A highly flexible,distributed multiprocessor architecture for network processing

Network processors (NPs) are an emerging field of programmable processors that are optimized to implement data plane packet processing networking functions. Unlike the general-purpose CPUs that rely heavily on caching for improving performance, the lack of locality in packet processing and need for high-performance I/O have forced designers to come up with innovative architectures that can hide memory latency while still processing packets at high data rates. Most of these NPs use some type of multiprocessing in combination with a hierarchy of memory types to achieve high performance. In addition, to keep up with packets arriving at high data rates over multiple incoming media interfaces, an NP must perform fast I/O and memory operations such as packet storage, table lookup, and extraction of fields in packet headers. We describe an architecture that uses a combination of distributed memory architecture and one or more multithreaded processors to achieve the necessary performance. We describe the challenges in programming such a processor including the issues related to consistency and maintaining packet ordering. We also present a programming model for generic network applications that uses software pipelines. We then demonstrate the use of the programming model in implementing two applications, namely, mapping traffic management algorithms onto a multithreaded architecture and an implementation of a media gateway based on voice-over-AAL2.     

Architecture for a hardware-based, TCP/IP content-processing system

The transmission control protocol is the workhorse protocol of the Internet. Most of the data passing through the Internet transits the network using TCP layered atop the Internet protocol (IP). Monitoring, capturing, filtering, and blocking traffic on high-speed Internet links requires the ability to directly process TCP packets in hardware. High-speed network intrusion detection and prevention systems guard against several types of threats. As the gap between network bandwidth and computing power widens, improved microelectronic architectures are needed to monitor and filter network traffic without limiting throughput. To address these issues, we've designed a hardware-based TCP/IP content-processing system that supports content scanning and flow blocking for millions of flows at gigabit line rates. The TCP splitter2 technology was previously developed to monitor TCP data streams, sending a consistent byte stream of data to a client application for every TCP data flow passing through the circuit. The content-scanning engine can scan the payload of packets for a set of regular expressions. The new TCP-based content-scanning engine integrates and extends the capabilities of the TCP splitter and the old content-scanning engine. IP packets travel to the TCP processing engine from the lower-layer-protocol wrappers. Hash tables are used to index memory that stores each flow's state.     

Affinity-Based Network Interfaces for Efficient Communication on Multicore Architectures

Improving the network interface performance is needed by the demand of applications with high communication requirements (for example, some multimedia, real-time, and high-performance computing applications), and the availability of network links providing multiple gigabits per second bandwidths that could require many processor cycles for communication tasks. Multicore architectures, the current trend in the microprocessor development to cope with the difficulties to further increase clock frequencies and microarchitecture efficiencies, provide new opportunities to exploit the parallelism available in the nodes for designing efficient communication architectures. Nevertheless, although present OS network stacks include multiple threads that make it possible to execute network tasks concurrently in the kernel, the implementations of packet-based or connection-based parallelism are not trivial as they have to take into account issues related with the cost of synchronization in the access to shared resources and the efficient use of caches. Therefore, a common trend in many recent researches on this topic is to assign network interrupts and the corresponding protocol and network application processing to the same core, as with this affinity scheduling it would be possible to reduce the contention for shared resources and the cache misses. In this paper we propose and analyze several configurations to distribute the network interface among the different cores available in the server. These alternatives have been devised according to the affinity of the corresponding communication tasks with the location (proximity to the memories where the different data structures are stored) and characteristics of the processing core. As this approach uses several cores to accelerate the communication path of a given connection, it can be seen as complementary to those that consider several cores to simultaneously process packets belonging to either the same or different connections. Message passing interface (MPI) workloads and dynamic web servers have been considered as applications to evaluate and compare the communication performance of these alternatives. In our experiments, performed by full-system simulation, improvements of up to 35% in the throughput and up to 23% in the latency have been observed in MPI workloads, and up to 100% in the throughput, up to 500% in the response time, and up to 82% in the requests attended per second have been measured in dynamic web servers.     

多跳无线网络中基于网络编码的多路径路由

提出了一种基于网络编码的多路径路由机制CAMP(network coding-aware multi-path routing).该机制能够根据路径的可靠性和编码机会,动态地在多条路径上进行数据包的传输.CAMP的路由发现机制能够向源节点返回多条可能的路径以及各条路径的每条边上的ETX(expected transmission count).与以往的多路径路由机制不同, CAMP可以通过转换它的传输路径来动态地创造而非仅仅等待编码机会.利用这一独特的路由机制,CAMP可以让多条路径分摊网络流量负载,并且最大化路径转换收益,从而改进网络的吞吐量.实验结果表明,在无线网络的数据传输过程中,CAMP能够取得比其他路由机制高得多的网络吞吐量.     

电力保护装置站控制层网络的防火墙策略及其实现方法

本文提供一种电力保护装置站控制层网络的防火墙策略及其实现。由于电力保护装置的特殊性,其防火墙策略有其独特的特点,不同的保护装置所使用的操作系统、协议栈可能不同,防火墙策略本身是一种报文处理逻辑的抽象,并不会受具体系统的影响,只是防火墙策略的实现需要依赖于保护装置自身的操作系统、协议栈。策略本身是抽象的方法论,与具体的系统没有关系,在不同的系统上有不同的实现方式,即策略统一、实现方式不同。在Linux操作系统上实现电力保护装置的防火墙来对防火墙策略进行说明,在Linux系统上利用netfilter子系统和nftables工具实现电力保护装置的防火墙策略,防火墙仅是电力系统保护装置网络安全架构的一小部分。     

卫星网络路由器高速数据转发设计

卫星网络由多颗卫星和地面站组成,星间通过高速激光链路通信。卫星网络的核心之一就是路由器。高性能路由器的典型特点为数据路径和控制路径的分离。控制路径处理与高层路由协议相关的数据包,数据路径处理需要转发的数据包。数据路径是路由器的关键路径,直接影响着路由器的整体性能。在调研路由器技术发展历程之后,分析了高性能路由器典型结构及相关关键技术,考虑目前卫星网络系统需求、软硬件环境约束条件,对现有技术进行了优化和适应性修改,确定了卫星网络路由器中数据路径的实现方案。该方案满足当前卫星网络应用需求,且经简单扩展后,还可满足后续更高性能卫星网络路由器的设计需求。     

Programming the data path in network processor‐based routers

There is growing interest in network processor technologies capable of processing packets at line rates. Network processors are likely to be an integral part of next generation high‐speed router and switch architectures, replacing the application‐specific integrated circuits (ASICs) that are used in routers today. In this paper, we present the design, implementation and evaluation of NetBind, a high‐performance, flexible and scalable binding tool for dynamically constructing data paths in network processor‐based routers. The methodology that underpins NetBind balances the flexibility of network programmability against the need to process and forward packets at line speeds. To support the dynamic binding of components with the minimum addition of instructions in the critical path, NetBind modifies the machine language code of components at run time. To support fast data path composition, NetBind reduces the number of binding operations required for constructing data paths to a minimum set so that binding latencies are comparable with packet forwarding times. Data paths constructed using NetBind seamlessly share the resources of the same network processor. Resources are assigned during the binding process. We compare the performance of NetBind to the MicroACE system developed by Intel and show that NetBind provides better performance in comparison to MicroACE with smaller binding overhead. The NetBind source code described and evaluated in this paper is freely available on the Web ( http://www.comet.columbia.edu/genesis/netbind ) for experimentation. Copyright © 2005 John Wiley & Sons, Ltd.     

Improving IPS by network processors

Many present applications usually require high communication throughputs. Multiprocessor nodes and multicore architectures, as well as programmable NICs (Network Interface Cards) provide new opportunities to take advantage of the available multigigabits per second link bandwidths. Nevertheless, to achieve adequate communication performance levels efficient parallel processing of network tasks and interfaces should be considered. In this paper, we leverage network processors as heterogeneous microarchitectures with several cores that implement multithreading and are suited for packet processing, to investigate on the use of parallel processing to accelerate the network interface, and thus the network applications developed above it. More specifically, we have implemented an intrusion prevention system (IPS) with such a network processor. We describe the IPS we have developed that after its offloaded implementation allows faster packet processing of both normal and corrupted traffic. The benefits from placing the IPS close to the network, by using specialized network processors, give many times lower latency and higher bandwidth available to the legitimate traffic.     

高速防火墙的研究与实现

随着宽带网络的日益普及，网络安全已成为信息技术领域一个重要的议题，现有的防火墙架构已无法满足高速网络环境下的应用。网络处理器是专为IP网络包处理设计的芯片，能够以线速处理网络传输数据。文中论述了网络处理器的体系结构和功能，并通过分析防火墙的几种不同架构，给出一种基于网络处理器的实现方案，为千兆网络提供了路由、过滤，以及网络地址转换等安全防护措施的实现。最后指出了该方案在网络安全领域的应用前景以及网络安全设备的发展方向。     

Broadcasting Sequential Processes (BSP)

Communication in a broadcast protocol multiprocessor (BPM) is inherently different from that in distributed systems formed by explicit links between processors. A message broadcast by a processor in a BPM is received directly by all other processors in the network instead of being restricted to only one processor. Broadcasting is an inexpensive way of communicating with a large number of processors on a BPM. In this paper I will describe a new approach to user-level distributed programming called broadcast programming, i.e., distributed programs written as cooperating broadcasting sequential processes (BSP). Existing concurrent programming languages do not provide facilities to exploit the broadcast capability of a BPM. The idea of distributed programs written as BSP is tailored to exploiting a BPM architecture but is not restricted to such an architecture-however, implementation of the broadcast capability may not be as efficient on other architectures. I will illustrate the utility and convenience of broadcast programming with many examples. These examples will also be used to explore the suitability and advantages of BSP and to determine appropriate facilities for BSP.     

Predictive scheduling of network processors

To provide flexibility in deploying new protocols and services, general-purpose processing engines are being placed in the datapath of routers. Such network processors (NPs) are typically simple RISC multiprocessors that perform forwarding and custom application processing of packets. The inherent unpredictability of execution time of arbitrary instruction code poses a significant challenge in providing service guarantees for data flows that compete for such processing resources in the network. However, we show that network processing workloads are highly regular and predictable, which can be exploited for scheduling purposes. We present two such predictive processor scheduling algorithms that aim at providing service guarantees as well as improving the performance of the NP by increasing the instruction data locality. Simulation results show that these algorithms provide significantly better performance than processor scheduling algorithms that do not take packet processing times into consideration.     

基于NDIS和层次I/O的组合网关实现技术剖析

介绍了NDIS、层次I/O及其在Windows网络协议栈实现中的地位和作用,剖析了采用核心态NDIS协议驱动程序和伪设备驱动程序,在多个协议栈层次上进行不同处理的组合网关实现技术,给出了使用这项技术的基本方法,评估了它的性能.     

基于多核处理器的L7-Filter规则匹配改进算法

针对多核处理器的体系结构和网络数据流在时间上的局部性特点,提出了一种基于多核处理器的分链动态适应算法。该算法通过对网络数据流进行类型分类并根据网络数据流的时间局部性对规则链进行动态优化,从而有效减少了多核处理器下L7-Filter对网络数据流的匹配次数,显著提升了规则匹配效率。仿真实验结果表明:在网络数据包个数相同条件下,所提算法在性能上约有7%的提高。随着网络数据包个数的增加,性能优越性更加明显。     

Edge-Cut Bounds on Network Coding Rates

Active networks are network architectures with processors that are capable of executing code carried by the packets passing through them. A critical network management concern is the optimization of such networks and tight bounds on their performance serve as useful design benchmarks. A new bound on communication rates is developed that applies to network coding, which is a promising active network application that has processors transmit packets that are general functions, for example a bit-wise XOR, of selected received packets. The bound generalizes an edge-cut bound on routing rates by progressively removing edges from the network graph and checking whether certain strengthened d-separation conditions are satisfied. The bound improves on the cut-set bound and its efficacy is demonstrated by showing that routing is rate-optimal for some commonly cited examples in the networking literature.     

嵌入式分布系统中网络设备的时间同步

针对航电系统中报文的处理需要时间同步的要求,采用VxWorks嵌入式操作系统,设计并实现了网络授时协议(NTP)服务器,建立了可靠的处理机制。重点对NTP协议进行介绍,包括其工作原理、网络结构、工作模式以及处理流程。最后对课题的分布式系统性能进行测试并作出详细的分析,阐明建立网络时间服务体系的必要性。NTP协议用于同步分布式系统中的计算机时间,对于分布式系统的网络应用有着重要的参考价值。     

Disjoint path properties of the data manipulator network family

A critical component of any parallel processing system is the interconnection network that provides communications among the system's processors and memories. The data manipulator (gamma) network family is an important class of multistage interconnection networks that is being studied by various researchers. One interesting property of the data manipulator network family is the existence of multiple paths through the network for most source/ destination pairs. The condition that must be present to have disjoint paths through the network for a given source/ destination pair is shown, where disjoint paths are multiple paths with no links in common. It is derived that the maximum number of disjoint paths for any source/destination pair is two and a method for finding the routing tags that specify these paths is given. For source/destination pairs that have disjoint paths, a single fault cannot prevent communication between that source/ destination pair. The effect of a fault in a given stage of the network on the number of source/destination pairs that can be connected is also discussed. All results are proven mathematically.     

使用多级交换网络进行高性能路由器设计

拓扑结构和路由算法是影响多级交换网络性能的重要因素．在比较多种多级互连拓扑属性的基础上,提出将3D Torus结构应用于大规模交换网络设计．然后针对3D Torus交换网络中报文路由面临的两个关键问题：多路径负载均衡和报文保序,提出一种基于维序的多路径路由算法DMR(dimension-order—based multi—path routing)．该算法可在保证报文顺序的同时在多条路径上平衡负载,提高交换网络吞吐率．最后通过模拟验证了算法的性能,并与维序路由和随机路由算法进行了比较．模拟结果表明,DMR算法的性能优于维序路由算法,能够达到随机路由算法性能水平,同时具有随机路由算法所不具备的报文保序特性．     

MANET与Internet互联时的增强型机制研究

已有的移动自组网与Internet的互联协议由于无法克服网关发现过程中的单向链路并且因盲目转播网关发现报文形成广播风暴等原因而致使性能严重恶化。该文提出了一种增强型的综合互联协议，该协议一方面采用效率较高的综合方式进行网关发现，另一方面则通过交换携带有对称邻居列表和非对称邻居列表的HELLO分组而有效克服了网关发现过程中的单向链路，同时抑制了广播风暴的形成。基于NS2的仿真结果显示该增强型的综合互联协议在不引入新控制分组的前提下能显著提升互联性能，降低互联开销。     

基于FPGA的时间触发协议控制器实现

时间触发协议是TTA架构必需的通信协议,用于在要求高可靠性的分布式容错实时系统中电子模块之间的互连;目前作为时间触发通信系统重要组成部分的时间触发控制器主要是采用处理器来实现协议的处理,协议开销比较大;基于FPGA的时间触发协议控制器的设计,采用了具有较好同步能力的编码方式和合理的帧格式,在建立全局时间基准的基础上优化了协议处理状态机,利用FP-GA的并行处理能力,降低了协议开销,增加了总线的效率,同时也提高了时钟同步精度和容错能力;仿真结果表明,基于FPGA的时间触发协议控制器具有较好的性能.     

Fibre Channel: a connection to the future

With commodity microprocessors on the horizon capable of processing hundreds of MIPS, current transmission rates cannot accommodate “Amdahl's Law”-where 1 Mbps of I/O is required for every MIPS of processing power-and will become a bottleneck to system performance in data-intensive applications. To remedy this shortcoming, ANSI Committee X3T11 initiated development of Fibre Channel, a switched protocol capable of transmitting at rates exceeding 1 Gbps, while still supporting existing protocols over both optical fiber and copper cables. Fibre Channel combines the best attributes of legacy channels and networks into a single standard that is a generic transport mechanism for data, voice and video. It is the key to scientific and business applications implemented in open and distributed architectures, because it removes the barriers to performance presented by the old methods of data communications. Fibre Channel introduces the high-performance, easy-to use, low-cost communications required by a new breed of processors and applications. Available today are new high-speed, scalable links to storage; high-performance networks enabling clusters, backbones, imaging, and visualization; and low-cost arbitrated loops providing efficient peripheral I/O