Efficient and flexible flow inspector

Abstract

In one embodiment, a data communication device includes a network interface controller to process packets received from at least one of a host device for sending over a network, and at least one remote device over the network, at least one processor to execute computer instructions to receive a configuration, and extract filtering rules from the configuration, and at least one hardware accelerator to receive the filtering rules from the at least one processor, and filter the packets based on the rules so that some of the packets are dropped and some of the packets are forwarded to the at least one processor to send data based on the forwarded packets to another device.

Description

FIELD OF THE INVENTION

The present invention relates to computer networks, and in particular, but not exclusively to, flow inspection.

BACKGROUND

Traffic inspection and filtering are fundamentals of any network topology and form the basis for network and cyber security-based solutions. Traffic filtering is used to provide network security by filtering network traffic based on different matching rules. Traffic filters are used to protect different services on a variety of network topologies and are used by many security companies.

SUMMARY

There is provided in accordance with an embodiment of the present disclosure, a data communication device, including a network interface controller to process packets received from at least one of a host device for sending over a network, and at least one remote device over the network, at least one processor to execute computer instructions to receive a configuration, and extract filtering rules from the configuration, and at least one hardware accelerator to receive the filtering rules from the at least one processor, and filter the packets based on the rules so that some of the packets are dropped and some of the packets are forwarded to the at least one processor to send data based on the forwarded packets to another device.

Further in accordance with an embodiment of the present disclosure, the device includes a data processing unit (DPU) including the network interface controller, the at least one processor, and the at least one hardware accelerator.

Still further in accordance with an embodiment of the present disclosure the computer instructions include instructions to extract a format from the configuration, format the data based on the extracted format, and send the formatted data to the other device.

Additionally in accordance with an embodiment of the present disclosure the computer instructions include instructions to parse headers of the forwarded packets, and format the data based on the extracted format and the parsed headers.

Moreover, in accordance with an embodiment of the present disclosure the other device is any one or more of the following a telemetry device, a device including a graphics processing unit (GPU), and a programmable device.

Further in accordance with an embodiment of the present disclosure the network interface controller includes packet processing circuitry to receive steering rules from the other device, and process other packets responsively to the steering rules.

Still further in accordance with an embodiment of the present disclosure the packet processing circuitry is configured to drop at least some of the other packets responsively to the steering rules.

Additionally in accordance with an embodiment of the present disclosure the computer instructions include instructions to send the data to the other device over the network.

Moreover, in accordance with an embodiment of the present disclosure the network interface controller includes packet processing circuitry to mirror the packets to the software including the computer instructions.

Further in accordance with an embodiment of the present disclosure the at least one hardware accelerator is configured to filter the packets responsively to any one or more of the following a 5-tuple identification, a tenant identification, a port identification, a user identification, and at least one field from a network header.

There is also provided in accordance with another embodiment of the present disclosure, a flow inspection method, including processing packets received from at least one of a host device for sending over a network, and at least one remote device over the network, receiving a configuration, extracting filtering rules from the configuration, receiving the filtering rules by at least one accelerator, and filtering the packets by the at least one accelerator based on the rules so that some of the packets are dropped and some of the packets are forwarded to at least one processor to send data based on the forwarded packets to another device.

Still further in accordance with an embodiment of the present disclosure, the method includes extracting a format from the configuration, formatting the data based on the extracted format, and sending the formatted data to the other device.

Additionally in accordance with an embodiment of the present disclosure, the method includes parsing headers of the forwarded packets, wherein the formatting includes formatting the data based on the extracted format and the parsed headers.

Moreover, in accordance with an embodiment of the present disclosure the other device is any one or more of the following a telemetry device, a device including a graphics processing unit (GPU), and a programmable device.

Further in accordance with an embodiment of the present disclosure, the method includes receiving steering rules from the other device, and processing other packets responsively to the steering rules.

Still further in accordance with an embodiment of the present disclosure, the method includes dropping at least some of the other packets responsively to the steering rules.

Additionally in accordance with an embodiment of the present disclosure, the method includes sending the data to the other device over the network.

Moreover, in accordance with an embodiment of the present disclosure, the method includes mirroring the packets to software.

Further in accordance with an embodiment of the present disclosure the filtering includes filter packets responsively to any one or more of the following a 5-tuple identification, a tenant identification, a port identification, a user identification, and at least one field from a network header.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood from the following detailed description, taken in conjunction with the drawings in which:

FIG. 1 is a block diagram view of a flow inspection system constructed and operative in accordance with an embodiment of the present invention;

FIG. 2 is a flowchart including steps in a method of operation of one or more processors in the flow inspection system of FIG. 1;

FIG. 3 is a flowchart including steps in a method of operation of one or more accelerators in the flow inspection system of FIG. 1; and

FIG. 4 is a flowchart including steps in a method of operation of a packet processing circuitry in the flow inspection system of FIG. 1.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

As previously mentioned, traffic inspection and filtering are fundamentals of any network topology and form the basis for network and cyber security-based solutions. Traffic filtering is used to provide network security by filtering network traffic based on different matching rules. Traffic filters are used to protect different services on a variety of network topologies and are used by many security companies.

Traffic inspection and filtering may be implemented using a software-based solution. However, a software-based solution leads to low performance compared to hardware-based solutions. Although performing traffic inspection and filtering using dedicated hardware generally has higher performance than software, using dedicated hardware is inflexible and it is very hard, if not impossible, to add new features, such as new filtering schemes or data output formats used by security services.

Embodiments of the present invention solve at least some of the above problems by providing a data communication device with a traffic inspection and filtering sub-system, which includes a hybrid hardware and software solution providing both high performance and flexible traffic inspection and filtering. The software (which may include firmware) receives a configuration (e.g., in a configuration file) and extracts filtering rules from the configuration. The filtering rules are then provided to one or more hardware accelerators, which receive the filtering rules and filter packets according to the filtering rules so that some of the packets are dropped and some of the packets are forwarded to the software, which formats data based on the forwarded packets and sends the data to another device for processing such as a telemetry device, a programmable device, or a device including a graphics processing unit (GPU), etc. The software provides flexibility regarding the filtering rules, while the hardware accelerator(s) provide high performance filtering according to the filtering rules provided by the configuration.

In some embodiments, the software extracts a format from the configuration with which to format the data for sending to the other device. In some embodiments, the software parses headers of the forwarded packets and formats the data based on the extracted format and the parsed headers. Including the format in the configuration allows the data formatting to remain flexible and be tailored according to the needs of the security service (or other service) receiving the formatted data.

In some embodiments, the data communication device includes a data processing unit (DPU) which includes a network interface controller to process receipt and sending of packets over a network, one or more processors (e.g., processor cores), and one or more hardware accelerators. Using the processor(s) and accelerator(s) to perform the filtering and data formatting allows the DPU to filter network flows without interrupting data streams being processed to and/or from a host device connected to the data communication device.

System Description

Reference is now made to FIG. 1, which is a block diagram view of a flow inspection system 10 constructed and operative in accordance with an embodiment of the present invention. The system 10 includes a data communication device 12, which includes a network interface controller (NIC) 14, one or more hardware accelerators 16, one or more processors 18 (e.g., a 64-bit Armv8 multicore processor array or another multicore array, or another programmable processor), and an interface 20. The network interface controller 14 may include packet processing circuitry 22 (including various units such as a physical layer (PHY) unit and a MAC unit) and a network interface 24. In some embodiments, the data communication device 12 includes a data processing unit (DPU) 26 (also known as a SmartNIC), which includes the network interface controller 14, the processor(s) 18, and the hardware accelerator(s) 16. The hardware accelerator(s) 16 may include any suitable accelerator, for example, networking accelerators, security accelerators, such as regular expression engines, etc.

The network interface controller 14 is configured to process packets received from: a host device 28 for sending over a network 30 to one or more remote device(s) 32; and/or the remote device(s) 32 over the network 30. The packets received from the host device 28 may be received via an interface 36 of the host device 28 and the interface 20 of the data communication device 12. The interface 36 and the interface 20 may be any suitable interface, for example, a peripheral bus interface, such as an interface operating according to peripheral component interconnect express (PCIe) standard.

The network interface 24 is configured to receive packets from the network 30 and send packets over the network 30. The processor(s) 18 may include one or more processing cores configured to execute computer instructions 38 (e.g., software or firmware). The processor(s) 18 is described in more detail with reference to FIG. 2. The hardware accelerator(s) 16 is configured to perform any suitable operation such as encryption, decryption, arithmetic operations, and filtering packets according to filtering rules as described in more detail with reference to FIG. 3. In some embodiments, the packet processing circuitry 22 of the network interface controller 14 is configured to mirror packets (received from the host device 28 or the remote device(s) 32) to the processor(s) 18, which is configured to filter the mirrored packets as described in more detail with reference to FIG. 3.

The system 10 may include another device 34 from which a configuration (e.g., in a configuration file) is received, as described in more detail with reference to FIG. 2. The data communication device 12 may also send formatted data to a device, such as the device 34 (or any suitable device), as described in more detail with reference to FIG. 2. The device 34 may be any suitable processing device, for example, a telemetry device, a device including a graphics processing unit (GPU), and/or a programmable device.

Reference is now made to FIG. 2, which is a flowchart 200 including steps in a method of operation of the processor(s) 18 in the flow inspection system 10 of FIG. 1. As previously mentioned, the processor(s) 18 are configured to execute computer instructions 38 (e.g., of software or firmware).

The computer instructions 38 are configured to receive a configuration (e.g., in a configuration file) from a device such as the device 34 (e.g., a security service) (block 202). The computer instructions 38 are configured to extract filtering rules from the configuration (block 204). The filtering rules may include any suitable filtering rules to identify packets of interest. The filtering rules may include rules related to any one or more of the following: a 5-tuple identification; a tenant identification; a port identification; a user identification; and at least one field from a network header. The extracted filtering rules are provided to the hardware accelerator(s) 16 to filter packets (e.g., packets mirrored to the hardware accelerator(s) 16) according to the filtering rules so that some of the packets are dropped and some of the packets are forwarded back to the computer instructions 38, as described in more detail with reference to FIG. 3.

The computer instructions 38 are configured receive filtered packets forwarded from the hardware accelerator(s) 16 (block 206). In some embodiments, the computer instructions 38 are configured to extract a format from the configuration (block 208). The format specifies how data from the packets should be formatted for sending to the device 34. In some embodiments, the computer instructions 38 are configured to parse headers of the forwarded packets (block 210) for use in the data formatting described in more detail below.

In some embodiments, the computer instructions 38 are configured to format data from the forwarded packets (block 212). In some embodiments, the computer instructions 38 are configured to format data from the forwarded packets based on the extracted format. In some embodiments, the computer instructions 38 are configured to format data from the forwarded packets based on the extracted format and the parsed headers. For example, the extracted format may specify where data from given headers (provided by the header parsing step of block 210) should be included in the formatted data.

The computer instructions 38 are configured to send the (formatted) data to the device 34 (block 214). In some embodiments, the computer instructions 38 are configured to send the (formatted) data to the device 34 over the network 30. In some embodiments, the device 34 may be directly connected to the data communication device 12.

In practice, some or all of the functions of the processor(s) 18 may be combined in a single physical component or, alternatively, implemented using multiple physical components. These physical components may comprise hard-wired or programmable devices, or a combination of the two. In some embodiments, at least some of the functions of the processor(s) 18 may be carried out by a programmable processor under the control of suitable software. This software may be downloaded to a device in electronic form, over a network, for example. Alternatively, or additionally, the software may be stored in tangible, non-transitory computer-readable storage media, such as optical, magnetic, or electronic memory.

Reference is now made to FIG. 3, which is a flowchart 300 including steps in a method of operation of one or more accelerators 16 in the flow inspection system 10 of FIG. 1. The hardware accelerator(s) 16 is configured to: receive the filtering rules from the computer instructions 38 running on the processor(s) 18 (block 302) and load the filtering rules into the hardware accelerator(s) 16; and filter the (mirrored) packets based on the filtering rules so that some of the packets are dropped and some of the packets are forwarded to the computer instructions 38 running on the processor(s) 18 to send data based on the forwarded packets to device 34 (block 304). The hardware accelerator(s) 16 is configured to filter the packets responsively to any suitable filtering rule which may include filtering rules based on one or more of the following: a 5-tuple identification of the packets; a tenant identification of the packets; a port identification of the packets; a user identification of the packets; and at least one field from a network header of the packets.

Reference is now made to FIG. 4, which is a flowchart 400 including steps in a method of operation of the packet processing circuitry 22 in the flow inspection system 10 of FIG. 1.

The device 34 receives the formatted data from the data communication device 12 and may analyze the formatted data and determine a decision based on the received data that certain packets (e.g., from given sources or given packet types etc.) should be dropped or otherwise processed. For example, the device 34 may identify some of the packets as a security threat and determine a decision to drop the identified packets. The device 34 may generate steering rules to be applied by the data communication device 12 to implement the decision.

The packet processing circuitry 22 is configured to: receive steering rules from the device 34 (block 402); and process other packets responsively to the received steering rules (block 404). In some embodiments, the packet processing circuitry 22 is configured to drop at least some of the other packets responsively to the steering rules.

Various features of the invention which are, for clarity, described in the contexts of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment may also be provided separately or in any suitable sub-combination.

The embodiments described above are cited by way of example, and the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the invention includes both combinations and sub-combinations of the various features described hereinabove, as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art.

Claims

1. A data communication device, comprising: a network interface controller to process packets received from at least one of: a host device for sending over a network; and at least one remote device over the network;at least one processor to execute computer instructions to: receive a configuration;extract from the configuration, filtering rules that are used to determine which of the packets are to be dropped and which of the packet are to be forwarded; andprovide the extracted filtering rules to at least one hardware accelerator; andthe at least one hardware accelerator to: receive the extracted filtering rules from the computer instructions being executed by the at least one processor; andfilter the packets based on the extracted filtering rules so that some of the packets are dropped and some of the packets are forwarded to the at least one processor to send data based on the forwarded packets to another device.

2. The device according to claim 1, further comprising a data processing unit (DPU) including the network interface controller, the at least one processor, and the at least one hardware accelerator.

3. The device according to claim 1, wherein the computer instructions include instructions to: extract a format from the configuration;format the data based on the extracted format; andsend the formatted data to the other device.

4. The device according to claim 3, wherein the computer instructions include instructions to: parse headers of the forwarded packets; andformat the data based on the extracted format and the parsed headers.

5. The device according to claim 1, wherein the other device is any one or more of the following: a telemetry device; a device including a graphics processing unit (GPU); and a programmable device.

6. The device according to claim 1, wherein the network interface controller includes packet processing circuitry to: receive steering rules from the other device; andprocess other packets responsively to the steering rules.

7. The device according to claim 6, wherein the packet processing circuitry is configured to drop at least some of the other packets responsively to the steering rules.

8. The device according to claim 1, wherein the computer instructions include instructions to send the data to the other device over the network.

9. The device according to claim 1, wherein the network interface controller includes packet processing circuitry to mirror the packets to the software comprising the computer instructions.

10. The device according to claim 1, wherein the at least one hardware accelerator is configured to filter the packets responsively to any one or more of the following: a 5-tuple identification; a tenant identification; a port identification; a user identification; and at least one field from a network header.

11. A flow inspection method, comprising: processing packets received from at least one of: a host device for sending over a network; and at least one remote device over the network;receiving a configuration;extracting from the configuration filtering rules that are used to determine which of the packets are to be dropped and which of the packets are to be forwarded;providing the extracted filtering rules to at least one hardware accelerator;receiving the extracted filtering rules by the at least one hardware accelerator from computer instructions executed by at least one processor; andfiltering the packets by the at least one hardware accelerator based on the extracted filtering rules so that some of the packets are dropped and some of the packets are forwarded to at least one processor to send data based on the forwarded packets to another device.

12. The method according to claim 11, further comprising: extracting a format from the configuration;formatting the data based on the extracted format; andsending the formatted data to the other device.

13. The method according to claim 12, further comprising parsing headers of the forwarded packets, wherein the formatting includes formatting the data based on the extracted format and the parsed headers.

14. The method according to claim 11, wherein the other device is any one or more of the following: a telemetry device; a device including a graphics processing unit (GPU); and a programmable device.

15. The method according to claim 11, further comprising: receiving steering rules from the other device; andprocessing other packets responsively to the steering rules.

16. The method according to claim 15, further comprising dropping at least some of the other packets responsively to the steering rules.

17. The method according to claim 11, further comprising sending the data to the other device over the network.

18. The method according to claim 11, further comprising mirroring the packets to software.

19. The method according to claim 11, wherein the filtering includes filter packets responsively to any one or more of the following: a 5-tuple identification; a tenant identification; a port identification; a user identification; and at least one field from a network header.

20. The system according to claim 1, wherein the at least one hardware accelerator includes any one or more of the following: a network accelerator; a security accelerator; or a regular expression engine.

21. The method according to claim 11, wherein the at least one hardware accelerator includes any one or more of the following: a network accelerator; a security accelerator; or a regular expression engine.