电子学报 ›› 2016, Vol. 44 ›› Issue (11): 2561-2568.DOI: 10.3969/j.issn.0372-2112.2016.11.001

• 学术论文 •    下一篇

一种面向100Gbps网络的L7-filter硬件加速方法

付文亮1, 郭平1, 周舟2   

  1. 1. 北京理工大学计算机科学与技术学院, 北京 100081;
    2. 中国科学院信息工程研究所信息内容安全技术国家工程实验室, 北京 100093
  • 收稿日期:2015-04-07 修回日期:2015-08-17 出版日期:2016-11-25
    • 通讯作者:
    • 郭平
    • 作者简介:
    • 付文亮,男,1984年出生于河北邯郸市.现为北京理工大学计算机学院在读博士生.主要从事高性能网络、网络安全、节能等领域关键技术研究;周舟,男,1983年出生,现为中国科学院信息工程研究所高级工程师.主要从事高性能网络及网络安全相关领域研究.
    • 基金资助:
    • 国家自然科学基金 (No.61402474)

A Hardware-Accelerated L7-filter Method for 100Gbps Networks

FU Wen-liang1, GUO Ping1, ZHOU Zhou2   

  1. 1. School of Computer Science and Technology, Beijing Institute of Technology, Beijing 100081, China;
    2. National Engineering Laboratory for Information Security Technologies, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
  • Received:2015-04-07 Revised:2015-08-17 Online:2016-11-25 Published:2016-11-25
    • Supported by:
    • National Natural Science Foundation of China (No.61402474)

摘要:

L7-filter是当前广泛应用的流量分类系统,其采用基于正则表达式匹配的深包检测方法,通过检测数据包有效载荷中存在的字符串特征对流量进行分类.然而,由于计算复杂度高、存储消耗大等原因,现有L7-filter软硬件方法的处理性能严重不足,不能适应当前40Gbps以及更高性能骨干网络.在对L7-filter的应用层协议规则集进行分析,总结其中广泛存在的特征的基础上,本文提出了一个硬件加速方法,其通过有针对性的数据模型、算法优化、匹配架构设计以提高流量分类系统的处理能力.为了验证方法的可行性,采用了基于Virtex6的FPGA板卡实现原型系统并对其进行评估.实验结果表明,原型系统的数据吞吐率可以达到约115Gbps.

关键词: 流量分类, 正则表达式匹配, 100Gbps, FPGA

Abstract:

L7-filter is a widely used traffic classification system which relies on regular expression matching based deep packet inspect method and can identify network traffic by inspecting string patterns hidden in the packet payload.However,due to considerable computation and storage expenditures,existing L7-filter software and hardware solutions could not offer sufficient performance in the context of 40 Gbps and higher speed networks.Based on analysis of common features of the L7-filter protocol patterns,this paper proposes a hardware-accelerated method which is for achieving high performance and includes customized data structure,optimization and matching architecture.To validate the proposed method,a hardware prototype on Virtex 6 FPGA card is implemented and tested.Experimental results show that the prototype can scan network traffic at a typical rate of about 115Gbps.

Key words: traffic classification, regular expression matching, 100Gbps, FPGA

中图分类号: