高速包分类协处理器及网络平台研究

【作者】 郑裕峰；

【导师】 王永纲； 安琪；

【作者基本信息】 中国科学技术大学 ， 物理电子学， 2007， 博士

【摘要】 因特网的骨架由路由器(交换机)以及路由器之间的高速物理链路组成。因特网连接成千上万个大小不同的本地网络，每个本地网络通过防火墙或者边缘路由器和因特网互联。因此，路由器和防火墙的性能决定了因特网的容量和灵活性，也是因特网的瓶颈所在。因特网是包交换网络，其传输信息的基本单位是网络包(IP包)，节点之间使用IP协议通信。网络包沿着各自传递路径，从一个节点传输到另一个节点，最终到达目的地。路由器和防火墙均是因特网的网络包传输处理中间节点，网络包从它们的一个端口进入，经过处理后从另一个端口输出或被过滤。因此，网络包的处理速度和灵活性是路由器和防火墙设计要考虑的最重要问题。包分类是路由器和防火墙中的一类网络包处理技术。随着因特网的蓬勃发展，网络负载迅速增长，超过了路由器容量的增长速度，导致网络拥塞和报文丢失现象。传统路由器对每个网络包都“平等、尽力服务”的形式已经不再使所有网络用户满意，有的用户愿意花费更多的钱来获得更好的网络服务。在这种背景下，网络服务提供商为了最大化利润，对路由器技术提出了差别服务，流量计费等要求，这些要求直接促成了包分类技术的发展和应用。随着多媒体业务，P2P应用的日益普及，以及恶意攻击和扫描，病毒和蠕虫等在因特网上的泛滥，要求防火墙设备能够以很高的速度，在一秒钟之内处理大量的网络连接，并跟踪这些连接状态。所有这些背景利用都要求路由器和防火墙设备要能对流入接口的网络包进行分类，根据网络包的源地址、目的地址、源端口号、目的端口号等域的内容，与既定的规则集匹配，识别不同的网络包，并对其特殊处理。目前，随着网络安全需求的不断提高，对防火墙的性能要求也在不断提高。防火墙经过过去基于软件的三个时代的发展，正向第四代硬件防火墙过渡。我国防火墙的市场很大，国产防火墙基本都是低端产品，高端市场基本上被Cisco、Juniper、CheckPoint等公司产品垄断，而高端防火墙主要用于金融、国家安全等重要网络资源的保护，长期使用国外防火墙产品已经引起国家有关部门的关注，因此开发我们拥有自主知识产权的高端防火墙无论在经济上还是政治上都有重要意义。第四代防火墙设备基于深度包检测技术，深度包检测技术要求防火墙对网络包的识别能力达到应用层内容，即深度包分类。它不仅可以按照网络第3层(网络层)协议和第4层(传输层)协议对网络包分类，还可以根据应用层的内容对网络包分类。对网络包分类的程度越深，防火墙对包的了解就越清晰，因而对包的控制就越精细。但随着分类深度的加深，每个网络包的处理速度就会急剧下降，这样防火墙设备就可能导致网络的传输瓶颈。因而，设法提高包分类速度，是能否实现高性能防火墙的关键。目前，国际上常用的包分类技术可以分为两大类，一类是基于高效率的包分类算法，改善算法提高分类速度，由于这些算法在通用CPU上运行，到目前为止，单纯的分类速度仍不能满足防火墙的需要；另一类是基于CAM或网络处理器的硬件实现，但由于CAM本身存在着功耗大、集成度较低，以及不能实现范围搜索等缺点，其应用也有一定的限制。多方面研究表明，目前还没有一种简单通用的方法能够提供满足高线速处理要求的深度包分类，包分类技术应该是各种算法和结构的有机结合。根据应用目的的不同，通过合理组合算法、CAM、通用CPU、网络处理器等来提高性能。本文充分调研了目前包分类技术的发展状况和应用前景，对比了多种包分类技术的实现原理，并结合我们目前的实际情况(综合考虑成本、功耗和包分类性能)，面向自主研发高性能的硬件防火墙设备，设计实现了一个基于FPGA的高速包分类协处理器，这是本文的第一部分和第二部分内容。协处理器将硬件逻辑实现的包分类引擎和管理调度接口集成到一个FPGA上，兼具较高的包分类性能和灵活性。本文的第三部分内容是基于上述包分类FPGA协处理器，将协处理器和嵌入式处理器相结合，构成高性能防火墙的研究开发平台，在此基础上展开基于我们自主核心技术的高性能防火墙的研发。本文设计和实现了一个嵌入式网络处理平台，一方面，网络处理平台作为包分类技术研究平台，可以对包分类协处理器进行调试和性能测试；另一方面，网络处理平台自身形成一个完整的网络包处理系统，可实现网络业务的实际开发。本文的第四部分内容是针对上述包分类FPGA协处理器和网络处理平台进行测试，测试结果和总结将在本文第五章和第六章描述。下面概要说明本文各章的具体内容。第一章是序言，介绍包分类技术产生的背景、意义，以及要达到的目标，并描述本文的工作内容、研究方法和研究意义。第二章是网络包分类技术，指出包分类技术所面临的挑战，总结目前国内外在包分类技术方面已有的工作，对一些有代表性的算法和技术作详细的分析比较。第三章是基于FPGA的包分类协处理器，描述本文设计的包分类FPGA协处理器的体系结构，它由包分类引擎和控制逻辑组成，介绍包分类引擎的硬件设计，以及协处理器的控制和管理。第四章是嵌入式包分类网络处理平台，介绍包分类网络处理平台的总体结构、硬件设计和软件设计。包分类网络处理平台主要由一个主控嵌入式处理器和包分类FPGA协处理器组成，嵌入式处理器上运行GNU／Linux操作系统，负责对整个网络处理平台的管理和调度，并提供完备的用户接口。这种设计方式使得：一方面，网络处理平台可以对包分类协处理器进行调试和性能测试；另一方面，网络处理平台自身形成一个完整的网络包处理系统，可实现网络业务的实际开发。第五章是包分类协处理器和网络处理平台测试，分别对包分类FPGA协处理器和网络处理平台的性能进行测试。通过测试结果，分析它们的特点和适用场合，以及将来的改进方案。第六章是总结，总结本文的工作和创新点，并探讨包分类协处理器和网络处理平台的改进措施和未来发展方向。更多还原

【Abstract】 The backbone of the Internet is comprised of a mesh of routers (switches) interconnected by high-speed physical links. The Internet connects millions of local networks with different sizes to each others. Each local network accesses the Internet through firewalls or routers located at the edge of the Internet. Therefore, the performance of routers and firewalls determines the capacity and flexibility of the Internet, and also becomes the bottleneck of the Internet.The Internet is a packet-switching network, in which packets (units of information carriage) are routed between various nodes (middle-nodes and end-hosts). Communication among nodes on the Internet takes place using the Internet Protocol, commonly known as IP. IP packets travel over links from one middle-node to the next on their way towards their final destination. Routers and firewalls are both the middle-nodes for forwarding and/or processing packets. The packets flow into them from some interfaces and are processed there, then they’ll determine to forward or deny those packets. Therefore, the processing speed and flexibility are the most important points to design routers and firewalls.Packet classification is one technique for processing packets in routers and firewalls. With the explosive growth of the Internet, the traffic over the Internet increases very rapid. It has been difficult for the packet processing capacity of routers to keep up with the increased traffic rates, which has caused increasing congestion and packet loss in intermediate nodes. Traditionally, the routers provide "fair and best-effort" services, treat all packets identically and serve them in a first-come-first-served manner, which will not satisfy the users any longer. As a result, some users are willing to pay more money in return for better service from the network. To maximize their revenue, the ISPs (Internet Service Provider) also wish to provide different levels of service at different prices to users with different requirements and perform traffic accounting & billing. These backgrounds drive the developments and applications of packet classification technique directly. However, with the popularity of multimedia and P2P applications and the overrun of malicious attacks/scanning and virus/worms over the Internet, firewalls are demanded to process and trace many connections per second with very high speed. All these backgrounds and applications require the routers and firewalls to classify the packets flowed into them. According to the source address, destination address, source port, destination port and so on, packets are matched with the pre-defined rule set and classified. After packet classification, routers and firewalls perform special processing over them.The implementations of packet classification in routers and firewalls can be classified into several types: the algorithm implementations for packet classification on general processors, the pure hardware implementation with CAM (Content Addressable Memory, a memory chip with special structure), the ASIC packet classification engine, the Network Processor packet classification engine, and the FPGA packet classification engine. These above implementations differ mainly in development difficulties, costs, packet classification performance, and expansibility. The detailed analysis and compare will be introduced in Chapter 1 and Chapter 2 in the thesis.The thesis presents and overviews the development status and application foreground of packet classification, compares previous works on packet classification, which is the first part of the thesis. Based on our practical situation (cost, power and performance of packet classification), a high-speed packet classification co-processor based on FPGA is designed and implemented in the second part of the thesis. The FPGA co-processor integrates a packet classification engine and management/scheduling interface implemented in hardware logic, provides very-well packet classification performance and flexibility at the same time. The third part of the thesis designs and implements an embedded network processing platform, based on the above packet classification FPGA co-processor. First, the platform works as a research platform for packet classification technique, can be used to debug and test the co-processor. Second, the platform has been established as an integrated packet-processing system itself, can be used to develop practical network applications. The fourth part of the thesis provides the test and conclusion of the packet classification FPGA co-processor and network processing platform.The following outlines the contents of each chapter in the thesis.Chapter 1 is the preface, introduces the backgrounds, usage and goals of packet classification, describes the research contents, methods and benefits in the thesis.Chapter 2 is the packet classification techniques, proposes the challenges that the packet classification faces, overviews the previous works on packet classification and compare them.Chapter 3 is packet classification co-processor based on FPGA, describes the architecture of the presented packet classification FPGA co-processor in details. The co-processor is comprised of packet classification engine and control logic. The hardware design of the co-processor and its control and management are discussed there.Chapter 4 is the embedded packet classification platform, introduces the structure, hardware and software design of the platform. The packet classification platform is mainly comprised of an embedded processor and packet classification FPGA co-processor. The embedded processor runs GNU/Linux operating system, manages and schedules the entire platform, provides a friendly user interface. This design benefits: (1) the platform can be used to debug and test the co-processor, (2) the platform can be regarded as an integrated packet-processing system itself to develop practical network applications.Chapter 5 is the test and measurement of the packet classification co-processor and network processing platform, tests the performance of FPGA co-processor and platform respectively. By the test results, their features, usage conditions and improvements are proposed.Chapter 6 is the conclusion, summarizes the works and innovation presented in the thesis. The improvements and future directions for packet classification FPGA co-processor and network processing platform are discussed there.更多还原