JP3779709B2 - Policy control circuit - Google Patents

Description

  The present invention is used for a packet transfer apparatus such as a router. In particular, it relates to a policy control technique for packet transfer processing.

  The configuration and operation of a conventional policy control chip are shown in FIGS. FIG. 8 is a diagram showing the configuration of the policy processing chip. FIG. 9 is a diagram showing the location of the chip in the network. FIG. 10 is a diagram illustrating an example of a function required for each arrangement place.

As shown in FIG. 9, the policy control chip is applied to four locations in the network.
(1) VPN (Virtual Private Network) entrance: A VPN is defined between specific users, and is a pre-authorized SA (Source
Packets other than (Address) / DA (Destination Address) pair are not allowed to pass. However, the rest are set based on the VPN operation policy.
(2) Relay router: The relay router only performs high-speed forwarding, and does not see other fields except in special cases.
(3) Edge router: The edge router plays the most important role in policy control. At the edge, priority control and prohibited protocol types based on TOS (Type of Service) (for example, UDP (User Datagram
Protocol) (Prohibition of packets). For the upstream of the edge router (from the terminal to the network), a filter to stop the flow of rate control and prohibited protocols into the network is suppressed. Filtering for is important.
(4) Server entrance: Downward to the server is particularly attacked by DoS or hackers. For this reason, as a firewall, the port number and protocol type allowed, and the rate are filtered in detail.
Nikkei Electronics, January 6, 2003, pp. 111-122, "Development of dynamic reconfigurable technology to rewrite the configuration between arithmetic units in 10ns" Nikkei Electronics, November 18, 2002, pp. 59-66, “The idea of software creates a virtual circuit, the hardware changes seven times instantly” Nikkei Electronics, 29 July 2002, pp. 114-123, “Everyone can make a circuit, to be hardware-free”

  FIG. 10 illustrates the above description. For the policy control chip, it is conceivable to create all the functions and use them as necessary. Alternatively, there is a method of creating a plurality of types of policy control chips and applying different chips to necessary places. However, in the former case, there is a problem that an expensive chip is developed and only a part of the functions are used, and in the latter case, there is an increase in the number of LSIs and there is a problem of economy.

  An object of the present invention is to provide a policy control circuit that has been implemented in such a background and is excellent in economy and capable of realizing flexible policy control.

The policy control circuit of the present invention is a reconfigurable DAP / DNA (Data
Several functional blocks necessary for policy control are designed on the (Application Processor / Distributed Network Architecture) chip, only the necessary functional blocks are configured and implemented, and the basic part and application part are defined. The main feature is that information such as a header and protocol type is passed from the basic unit to the application unit as bit information, and an instruction according to a policy such as a count instruction or a discard instruction is passed from the application unit.

  That is, the present invention is a policy control circuit for determining a policy relating to processing of an IP packet based on header information of the IP packet, and the present invention is characterized by means for extracting header information from the IP packet. A means for extracting predetermined bits from the header information, an application unit interface for transferring the information on the predetermined bits to the policy analysis means for processing the IP packet, and the IP based on the analysis result of the policy analysis means. A basic unit including means for controlling packet transfer, one or more policy analysis means for performing one or more different policy analyzes based on the information of the predetermined bits, and a policy analysis result by the policy analysis means And an application unit having a basic unit interface for transferring to the controlling means.

  As described above, since the basic unit and the application unit are independent of each other, the basic unit can be applied to various uses by changing only the application unit without changing the basic unit.

  The basic unit interface and the application unit interface each include means for transmitting and receiving packets between the basic unit interface and the application unit interface, and the means for transmitting and receiving is directed from the basic unit to the application unit. Means for mounting the information of the predetermined bit in the packet and identification information for specifying the type of processing of the IP packet; and identification information for specifying the type of processing of the IP packet in the packet going from the application unit to the basic unit And means for mounting the policy analysis result.

  As a result, when the application unit has a plurality of policy analysis units, packets from the basic unit can be distributed to these policy analysis units, so that the communication processing between the basic unit and the application unit is simplified. Can do.

In addition, the policy control circuit of the present invention is connected to DAP / DNA (Data Application
When mounted on a (Processor / Distributed Network Architecture) type configurable processor, for example, the application section is mounted on DAP and the basic section is mounted on DNA. Alternatively, on the DAP / DNA type configurable processor, the application unit may be mounted on DNA and DAP, and the basic unit may be mounted on DNA.

  Here, the DAP / DNA type configurable processor will be briefly described. The DAP / DNA is mainly composed of two parts. One is a DAP of a RISC type CPU core, and the other is DNA of a data processing unit in which arithmetic units called “elements” are arranged in a matrix. DAP / DNA is characterized in that execution on an actual chip is completely guaranteed if it passes simulation at the time of application development. Code optimization and development process as seen in development for FPGA and DSP In principle, no backtracking occurs (for example, see Non-Patent Documents 1 to 3).

  Thereby, when changing or adding the function of an application part, this operation | work can be performed easily.

  Another aspect of the present invention is a policy control circuit in which the basic part and the application part of the policy control circuit of the present invention are mounted on a DAP / DNA type configurable processor provided in a network configuration device having different functions. The present invention is characterized in that the policy analysis means of the application unit is limited to policy analysis means determined to be indispensable in the network configuration device.

  In this way, in the conventional method in which all the functions are built into the chip and used as needed, or in the conventional method in which a plurality of types of policy control chips are created and different chips are applied to the necessary places. Problems such as expensive chip development or an increase in the variety of LSIs can be avoided.

  According to the present invention, it is possible to realize a policy control that is economical and flexible.

  The configuration of the policy control circuit according to the embodiment of the present invention will be described with reference to FIGS. FIG. 1 is an overall configuration diagram of the policy control circuit of this embodiment. FIG. 2 is a block diagram of the basic part of the policy control circuit of this embodiment. FIG. 3 is a configuration diagram of an application unit of the policy control circuit of this embodiment.

  The embodiment of the present invention is a policy control circuit for determining a policy relating to processing of an IP packet based on the information of the header of the IP packet. The feature of this embodiment is as shown in FIG. 1 and FIG. A header extraction unit 1 that extracts header information from the IP packet, a bit selection unit 2 that extracts a predetermined bit from the header information, and a policy analysis CPU 4-2 regarding the processing of the IP packet. 1 to the basic unit 20 including the application unit interface 3 for transferring to 4-i and the data processing CPU 6 for controlling the transfer of the IP packet based on the analysis result of the policy analysis CPUs 4-2 to 4-i; As shown in FIG. 3, one or more policy analysis CPUs 4 each perform one or more different policy analyzes based on the information of the predetermined bits. And 2 to 4-i, it is in place and a application unit 21 that includes a base unit interface 5 for transferring policy analysis result to the data processing CPU6 by the policy analysis CPU4-2~4-i.

  FIG. 4 is a diagram showing an example of A-interface information. The basic unit interface 5 and the application unit interface 3 are respectively provided with means for transmitting and receiving packets between the basic unit interface 5 and the application unit interface 3, and the means for transmitting and receiving the basic unit 20 as shown in FIG. Means for mounting the extracted bit 10 which is information of the predetermined bit and a processing ID 11 for specifying the type of processing of the IP packet in the packet going from the application unit 21 to the application unit 21; And a means for mounting a result ID 13 for specifying the type of processing of the IP packet and data 14 as the policy analysis result.

  The packet is transferred to any one of the policy analysis CPUs 4-2 to 4-i by the extracted bit 10 and the processing ID 11 of the packet from the basic unit 20 to the application unit 21. You can write attached data.

  FIG. 5 is a diagram showing a configuration example of a DAP / DNA chip. 6 and 7 are diagrams showing an example of mounting the basic part and the application part on the DAP / DNA chip. The policy control circuit of the present embodiment is implemented on the DAP / DNA type configurable processor shown in FIG. 5, and as shown in FIG. 6, the application unit 21 is mounted on the DAP and the basic unit 20 is mounted on the DNA. The Alternatively, on the DAP / DNA type configurable processor, as shown in FIG. 7, the application unit 21 is mounted on DNA and DAP, and the basic unit 20 is mounted on DNA.

  Further, as shown in FIG. 9, the present embodiment is implemented on a DAP / DNA type configurable processor provided in a network component such as a VPN entrance, a relay router, an edge router, or a server entrance having different functions. When the basic unit 20 and the application unit 21 of the policy control circuit are mounted, the policy analysis CPUs 4-2 to 4-i of the application unit 21 are limited to policy analysis CPUs that are determined to be indispensable in the network configuration device. And implement.

  Hereinafter, this embodiment will be described in more detail.

Example 1
The policy control circuit according to the first embodiment includes a general-purpose and fixed basic unit 20 that is not reconfigured in principle, and an application unit 21 that stores a function block that requires a necessary function or change. The basic unit 20 and the application unit 21 are connected by an A-interface. Further, from the basic unit 20, in the example, an alarm can be displayed on the OpS or the display, and the external RAM can be accessed. The application unit 21 can be reconfigured and realizes necessary functions as much as necessary.

  FIG. 2 shows a configuration example of the basic unit 20. Among the data, the header portion of the IP packet is copied by the header extraction unit 1. The bit select unit 2 cuts out bits such as SA and DA in the IP header. The data processing CPU 6 mainly distributes data. The CPU described here has a simple structure, and it is also possible to realize wire logic by performing only distribution.

  This CPU processes the data to be transferred to the application unit 21 into a format on the A-interface. For example, this circuit is used when asking the forwarding port based on DA or asking whether it is permitted by VPN based on SA / DA pair.

  FIG. 3 is a block diagram of the application unit 21. Based on the data passed from the basic unit 20, for example, the forwarding port CPU 4-1 is inquired of the destination port based on DA. In the forwarding processing CPU 4-1, the destination port is attached and returned to the basic unit interface 5. Further, for example, when the policy analysis CPU (# 1) 4-1 is asked based on the DA, if the DA is a priority, the DA is returned together with the priority information.

  The policy analysis CPUs (# 1) to (#i) are reconfigurable in both contents and number of analysis, and necessary functions can be arranged as many as necessary. Each CPU is also relatively simple, and a simple one can be realized by a comparator and a register.

  FIG. 4 shows an example of information on the A-interface. The A-interface has a simple packet format, and consists of an extraction bit 10 and a processing ID 11 and data 12 from the basic unit 20 to the application unit 21. For example, DA, threshold exceeding processing request (congestion control), Notify like network congestion. It may be used when controlling the rate to a specific DA.

  On the other hand, a result ID 13 and data 14 are attached from the application unit 21 to the basic unit 20, and as shown in the figure, for example, in the case of an output port analysis, the output port number, whether priority is given, whether discarding is required , Pass the count value, etc.

  As described above, the function can be realized by the configuration of the policy analysis CPUs 4-2 to 4-i of the application unit 21.

(Example 2)
FIG. 5 shows the configuration of a DAP / DNA circuit manufactured by IPFlex (for example, see Non-Patent Documents 1 to 3). DAP / DNA mainly consists of two parts. One is the DAP of the RISC type 32-bit CPU core, and the other is the DNA of the data processing unit in which 148 arithmetic units called “elements” are arranged in a matrix. DAP / DNA is characterized in that execution on an actual chip is completely guaranteed if it passes simulation at the time of application development. Code optimization and development process as seen in development for FPGA and DSP In principle, no backtracking occurs.

  In the second embodiment, as shown in FIG. 6, the basic unit 20 is realized on the DNA matrix, and the basic unit 20 operates at a data wire speed (for example, 2.4 Gb / s). The application unit 21 is realized by DAP software, and enables complex policy control.

Example 3
Example 3 is shown in FIG. In the application unit 21, forwarding and simple filtering can be realized by the DNA unit, and a complex attack analysis can be shared between the DNA and the DAP. By realizing it on DNA as much as possible, the performance of hardware can be extracted. Of course, all functions may be realized on DNA.

  The present invention is characterized in that the policy control method is divided into a basic part and an application part using the reconfigurable nature of DAP / DNA, and only necessary functions are realized in a free place in the network. Can be economical. In addition, although a firewall or the like cannot follow changes in attacks, the method according to the present invention can cope with it, and a high-performance and flexible policy control circuit can be realized.

The whole block diagram of the policy control circuit of a present Example. The block diagram of the basic part of the policy control circuit of a present Example. The block diagram of the application part of the policy control circuit of a present Example. The figure which shows the example of information of A-interface of a present Example. The block diagram of DAP / DNA. The figure for demonstrating mounting of the fundamental part and application part to DAP / DNA of Example 2. FIG. The figure for demonstrating mounting of the fundamental part and application part to DAP / DNA of Example 3. FIG. The figure for demonstrating the conventional packet policy process. The figure which shows a network structure and the location which needs policy processing. The figure which shows the operation example of a policy processing chip.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Header extraction part 2 Bit selection part 3 Application part interface 4-1 Forwarding processing CPU
4-2-4-i Policy analysis CPU
5 Basic part interface 6 Data processing CPU
7 Header processing part 8 Access control part 9 Counter 10 Extraction bit 11 Process ID
12, 14 Data 13 Result ID
20 Basic part 21 Application part

Claims (6)

In a policy control circuit for determining a policy regarding processing of the IP packet based on information of the header of the IP packet,
Means for extracting header information from the IP packet;
Means for extracting predetermined bits from the information of the header;
An application unit interface for transferring the information of the predetermined bit to the policy analysis means relating to the processing of the IP packet;
A basic unit comprising: means for controlling transfer of the IP packet based on the analysis result of the policy analysis means;
One or more policy analysis means for respectively performing one or more different policy analyzes based on the information of the predetermined bits;
An application unit including a basic unit interface for transferring a policy analysis result by the policy analysis unit to the control unit ;
The basic unit interface and the application unit interface each include means for transmitting and receiving packets between the basic unit interface and the application unit interface,
This means for sending and receiving
Means for mounting the information of the predetermined bit and identification information for specifying the type of processing of the IP packet in the packet going from the basic unit to the application unit;
Means for mounting identification information for identifying the type of processing of the IP packet and the policy analysis result on the packet from the application unit to the basic unit;
Policy control circuit comprising the. In a policy control circuit for determining a policy regarding processing of the IP packet based on information of the header of the IP packet,
Means for extracting header information from the IP packet;
Means for extracting predetermined bits from the information of the header;
An application unit interface for transferring the information of the predetermined bit to the policy analysis means relating to the processing of the IP packet;
Means for controlling forwarding of the IP packet based on the analysis result of the policy analysis means;
A basic part with
One or more policy analysis means for respectively performing one or more different policy analyzes based on the information of the predetermined bits;
A basic interface for transferring a policy analysis result by the policy analysis means to the control means;
Application section with
With
DAP / DNA (Data Application
Processor / Distributed Network
Architecture) on a configurable processor
The application unit is implemented in DAP,
The basic part was implemented in DNA
A policy control circuit. In a policy control circuit for determining a policy regarding processing of the IP packet based on information of the header of the IP packet,
Means for extracting header information from the IP packet;
Means for extracting predetermined bits from the information of the header;
An application unit interface for transferring the information of the predetermined bit to the policy analysis means relating to the processing of the IP packet;
Means for controlling forwarding of the IP packet based on the analysis result of the policy analysis means;
A basic part with
One or more policy analysis means for respectively performing one or more different policy analyzes based on the information of the predetermined bits;
A basic interface for transferring a policy analysis result by the policy analysis means to the control means;
Application section with
With
On the DAP / DNA type configurable processor,
The application unit is implemented on DNA and DAP,
The basic part was mounted on DNA
A policy control circuit. DAP / DNA (Data Application
Processor / Distributed Network
Architecture) on a configurable processor
The application unit is implemented in DAP,
The basic unit, policy control circuit according to claim 1 Symbol placement mounted on DNA. On the DAP / DNA type configurable processor,
The application unit is implemented on DNA and DAP,
The basic part was mounted on DNA
The policy control circuit according to claim 1 . 6. A policy control circuit for mounting the basic part and the application part of the policy control circuit according to claim 1 on a DAP / DNA type configurable processor provided in a network configuration apparatus having different functions. Implementation method,
The policy analysis means of the application unit is limited to policy analysis means determined to be indispensable in the network configuration device.
And a policy control circuit mounting method .

Images