基于多核的入侵防御系统的设计与实现  

Design and implementation of IPS based on multi-core

作　　者：杨启军[1] 鲁士文[2] 

机构地区：[1]中国科学院研究生院,北京100039 [2]中国科学院计算技术研究所,北京100080

出　　处：《计算机工程与设计》2010年第21期4595-4598,共4页Computer Engineering and Design

摘　　要：为了基于多核网络处理器设计高性能入侵防御系统,提出一个易扩展的利于性能最大化的软件方案。给出了基于多核处理器OCTEON Plus CN5860的实现。用该处理器的SSO单元进行基于流的数据包分发,各核运行相同的简单代码循环,采用轮询方式从SSO单元获得数据包。初始化时按照最大页表配置好TLB,避免TLB缺失引起的性能损失。测试数据表明,该方案的核之间取得了较充分的并行化,性能随着核数量的增加而线性增长。To design a high performanceintmsion prevention systembased on multi-core network processor a scalable software solution for maximum performance is proposed. The implementation based on OCTEON plus CN5860 is presented. The SSO unit of the processor is used to do flow-level packet scheduling. Each core runs simple executive loop and poll packets from the SSO unit. TLB entries are set with maximum page size on initialization stage and so performance loss introduced by TLB miss will be avoided. Test data show the solution has good parallel and performance gets a linear growth with the increase of cores.

关 键 词：多核处理器 入侵防御系统 并行处理 数据包保序 数据包分发 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]