JP4060348B2 - Data processing device - Google Patents

Description

  The present invention relates to a data processing technique, and more particularly to a data processing apparatus that processes communication data.

  With the development of the Internet infrastructure and the widespread use of communication terminals such as mobile phone terminals, personal computers, and VoIP (Voice over Internet Protocol) telephone terminals, the number of Internet users is increasing explosively. Under such circumstances, security problems such as computer viruses, hacking, and spam mails are becoming obvious, and a technique for appropriately controlling communication is required. With the improvement of the communication environment, the amount of communication has become enormous, and the need for a communication control device that processes large volumes of data at high speed is increasing.

FIG. 1 shows a configuration of a conventional communication control apparatus 1. The conventional communication control device 1 includes a communication control unit 2 on the reception side, a packet processing unit 3, and a communication control unit 4 on the transmission side. The communication control units 2 and 4 include PHY processing units 5a and 5b that perform processing on the physical layer of the packet, and MAC processing units 6a and 6b that perform processing on the MAC layer of the packet, respectively. The packet processing unit 3 includes a protocol processing unit that performs processing according to a protocol, such as an IP processing unit 7 that performs IP (Internet Protocol) protocol processing and a TCP processing unit 8 that performs TCP (Transport Control Protocol) protocol processing. And an AP processing unit 9 that performs application layer processing. The AP processing unit 9 performs processing such as filtering according to the data included in the packet.
JP-A-4-180425

  In the conventional communication control apparatus 1, the packet processing unit 3 is realized by software using a CPU that is a general-purpose processor and an OS that runs on the CPU. However, with such a configuration, the performance of the communication control device 1 depends on the performance of the CPU, and there is a limit to the implementation of a communication control device that can process a large-capacity packet at high speed. For example, in the case of a 64-bit CPU, the maximum amount of data that can be processed simultaneously at a time is 64 bits, and there has been no communication control device having higher performance. In addition, since it is assumed that there is an OS having a general-purpose function, there is no possibility of a security hole or the like, and maintenance work such as OS version upgrade is required.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a technique for realizing a high-speed data processing apparatus.

  One embodiment of the present invention relates to a data processing apparatus. The data processing apparatus includes a first storage unit that stores reference data serving as a reference for determining the content of processing to be performed on acquired data, and whether the reference data is included in the data. Based on the search result, a search unit for searching by comparing the data and the reference data, a second storage unit for storing the search result by the search unit and the content of the process in association with each other A processing unit that executes the processing contents associated with the search result on the data, and the search unit is configured by a wired logic circuit.

  The search unit or the processing unit may be realized using an FPGA (Field Programmable Gate Array) or the like. By configuring the search unit with a dedicated hardware circuit, it is possible to realize a data processing apparatus having a desired performance without being restricted by the performance of the CPU.

  The wired logic circuit may include a plurality of first comparison circuits that compare the data and the reference data in bit units. By providing, for example, 64 or more first comparison circuits in parallel, a circuit capable of comparing a larger number of bits than the CPU at a time can be realized.

  The search unit may include a position detection circuit that detects a position of comparison target data to be compared with the reference data from the communication data. The position detection circuit includes a plurality of second comparison circuits that compare the position specifying data for specifying the position of the comparison target data and the communication data, and the communication data is given to the plurality of second comparison circuits by a predetermined amount. It is also possible to input the data by shifting the position by the data length and compare in parallel with the position specifying data. By providing a plurality of second comparison circuits, a plurality of positions can be determined at a time, so that the position of the comparison target data can be detected at a higher speed.

  The search unit may include a binary search circuit for searching whether or not the reference data is included in the communication data by binary search. When the number of data of the reference data is smaller than the number of data that can be held in the first storage unit, the reference data is stored in descending order from the last data position of the first storage unit, and 0 is set to the remaining data. It may be stored. When the reference data is 0, the next binary search can be performed without executing the comparison, so that the binary search can be executed at a higher speed.

  When the search unit divides the plurality of reference data stored in the first storage unit into three or more ranges, the search unit determines which of the ranges the comparison target data to be compared with the reference data belongs to A determination circuit may be included. The determination circuit includes a plurality of third comparison circuits for comparing the reference data of the boundary of the range with the comparison target data, and the comparison target data is set to any one of the three or more ranges by the plurality of third comparison circuits. Whether they belong may be determined in parallel at the same time. By specifying the range prior to binary search, the search speed can be improved. The reference data stored at a predetermined position in the first storage unit may be input to the third comparison circuit as the reference data for the boundary. By making it possible to automatically set the boundary reference data, the processing can be started immediately even if the contents of the first storage unit are changed.

  The range may be set according to a distribution of appearance frequencies of the reference data in the communication data. Thereby, the search efficiency can be further improved, and a higher-speed search can be realized.

  The first storage unit may further store information indicating a position of comparison target data in the communication data, and the search unit may extract the comparison target data based on the information indicating the position. Thereby, comparison object data can be set more flexibly and search efficiency can be improved.

  The first storage unit or the second storage unit may be provided to be rewritable from the outside. Thereby, reference data, processing contents, etc. can be variably set, and the data processing apparatus can be used for various data processing.

  The retrieval unit may start comparing the reference data with the data when the data to be compared with the reference data is acquired without waiting for the acquisition of all data of the communication packet. Thereby, the time required for processing can be shortened. Not only the comparison process in the search unit but also other processes may be started without waiting for the acquisition of all data.

  Another aspect of the present invention relates to a data processing apparatus. The data processing device includes a plurality of any of the data processing devices described above, and each of the data processing devices includes two interfaces for inputting / outputting data to / from a communication line. The direction of processing the data is variably controlled by switching between input and output. As a result, when one of the data processing devices becomes inoperable, another data processing device can be operated as an alternative, and fault tolerance can be improved. Also, when any one of the data processing devices is stopped due to maintenance or the like, the other data processing device can be operated as an alternative, and maintenance can be performed without stopping the operation. Furthermore, by changing the direction of the flow of data processed by each data processing device in accordance with the traffic conditions, it is possible to appropriately cope with traffic increase / decrease.

  It should be noted that any combination of the above-described constituent elements and a conversion of the expression of the present invention between a method, an apparatus, a system, a recording medium, a computer program, etc. are also effective as an aspect of the present invention.

  According to the present invention, a technique for realizing a high-speed data processing device can be provided.

  FIG. 2 shows a configuration of a communication control apparatus which is an example of the data processing apparatus of the present invention. The communication control apparatus 10 according to the present embodiment replaces the packet processing unit 3 realized by software including a CPU and OS in the conventional communication control apparatus 1 shown in FIG. A packet processing circuit 20 configured by hardware. Rather than processing communication data with an OS and software that run on a CPU that is a general-purpose processing circuit, a dedicated hardware circuit for processing communication data is provided, thereby limiting the performance limit caused by the CPU, OS, etc. It is possible to overcome and realize a communication control device with high processing capability.

  For example, when searching for whether or not the data included in the packet includes reference data that is a criterion for filtering in order to perform packet filtering or the like, the communication data and the reference data are compared using the CPU. However, only 64 bits can be compared at a time, and even if it is attempted to improve the processing speed, there is a problem that the performance of the CPU reaches a peak. In the CPU, it is necessary to repeat the process of reading 64 bits from the communication data into the memory, comparing with the reference data, and then reading the next 64 bits into the memory. Time is rate limiting and processing speed is limited.

  On the other hand, in the present embodiment, a dedicated hardware circuit configured by a wired logic circuit is provided to compare communication data and reference data. This circuit includes a plurality of comparators provided in parallel to enable comparison of data lengths longer than 64 bits, for example, a data length of 1024 bits. In this way, by providing dedicated hardware, a large number of bit matching operations can be executed in parallel at the same time. The communication control apparatus 1 using a conventional CPU can process 1024 bits at a time, which can process only 64 bits at a time, and can dramatically improve the processing speed. If the number of comparators is increased, the processing capability is improved, but the cost and size also increase. Therefore, an optimum hardware circuit may be designed in consideration of desired processing performance, cost, size, and the like.

  Further, since the communication control apparatus 10 of the present embodiment is configured by dedicated hardware using a wired logic circuit, an OS (Operating System) is not required. This eliminates the need for OS installation, bug handling, version upgrade, and the like, and can reduce costs and man-hours for management and maintenance. Unlike CPUs that require general-purpose functions, unnecessary functions are not included, so unnecessary resources are not used, and cost reduction, circuit area reduction, and processing speed improvement can be expected. . Furthermore, unlike conventional communication control devices that use an OS, it does not have an extra function, so it is unlikely that security holes will occur, and is resistant to attacks from malicious third parties via the network. Is excellent.

  The conventional communication control apparatus 1 processes a packet by software premised on a CPU and an OS, receives all data of the packet, performs protocol processing, and passes the data to the application. On the other hand, in the communication control apparatus 10 according to the present embodiment, since processing is performed by a dedicated hardware circuit, it is not necessary to start processing after receiving all the data of the packet. If received, the process can be started at an arbitrary time without waiting for the reception of subsequent data. For example, position detection processing in a position detection circuit described later can be started when position specifying data for specifying the position of comparison target data is received. As described above, since various processes can be executed in a floating manner without waiting for reception of all data, the time required to process packet data can be shortened.

  FIG. 3 shows the internal configuration of the packet processing circuit. The packet processing circuit 20 includes a first database 50 that stores reference data serving as a reference for determining the content of processing to be performed on communication data, and whether the received communication data includes reference data. Whether or not the search circuit 30 for searching by comparing the communication data with the reference data, and the second database 60 for storing the search result by the search circuit 30 and the contents of the processing to be executed on the communication data in association with each other. And a processing execution circuit 40 that processes communication data based on the search result by the search circuit 30 and the conditions stored in the second database 60.

  When the search circuit 30 divides the reference data stored in the first database 50 into three or more ranges, the position detection circuit 32 detects the position of the comparison target data to be compared with the reference data from the communication data. An index circuit 34 that is an example of a determination circuit that determines to which of the ranges the comparison target data belongs; a binary search circuit 36 that searches for reference data that matches the comparison target data in the determined range; including. Although any search technique can be used as a method for searching the comparison target data from the reference data, the binary search method is used in the present embodiment.

  FIG. 4 shows the internal configuration of the position detection circuit. The position detection circuit 32 includes a plurality of comparison circuits 33a to 33f for comparing the position specifying data for specifying the position of the comparison target data with the communication data. Here, six comparison circuits 33a to 33f are provided, but the number of comparison circuits may be arbitrary as will be described later. Communication data is input to each of the comparison circuits 33a to 33f with a predetermined data length, for example, shifted by 1 byte. In the plurality of comparison circuits 33a to 33f, the position specifying data to be detected and the communication data are compared in parallel at the same time.

  In the present embodiment, as an example for explaining the operation of the communication control apparatus 10, a character string “No. ##” included in the communication data is detected, and a number “ “##” is compared with the reference data, and the case where the packet is allowed to pass if it matches the reference data and the packet is discarded if it does not match will be described.

  In the example of FIG. 4, in order to detect the position specifying data “No.” for specifying the position of the number “####” from the communication data, the communication data “01No. 361. Each character is shifted and input to the comparison circuits 33a to 33f. That is, the comparison circuit 33a has “01N”, the comparison circuit 33b has “1No”, the comparison circuit 33c has “No.”, the comparison circuit 33d has “o.”, And the comparison circuit 33e has “ . 3 ”and“ 36 ”are input to the comparison circuit 33f. Here, the comparison circuits 33a to 33f simultaneously perform comparison with the position specifying data “No.”. Thereby, the comparison circuit 33c matches, and it is detected that the character string “No.” exists in the third character from the head of the communication data. In this way, it is detected that numerical data that is comparison target data exists after the position specifying data “No.” detected by the position detection circuit 32.

  If similar processing is performed by the CPU, first, the character string “01N” is compared with “No.”, and then the character string “1No” is compared with “No.”. Since it is necessary to execute comparison processing one by one, improvement in detection speed cannot be expected. On the other hand, in the communication control apparatus 10 according to the present embodiment, by providing a plurality of comparison circuits 33a to 33f in parallel, simultaneous parallel comparison processing that cannot be performed by the CPU becomes possible, and the processing speed is remarkably increased. Can be improved. As the number of comparison circuits increases, the number of positions that can be compared simultaneously increases, so the detection speed also improves.However, considering the cost, size, etc., a sufficient number of comparison circuits are required to obtain the desired detection speed. What is necessary is just to provide.

  The position detection circuit 32 may be used not only for detecting position specifying data but also for detecting a character string for general use. Further, not only the character string but also the position specifying data may be detected in bit units.

  FIG. 5 shows an example of internal data of the first database. In the first database 50, reference data serving as a reference for determining processing contents such as packet filtering, routing, switching, and replacement is sorted and stored according to some sort condition. In the example of FIG. 5, 1000 pieces of reference data are stored.

  In the first record of the first database 50, an offset 51 indicating the position of the comparison target data in the communication data is stored. For example, in a TCP packet, since the data configuration in the packet is determined in units of bits, if a position such as flag information for determining the processing content of the packet is set as the offset 51, only necessary bits are set. Since the processing contents can be determined by comparing the two, the processing efficiency can be improved. Even if the data structure of the packet is changed, it can be dealt with by changing the offset 51. The first database 50 may store the data length of the comparison target data. As a result, the comparison can be performed by operating only the necessary comparators, so that the search efficiency can be improved.

  When the reference data stored in the first database 50 is divided into three or more ranges 52a to 52d, the index circuit 34 determines to which of the ranges the comparison target data belongs. In the example of FIG. 5, 1000 pieces of reference data are divided into four ranges 52a to 52d, 250 pieces each. The index circuit 34 includes a plurality of comparison circuits 35a to 35c that compare the reference data at the boundary of the range with the comparison target data. By comparing the comparison target data with the boundary reference data simultaneously in parallel by the comparison circuits 35a to 35c, it is possible to determine in which range the comparison target data belongs by one comparison process.

  The boundary reference data input to the comparison circuits 35 a to 35 c of the index circuit 34 may be set by a device provided outside the communication control device 10, or the reference data at a predetermined position in the first database 50 is previously stored. You may make it input automatically. In the latter case, even if the first database 50 is updated, the reference data at a predetermined position in the first database 50 is automatically input to the comparison circuits 35a to 35c. Processing can be executed.

  As described above, when a binary search is executed by the CPU, a plurality of comparisons cannot be executed at the same time. However, in the communication control device 10 of the present embodiment, a plurality of comparison circuits 35a to 35c are provided in parallel. Thus, simultaneous parallel processing can be performed, and the search speed can be remarkably improved.

  When the range is determined by the index circuit 34, the binary search circuit 36 executes a search by the binary search method. The binary search circuit 36 further divides the range determined by the index circuit 34 into two, and compares the reference data at the boundary position with the comparison target data to determine which range it belongs to. The binary search circuit 36 includes a plurality of, for example, 1024 comparison circuits in this embodiment for comparing the reference data and the comparison target data in bit units, and simultaneously executes 1024-bit bit matching. When it is determined which of the two divided ranges, the reference data at the boundary position is read by dividing the range into two and compared with the comparison target data. Thereafter, this process is repeated to further limit the range, and finally, reference data that matches the comparison target data is searched.

  The operation will be described in more detail using the example described above. In the communication data shown in FIG. 4, the comparison target data following the position specifying data “No.” is the number “361”. Since there is a space for one character between the position specifying data “No.” and the comparison target data “361”, the offset 51 is set to “8” bits in order to remove this space from the comparison target data. Is set. The binary search circuit 36 skips “8” bits, that is, one byte, from the communication data following the position specifying data “No.”, and reads “361” as the comparison target data.

  “361” is input as comparison target data to the comparison circuits 35a to 35c of the index circuit 34, and reference data “378” at the boundary between the ranges 52a and 52b is input to the comparison circuit 35a as reference data. The reference data “704” at the boundary between the ranges 52b and 52c is input to 35b, and the reference data “937” at the boundary between the ranges 52c and 52d is input to the comparison circuit 35c. The comparison circuits 35a to 35c perform comparison at the same time, and it is determined that the comparison target data “361” belongs to the range 52a. Thereafter, the binary search circuit 36 searches whether or not the comparison target data “361” exists in the reference data.

  FIG. 6 shows another example of internal data of the first database. In the example shown in FIG. 6, the number of reference data is less than the number of data that can be held in the first database 50, here 1000. At this time, the first database 50 stores the reference data in descending order from the last data position. Then, 0 is stored in the remaining data. As a database loading method, data is not placed from the beginning but placed from the back of the loading area, and if there is a vacancy at the beginning of the loading area, all the vacancies are zero-suppressed, so the database is always full. The maximum time for binary search can be made constant. Further, when “0” is read as the reference data during the search, the binary search circuit 36 can determine the range without performing the comparison and can proceed to the next comparison because the comparison result is self-explanatory. Thereby, the search speed can be improved.

  In the software processing by the CPU, when the reference data is stored in the first database 50, the reference data is stored in ascending order from the first data position. For example, the maximum value is stored in the remaining data. In this case, the comparison process as described above cannot be omitted in the binary search. The comparison technique described above is realized by configuring the search circuit 30 with a dedicated hardware circuit.

  FIG. 7 shows still another example of the internal data of the first database. In the example shown in FIG. 7, the reference data is not equally divided into three or more ranges, but the number of reference data belonging to the range is uneven, such as 500 for the range 52a and 100 for the range 52b. It has become. These ranges may be set according to the distribution of the appearance frequency of the reference data in the communication data. That is, the ranges may be set so that the sum of the appearance frequencies of the reference data belonging to the respective ranges is substantially the same. Thereby, search efficiency can be improved. The reference data input to the comparison circuits 35a to 35c of the index circuit 34 may be changeable from the outside. Thereby, a range can be set dynamically and search efficiency can be optimized.

  FIG. 8 shows a configuration of a comparison circuit included in the binary search circuit. As described above, the binary search circuit 36 includes 1024 comparison circuits 36a, 36b,. Each of the comparison circuits 36a, 36b,... Receives the reference data 54 and the comparison target data 56 one bit at a time, and compares them. The internal configurations of the comparison circuits 35a to 35c of the index circuit 34 are the same. In this way, by executing the comparison process with a dedicated hardware circuit, a large number of comparison circuits can be operated in parallel and a large number of bits can be compared simultaneously, so that the comparison process can be speeded up. .

  FIG. 9 shows an example of internal data of the second database. The second database 60 includes a search result column 62 for storing a search result by the search circuit 30 and a processing content column 64 for storing the content of processing to be executed on communication data, and corresponds the search result to the processing content. Hold it. In the example of FIG. 9, a condition is set such that if the reference data is included in the communication data, the packet is allowed to pass, and if it is not included, the packet is discarded. The process execution circuit 40 searches the second database 60 for process contents based on the search result, and executes the process on the communication data. The processing execution circuit 40 may also be realized by a wired logic circuit.

  FIG. 10 shows another example of internal data of the second database. In the example of FIG. 10, the processing content is set for each reference data. When packet replacement is performed, replacement destination data may be stored in the second database 60. When packet routing or switching is performed, information on the route may be stored in the second database 60. The process execution circuit 40 executes processes such as filtering, routing, switching, and replacement stored in the second database 60 according to the search result by the search circuit 30. As shown in FIG. 10, when setting the processing content for each reference data, the first database 50 and the second database 60 may be integrated.

  The first database and the second database are provided so as to be rewritable from the outside. By exchanging these databases, various data processing and communication control can be realized using the same communication control device 10. In addition, two or more databases storing reference data to be searched may be provided to perform multi-stage search processing. At this time, two or more databases that store search results and processing contents in association with each other may be provided to realize more complicated conditional branching. As described above, in the case where a plurality of databases are provided to perform a multi-stage search, a plurality of position detection circuits 32, index circuits 34, binary search circuits 36, etc. may be provided.

  The data used for the comparison described above may be compressed by the same compression logic. In comparison, if the comparison source data and the comparison destination data are compressed by the same method, the same comparison as usual is possible. As a result, the amount of data loaded at the time of comparison can be reduced. If the amount of data to be loaded is reduced, the time required to read data from the memory is reduced, so that the overall processing time can also be reduced. Further, since the amount of the comparator can be reduced, it is possible to contribute to downsizing, weight reduction, and cost reduction of the apparatus. The data used for the comparison may be stored in a compressed form, or may be compressed after being read from the memory and before the comparison.

  FIG. 11 shows another configuration example of the communication control apparatus according to the present embodiment. The communication control apparatus 10 shown in this figure has two communication control units 12 having the same configuration as the communication control apparatus 10 shown in FIG. Moreover, the switching control part 14 which controls operation | movement of each communication control unit 12 is provided. Each communication control unit 12 has two input / output interfaces 16 and is connected to two networks on the upstream side and the downstream side via the input / output interfaces 16. The communication control unit 12 inputs communication data from one of the networks and outputs the processed data to the other network. The switching control unit 14 switches the direction of communication data flow in the communication control unit 12 by switching input / output of the input / output interface 16 provided in each communication control unit 12. Thereby, not only one direction but two-way communication control becomes possible.

  The switching control unit 14 may perform control so that one of the communication control units 12 processes an inbound packet and the other processes an outbound packet, or may control both to process an inbound packet. May handle outbound packets. Thereby, for example, the direction of communication to be controlled can be made variable in accordance with the traffic status and purpose.

  The switching control unit 14 may acquire the operation status of each communication control unit 12 and switch the communication control direction according to the operation status. For example, when one communication control unit 12 is in a standby state and the other communication control unit 12 is operating, when it is detected that the communication control unit 12 has stopped due to a failure or the like, The communication control unit 12 may be operated. Thereby, the fault tolerance of the communication control apparatus 10 can be improved. Further, when maintenance such as database update is performed on one communication control unit 12, the other communication control unit 12 may be operated as an alternative. Thereby, maintenance can be performed appropriately without stopping the operation of the communication control apparatus 10.

  Three or more communication control units 12 may be provided in the communication control device 10. For example, the switching control unit 14 acquires the traffic status, and controls the communication direction of each communication control unit 12 so that more communication control units 12 are allocated to the communication control process in the direction with a large amount of communication. May be. Thereby, even if the communication amount in a certain direction increases, it is possible to minimize a decrease in communication speed.

  A part of the communication control unit 2 or 4 may be shared between the plurality of communication control units 12. A part of the packet processing circuit 20 may be shared.

  The present invention has been described based on the embodiments. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

It is a figure which shows the structure of the conventional communication control apparatus. It is a figure which shows the structure of the communication control apparatus which concerns on embodiment. It is a figure which shows the structure of a packet processing circuit. It is a figure which shows the structure of a position detection circuit. It is a figure which shows the internal data of a 1st database. It is a figure which shows another example of the internal data of a 1st database. It is a figure which shows another example of the internal data of a 1st database. It is a figure which shows the structure of the comparison circuit contained in a binary search circuit. It is a figure which shows the example of the internal data of a 2nd database. It is a figure which shows another example of the internal data of a 2nd database. It is a figure which shows another structural example of the communication control apparatus which concerns on embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 Communication control apparatus, 12 Communication control unit, 14 Switching control part, 20 Packet processing circuit, 30 Search circuit, 32 Position detection circuit, 33 Comparison circuit, 34 Index circuit, 35 Comparison circuit, 36 Binary search circuit, 40 Process execution circuit , 50 1st database, 60 2nd database.

Claims (4)

A first storage unit that stores reference data serving as a reference for determining the content of processing to be performed on the acquired data;
A search unit for searching whether or not the reference data is included in the data by comparing the data and the reference data;
A second storage unit that stores the search result by the search unit and the content of the process in association with each other;
A processing unit that executes processing associated with the search result for the data based on the search result,
The search unit includes a wired logic circuit,
When the search unit divides the plurality of reference data stored in the first storage unit into three or more ranges before executing the search, the comparison target data to be compared with the reference data is within the range. A data processing apparatus comprising a determination circuit for determining which one of them belongs.   The determination circuit includes a plurality of third comparison circuits for comparing the reference data of the boundary of the range and the comparison target data, and the comparison target data is set to any one of the three or more ranges by the plurality of third comparison circuits. The data processing apparatus according to claim 1, wherein the data processing devices are simultaneously determined in parallel.   3. The data processing apparatus according to claim 2, wherein the reference data stored in a predetermined position of the first storage unit is input to the third comparison circuit as the reference data of the boundary.   The data processing apparatus according to claim 1, wherein the range is set according to a distribution of appearance frequencies of the reference data in the data.

Images