Alleviate the system and the method thereof of load on host computers by device unloading
Technical field
The present invention relates to a kind of uninstalling system and method thereof of hardware unit, refer to a kind of being applied in the network package transmission/reception especially, can alleviate the system and the method thereof of the computational burden of main frame on ICP/IP protocol and IPSec data security coding.
Background technology
In the transmission/reception of past for network package,, fully all take the executable software mode of computer to reach no matter be in ICP/IP protocol or the part of encoding in the IPSec data security.
Shown in Figure 1A, comprise the part of IPSec application program 30, IP application program 40 and TCP/UDP (promptly transmitting control/user's data protocol) application program 50 to call TCP/UDP in the following text, all carried out processing by software view in the past.When network package after network 10 receives via network equipment 20, just need processing (IPSec application program 30 must be handled with authentication encryption and decryption hypervisor 35 bindings of carrying out on the main frame at this moment) through IPSec data security coding, carry out relevant IP agreement and carry out the processing of relevant TCP/UDP agreement by IP application program 40 more afterwards, at last data content is sent to corresponding web application 60 by TCP/UDP application program 50.
Otherwise, when web application 60 needs to transmit the data content of network package, just must can smoothly network package be sent out by network equipment 20 by after the processing of TCP/UDP application program 50, IP application program 40 and IPSec application program 30 equally.
Yet, because the part of relevant ICP/IP protocol and IPSec data security coding all realizes by the software running, therefore in the process of handling, must expend the calculation resources of many host cpus, particularly when the quantity of network package is huge, its usefulness for main frame will produce influence greatly.
Therefore, just beginning the someone proposes to alleviate the computing load of main frame on network package is handled with the unloading mechanism of hardware unit, but it mainly all is the part of handling at ICP/IP protocol, promptly utilize TOE device 85 (Traffic Offload Engine Device, it is flow offload engine device, to call the TOE device in the following text) realize the part that ICP/IP protocol is handled, its running schematic diagram is shown in Figure 1B, this kind mode mainly is to install and carry out TOE driver 80 on main frame, an independently TOE device 85 is installed on main frame then, is responsible for specially the part of handling relevant ICP/IP protocol.
It is roughly similar to Figure 1A that its main network package transmits working method, only this moment for socket (Socket) online (be that the network connections object is online, connect to call socket in the following text) lead and handle to TOE device 80, therefore on main frame, carried out a socket guiding storehouse 70 more, be responsible for web application 60 is transferred to the processing that TOE device 85 carries out the ICP/IP protocol part again for the socket that transmits network package and produce connects to being directed in the TOE driver 80, send out by network 10 at last.As for the function mode that network package receives, then just opposite with the transmission function mode.
This kind alleviates the mechanism of load on host computers by the device unloading mode, and the calculation resources that can significantly reduce host cpu really expends.But, flourish along with ecommerce, the fail safe of data passes is also more and more important on the network, therefore it is also more and more heavier to handle the ratio of network package by IPSec data security coded system, nearly all network package all must be through the processing of IPSec data security coding in transmission/reception, and therefore in fact this part also expends the calculation resources of many host cpus.
Owing to do not see at present the problem that calculation resources that relevant technological means can solve network package and transmit/produced when receiving expends yet on the IPSec data security is encoded, therefore how effectively thoroughly to improve the problem of load on host computers by the mode of hardware unit, make the main frame can be more efficient in the processing of network package, just become present considerable problem.
Summary of the invention
In view of above problem, main purpose of the present invention is to provide a kind of system and method thereof that alleviates load on host computers by device unloading, the problem that the host cpu calculation resources that is caused when in the past carrying out ICP/IP protocol and IPSec data security coding by software to utilize hardware unit to solve expends in a large number reaches the purpose effect that promotes the main frame operational paradigm.
Therefore, for achieving the above object, disclosed in this inventionly alleviate the system of load on host computers, include a socket (Socket) guiding storehouse by device, be executed on the operating system of main frame, in order to carry out being responsible for passing on socket data in connection content when network package transmits; And carrying out being responsible for communication of data content when network package receives; One TOE/IPSec driver is executed on the operating system of main frame, in order to when carrying out the network package transmission, receive this socket guiding this socket that the storehouse sent and connect data content, and this socket that leads again connects; When carrying out the network package reception, be responsible for communication of data content and give this socket guiding storehouse; An and TOE/IPSec device, be connected on the main frame, in order to when carrying out the network package transmission, receive this TOE/IPSec driver again this socket of guiding connect, and to this socket connection data content execution TCP/UDP package and the processing of IP package, generation has the network package of a header information, network package is carried out authenticated encryption processing and the processing of follow-up IP package of IPSec again, at last network package is sent out; And when network package receives, resolve this header information of network package, and one of network package execution IPSec is authenticated decryption processing and IP package dissection process and TCP/UDP package dissection process, communication of data content is given this TOE/IPSec driver then.
It alleviates by device in the method for load on host computers, mainly can be divided into receiving network package and transmitting two parts of network package.
When in the TOE/IPSec device, receiving network package, comprise following treatment step: (a) receive network package by the TOE/IPSec device; (b) header information of resolving network package is judged; (c) when network package belongs to the IPSec package, network package is carried out the authentication decryption processing of IPSec; (d) network package is carried out the IP dissection process; (e) network package is carried out the TCP/UDP dissection process; (f) from TOE/IPSec device communication of data content to the TOE/IPSec driver; And (g) by socket guiding storehouse communication of data content to the map network application program.
When transmitting network package, then comprise the following step: (a) web application generates socket connection to send data content; (b) by socket guiding storehouse this socket is connected guiding and give the TOE/IPSec driver; (c) send the data content that this socket connects to the TOE/IPSec device by the TOE/IPSec driver; (d) in the TOE/IPSec device, the data content is carried out the network package that tool one header information was handled and produced to TCP/UDP package and part IP package; (e) in the TOE/IPSec device, judge when belonging to the IPSec package, network package is carried out the authenticated encryption of IPSec and handled; (f) in the TOE/IPSec device network package being carried out the IP package handles; And (g) by TOE/IPSec device transmission network package.
Relevant characteristics and implementation of the present invention, existing conjunction with figs. is described in detail as follows as most preferred embodiment.
Description of drawings
Figure 1A is the running schematic diagram of existing main frame at ICP/IP protocol and IPSec data security coding;
Figure 1B is that existing main frame is in conjunction with the running schematic diagram of TOE hardware unit at ICP/IP protocol and IPSec data security coding;
Fig. 2 is the running schematic diagram of system of the present invention;
Fig. 3 A is the operation workflow figure of the inventive method when receiving network package;
Fig. 3 B is the inventive method operation workflow figure for IPSec data security coding when receiving network package;
Fig. 4 A is the operation workflow figure of the inventive method when transmitting network package; And
Fig. 4 B is the inventive method operation workflow figure for IPSec data security coding when transmitting network package.
Wherein, description of reference numerals is as follows:
10 networks
20 network equipments
30 IPSec application programs
35 authentication encryption and decryption hypervisors
40 IP application programs
50 TCP/UDP application programs
60 web applications
70 sockets guiding storehouse
80 TOE drivers
85 TOE devices
90 TOE/IPSec drivers
95 TOE/IPSec devices
Step 100 receives network package by the TOE/IPSec device
Step 110 is resolved a header information of network package
Step 120 belongs to the IPSec package
Step 130 pair network package is carried out the authentication decryption processing of IPSec
Step 131 determines one to handle type according to this header information
Step 132 utilizes this header information and this processing type to read corresponding authentication deciphering rule
Step 133 rule is still effective
Step 134 is carried out network package authentication decryption processing according to corresponding authentication deciphering rule
Step 135 is abandoned network package and is handled
Step 140 pair network package is carried out the IP dissection process
Step 150 pair network package is carried out the TCP/UDP dissection process
Step 160 communication of data content is to the TOE/IPSec driver
Step 170 leads the storehouse communication of data content to the map network application program by socket
Step 200 web application generates a socket and connects to send data content
Step 210 connects guiding by socket guiding storehouse with this socket and gives the TOE/IPSec driver
Step 220 sends the data content of this socket connection to the TOE/IPSec device by the TOE/IPSec driver
Step 230 pair data content is carried out the TCP/UDP package and part IP package is handled and the network package of generation tool one header information
Step 240 belongs to the IPSec package
Step 250 pair network package is carried out the authenticated encryption of IPSec and is handled
Step 251 determines one to handle type according to this header information
Step 252 utilizes this header information and this processing type to read corresponding authenticated encryption rule
Step 253 rule exists
Step 254 rule is still effective
Step 255 is carried out the network package authenticated encryption according to corresponding authenticated encryption rule and is handled
Step 256 is abandoned network package and is handled
Step 257 is the application authentication encryption rule again
Step 260 pair network package is carried out the IP package and is handled
Step 270 transmits network package by the TOE/IPSec device
Embodiment
The present invention proposes a kind of system and method thereof that can alleviate load on host computers by the mode of device unloading, it mainly is that part with relevant ICP/IP protocol when carrying out network package transmission/reception and IPSec data security coding changes by separate connection and finishes in the hardware unit of main frame, therefore the load that can significantly alleviate main frame, and the operation efficiency of lifting host machine integral.
Fig. 2 is the work schematic diagram of system of the present invention.Wherein mainly include socket (Socket) guiding storehouse 70, TOE/IPSec driver 90 and TOE/IPSec device 95 three parts, be respectively described below:
(1) socket guiding storehouse 70 is executed on the operating system of main frame, is used to carry out be responsible for passing on a socket data in connection content when network package transmits; And in carrying out being responsible for communication of data content when network package receives.
The mode that relevant socket passes on, for instance, generally in connecting, socket can have an area attribute, this area attribute mainly is to be used for the object of designated treatment, suppose that the area attribute of setting in the socket connection originally is: AF_INET, indicating that network package is sent to relevant application program deals with, but, handles this socket to TOE/IPSec device 95 for being connected guiding, therefore must be by the socket action that storehouse 70 leads of leading, this moment just must be by the mode of its area attribute of change, login the purpose of reaching socket connection guiding to the registration that the operating system of main frame is done again, therefore just AF_INET originally must be changed to AF_TOE, can successfully be directed on the actual TOE/IPSec device 95 that will handle so that socket is connected.(area attribute in the in fact relevant socket connection is set and can be defined according to actual state, only needs complete can the reaching smoothly of definition that the socket connection purpose of guiding is again got final product, and is not restriction with above-mentioned example)
(2) the TOE/IPSec driver 90, are executed in equally on the operating system of main frame, when being used to carry out the network package transmission, receive this socket connection data content that socket guiding storehouse 70 is sent, and fairlead connect the word connection again.
When carrying out network package when receiving, the data content of then being responsible for being sent from TOE/IPSec device 95 is to socket guiding storehouse 70.
In fact, this TOE/IPSec driver 90 also be responsible for and host operating system between link up and get in touch, to keep the normal operation between main frame and the TOE/IPSec device 95.
(3) the TOE/IPSec device 95, by specific connecting interface (as: PCIX promptly expands the peripheral assembly connecting interface, to call PCIX in the following text)) be connected on the main frame.When carrying out the network package transmission, receive 90 socket connections of guiding again of this TOE/IPSec driver, and to socket connection data content execution TCP/UDP package and the processing of IP package, generation has a header information and (comprises: network package type, source IP addresses, purpose IP address ...) network package, again network package is carried out authenticated encryption processing and the processing of follow-up IP package of IPSec, at last network package is sent out.
When network package receives, resolve this header information of network package, and one of network package execution IPSec is authenticated decryption processing and IP package dissection process and TCP/UDP package dissection process, communication of data content is given TOE/IPSec driver 90 then.
Fig. 3 A is the detailed process step of the inventive method when receiving network package, is described as follows: the network package (step 100) that at first receives automatic network 10 by TOE/IPSec device 95; Resolve the header information of network package and judge (step 110), judge that network package belongs to the IPSec package? (step 120)
When network package belongs to the IPSec package, network package is carried out the authentication decryption processing (step 130) of IPSec; Then network package is carried out IP dissection process (step 140) then; Afterwards network package is carried out TCP/UDP dissection process (step 150).
Above-mentioned step 100 to step 150 all realizes in TOE/IPSec device 95, after finishing just from TOE/IPSec device 95 communication of data content to TOE/IPSec driver 90 (step 160); Lead storehouse 70 communication of data content to map network application program 60 (step 170) by socket at last.
Otherwise, when step 110 place judges that network package does not belong to the IPSec package, then do not need to carry out the authentication decryption processing of IPSec, so just direct execution in step 140 is to the step of step 170.
In the relevant step 130 network package is carried out the flow process of the authentication decryption processing of IPSec, can be by its thin portion process step be described as Fig. 3 B, comprise: type (step 131) is handled in decision according to header information, here the possible processing type of being mentioned can be ESP (Encapsulating SecurityPayload, promptly encapsulate safe and effective load, to call ESP in the following text) or AH (Authentication Header, the authentication authorization and accounting header is to call AH in the following text); Utilize header information and handle type and read corresponding authentication deciphering rule (step 132), different processing types will cause using different ipsec certification deciphering rules and handle; Do you judge original authentication deciphering rule that writes down whether effectively (step 133)? when rule is still effective, carry out network package authentication decryption processing (step 134) according to corresponding authentication deciphering rule, if otherwise rule is invalid then will initiatively abandon network package is carried out follow-up processing (step 135).
Fig. 4 A then illustrates the flow process of the present invention when transmitting network package.At first, generating socket by web application 60 connects to send data content (step 200); By socket guiding storehouse 70 socket is connected guiding then and give TOE/IPSec driver (step 210); Send the data content that socket connects to TOE/IPSec device 95 (step 220) by TOE/IPSec driver 90; To the network package (step 230) of data content execution TCP/UDP package and processing of part IP package and generation tool header information, carry out the judgement of network package.
When belonging to the IPSec package (step 240), network package is carried out the authenticated encryption of IPSec and handled (step 250); Network package is carried out the IP package handle (step 260); Just can by network 10 network package be given by TOE/IPSec device 95 at last and send out (step 270).
Wherein, the thin portion flow process of the authenticated encryption processing of relevant step 250 couple network package execution IPSec can be further described by Fig. 4 B.The process step of its thin portion comprises: determine it to handle type (step 251) according to header information; Utilize header information and processing type to read corresponding authenticated encryption rule (step 252); When authentication deciphering rule exists and be effective (step 253 and step 254), carry out the network package authenticated encryption according to corresponding authenticated encryption rule and handle (step 255).
If when step 253, when finding that required corresponding authenticated encryption rule does not exist, then will directly abandon (step 256) handled in the continuation of network package, finish the thin portion flow process of whole steps 250 then; Perhaps when the time in step 254, when finding that required corresponding authenticated encryption rule is invalid, then this moment application authentication encryption rule (step 257) again, and then carry out the part of step 255, carry out the network package authenticated encryption by corresponding authenticated encryption rule and handle, the thin portion flow process of last end step 250.
Though the present invention with aforesaid preferred embodiment openly as above, right its is not in order to qualification the present invention, any those skilled in the art, without departing from the spirit and scope of the present invention, the equivalent structure of being made changes, and all is included in the claim of the present invention.