JP4400103B2 - Routing processing device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a routing processing device, and more particularly to a routing processing device that processes routing of an IP (Internet Protocol) packet and a response to a specific packet by software.
[0002]
[Prior art]
In recent years, with the increase in IP traffic, packets with unknown destinations are intentionally sent, or a large amount of specific packets are sent to attack the network or routing processing device, causing harm to the network or routing processing device. Has increased.
[0003]
As the above-described routing processing device, a device that performs processing such as IP packet destination resolution using CAM (Content Addressable Memory) has been proposed (for example, see Patent Document 1).
[0004]
In the above routing processing device, a packet received from a transmission path is divided into cells of a predetermined length, a CAM is searched using a predetermined search key extracted from the cell, and based on a memory address output from the CAM. The memory address of the search information storage memory is calculated, and cell header update and destination resolution are performed based on the search information output from the search information storage memory.
[0005]
[Patent Document 1]
JP 2003-23437 A (pages 3 to 7, FIG. 1)
[0006]
[Problems to be solved by the invention]
However, in the above-described conventional routing processing device, a routing process for a packet whose destination is unknown and a response to a specific packet are processed by software.
[0007]
Accordingly, an object of the present invention is to provide a routing processing apparatus that can solve the above-described problems, prevent a reduction in processing capability, and can cope with an attack much faster than software processing. It is to provide.
[0008]
[Means for Solving the Problems]
A routing processing device according to the present invention is a routing processing device that performs routing processing of a packet with unknown destination and response processing to a specific packet by software,
A hardware unit that autonomously performs the discard determination of the unknown packet ,
The hardware unit includes destination search memory in which route information is registered in advance and the route information is output according to a destination search result based on the address information of the packet, and address information for unregistered destination search is registered in advance. Unregistered destination search memory for outputting discard information according to the unregistered destination search result based on the address information of the packet, and unregistered in both the destination search memory and the unregistered destination search memory Search result storage means for temporarily storing unregistered address information,
The search result storage means writes the address information of the packet in the unregistered destination search memory only for a packet in which a flow rate of a certain level or more is detected within a preset unit time .
[0009]
That is, the routing processing device of the present invention is a device that processes the routing of IP (Internet Protocol) packets whose addresses are not registered and the response of specific packets by software, and processes input IP packets in hardware autonomy. By performing the determination, the software load is reduced when a large number of IP packets are input.
[0010]
In the routing processing device of the present invention, by performing processing determination of input IP packets in hardware autonomous, routing processing in software is performed even when an unknown destination packet having a flow rate of a certain level or more is input within a unit time. Since it is not necessary to do so, it is possible to prevent a reduction in processing capacity.
[0011]
In the routing processing apparatus of the present invention, since the hardware autonomously determines whether to discard a packet whose destination is unknown, it is possible to cope with an attack much faster than the processing by software.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a routing processing apparatus according to an embodiment of the present invention. In FIG. 1, a routing processing apparatus according to an embodiment of the present invention comprises a line unit 1 and a switch unit 2.
[0013]
The line unit 1 includes a line interface unit 11, a destination search CAM (Content Addressable Memory) 12, an unregistered destination search CAM 13, a destination search unit 14, a switching interface unit 15, and a search result storage unit 16. ing.
[0014]
The line interface unit 11 is a means for receiving an IP (Internet Protocol) packet. In the destination search CAM 12, IP packet route information (hereinafter referred to as an IP address) is registered. The unregistered destination search CAM 13 registers an IP address when an IP packet having an IP address not registered in the destination search CAM 12 is received.
[0015]
The destination search unit 14 extracts an IP address for performing destination search from the received IP packet, and processes the IP packet according to transfer information from the destination search CAM 12 and discard information from the unregistered destination search CAM 13. The switching interface unit 15 performs an interface with the switch unit 2.
[0016]
The search result storage unit 16 temporarily stores an unregistered IP address in both the destination search CAM 12 and the unregistered destination search CAM 13. The search result storage unit 16 includes a registration control circuit 17 that performs various processes for unregistered addresses, and address management units 18-1 to 18-m that manage unregistered addresses.
[0017]
Each of the address management units 18-1 to 18-m includes an address storage unit 181-1 to 181-m for temporarily storing an unregistered address (address storage units 181-2 to 181-m are not shown), and an unregistered address. Counter 182-1 to 182-m (counter 182-2 to 182-m is not shown) and timer 183-1 that measures the time since the unregistered address is stored 183 -m (timers 183-2 to 183 -m are not shown).
[0018]
With reference to FIG. 1, the flow search process of the routing processing apparatus according to the embodiment of the present invention will be described.
[0019]
When the line interface unit 11 receives an IP packet from a network (not shown), the line interface unit 11 checks whether the packet is a correct IP packet, and transmits the IP packet to the destination search unit 14 if it is a correct IP packet.
[0020]
The destination search unit 14 extracts an IP address from the IP packet received from the line interface unit 11 in order to perform destination search for transferring the IP packet next, and outputs the IP address to the destination search CAM 12. The route information is registered in the destination search CAM 12 in advance, and the destination search is performed with the IP address from the destination search unit 14 as an input.
[0021]
The destination search CAM 12 returns transfer information to the destination search unit 14 when the IP address is registered, and non-destination information when the IP address is not registered. The destination search unit 14 transfers the IP packet to the switching interface unit 15 when the transfer information is returned from the destination search CAM 12, and similarly to the unregistered destination search CAM 13 when the destinationless information is returned. The extracted IP address is output.
[0022]
An IP address is registered in the unregistered destination search CAM 13 in accordance with an instruction from the search result storage unit 16, and an unregistered destination search is performed using the IP address received from the destination search unit 14 as an input. The unregistered destination search CAM 13 returns discard information to the destination search unit 14 when there is a match with the registered IP address, and no destination information when there is no match.
[0023]
The destination search unit 14 discards the IP packet when the discard information is returned from the unregistered destination search CAM 13, and transmits the IP address to the search result storage unit 16 when the destinationless information is returned.
[0024]
The IP address transmitted from the destination search unit 14 is received by the registration control circuit 17 in the search result storage unit 16. The registration control circuit 17 has functions of managing the address management units 18-1 to 18-m and controlling the writing of the IP address to the unregistered destination search CAM 13.
[0025]
The address management units 18-1 to 18-m are activated by the address storage units 181-1 to 181-m that store IP addresses according to instructions from the registration control circuit 17, and the timer value is “ The timers 183-1 to 183-m for loading “0” into the counters 182-1 to 182-m when the value reaches “0” and the IP addresses received from the registration control circuit 17 are already stored in the address storage units 181-1 to 181-1. When the IP address is the same as the IP address stored in 181-m, the counter 182-1 to 182-m performs +1 and notifies the registration control unit 17 when a predetermined threshold value is exceeded. Has been.
[0026]
When the search result storage unit 16 receives an IP address from the destination search unit 14, the address management unit 18 in which the IP address is already stored among the m address management units 18-1 to 18-m having the registration control circuit 17. The IP address is output to −1 to 18- (i−1) (an integer satisfying i <m).
[0027]
The address management units 18-1 to 18- (i-1) that received the IP address check whether or not they match the addresses stored in the address storage units 181-1 to 181- (i-1). To do. If the address management units 18-1 to 18- (i-1) do not match the stored IP address, the address management units 18-1 to 18- (i-1) notify the registration control circuit 17 of the search mismatch information. When the search mismatch information is notified from all the address management units 18-1 to 18- (i-1), the registration control circuit 17 sends an IP address to the address management unit 18-i that has not yet registered an IP address. A storage request is made.
[0028]
The address management unit 18-i stores the IP address in the address storage unit 181-i and starts the timer 183-i. If the address management unit 18-i matches the stored IP address, the counter 182-i is incremented by 1, and the search control information is notified to the registration control circuit 17. At this time, when the count value in the counter 182-i exceeds a preset threshold value, the address management unit 18-i notifies the registration control circuit 17 of the count value excess information in addition to the detection match information.
[0029]
When the search control information is notified from any of the address management units 18-1 to 18-i, the registration control circuit 17 discards the IP address received from the destination search unit 14 and the count value excess information is notified The IP address is written in the unregistered destination search CAM 13.
[0030]
For example, if the IP address a is registered in the unregistered destination search CAM 13 due to exceeding the count value in the search result storage unit 16 and then input to the line unit 1 again, the destination search unit via the line interface unit 11 When the destination search is performed at 14, the search with the unregistered destination search CAM 13 matches the registered address, so the unregistered destination search CAM 13 sends the discard information to the destination search unit 14. Will be returned. The destination search unit 14 discards the IP packet according to the discard information from the unregistered destination search CAM 13.
[0031]
As described above, in this embodiment, the destination search unit 14 autonomously determines discard of a packet with an unknown destination by using the destination search CAM 12, the unregistered destination search CAM 13, and the search result storage unit 16. As a result, even when an unknown packet having a flow rate of a certain level or more is input within a unit time, it is not necessary to perform routing processing by software, so that a reduction in processing capability can be prevented.
[0032]
In this embodiment, the hardware autonomously determines whether to discard a packet whose destination is unknown, so that it is possible to cope with an attack much faster than the processing by software.
[0033]
Next, a routing processing apparatus according to another embodiment of the present invention will be described. Since the configuration of the routing processing apparatus according to another embodiment of the present invention is the same as the configuration of the routing processing apparatus according to the embodiment of the present invention shown in FIG. 1, the other embodiments of the present invention will be described with reference to FIG. An operation of the routing processing apparatus according to the example will be described.
[0034]
In the routing processing apparatus according to another embodiment of the present invention, all the IP addresses received by the line unit 1 are managed by the search result storage unit 16, and only IP packets for which a flow rate of a certain level or more is detected within a unit time are not yet obtained. It is registered in the registered destination search CAM 13.
[0035]
As a result, in the routing processing device according to another embodiment of the present invention, it is possible to prevent malfunction of the routing processing device or server belonging to the network against an attack such as intentionally flowing a large amount of packets.
[0036]
FIG. 2 is a block diagram showing the configuration of a routing processing apparatus according to another embodiment of the present invention. 2, the routing processing apparatus according to another embodiment of the present invention has the same configuration as the routing processing apparatus according to the embodiment of the present invention shown in FIG. 1 except that the unregistered destination search CAM 13 is excluded. The same components are denoted by the same reference numerals.
[0037]
In the routing processing apparatus according to another embodiment of the present invention, since the unregistered destination search CAM 13 is excluded, the unregistered destination address is registered in the destination search CAM 12, and the transfer information / discard is included in the search result for the destination search unit 14. An information identifier has been added.
[0038]
Accordingly, in the routing processing device according to another embodiment of the present invention, the destination search CAM 12 and the unregistered destination are used in order to determine whether the IP packet received by the destination search unit 14 should be transferred or discarded. Since it is possible to determine what has to be executed twice for the search CAM 13 by simply searching the destination search CAM 12, the time required for the search process can be halved.
[0039]
In the routing processing apparatus according to another embodiment of the present invention, since the unregistered destination address is registered in the destination search CAM 12, the unregistered destination search CAM 13 is not necessary, and the number of parts can be reduced.
[0040]
【The invention's effect】
As described above, the present invention is configured and operated as described above, so that it is possible to prevent a decrease in processing capability, and to cope with an attack much faster than processing by software. The effect of being able to be obtained.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a routing processing apparatus according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration of a routing processing apparatus according to another embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Line part 2 Switch part 11 Line interface part 12 Address search CAM
13 CAM for unregistered destination search
14 Destination search unit 15 Switching interface unit 16 Search result storage unit 17 Registration control circuit 18-1 to 18-m Address management unit 181-1 Address storage unit 182-1 Counter 183-1 Timer

Claims (5)

A routing processing device that performs a routing process for an unknown packet and a response process for a specific packet by software,
A hardware unit that autonomously performs discard determination of the packet with unknown destination,
The hardware unit includes destination search memory in which route information is registered in advance and the route information is output according to a destination search result based on the address information of the packet, and address information for unregistered destination search is registered in advance. Unregistered destination search memory for outputting discard information according to the unregistered destination search result based on the address information of the packet, and unregistered in both the destination search memory and the unregistered destination search memory Search result storage means for temporarily storing unregistered address information,
The search result storage means writes the address information of the packet to the unregistered destination search memory only for a packet in which a flow rate of a certain level or more is detected within a preset unit time. apparatus.   The routing processing apparatus according to claim 1, wherein the destination search memory and the unregistered destination search memory are CAM (Content Addressable Memory).   2. The unregistered destination search memory outputs discard information of the packet when the address information of the packet matches preregistered address information for unregistered destination search. 3. The routing processing device according to 2.   4. The routing processing apparatus according to claim 1, wherein the destination search memory and the unregistered destination search memory output no-destination information when there is no match.   A destination search means for performing packet processing in accordance with extraction of address information for performing destination search from the received packet, transfer information from the destination search memory, and discard information from the unregistered destination search memory; The routing processing device according to any one of claims 1 to 4.

Images