Flow table rapid searching method and system under high-concurrency network environment

Abstract

The invention relates to a flow table rapid searching method and system under a high-concurrency network environment. The method comprises the steps of: 1) counting the flow entering a network interface, setting a buffering window of a buffering area according to the counted current flow state; 2) according to the size of the set buffering window, utilizing quintuple information to group arrived data packets; 3) according to a preset scheduling strategy, scheduling each cached group, and successively sending each group to a connection management module; and 4) extracting the quintuple information of each group by the connection management module, carrying out flow table searching, finding corresponding flow table items, and using the data packets in the groups to update the information of the flow table items. The flow table rapid searching method and system are mainly suitable for a high speed network flow processing system of a backbone link, the access cost of the connection management module under the high speed network environment is optimized, and the access efficiency of the flow table is improved.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a fast flow table search method and system for a high-concurrency network environment. Background technique [0002] In a high-speed network environment, efficient connection management has become a key module of existing network traffic processing systems (such as intrusion detection, traffic accounting, etc. systems). Usually, the traffic processing system architecture is mainly divided into three modules: traffic acquisition, Connection management, business processing. Connection management provides flow traceability for business processing, including three operations: search, update, and delete. In order to accurately record each connection, the connection management module must maintain a connection table (or session table), wherein each connection table item traces a connection in the network, and is responsible for recording the identification ID, sta...

AI Technical Summary

Problems solved by technology

[0007] In terms of optimizing the search operation with the help of network locality, using FPGA and SRAM to realize the high-speed cache of the flow table can speed up the access speed. Limited by the circuit complexity of the FPGA and the capacity limitation of the SRAM, the size of the flow table is limited by the storage capacity. In a high-concurrency network environment, affected by traffic fluctuations and burst traffic, a large number of active connections will be forced to be replaced, resulting in missed detection by the system

Images