A Flow Classification Algorithm based on FPGA and CPU Collaboration

Flow classification is a key technique in network encryption machine, which matches 5-tuples of IP packet against a predefined rule-set to decide the subsequent processing, such as secret transmission\clear transmission\discard. Currently, there is no flow classification algorithm that can support both 10Gbps line-rate range matching and rule set real-time modification on the CPU. We solve this problem through FPGA and CPU cooperation. We perform range matching on the first packet of the data flow on the FPGA, and create a flow table entry on the CPU side. Then perform the flow table hash matching on the subsequent packets on the CPU, and design the synchronous updating scheme of the rule set and the flow table. The mechanism can significantly reduce the computational and communication overhead.