layer, for calculating the delay duration, sending the MAC frame containing the TCP packet after the delay duration ends, and determining whether the MAC frame containing the TCP packet has been modified; and a market-side MAC module, set at the data link layer, for receiving the extended data packets sent by the forwarding control module, realizing high-speed packet filtering and interception at the 10G network underlying layer.

Description

Technical Field

[0001] This application relates to the field of message processing technology, and in particular to a 10G network low-level message high-speed filtering and interception system and method based on FPGA architecture. Background Technology

[0002] In financial risk control systems, it is necessary to perform extensive analysis of 10G network packets and intercept abnormal packets based on the results. The key challenge of the project is how to complete the analysis and interception in real time and efficiently without increasing network latency as much as possible.

[0003] Currently, when analyzing and intercepting 10G network packets, the client typically handles the network data packets by handing them over to the upper network protocol layer for parsing and inspection. After parsing out the service packets, the risk control module detects and intercepts service packets with risk control abnormalities. The correct service packets are then reassembled into TCP packets and sent to the market side, thus achieving the interception of abnormal service packets.

[0004] However, this processing and interception method requires parsing and assembling the TCP network protocol stack, and maintaining independent TCP links on both sides. The protocol stack is difficult to maintain, resulting in a large delay in data packet traversal, which cannot meet the needs of real-time and efficient packet filtering and interception in 10G network scenarios. Summary of the Invention

[0005] To address the technical challenge of achieving rapid packet filtering and interception at the 10G network layer while reducing network latency, this application provides a 10G network layer packet rapid filtering and interception system and method based on FPGA architecture.

[0006] Firstly, this application provides a 10G network low-level packet high-speed filtering and interception system based on FPGA architecture, which adopts the following technical solution: A 10G network low-level packet high-speed filtering and interception system based on FPGA architecture, the system comprising: The client MAC module, located at the data link layer, is used to receive raw data packets in Ethernet frame format sent by the physical layer, count the first frame time of each frame, and insert the corresponding count value as the identity of the raw data packet into the raw data packet to obtain an extended data packet. The risk control module is located at the data link layer and associated with the transport layer. It is used to analyze the data in the extended data packet according to predetermined rules to generate detection results and match the detection results with the corresponding identity identifier. The MAC parsing module, located at the data link layer and associated with the transport layer, is used to parse the extended data packet and determine whether the type of the extended data packet is a TCP packet. If so, it obtains the packet length field of the TCP packet. The forwarding control module, located at the data link layer, is used to calculate the delay duration based on the packet length field, send the MAC frame containing the TCP packet after the delay duration ends, and read the detection result corresponding to the identity identifier in the TCP packet at the time point one frame before the end of the TCP packet to determine whether the MAC frame containing the TCP packet has been modified. The market-side MAC module, located at the data link layer, is used to receive the extended data packets sent by the forwarding control module.

[0007] In one possible implementation, the system further includes: The TCP packet buffer queue is set at the data link layer and is used to store the MAC frame containing the TCP packet. The TCP segment length buffer queue is set at the data link layer and is used to store the packet length field of TCP packets. Non-TCP packet buffer queue, set at the data link layer, is used to store the MAC frame containing non-TCP packets; The packet length field of each TCP packet in the TCP segment length cache queue corresponds one-to-one with the number of TCP packets in the TCP packet cache queue. The forwarding control module determines whether the TCP segment length buffer queue and the non-TCP packet buffer queue are empty, and controls the sending priority of TCP packets and non-TCP packets.

[0008] In one possible implementation, the forwarding control module obtains the delay duration based on the ratio of the packet length field to the preset unit byte length and the number of clock cycles corresponding to the unit byte length.

[0009] Secondly, this application provides a method for high-speed filtering and interception of 10G network low-level packets based on FPGA architecture, employing the following technical solution: A method for high-speed filtering and interception of low-level packets in a 10G network based on an FPGA architecture, the method comprising: The client MAC module, located at the data link layer, receives raw data packets in Ethernet frame format sent by the physical layer, counts the first frame time of each frame, and inserts the corresponding count value as the identity of the raw data packet into the raw data packet to obtain an extended data packet. The risk control module, which is set up at the data link layer and associated with the transport layer, analyzes the data in the extended data packet according to predetermined rules to generate a detection result, and matches the detection result with the corresponding identity identifier. The MAC parsing module, which is set up at the data link layer and associated with the transport layer, parses the extended data packet and determines whether the type of the extended data packet is a TCP packet. If so, it obtains the packet length field of the TCP packet. The forwarding control module, located at the data link layer, calculates the delay duration based on the packet length field. After the delay duration expires, it sends the MAC frame containing the TCP packet. At the time point one frame before the end of the TCP packet, it reads the detection result corresponding to the identity identifier in the TCP packet to determine whether the MAC frame containing the TCP packet has been modified.

[0010] In one possible implementation, after obtaining the packet length field of the TCP packet, the process includes: The packet length field of the TCP packet is stored in the TCP segment length cache queue, and the TCP packet is stored in the TCP packet cache queue, wherein the TCP segment length cache queue and the TCP packet cache queue are set at the data link layer; In this context, the packet length field of each TCP packet in the TCP segment length cache queue corresponds one-to-one with the number of TCP packets in the TCP packet cache queue.

[0011] In one possible implementation, the sending priority of multiple types of extended data packets is determined based on whether the TCP segment length buffer queue is not empty.

[0012] In one possible implementation, the extended data packet includes TCP packets and non-TCP / non-TCP packets. When the TCP segment length buffer queue is not empty, the MAC frame containing the TCP packet is sent first.

[0013] In one possible implementation, calculating the delay duration based on the packet length field includes: The delay duration is obtained based on the ratio of the packet length field to the preset unit byte length and the number of clock cycles corresponding to the unit byte length.

[0014] In one possible implementation, the step of reading the detection result corresponding to the identity identifier in the TCP packet at a time point one frame before the end of the TCP packet to determine whether the MAC frame containing the TCP packet has been modified includes: The detection result includes a first indication information for indicating that the detection has passed and a second indication information for indicating that the detection has failed, including: When the detection result is the first indication information, the MAC frame containing the TCP packet is sent directly; When the detection result is the second knowledge information indication information, the CRC data field of the MAC frame containing the TCP packet is modified.

[0015] Thirdly, this application provides a 10G network low-level packet high-speed filtering and interception device based on FPGA architecture, which adopts the following technical solution: A 10G network low-level packet high-speed filtering and interception system device based on FPGA architecture includes: a memory and a processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the second aspect and / or various possible implementations of the second aspect as described above.

[0016] This application provides a 10G network low-level packet high-speed filtering and interception system and method based on FPGA architecture. By setting up various modules at the bottom of the data link layer and the associated transport layer, it realizes direct analysis and processing of the low-level fields of Ethernet frames. Since each module is completely sinked to the bottom of the network, it skips the parsing of the session layer and above the protocol stack, avoids the delay caused by the complex logic of the upper layer, and realizes high-speed filtering of packets.

[0017] Based on FPGA architecture, each module operates in parallel through hardware logic. The client MAC module inserts the identity identifier, the risk control module generates detection results in parallel and matches the identity identifier, the MAC parsing module parses the packet type and obtains the packet length field in parallel, and the forwarding control module calculates the delay based on the packet length and executes the sending and modification decisions. There is no serial waiting in each link, which improves the interception efficiency.

[0018] The forwarding control module dynamically calculates the delay duration based on the TCP packet length field, ensuring a precise match between the timing of TCP packet transmission and the detection time of the risk control module. Simultaneously, it reads the detection result one frame before the end of the MAC frame containing the TCP packet and makes a real-time decision on whether to modify the packet, ensuring the timeliness of the interception decision and reducing unnecessary network latency from the transmission control and result matching stages. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of a 10G network low-level packet high-speed filtering and interception system based on FPGA architecture, provided as an embodiment of this application.

[0020] Figure 2 This is a schematic diagram of a 10G network low-level packet high-speed filtering and interception system based on FPGA architecture, provided as an embodiment of this application.

[0021] Figure 3 This is a flowchart illustrating a method for high-speed filtering and interception of 10G network bottom-layer packets based on FPGA architecture, provided as an embodiment of this application.

[0022] Figure 4 This is a flowchart illustrating a method for high-speed filtering and interception of 10G network bottom-layer packets based on FPGA architecture, provided as an embodiment of this application.

[0023] Figure 5This is a schematic diagram of a 10G network low-level packet high-speed filtering and interception device based on FPGA architecture, provided as an embodiment of this application. Detailed Implementation

[0024] To better understand the purpose, technical solutions, and advantages of this application, it has been described and illustrated below with reference to the accompanying drawings and embodiments. However, those skilled in the art should understand that this application can be implemented without these details. In some cases, to avoid obscuring various aspects of this application due to unnecessary description, well-known methods, processes, systems, components, and / or circuits already described at a higher level will not be elaborated upon. It will be apparent to those skilled in the art that various modifications can be made to the embodiments disclosed in this application, and the general principles defined in this application can be applied to other embodiments and application scenarios without departing from the principles and scope of this application. Therefore, this application is not limited to the illustrated embodiments, but conforms to the broadest scope consistent with the scope of protection claimed in this application.

[0025] It should be noted that the descriptions of these embodiments are for the purpose of aiding understanding the present invention, but do not constitute a limitation thereof. Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0026] It should be understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or any combination thereof. For hardware implementations, the processor may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, other electronic units designed to perform the functions described herein, or combinations thereof.

[0027] When an embodiment is implemented as software, firmware, middleware, or microcode, program code, or code segments, it may be stored in a machine-readable medium, such as a storage component. A code segment may represent a procedure, function, subroutine, program, routine, subroutine, module, software package, class, or any combination of instructions, data structures, or program statements. One code segment can be coupled to another code segment or hardware circuitry by passing and / or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc., can be passed, forwarded, or transmitted using any suitable means, including memory sharing, messaging, token passing, network transmission, etc.

[0028] For software implementations, the techniques described herein can be implemented using modules (e.g., programs, functions, etc.) that perform the functions described herein. The software code can be stored in memory units and executed by a processor. The memory units can be implemented within or outside the processor; in the latter case, the memory units can be communicatively coupled to the processor via various methods known in this art.

[0029] In the description of this application, "several" means one or more, "more than" means two or more, "greater than," "less than," and "exceeding" are understood to exclude the stated number, while "above," "below," and "within" are understood to include the stated number. The use of "first" and "second" in the description is merely for distinguishing technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or implicitly indicating the order of the indicated technical features.

[0030] In the description of this application, the terms "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples.

[0031] Noun description: 10G network: refers to a high-speed network with a transmission rate of 10 gigabits per second (10Gbps), which is 10 times that of the traditional gigabit network (1Gbps). It is mainly used in scenarios that are sensitive to bandwidth and latency, such as financial transactions and data center interconnection. This application is adapted to the underlying message processing requirements of this network.

[0032] FPGA (Field Programmable Gate Array): A chip with customizable hardware logic that supports parallel computing and precise timing control at the underlying level. Compared with CPU software processing, it can significantly reduce data processing latency and is the core hardware carrier for achieving "ultra-fast screening and interception" in this solution.

[0033] MAC layer (Media Access Control layer): A sublayer of the data link layer in the OSI model, responsible for receiving / sending data packets, address identification, and frame encapsulation.

[0034] The OSI model (Open Systems Interconnection model) is a seven-layer architecture for network communication defined by the International Organization for Standardization (ISO). It is used to unify the design of communication protocols between network devices. From bottom to top, the layers are: Physical Layer, Data Link Layer, Network Layer, Transport Layer, Session Layer, Presentation Layer, and Application Layer. Each layer is functionally independent but works together through interfaces. Physical layer (Layer 1): Responsible for converting digital signals into electrical / optical signals that can be transmitted through physical media (optical fiber, network cable), defining physical characteristics such as transmission medium, interface type, and signal encoding; Data Link Layer (Layer 2): Divided into MAC sublayer and LLC sublayer, responsible for frame encapsulation, address identification (MAC address), CRC check, and error control; Network layer (Layer 3): Responsible for routing, IP address allocation, and packet forwarding, enabling interconnection between different networks; Transport layer (layer 4): Provides end-to-end transport services, with TCP (reliable transport) and UDP (connectionless transport) as the core protocols. Presentation layer (layer 6): Responsible for data encryption, decryption, compression, and format conversion, ensuring that the receiver can parse the data; Application layer (layer 7): Provides network services (such as HTTP, FTP, financial transaction protocols) for applications and is the source of business data.

[0035] TCP (Transmission Control Protocol): A connection-oriented reliable transmission protocol that ensures data integrity through mechanisms such as acknowledgment, retransmission, and ordered reassembly. It is the main transmission carrier for core business operations such as financial reporting.

[0036] CRC (Cyclic Redundancy Check): A check value is generated by calculating a check value on the data packet. The receiver verifies the consistency to determine whether the data is corrupted.

[0037] Compared to the current method of analyzing and intercepting 10G network packets, which involves handing network data packets over to the upper network protocol layer for parsing and inspection on the client side, reassembling correct service packets into TCP packets, and sending them to the market side to intercept abnormal service packets, this processing and interception method results in large data packet traversal delays and cannot meet the requirements for real-time and efficient packet filtering and interception in 10G network scenarios.

[0038] To address the aforementioned technical challenges, a system and method for rapid packet filtering and interception at the 10G network layer based on the FPAG architecture are provided. This system enables rapid packet filtering and interception at the 10G network layer while reducing network latency.

[0039] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0040] Figure 1A schematic diagram of a 10G network low-level packet high-speed filtering and interception system based on FPGA architecture is provided as an embodiment of this application; as shown below. Figure 1 As shown in the figure, this application discloses a 10G network low-level packet high-speed filtering and interception system based on FPGA architecture. The system includes: The client MAC module 101, located at the data link layer, receives raw data packets in Ethernet frame format sent by the physical layer, counts the first frame time of each frame, and inserts the corresponding count value as the identity identifier of the raw data packet into the raw data packet to obtain the extended data packet.

[0041] The client-side business module located at the physical layer (such as a brokerage trading system) generates business messages (such as stock buy orders) based on user operations. The messages contain core business fields such as "trading code, order amount, and account ID", and are encapsulated into Ethernet frame format (including 6B destination MAC (exchange address), 6B source MAC (brokerage terminal address), 2B type field (0x0800, identifying IP protocol), data payload, and 4B CRC) to become the raw data packet and sent to the client MAC module 101.

[0042] For example, when a user submits an order through a brokerage app to "buy 1000 shares of XX stock at a price of 50 yuan per share", the business module generates the original Ethernet frame with the following characteristics: Destination MAC=00:11:22:33:44:55 (Exchange MAC), Source MAC=AA:BB:CC:DD:EE:FF (Brokerage Terminal MAC), Data Payload="Trading Code 600XXX|Amount 50000 yuan|Account 123456", CRC=0x12345678.

[0043] The client MAC module 101 (OSI Layer 2) receives raw data packets in Ethernet frame format through the 10G SFP+ physical layer module (OSI Layer 1), bypassing the CPU / software protocol stack to achieve direct access to the underlying data.

[0044] The client MAC module 101 interfaces with the service module and completes two key operations at the first frame of the original data packet (SOP, i.e., the clock cycle during which the Ethernet frame "preamble + start of frame delimiter" is detected): Counting generates identity identifiers: The counting is implemented using the pkt_cnt counter, which is an unsigned incrementing counter with a bit width typically of 16 or 32 bits. The design can be tailored to the service throughput. For example, a 16-bit counter can cover 65,536 unique identifiers, satisfying most scenarios. Alternatively, a 32-bit unsigned counter can be used, covering approximately 4.3 billion unique identifiers, providing further assurance for the high concurrency and long-term operation of 10G networks. This application provides an example of a 32-bit counter.

[0045] An increment operation is triggered only once at the "first shot of each frame of data" to generate an identity identifier for the current raw data packet. This identity identifier is unique (e.g., 0x00000001). The counter maintains its original value in the idle state. Once the SOP signal (marking the start of data packets) is detected, the pkt_cnt = pkt_cnt + 1 is immediately updated in the current clock cycle.

[0046] When the counter reaches its maximum value (e.g., 65535 for 16-bit networks), it automatically resets to zero and starts counting again. Because the packet processing cycle is extremely short (single packet processing in 10G networks is typically in the microsecond range), the interval between repeated occurrences of the same identifier far exceeds the packet's lifespan, thus preventing confusion.

[0047] Identification identifier inserted into packet header: The input data stream is monitored in real time by a hardware multiplexer (MUX). When the "start of packet flag" specified by the protocol (such as the preamble of an Ethernet frame + start of frame delimiter) is captured, the SOP signal is immediately pulled high. The clock period during which the SOP signal is pulled high is the "first frame time point". At this time, the current value of pkt_cnt is latched to avoid the identity identifier being confused due to the count update, and at the same time, it is prepared to be inserted into the data packet.

[0048] A 4-byte identity identifier is inserted after the original frame header (14B) and before the data payload to form an extended frame structure to obtain an extended data packet: 4B identity identifier + original frame header (14B) + 4B identity identifier + data payload + 4B CRC.

[0049] For example, when the client MAC module 101 detects the SOP signal of the order frame (raw data packet), pkt_cnt changes from 0 to 1 (ID=0x00000001). The extended frame structure of the extended data packet after inserting the identity identifier is: 0x00000001 (identity identifier) ​​+ destination MAC (6B) + source MAC (6B) + type field (2B) + "transaction code 600XXX|amount 50000 yuan|account 123456" + CRC (0x12345678)

[0050] The identity identifier is inserted at the first frame of the original data packet to ensure that all subsequent branches can obtain the packet's identity identifier. Identity identifier insertion increases the total data packet length by 4 bytes, but because the identity identifier is located before the original frame header, it does not modify the internal structure of the original data packet, including the packet length field in the original frame header. Downstream modules (such as the MAC parsing module) can first remove the identity identifier and then parse the data packet according to the original protocol without additional packet length correction, ensuring the compatibility and accuracy of the parsing process. However, the MAC module will synchronously update the subsequent "packet length field" to ensure that downstream modules (such as the MAC parsing module) can correctly identify the data packet boundaries, without affecting normal parsing.

[0051] The risk control module 102 is located at the data link layer and associated with the transport layer. It analyzes the data in the extended data packet according to predetermined rules to generate detection results and matches the detection results with the corresponding identity identifier.

[0052] An extended data packet with an identification identifier is sent to the risk control module 102 for risk rule matching. The risk control module 102 stores preset rules, which can be multiple and include rules such as "blacklisted IP / port blocking," "excessive order amount detection," and "abnormal message format filtering." The module compares the content of the extended data packet (such as target address, business fields, and protocol type) with the preset rules and generates a detection result. The detection result can be either pass or block, and the detection result is bound to the identification identifier corresponding to this extended data packet.

[0053] The data in the extended data packet is analyzed by predefined rules to determine whether the data in the extended data packet is compliant, etc., for real-time risk assessment.

[0054] For example, the preset rule is "order amount ≤ 100,000 yuan". The current extended data packet field "order amount = 200,000 yuan" is checked and compared with the preset rule. If it meets the preset rule, the detection result is pass; if it does not meet the preset rule, the detection result is block.

[0055] The MAC parsing module 103 is set at the data link layer and associated with the transport layer. It parses extended data packets and determines whether the type of the extended data packet is a TCP packet. If so, it obtains the packet length field of the TCP packet.

[0056] The extended data packet with identification is sent to the MAC parsing module 103. The MAC parsing module 103 uses hardware logic to parse the protocol type of the extended data packet and determine whether the extended data packet is a TCP packet.

[0057] By reading the "Type field (0x0800)" of the extended data packet extended frame, the encapsulated IP protocol is confirmed; further parsing the "Protocol Number field (10th byte)" of the IP header, if it is 6 (TCP protocol), it is determined to be a TCP packet; if it is other values ​​(such as 17=UDP), it is determined to be a non-TCP packet.

[0058] For TCP packets, extract the packet length field. TCP packet length field = total IP layer length - IP header length; The IP header length is equal to a 4-bit header length field multiplied by 4 bytes.

[0059] Since TCP packets are typically core business packets, subsequent calculations are only performed on TCP packets related to core business packets, while non-TCP packets are skipped to avoid resource contention caused by uniform processing of all packet types. At the same time, the dynamic calculation logic does not block other data packets for parallel processing, supporting 10G network line-speed transmission.

[0060] The forwarding control module 104, located at the data link layer, calculates the delay duration based on the packet length field. After the delay duration expires, it sends the MAC frame containing the TCP packet and reads the detection result corresponding to the identity identifier in the TCP packet one frame before the end of the TCP packet to determine whether the MAC frame containing the TCP packet has been modified.

[0061] Since the time taken for the risk control module 102 to detect TCP packets increases with the data length, by dynamically calculating the delay time, TCP packets of different lengths can be delayed to ensure that the system can obtain the detection results of the risk control module 102 at the moment when all MAC frames containing TCP packets are transmitted are sent to the end of the frame. This ensures that the TCP packets wait until the detection results are generated before being sent to the market-side MAC module, avoiding the failure of interception due to sending before the results arrive or the results timeout, thus achieving fast and accurate screening and interception.

[0062] Compared to a fixed delay scheme, this approach allows short packets to avoid waiting for redundant clock cycles, long packets to avoid timing misalignment due to insufficient waiting, and each packet to wait only for the exact duration required for detection. This compresses the end-to-end processing link time and reduces latency.

[0063] When the delay period ends, it indicates that the detection result of the TCP packet has been generated. At this time, the TCP packet is sent, which can dynamically determine the timing of sending each extended data packet.

[0064] Because each TCP packet contains a unique identifier, and the detection result is also bound to that identifier, the detection result of the TCP packet is obtained when the packet is sent to the end. Based on the content of the detection result, it is determined whether the data of the TCP packet should be modified. If the detection result is successful, the TCP packet can be sent without modification. If the detection result is blocked, it means that the risk assessment of the TCP packet has failed, and the verification data in the TCP packet is modified, thus making the TCP packet a network invalid packet, achieving extremely fast response.

[0065] The market-side MAC module 105, located at the data link layer, receives extended data packets sent by the forwarding control module.

[0066] The market-side MAC module 105 receives extended data packets in Ethernet frame (including TCP packets and non-TCP packets) format sent by the client forwarding control module through the 10G SFP+ physical layer module. It converts the bit stream into a frame structure recognizable by the data link layer (preamble + start-of-frame delimiter + frame header + data + CRC). The market-side MAC module 105 detects the start / end of the frame and discards frames with incorrect format (such as missing delimiters or abnormal frame length) to avoid invalid data occupying subsequent resources. It also calculates the CRC value of the received frame and compares it with the CRC field at the end of the frame. If they do not match, the frame is determined to be invalid. If the detection result of the extended data packet is interception, the CRC of the extended data packet can be modified. When the market-side MAC module 105 receives the extended data packet with modified CRC, it removes the added header field and discards it directly, encapsulates it into a standard Ethernet packet and sends it without forwarding it to the upper layer.

[0067] Data received by the client needs to be processed before it can be sent to the market, but data received by the market can be sent directly to the client.

[0068] This application provides a 10G network low-level packet high-speed filtering and interception system based on FPGA architecture. The system uses a client MAC module 101 to insert a unique identifier into each data frame at the data link layer, ensuring accurate matching between the detection results of the risk control module 102 and the data packets. This avoids misalignment under high concurrency and guarantees interception accuracy. The MAC parsing module 103 associates the data link layer with the transport layer, parsing only low-level fields such as Ethernet frames, IP headers, and TCP headers to determine TCP packets and extract packet lengths, skipping the upper-layer protocol stack for high-speed packet classification. The forwarding control module 104 dynamically calculates the delay duration based on the TCP packet length, ensuring precise matching between the data packet sending timing and the detection time of the risk control module 102. Short packets have no redundant waiting, and long packets do not have timing misalignment, compressing end-to-end processing delay. All modules operate in parallel at the data link layer based on FPGA, with client MAC identifier insertion, risk control module 102 detection, MAC parsing and classification, and forwarding control modification proceeding synchronously. This adapts to the high throughput of 10G networks, achieving high-speed packet filtering and interception.

[0069] Figure 2 A schematic diagram of a 10G network low-level packet high-speed filtering and interception system based on FPGA architecture is provided as an embodiment of this application, as shown below. Figure 2 As shown, based on the above embodiments, this embodiment includes the following system: The client MAC module 201, located at the data link layer, receives raw data packets in Ethernet frame format sent by the physical layer, counts the first frame time of each frame, and inserts the corresponding count value as the identity of the raw data packet into the raw data packet to obtain the extended data packet.

[0070] The description of client MAC module 201 can be found in the description of client MAC module 101.

[0071] The risk control module 202 is located at the data link layer and associated with the transport layer. It analyzes the data in the extended data packet according to predetermined rules to generate detection results and matches the detection results with the corresponding identity identifier.

[0072] The description of risk control module 202 can be found in the description of risk control module 102.

[0073] The MAC parsing module 203 is set at the data link layer and associated with the transport layer. It parses extended data packets and determines whether the type of the extended data packet is a TCP packet. If so, it obtains the packet length field of the TCP packet.

[0074] The description of MAC parsing module 203 can be found in the description of MAC parsing module 103.

[0075] TCP packet buffer queue 206 is set at the data link layer and is used to store the MAC frame containing the TCP packet.

[0076] TCP packet buffer queue 206 is used to specifically buffer data packets that are determined to be TCP type by MAC parsing module 203 to adapt to the high-concurrency transmission of 10G network. At the same time, it provides a storage medium for forwarding control module 204 to read TCP packets according to the delay time, so as to avoid data loss due to untimely subsequent processing.

[0077] TCP segment length buffer queue 207 is set at the data link layer and is used to store the packet length field of TCP packets.

[0078] TCP segment length cache queue 207 stores the total TCP segment length (packet length field) derived by MAC parsing module 203, which can provide fast input for delay duration calculation by forwarding control module 204 without re-parsing TCP packets, greatly reducing calculation time; at the same time, by matching the order with the TCP packet cache queue, it ensures the precise binding of packet length and data packet, and guarantees the accuracy of delay duration calculation.

[0079] The packet length field of each TCP packet in TCP segment length cache queue 207 corresponds one-to-one with the number of TCP packets in TCP packet cache queue 206.

[0080] Non-TCP packet buffer queue 208 is set at the data link layer and is used to store the MAC frame containing non-TCP packets.

[0081] The non-TCP packet cache queue 208 caches data packets that are determined by the MAC parsing module 203 to be non-TCP types (such as UDP, ARP, etc.). Non-TCP packets can be classified and stored to facilitate fast forwarding using a simplified process, avoid resource contention with TCP packet processing logic, improve the overall system's processing efficiency for different types of data packets, and ensure the smooth flow of various messages under 10G networks.

[0082] TCP packet cache queue 206, TCP segment length cache queue 207, and non-TCP packet cache queue 208 are all deployed at the data link layer. The interaction between modules depends on the hardware timing of the data link layer, and the caching and read / write control are based on the link layer transmission characteristics of Ethernet frames.

[0083] The forwarding control module 204, located at the data link layer, determines whether the TCP segment length buffer queue 207 and the non-TCP packet buffer queue 208 are empty, determines the sending priority of TCP packets and non-TCP packets, calculates the delay duration based on the packet length field, sends the MAC frame containing the TCP packet after the delay duration ends, and reads the detection result corresponding to the identity identifier in the TCP packet at the time point one frame before the end of the TCP packet to determine whether the TCP packet has been modified.

[0084] Based on the aforementioned forwarding control module 104, the forwarding control module 204 in this embodiment can also: When the TCP segment length buffer queue 207 is not empty, the forwarding control module 204 prioritizes sending TCP packets. At this time, the delay duration is calculated based on the packet length field of the TCP packet, and the TCP packet is sent after the delay duration expires. When the TCP segment length buffer queue 207 is empty but the non-TCP packet buffer queue 208 is not empty, the forwarding control module 204 prioritizes sending non-TCP packets, and the forwarding control module 204 does not make any modifications to the non-TCP packets, but only sends the non-TCP packets to the market end unchanged.

[0085] Specifically, when calculating the delay duration, the delay duration is obtained based on the ratio of the packet length field to the preset unit byte length and the number of clock cycles corresponding to the unit byte length.

[0086] Since a single TCP packet may contain multiple consecutive orders, based on tests of different hardware performance, the system has made delay plans for different TCP packet lengths according to empirical values. The number of clock cycles corresponding to a unit byte length can be determined. The number of clock cycles corresponding to a unit byte length is configured by the host computer. The forwarding control module 204 can determine the corresponding delay duration based on the ratio between the packet length field of the corresponding TCP packet and the unit byte length.

[0087] Specifically, if the length of a unit byte is n, and the number of clock cycles corresponding to a unit byte length of n is m, then the delay duration of the current TCP packet is (packet length field / n) * m). For example, a length of 256 bytes is m delay units, a length of 512 bytes is 2m delay units, and a length of 1024 bytes is 4m delay units. The corresponding delay duration can be obtained based on the number of bytes in the TCP packet.

[0088] The market-side MAC module 205, located at the data link layer, receives extended data packets sent by the forwarding control module 204.

[0089] The description of the market-side MAC module 205 can be found in the description of the market-side MAC module 105.

[0090] This application provides a 10G network low-level packet high-speed filtering and interception system based on FPGA architecture. By classifying and caching TCP packets, TCP segment lengths, and non-TCP packets, it avoids resource contention and provides a dedicated data carrier for forwarding control, ensuring accurate correspondence between packet length and data packet. The forwarding control module adds queue status judgment and priority scheduling, prioritizing the transmission of TCP packets and simplifying and accelerating the forwarding of non-TCP packets. Furthermore, it adapts to different hardware performance by dynamically calculating latency. The entire link relies on the data link layer hardware timing without intervention from upper-layer protocol stacks, achieving a dual improvement in accurate interception and low-latency transmission under high concurrency.

[0091] Figure 3 A flowchart illustrating a method for high-speed filtering and interception of 10G network low-level packets based on FPGA architecture, provided in one embodiment of this application; as shown... Figure 3 As shown in the figure, this application discloses a method for high-speed filtering and interception of 10G network underlying packets based on FPGA architecture. The method includes: S301. The client MAC module set at the data link layer receives the raw data packets in Ethernet frame format sent by the physical layer, counts the first frame time of each frame, and inserts the corresponding count value as the identity of the raw data packet into the raw data packet to obtain the extended data packet.

[0092] The client MAC module, located at the data link layer, receives raw data packets in Ethernet frame format sent by the physical layer, counts the first frame time of each frame, and inserts the corresponding count value as the identity of the raw data packet into the raw data packet to obtain the extended data packet.

[0093] The client-side business module located at the physical layer (such as a brokerage trading system) generates business messages (such as stock buy orders) based on user operations. The messages contain core business fields such as "trading code, order amount, and account ID", which are encapsulated into Ethernet frame format (including 6B destination MAC (exchange address), 6B source MAC (brokerage terminal address), 2B type field (0x0800, identifying IP protocol), data payload, and 4B CRC) to become the raw data packet and sent to the client MAC module.

[0094] For example, when a user submits an order through a brokerage app to "buy 1000 shares of XX stock at a price of 50 yuan per share", the business module generates the original Ethernet frame with the following characteristics: Destination MAC=00:11:22:33:44:55 (Exchange MAC), Source MAC=AA:BB:CC:DD:EE:FF (Brokerage Terminal MAC), Data Payload="Trading Code 600XXX|Amount 50000 yuan|Account 123456", CRC=0x12345678.

[0095] The client MAC module (OSI Layer 2) receives raw data packets in Ethernet frame format through the 10G SFP+ physical layer module (OSI Layer 1), bypassing the CPU / software protocol stack to achieve direct access to the underlying data.

[0096] The client MAC module interfaces with the service module and completes two key operations at the first frame of the raw data packet (SOP, i.e., the clock cycle in which the Ethernet frame "preamble + start of frame delimiter" is detected): Counting generates identity identifiers: The counting is implemented using the pkt_cnt counter, which is an unsigned incrementing counter with a bit width typically of 16 or 32 bits. The design can be tailored to the service throughput. For example, a 16-bit counter can cover 65,536 unique identifiers, satisfying most scenarios. Alternatively, a 32-bit unsigned counter can be used, covering approximately 4.3 billion unique identifiers, providing further assurance for the high concurrency and long-term operation of 10G networks. This application provides an example of a 32-bit counter.

[0097] An increment operation is triggered only once at the "first shot of each frame of data" to generate an identity identifier for the current raw data packet. This identity identifier is unique (e.g., 0x00000001). The counter maintains its original value in the idle state. Once the SOP signal (marking the start of data packets) is detected, the pkt_cnt = pkt_cnt + 1 is immediately updated in the current clock cycle.

[0098] When the counter reaches its maximum value (e.g., 65535 for 16-bit networks), it automatically resets to zero and starts counting again. Because the packet processing cycle is extremely short (single packet processing in 10G networks is typically in the microsecond range), the interval between repeated occurrences of the same identifier far exceeds the packet's lifespan, thus preventing confusion.

[0099] Identification identifier inserted into packet header: The input data stream is monitored in real time by a hardware multiplexer (MUX). When the "start of packet flag" specified by the protocol (such as the preamble of an Ethernet frame + start of frame delimiter) is captured, the SOP signal is immediately pulled high. The clock period during which the SOP signal is pulled high is the "first frame time point". At this time, the current value of pkt_cnt is latched to avoid the identity identifier being confused due to the count update, and at the same time, it is prepared to be inserted into the data packet.

[0100] Insert a 4-byte identity identifier before the original frame header (14B) to form an extended frame structure to obtain an extended data packet: 4B identity identifier + original frame header (14B) + data payload + 4B CRC. Insert a 4-byte identity identifier after the original frame header (14B) and before the data payload to form an extended frame structure to obtain an extended data packet: original frame header (14B) + 4B identity identifier + data payload + 4B CRC.

[0101] For example, when the client MAC module detects the SOP signal in the order frame (raw data packet), pkt_cnt changes from 0 to 1 (ID=0x00000001). The extended frame structure of the extended data packet after inserting the identity identifier is: 0x00000001 (identity identifier) ​​+ destination MAC (6B) + source MAC (6B) + type field (2B) + "transaction code 600XXX|amount 50000 yuan|account 123456" + CRC (0x12345678)

[0102] The identity identifier is inserted at the very first frame of the original data packet, ensuring that all subsequent branches can obtain the packet's identity identifier. Identity identifier insertion increases the total packet length by 4 bytes, but because the identifier is located before the original frame header, it does not modify the internal structure of the original data packet, including the packet length field in the original frame header. Downstream modules (such as the MAC parsing module) can first remove the identity identifier and then parse the data packet according to the original protocol, without needing to handle additional packet length correction, ensuring the compatibility and accuracy of the parsing process. The MAC module synchronously updates the subsequent "packet length field," ensuring that downstream modules (such as the MAC parsing module) can correctly identify the packet boundaries and not affect normal parsing.

[0103] S302. The risk control module, which is set at the data link layer and associated with the transport layer, analyzes the data in the extended data packet according to the predetermined rules to generate the detection result and matches the detection result with the corresponding identity identifier.

[0104] An extended data packet with an identity identifier is sent to the risk control module for risk rule matching. The risk control module stores preset rules, which can be multiple and include rules such as "blacklisted IP / port blocking," "excessive order amount detection," and "abnormal message format filtering." The module compares the content of the extended data packet (such as target address, business fields, and protocol type) with the preset rules and generates a detection result, which can be either pass or block. The detection result is then bound to the identity identifier corresponding to this extended data packet.

[0105] The data in the extended data packet is analyzed by predefined rules to determine whether the data in the extended data packet is compliant, etc., for real-time risk assessment.

[0106] For example, the preset rule is "order amount ≤ 100,000 yuan". The current extended data packet field "order amount = 200,000 yuan" is checked and compared with the preset rule. If it meets the preset rule, the detection result is pass; if it does not meet the preset rule, the detection result is block.

[0107] S303. The MAC parsing module, which is set at the data link layer and associated with the transport layer, parses the extended data packet and determines whether the type of the extended data packet is a TCP packet. If so, it obtains the packet length field of the TCP packet.

[0108] The extended data packet with the identification identifier is sent to the MAC parsing module. The MAC parsing module uses hardware logic to parse the protocol type of the extended data packet and determine whether the extended data packet is a TCP packet.

[0109] By reading the "Type field (0x0800)" of the extended data packet extended frame, the encapsulated IP protocol is confirmed; further parsing the "Protocol Number field (10th byte)" of the IP header, if it is 6 (TCP protocol), it is determined to be a TCP packet; if it is other values ​​(such as 17=UDP), it is determined to be a non-TCP packet.

[0110] For TCP packets, extract the packet length field. TCP packet length field = total IP layer length - IP header length; The IP header length is equal to a 4-bit header length field multiplied by 4 bytes.

[0111] Since TCP packets are typically core business packets, subsequent calculations are only performed on TCP packets related to core business packets, while non-TCP packets are skipped to avoid resource contention caused by uniform processing of all packet types. At the same time, the dynamic calculation logic does not block other data packets for parallel processing, supporting 10G network line-speed transmission.

[0112] S304. The forwarding control module set at the data link layer calculates the delay duration based on the packet length field. After the delay duration ends, it sends the MAC frame containing the TCP packet and reads the detection result corresponding to the identity identifier in the TCP packet at the time point one frame before the end of the TCP packet to determine whether the MAC frame containing the TCP packet has been modified.

[0113] Since the time taken for the risk control module to detect TCP packets increases with the data length, by dynamically calculating the delay time, TCP packets of different lengths can be delayed to ensure that the system can obtain the detection results of the risk control module at the moment when all MAC frames containing TCP packets are transmitted are sent. This ensures that TCP packets wait until the detection results are generated before being sent, avoiding the failure of interception due to sending before the results arrive or the results timeout, thus achieving fast and accurate screening and interception.

[0114] Compared to a fixed delay scheme, this approach allows short packets to avoid waiting for redundant clock cycles, long packets to avoid timing misalignment due to insufficient waiting, and each packet to wait only for the exact duration required for detection. This compresses the end-to-end processing link time and reduces latency.

[0115] When the delay ends, the TCP packet is sent at the end of the data packet. Therefore, the end data can be modified based on the result. When the delay ends, it means that the detection result of the TCP packet has been generated. At this time, the TCP packet is sent, which can dynamically determine the timing of sending each extended data packet.

[0116] Because each TCP packet contains a unique identifier, and the detection result is also bound to that identifier, the detection result of the TCP packet is obtained when the packet is sent to the end. Based on the content of the detection result, it is determined whether the data of the TCP packet should be modified. If the detection result is successful, the TCP packet can be sent without modification. If the detection result is blocked, it means that the risk assessment of the TCP packet has failed, and the verification data in the TCP packet is modified, thus making the TCP packet a network invalid packet, achieving extremely fast response.

[0117] S305, Extended data packets sent by the market-side MAC receiving and forwarding control module located at the data link layer.

[0118] The market-side MAC module receives extended data packets in Ethernet frame (including TCP packets and non-TCP packets) format sent by the client forwarding control module through the 10G SFP+ physical layer module. It converts the bit stream into a frame structure recognizable by the data link layer (preamble + start-of-frame delimiter + frame header + data + CRC). The market-side MAC module 105 detects the start / end of the frame and discards frames with incorrect format (such as missing delimiters or abnormal frame length) to avoid invalid data occupying subsequent resources. It also calculates the CRC value of the received frame and compares it with the CRC field at the end of the frame. If they do not match, the frame is determined to be invalid. If the detection result of the extended data packet is interception, the CRC of the extended data packet can be modified. When the market-side MAC module receives the extended data packet with modified CRC, it removes the added header field, encapsulates it into a standard Ethernet packet, and discards it directly without forwarding it to the upper layer.

[0119] Data received by the client needs to be processed before it can be sent to the market, but data received by the market can be sent directly to the client.

[0120] This application provides a method for rapid filtering and interception of 10G network packets based on FPGA architecture. The method bypasses the software protocol stack through the client MAC module, inserting a unique identifier at the data link layer to ensure accurate binding throughout the process and avoid matching misalignment under high concurrency. The risk control module and the MAC parsing module process in parallel. The risk control module generates detection results and binds identifiers in real time according to preset rules, while the MAC parsing module only parses the underlying core fields to quickly determine TCP packets and extract packet lengths, skipping redundant upper-layer parsing and achieving rapid packet classification and screening. The forwarding control module dynamically calculates the delay time based on packet length, adapting to the risk control detection time, ensuring no redundant waiting for short packets and no timing misalignment for long packets, thus compressing end-to-end delay. The detection result is read one frame before the end of the packet, and abnormal packets are modified in real time to achieve rapid interception response.

[0121] This embodiment provides a method for high-speed filtering and interception of 10G network underlying packets based on FPGA architecture, which can be applied to the system provided in the above embodiment.

[0122] Figure 4 A flowchart illustrating a method for high-speed filtering and interception of 10G network low-level packets based on FPGA architecture, provided as an embodiment of this application, is shown below. Figure 4 As shown, based on the above embodiments, this embodiment includes the following method: S401. The client MAC module set at the data link layer receives the raw data packets in Ethernet frame format sent by the physical layer, counts the first frame time of each frame, and inserts the corresponding count value as the identity of the raw data packet into the raw data packet to obtain the extended data packet.

[0123] The description of step S401 can be found in step S301.

[0124] S402. The risk control module, which is set at the data link layer and associated with the transport layer, analyzes the data in the extended data packet according to the predetermined rules to generate the detection result and matches the detection result with the corresponding identity identifier.

[0125] The description of step S402 can be found in step S302.

[0126] The detection result includes a first indication information for indicating that the detection has passed and a second indication information for indicating that the detection has failed. For example, the first indication information can be "passed" and the second indication information can be "blocked".

[0127] S403. The MAC parsing module, which is set at the data link layer and associated with the transport layer, parses the extended data packet and determines whether the type of the extended data packet is a TCP packet. If so, it obtains the packet length field of the TCP packet.

[0128] The extended data packets include TCP packets and non-TCP packets, and the description of step S403 can be found in step S303.

[0129] S404. Store the packet length field of the TCP packet into the TCP segment length buffer queue, store the TCP packet into the TCP packet buffer queue, and store the non-TCP packet into the non-TCP packet buffer queue.

[0130] Data packets identified as TCP type by the MAC parsing module are cached in the TCP packet cache queue to adapt to the high-concurrency transmission of 10G networks. At the same time, it provides a storage medium for the forwarding control module to read TCP packets according to the delay duration, avoiding data loss due to untimely subsequent processing.

[0131] Storing the total TCP segment length (packet length field) derived by the MAC parsing module in the TCP segment length cache queue provides a fast input for the delay calculation of the forwarding control module, eliminating the need to re-parse TCP packets and significantly reducing calculation time. At the same time, by matching the order with the TCP packet cache queue, the precise binding of packet length and data packet is ensured, guaranteeing the accuracy of delay calculation.

[0132] The packet length field of each TCP packet in the TCP segment length cache queue corresponds one-to-one with the number of TCP packets in the TCP packet cache queue.

[0133] Data packets identified as non-TCP types (such as UDP, ARP, etc.) by the MAC parsing module are cached in the non-TCP packet cache queue. This allows for the categorization and storage of non-TCP packets, enabling a simplified process for rapid forwarding. This avoids resource contention with TCP packet processing logic, improves the overall system's efficiency in processing different types of data packets, and ensures the smooth flow of various messages under 10G networks.

[0134] S405. The forwarding control module set at the data link layer determines whether the TCP segment length buffer queue and the non-TCP packet buffer queue are empty, and determines the sending priority of TCP packets and non-TCP packets.

[0135] Since TCP packets are typically core business packets, subsequent calculations are only performed on TCP packets related to core business packets, while non-TCP packets are skipped to avoid resource contention caused by uniform processing of all packet types. At the same time, the dynamic calculation logic does not block other data packets for parallel processing, supporting 10G network line-speed transmission.

[0136] S406: When the TCP segment length buffer queue is not empty, the forwarding control module prioritizes sending TCP packets and calculates the delay duration based on the packet length field of the TCP packet.

[0137] Since the time taken for the risk control module to detect TCP packets increases with the length of the data, by dynamically calculating the delay time, it can be ensured that the TCP packet waits until the detection result is generated before it is sent, avoiding the failure of interception due to sending before the result arrives or the result timeout, thus achieving fast and accurate screening and interception.

[0138] Compared to a fixed delay scheme, this approach allows short packets to avoid waiting for redundant clock cycles, long packets to avoid timing misalignment due to insufficient waiting, and each packet to wait only for the exact duration required for detection. This compresses the end-to-end processing link time and reduces latency.

[0139] When the delay period ends, it indicates that the detection result of the TCP packet has been generated. At this time, the TCP packet is sent, which can dynamically determine the timing of sending each extended data packet.

[0140] When calculating the delay duration, the delay duration is obtained based on the ratio of the packet length field to the preset unit byte length and the number of clock cycles corresponding to the unit byte length.

[0141] Since a single TCP packet may contain multiple consecutive orders, based on tests of different hardware performance, the system has made delay plans for different TCP packet lengths according to empirical values. The number of clock cycles corresponding to a unit byte length can be determined. The number of clock cycles corresponding to a unit byte length is configured by the host computer. The forwarding control module 204 can determine the corresponding delay duration based on the ratio between the packet length field of the corresponding TCP packet and the unit byte length.

[0142] Specifically, if the length of a unit byte is n, and the number of clock cycles corresponding to a unit byte length of n is m, then the delay duration of the current TCP packet is (packet length field / n) * m). For example, a length of 256 bytes is m delay units, a length of 512 bytes is 2m delay units, and a length of 1024 bytes is 4m delay units. The corresponding delay duration can be obtained based on the number of bytes in the TCP packet.

[0143] S407. After the delay period ends, the forwarding control module sends a TCP packet and reads the detection result corresponding to the identity identifier in the TCP packet one frame before the end of the TCP packet to determine whether the TCP packet has been modified.

[0144] When the detection result is the first indication information, the MAC frame containing the TCP packet is sent directly; When the detection result is the second knowledge information indication information, modify the CRC data field of the MAC frame containing the TCP packet.

[0145] Because each TCP packet contains a unique identifier, and the detection result is also bound to that identifier, the detection result of the TCP packet is obtained when it reaches the end of the transmission. Based on the content of the detection result, it is determined whether the data of the TCP packet should be modified. If the detection result is the first indication information, the TCP packet does not need to be modified and continues to be sent. If the detection result is the second knowledge information indication information, it indicates that the risk assessment of the TCP packet has failed, and the check data in the TCP packet is modified. Specifically, the CRC check field can be destroyed, making the TCP packet a network invalid packet. The physical layer of the system will still send the invalid packet to the physical fiber optic cable, where it is parsed by the physical layer of the other party's network card and discarded at the data link layer, thus achieving a very fast response of the TCP packet.

[0146] Since the 4-byte CRC field at the end of the Ethernet frame is a check value for the entire frame (excluding the CRC), the receiving end (market end) will recalculate the CRC and compare it with the frame end field. If they do not match, the frame is determined to be invalid and discarded.

[0147] S408. When the TCP segment length buffer queue is empty but the non-TCP packet buffer queue is not empty, the forwarding control module prioritizes sending non-TCP packets, and the forwarding control module does not make any modifications to the non-TCP packets.

[0148] Since non-TCP packets are typically supportive or auxiliary business data that does not require reliable transmission, tolerates a small amount of packet loss, has moderate real-time requirements, and does not involve core data such as funds / transaction instructions, even delays or minor packet loss will not affect the execution of core transactions. The market end only needs to send the non-TCP packet unchanged. Under 10G network line-speed transmission, the concurrency of TCP packets is extremely high during peak core transaction periods. If non-TCP packets preempt transmission resources, it may cause TCP packet transmission delays, affecting the timeliness of transaction instruction delivery. By reducing the priority of non-TCP packets, bandwidth and timing resources for core business are prioritized, aligning with the design logic of "core business priority." Non-TCP packets do not carry core business data (such as transaction amounts or account information) and are only used for basic network interactions or auxiliary notifications. They do not pose a risk of "illegal data transmission" and do not require modification of data packets for interception, thus conforming to the applicable scope of risk control rules.

[0149] There is no need to design hardware logic such as detection result matching and data packet modification for non-TCP packets, reducing FPGA resource consumption and allowing hardware computing power to be concentrated on the core processing of TCP packets, further improving the low latency and high throughput performance of core services under 10G networks.

[0150] S409, Extended data packets sent by the market-side MAC receiving and forwarding control module located at the data link layer.

[0151] The description of step S409 can be found in step S305.

[0152] This application provides a method for high-speed filtering and interception of 10G network packets based on FPGA architecture. It avoids resource contention by classifying and storing TCP packets, TCP segment lengths, and non-TCP packets in three types of buffer queues, ensuring accurate correspondence between packet length and data packet, providing an efficient data carrier for subsequent processing. The forwarding control module first determines the queue status and schedules packets according to the TCP packet priority principle, ensuring uninterrupted transmission of core services. Furthermore, it dynamically calculates latency to adapt to hardware performance and detection time, compressing redundant waiting. Simultaneously, it ensures interception accuracy through identity binding and low-level parallel parsing. Abnormal packets are modified in real-time before the end of the TCP packet to achieve a high-speed response, while non-TCP packets are forwarded quickly without modification. The entire link relies on data link layer hardware timing to adapt to high throughput, achieving an optimized closed loop of classified storage, precise scheduling, high-speed interception, and low-latency transmission.

[0153] Figure 5 A schematic diagram of a 10G network low-level packet high-speed filtering and interception device based on FPGA architecture is provided as an embodiment of this application, as shown below. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: The device 50 includes at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus 504.

[0154] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0155] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0156] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0157] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0158] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0159] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0160] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0161] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0162] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0163] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0164] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0165] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0166] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0167] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0168] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A 10G network low-level packet high-speed filtering and interception system based on FPGA architecture, characterized in that, The system includes: The client MAC module, located at the data link layer, is used to receive raw data packets in Ethernet frame format sent by the physical layer, count the first frame time of each frame, and insert the corresponding count value as the identity of the raw data packet into the raw data packet to obtain an extended data packet. The risk control module is located at the data link layer and associated with the transport layer. It is used to analyze the data in the extended data packet according to predetermined rules to generate detection results and match the detection results with the corresponding identity identifier. The MAC parsing module, located at the data link layer and associated with the transport layer, is used to parse the extended data packet and determine whether the type of the extended data packet is a TCP packet. If so, it obtains the packet length field of the TCP packet. The forwarding control module, located at the data link layer, is used to calculate the delay duration based on the packet length field, send the MAC frame containing the TCP packet after the delay duration ends, and read the detection result corresponding to the identity identifier in the TCP packet at the time point one frame before the end of the TCP packet to determine whether the MAC frame containing the TCP packet has been modified. The market-side MAC module, located at the data link layer, is used to receive the extended data packets sent by the forwarding control module.

2. The system according to claim 1, characterized in that: The system also includes: The TCP packet buffer queue is set at the data link layer and is used to store the MAC frame containing the TCP packet. The TCP segment length buffer queue is set at the data link layer and is used to store the packet length field of TCP packets. Non-TCP packet buffer queue, set at the data link layer, is used to store the MAC frame containing non-TCP packets; The packet length field of each TCP packet in the TCP segment length cache queue corresponds one-to-one with the number of TCP packets in the TCP packet cache queue. The forwarding control module determines whether the TCP segment length buffer queue and the non-TCP packet buffer queue are empty, and controls the sending priority of TCP packets and non-TCP packets.

3. The system according to claim 1, characterized in that, The forwarding control module obtains the delay duration based on the ratio of the packet length field to the preset unit byte length and the number of clock cycles corresponding to the unit byte length.

4. A method for high-speed filtering and interception of 10G network underlying packets based on FPGA architecture, characterized in that, The method includes: The client MAC module, located at the data link layer, receives raw data packets in Ethernet frame format sent by the physical layer, counts the first frame time of each frame, and inserts the corresponding count value as the identity of the raw data packet into the raw data packet to obtain an extended data packet. The risk control module, which is set up at the data link layer and associated with the transport layer, analyzes the data in the extended data packet according to predetermined rules to generate a detection result, and matches the detection result with the corresponding identity identifier. The MAC parsing module, which is set up at the data link layer and associated with the transport layer, parses the extended data packet and determines whether the type of the extended data packet is a TCP packet. If so, it obtains the packet length field of the TCP packet. The forwarding control module set at the data link layer calculates the delay duration based on the packet length field, sends the MAC frame containing the TCP packet after the delay duration ends, and reads the detection result corresponding to the identity identifier in the TCP packet at the time point one frame before the end of the TCP packet to determine whether the MAC frame containing the TCP packet has been modified. The market-side MAC, located at the data link layer, receives the extended data packets sent by the forwarding control module.

5. The method according to claim 4, characterized in that, After obtaining the packet length field of the TCP packet, the following steps are included: The packet length field of the TCP packet is stored in the TCP segment length cache queue, and the TCP packet is stored in the TCP packet cache queue, wherein the TCP segment length cache queue and the TCP packet cache queue are set at the data link layer; In this context, the packet length field of each TCP packet in the TCP segment length cache queue corresponds one-to-one with the number of TCP packets in the TCP packet cache queue.

6. The method according to claim 5, characterized in that, The sending priority of multiple types of extended data packets is determined based on whether the TCP segment length buffer queue is not empty.

7. The method according to claim 6, characterized in that, The extended data packet includes TCP packets and non-TCP packets. When the TCP segment length buffer queue is not empty, the MAC frame containing the TCP packet is sent first.

8. The method according to claim 4, characterized in that, The step of calculating the delay duration based on the packet length field includes: The delay duration is obtained based on the ratio of the packet length field to the preset unit byte length and the number of clock cycles corresponding to the unit byte length.

9. The method according to claim 4, characterized in that, The step of reading the detection result corresponding to the identity identifier in the TCP packet at the time point one frame before the end of the TCP packet to determine whether the MAC frame containing the TCP packet has been modified includes: The detection result includes a first indication information for indicating that the detection has passed and a second indication information for indicating that the detection has failed, including: When the detection result is the first indication information, the MAC frame containing the TCP packet is sent directly; When the detection result is the second knowledge information indication information, the CRC data field of the MAC frame containing the TCP packet is modified.

10. A 10G network low-level packet high-speed filtering and interception device based on FPGA architecture, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 4-9.

Images