CN1863142A - Method for providing different service quality tactics to data stream - Google Patents

Abstract

The present invention provides a method for providing different quality of service policies for data streams. The method mainly includes: customizing an ACL (Access Control List) template containing partial field information of each layer; using the ACL template to classify data streams , to provide different QoS (Quality of Service) policies for data streams. By using the method of the invention, it is possible to flexibly select the type of ACL according to user needs, realize finer-grained data flow classification processing, and provide corresponding different QoS policies for the data flow.

Description

Methods of providing different quality of service policies to data streams

technical field

The invention relates to the communication field, in particular to a method for providing different QoS (quality of service) strategies for data streams.

Background technique

In the network, it is necessary to classify the data flow, that is, to identify and classify the data flow. Then, according to the result of flow classification, different QoS (Quality of Service) policies are adopted for different data flows. QoS policies are also called "actions", including operations such as discarding, changing priority, and bandwidth limitation.

The traditional flow classification method is to classify the data flow according to the standard quintuple of the data flow message, which is the five fields of the data flow IP message: source IP address, destination IP address, Protocol number, TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) source port number, TCP or UDP destination port number. This method first needs to extract the five-tuple of the message and form a key (keyword), and then classify the data streams whose key values meet certain conditions into one category.

With the increase of network traffic and the continuous improvement of users' requirements for QoS, the traditional classification method based on five-tuples can no longer meet the requirements, and it is necessary to divide the data flow into a finer granularity. Therefore, the data flow classification Other domains are added, such as source/destination MAC (Media Access Control) address, Ethernet type, VLAN (Virtual Local Area Network) priority, TOS (Type of Service), segmentation flag, TCP synchronization flag, etc.

At present, in data communication equipment, data flow classification and actions are usually implemented through ACL (Access Control List). ACL is a combination of rules and actions. Rules are the characteristics used to distinguish a certain data flow, such as {source MAC ＝2222.2222.2222 AND destination IP＝1.1.1.1} can constitute a rule. Figure 1 shows the ACL processing flow.

In data communication equipment, the practical application of flow classification technology mainly includes the following types:

1. Unstructured sequential matching: Similar to a linked list, keys and rules are matched one by one.

2. HASH (hash) hashing: first perform a first-level Hash hashing on the key value, and then match the rules.

3. Precompiled fast ACL: Use various tree computing techniques to quickly locate certain or certain rule nodes.

4. TCAM (Tri-State Content Addressable Memory) technology: the matching process of keys and rules is completed by hardware.

The first three implementations are all completed by software, and the biggest problem is that the matching time is too large. The current network transmission and router forwarding speed are constantly improving, which requires that the search speed of the ACL rule table should be correspondingly increased in the process of message processing. Therefore, TCAM technology is the main flow classification technology used in current data communication equipment. .

TCAM is usually used in the implementation of ACL. The feature of TCAM is to complete the search and matching process of the rule table through hardware. The specific processing process is as follows: firstly, various rules configured by the user are stored in the TCAM, and each rule is associated with a certain action. Then, extract the five-tuple or multi-group of the data flow message that needs to be classified to form a key, search the rule table stored in the TCAM according to the key, match with the items in the rule table, and successfully match (hit) one After the rule, TCAM will return the corresponding action index.

The biggest advantage of TCAM is that the search speed is fast, and the search time is independent of the number of entries. Therefore, this advantage is particularly prominent when the table capacity is large. However, TCAM is expensive, and in practical applications, the capacity of TCAM is limited. Currently, the TCAM hardware specification defines several entry lengths: 72bits, 144bits, and 288bits. A rule in the ACL can be regarded as a TCAM entry. The length of the rule is equal to the length of the key value. Therefore, the following relationship exists:

TCAM capacity = key length (rule length) × number of TCAM entries.

In order to solve the problem that standard quintuples cannot meet the needs of the existing network, a solution in the prior art is: add a layer-2 header field (such as source/purpose MAC address, Ethernet type and VLAN ID, etc.), three-layer header field and four-layer header field (such as TCP synchronization flag, etc.). Due to the limitation of the length of TCAM entries, all fields (layer 2, layer 3, and layer 4) cannot be placed in a key at the same time, so the so-called layer 2 ACL and layer 3 ACL (IPv4/IPv6 ACL) appear. A layer-3 ACL contains the content of the above-mentioned layer-3 and layer-4 header fields. The key structure of a layer-2 ACL is shown in Figure 2, the key structure of an IPv4 layer-3 ACL is shown in Figure 3, and the key structure of an IPv6 layer-3 ACL As shown in Figure 4.

The key length of Layer 2 ACL and IPv4 ACL is 144 bits, and the key length of IPv6 ACL is 288 bits. The rule tables of the three ACLs occupy different TCAM areas respectively.

According to the above Layer 2 ACL and Layer 3 ACL, the user has two options for configuring the ACL:

1. Select an ACL type from the above Layer 2 ACL and Layer 3 ACL: Layer 2 ACL or Layer 3 ACL. Then, the implementation module will perform corresponding processing according to the selected ACL type and the type of data flow packet to be processed. The specific processing flow is shown in Figure 5. The specific processing process is briefly introduced as follows:

If the user chooses to use Layer 2 ACL, extract the content of the Layer 2 header field from the data flow packet to be classified, and then match it with the rule table of Layer 2 ACL. If a rule is matched, return the corresponding Action, execute this action to process the data flow message accordingly;

If the user chooses to use a layer-3 ACL, extract the contents of the layer-3 and layer-4 header fields from the data flow packet to be classified, and then match it with the rule table of the layer-3 ACL. If the match hits a rule, return the The action corresponding to the rule, execute this action to process the data flow packet accordingly.

2. If the user needs to match the Layer 2 and Layer 3 fields of the message at the same time, it can be realized through two ACLs. First, configure the first ACL (Layer 2 ACL), and specify its action as "execute Layer 3 ACL". The action of Layer 3 ACL is specified as the real QoS policy. The processing flow is shown in Figure 6, and the specific processing process is briefly introduced as follows:

First extract the content of the Layer 2 header field from the data flow message to be classified, and then match it with the rule table of the Layer 2 ACL. If the match hits a rule, continue to extract the Layer 3 and Layer 4 headers from the message The content of the field is then matched with the rule table of the three-layer ACL. If a rule is matched, the action corresponding to the rule is returned, and the action is executed to process the data flow packet accordingly.

The shortcoming of the above-mentioned prior art solution is: in the first mode of this scheme, the user can only select one type of ACL in the two-layer ACL and the three-layer ACL, that is, the second and third layers of the message cannot be matched at the same time. layer field. Therefore, fine-grained traffic division cannot be realized, which limits the user's use effect.

In the second method of this scheme, although the simultaneous matching of the second and third layer fields can be realized, it is necessary to visit the TCAM twice to perform the operation of the second matching rule table, and even need to visit the SRAM (static memory) once more to The search action, therefore, puts forward very high requirements on the bandwidth of the peripheral, and in the routing device, the bandwidth resources of the peripheral are usually very limited, so the execution of the two ACLs is likely to become the performance bottleneck of the forwarding device.

In addition, in practical applications, when users configure ACL rules, they seldom use all the fields in the rule table. For example, for Ethernet IPv4 data flows, users may only want to identify that the source MAC and destination IP meet a certain condition. , without caring about other fields. Therefore, in practical applications, many fields in the structure of the rule entry in this scheme are not used, resulting in waste of TCAM resources.

Contents of the invention

In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a method for providing different quality of service policies for data streams, so that ACL types can be flexibly selected according to user needs, and finer-grained data stream classification processing can be realized , and provide corresponding different QoS policies for the data flow.

The purpose of the present invention is achieved through the following technical solutions:

A method of providing different quality of service policies to data streams, including:

A. Customize the access control list ACL template containing partial field information of each layer;

B. Using the ACL template to classify the data flow, and provide different QoS policies for the data flow.

Described step A specifically comprises:

According to user requirements, customize the ACL template including some Layer 2 header fields and some Layer 3 header fields of the packet,

and / or,

According to user requirements, customize the ACL template including part of the Layer 2 header field and part of the Layer 4 header field of the packet,

and / or,

According to user requirements, customize the ACL template including part of the Layer 3 header field and part of the Layer 4 header field of the packet.

The length of the ACL template does not exceed the entry length defined in the TCAM specification.

Described step A also includes:

The customized ACL template is saved in a template library, and the user can add, delete, and modify operations in the template library.

Described step B specifically comprises:

B1. Select an ACL template according to the data flow to be processed, and configure the rules of the ACL template;

B2. Match the rule with the data flow to be processed, and provide a corresponding QoS policy for the data flow according to the matching result.

Described step B1 specifically comprises:

Configure the rules of the ACL template by specifying the matching conditions of each field in the ACL template.

Described step B2 specifically comprises:

B21. According to the definition of the ACL template, extract the corresponding field content from the data flow message to be processed, and form the keyword key with the extracted field content;

B22. Perform matching processing on the key and the configured ACL template rules, and provide corresponding QoS policies for the data flow according to the matching result.

Described step B22 specifically comprises:

If the key and the rule of the configured ACL template match and hit, then execute the action corresponding to the rule to provide the corresponding QoS policy for the data flow; otherwise, forward the data flow according to the normal forwarding process.

As can be seen from the technical solution provided by the present invention above, the present invention has the following advantages compared with the prior art by customizing some ACL rule templates for users:

1. The present invention does not need to increase TCAM hardware investment. By providing the user with an ACL rule template, the user can flexibly select the ACL type according to the need when configuring the flow classification rule, and realize more fine-grained flow classification processing.

2. When the user needs to match the second and third layer fields of the message at the same time, the present invention only needs to execute the ACL once to meet the user's requirement, thereby saving peripheral bandwidth resources.

3. The present invention can reduce useless fields in the TCAM and improve the utilization rate of TCAM resources.

Description of drawings

Fig. 1 is the specific processing flowchart of ACL;

Figure 2 is a schematic diagram of the key structure of the Layer 2 ACL;

Figure 3 is a schematic diagram of the key structure of the Ipv4 three-layer ACL;

Figure 4 is a schematic diagram of the key structure of the Ipv6 three-layer ACL;

FIG. 5 is a specific processing flowchart of a processing method for enabling a layer-2 ACL or a layer-3 ACL in the prior art;

FIG. 6 is a specific processing flowchart of a processing method for simultaneously enabling Layer 2 ACL and Layer 3 ACL in the prior art;

Fig. 7 is the specific processing flowchart of the method of the present invention;

Fig. 8 is a schematic diagram of an embodiment of the Ipv4 ACL rule template of the present invention;

Fig. 9 is a schematic diagram of an embodiment of the IPv6 ACL rule template of the present invention;

FIG. 10 is a specific processing flow chart of the processing method based on the layer-2 ACL, layer-3 ACL and ACL template of the present invention.

Detailed ways

The invention provides a method for providing different quality of service policies for data streams. The core of the present invention is: on the premise of not increasing the length of the TCAM key, by providing some commonly used ACL rule templates for the user, the user can realize fine-grained flow classification when configuring the ACL without affecting the forwarding performance.

Describe the present invention in detail below in conjunction with accompanying drawing, the specific processing flow of the method of the present invention is as shown in Figure 7, comprises the following steps:

Step 7-1. Customize some ACL templates according to user requirements.

In the present invention, firstly, some ACL templates need to be customized according to user's requirements, and the ACL templates may include part of Layer 2 ACL information, part of Layer 3 ACL information and part of Layer 4 ACL information, and may also include some other information. The length of the template cannot exceed the entry length defined in the existing TCAM specification. Therefore, the customized ACL template cannot include all Layer 2 ACL and Layer 3 ACL information, but the customization of the template is based on the configurations commonly used by users in actual use, so it can meet the requirements of most users.

For example, such an ACL template for identifying IPv4 packets can be customized for the user: <source MAC address, source IP address, destination IP address, TOS, protocol number>, the structure of the template is shown in Figure 8.

For IPv6 ACL, due to the particularity of its IP address, some ACL templates can also be constructed in a similar way. The current IPv6 ACL only implements IPv6 unicast flow classification processing, and the IPv6 unicast address (also called the global address) includes two parts: the high 64-bit address and the low 64-bit address. Among them, the upper 64-bit address represents the network prefix, and the lower 64-bit address represents the interface index.

Therefore, we can customize some different IPv6 ACL templates according to user needs. That is, a part of the upper 64-bit address or the lower 64-bit address of an IPv6 address is selected, and combined with some Layer 2 ACLs to form an IPv6 ACL template to achieve a finer-grained IPv6 ACL. For example, the following IPv6 ACL template can be constructed: <source MAC, source IP (lower 64 bits), destination IP, protocol number>

Step 7-2. Save the customized ACL template in the template library of the router.

After customizing some ACL templates according to the user's needs, the present invention needs to maintain a template library in the router, and save some of the above-mentioned customized ACL templates in the template library, and the user can add them to the template library according to actual needs. , delete, modify and other operations.

Step 7-3. When a traffic classification operation is required, select an ACL template and specify a matching condition.

When the user needs to classify a specific data flow according to the above-mentioned customized ACL template, he selects a required ACL template from the above-mentioned template library. Then specify the matching conditions for each field in the selected ACL template, that is, configure a specific ACL template rule and store it in the TCAM.

For example, according to the ACL template shown in Figure 8 above, the following rules can be configured:

{Source MAC=00e0.fcfa.0000, source IP=2.2.2.2/24, destination IP=4.4.4.4/24, TOS=0×4c, protocol number=6}.

According to the ACL template shown in Figure 9 above, the following rules can be configured:

{Source MAC＝00e0.fcfa.0000, VLAN ID＝0×3, source IP (lower 64bits)＝0:0:C934:12FE, destination IP＝2008::1, Traffic Class＝0×c, protocol number＝ 17}

Step 7-4, according to the selected ACL template, extract the corresponding field content from the packet and form a Key.

According to the definition of the ACL template selected above, the corresponding field content is extracted from the data flow message to be processed, for example, part of the content in the second, third and fourth layer header fields of the message can be extracted, and then the The extracted content constitutes a key.

Step 7-5: Check whether the key matches the ACL rules.

Match the constituted key with the configured ACL rule, and if the match is successful (hit), execute step 7-6; otherwise, execute step 7-7.

Step 7-6, execute the action corresponding to the ACL rule.

If the key matches the configured ACL template rule, the TCAM will return the corresponding action index, find the corresponding action according to the action index, and execute the action to provide the corresponding QoS policy for the data flow.

Step 7-7, normally forwarding the message.

If the key does not match the configured ACL template rule, the data flow packet to be processed is normally forwarded according to the normal forwarding process.

The method of the present invention can be combined with existing processing methods based on two-layer ACL and three-layer ACL, that is, when a user configures an ACL rule, the ACL type can be selected as required: two-layer ACL, three-layer ACL or ACL template. The specific processing flow is shown in Figure 10. The specific processing process is briefly introduced as follows:

If the user chooses to enable Layer 2 ACL and Layer 3 ACL at the same time, first extract the content of the Layer 2 header field from the data flow packet to be classified, and then match it with the rule table of Layer 2 ACL. If the match matches a rule , then continue to extract the content of the Layer 3 and Layer 4 header fields from the message, and then match it with the rule table of the Layer 3 ACL. If a rule is matched, the action corresponding to the rule will be returned, and the action will be executed for the data Stream packets are processed accordingly.

If the user chooses to enable Layer 3 ACL, extract the content of the Layer 3 and Layer 4 header fields from the data flow packet to be classified, and then match it with the rule table of Layer 3 ACL. If the match matches a rule, return The action corresponding to the rule is executed to perform corresponding processing on the data flow packet.

If the user chooses to enable the ACL template, specify the matching conditions for each field in the selected ACL template, configure a specific ACL template rule, and extract Layer 2, The contents of the Layer 3 and Layer 4 header fields are matched with the configured ACL template rule. If the match is found, the action corresponding to the rule is returned, and the action is executed to process the data flow packet accordingly.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (8)

1, a kind ofly provide the method for different quality of service policy, it is characterized in that, comprising to data flow:

A, customization comprise the access control list ACL template of each layer segment field information;

B, utilize described ACL template, data stream is classified, provide different QoS policy to data flow.

2, provide the method for different quality of service policy according to claim 1 is described to data flow, it is characterized in that described steps A specifically comprises:

According to user's request, customization comprises two layers of the fields of part of message and the ACL template of three layers of fields of part,

And/or,

According to user's request, customization comprises two layers of the fields of part of message and the ACL template of four layers of fields of part,

And/or,

According to user's request, customization comprises three layers of the fields of part of message and the ACL template of four layers of fields of part.

3, provide the method for different quality of service policy according to claim 1 is described to data flow, it is characterized in that the length of described ACL template is no more than the list item length that defines in the three-state content addressable memory TCAM specification.

4, provide the method for different quality of service policy according to claim 1 is described to data flow, it is characterized in that described steps A also comprises:

The ACL template of described customization is kept in the ATL, and the user can increase in this ATL, deletion, retouching operation.

5, describedly provide the method for different quality of service policy according to claim 1,2,3 or 4, it is characterized in that described step B specifically comprises to data flow:

B1, according to pending data flow, select an ACL template, and dispose the rule of this ACL template;

B2, described rule and pending data flow are carried out matching treatment, and corresponding qos policy is provided for this data flow according to the result of coupling.

6, provide the method for different quality of service policy according to claim 5 is described to data flow, it is characterized in that described step B1 specifically comprises:

Dispose the rule of this ACL template by the matching condition of specifying each field in the described ACL template.

7, provide the method for different quality of service policy according to claim 6 is described to data flow, it is characterized in that described step B2 specifically comprises:

B21, according to the definition of described ACL template, from pending data flow message, extract corresponding field contents, and the field contents that extracts constituted keyword key;

B22, the rule of the ACL template of described key and described configuration is carried out matching treatment, and corresponding qos policy is provided for this data flow according to the result of coupling.

8, provide the method for different quality of service policy according to claim 7 is described to data flow, it is characterized in that described step B22 specifically comprises:

If the rule match of the ACL template of described key and described configuration is hit, then carry out the pairing action of this rule and provide corresponding qos policy to data flow; Otherwise, data stream is transmitted according to normal forwarding process.

Images