Packet Processing Method for Network Device Policy Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The limited number of concurrent packet processing policies in network devices due to scarce hardware resources in packet forwarding chips, which restricts the execution of configured policies.
Innovation Solution
A method where a first network device obtains identification information for packets and inserts it into the packets, allowing a downstream network device to match policies based on this information, reducing the need for constructing key description information and alleviating resource constraints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the packet forwarding chip extracts multiple matching fields to construct key description information for policy matching, then the packet processing accuracy is improved, but the hardware resources (copy engine and key buffer) are exhausted, limiting the quantity of concurrent policies
Solution Approach 1:
The patent extracts only the essential identification information from packets rather than constructing complete key description information from multiple fields. This selective extraction reduces resource consumption while maintaining sufficient accuracy for policy matching, allowing more concurrent policies to be supported.
Solution Approach 2:
The patent segments the policy matching process into two stages: first, simple identification information extraction and matching; second, detailed policy execution. This segmentation allows the resource-constrained copy engine and key buffer to be used minimally for initial filtering, while more complex processing can be handled subsequently with different resource requirements.
2Adaptability or versatility
If the packet forwarding chip uses scarce hardware resources (copy engine and key buffer) to construct key description information, then the policy matching capability is enhanced, but the device complexity increases due to resource constraints
Solution Approach 1:
The patent uses lightweight, easily constructed identification information instead of complex key description information that requires extensive hardware resources. This approach treats the matching key as a simple, disposable identifier that can be quickly generated and discarded, rather than a complex structure requiring persistent hardware buffers.
Solution Approach 2:
The patent changes the parameter of the matching key from complex multi-field key description information to simple identification information. This parameter change fundamentally reduces the resource requirements for storage and processing, allowing the system to support more concurrent policies without increasing hardware complexity.
3Productivity
If the network device supports more concurrent packet processing policies, then the network security coverage is improved, but the hardware resources of the packet forwarding chip become insufficient
Solution Approach 1:
The patent uses simple identification information that can be easily copied and processed, rather than complex key description information that requires substantial hardware resources for manipulation. This copying approach minimizes the resource overhead for each policy matching operation, enabling support for more concurrent policies with the same hardware resources.
Data Source
AI summary
Embodiments of the present disclosure provide a packet processing method and a network device, so as to effectively resolve a problem that a quantity of concurrent packet processing policies is limited in a network device due to scarce hardware resources of a packet forwarding chip. A method part in the embodiments of the present disclosure includes: obtaining, by a first network device, identification information; processing, by the first network device, a packet when receiving the packet, where a processed packet includes the identification information, and packets corresponding to different preset policy information include different identification information; and sending, by the first network device, the processed packet to a second network device, so that the second network device matches a corresponding policy for the processed packet based on the identification information.