A high-performance hardware deep packet inspection method and device based on a heterogeneous pipeline

Abstract

The application relates to a high-performance hardware deep packet detection method and device based on a heterogeneous pipeline, which comprises the following steps: clustering and bucketing a rule set to be detected at a software end, generating an XOR retrieval table, an NSSO mask table and a cuckoo hash table configuration; adopting a three-stage pipeline processing architecture at a hardware end: a first stage uses a parallel hash array to extract a data fingerprint, carries out linear-speed preliminary screening through an XOR retriever and outputs a rule bucket activation token; a second stage dynamically activates a matching engine in response to the token, adopts an NSSO algorithm based on a bit slicing architecture, and updates a matching state through a parallel index high-low mask subtable; and a third stage uses a cuckoo hash index to cooperate with a hierarchical storage strategy to quickly check short rules on a chip and accurately verify long rules by reading external memory through a DMA mechanism. The application gradually unloads traffic pressure through multiple levels of logic, effectively solving the problems of storage bottlenecks, port conflicts and power consumption faced by large-scale rule matching in a high-speed network environment.

Description

Technical Field

[0001] This invention relates to the fields of network security and high-speed data processing technology, specifically to a high-performance hardware deep packet inspection (DPI) method and apparatus based on heterogeneous pipelines. Background Technology

[0002] With the widespread adoption of cloud computing and 5G networks, network bandwidth has increased from 10Gbps to 100Gbps or even 400Gbps. Deep Packet Inspection (DPI), a core technology in network security, requires full-content string matching of traffic payloads to identify virus signatures, intrusion attacks, or application layer protocols.

[0003] Early research in this field widely employed software detection schemes based on general-purpose CPUs, utilizing the AC multi-pattern matching algorithm for detection. However, this method is limited by the instruction serial execution bottleneck of the von Neumann architecture, facing severe memory bandwidth contention, large processing latency jitter, and excessively high CPU utilization when handling high-speed links above 100Gbps, making it difficult to meet the requirements of real-time detection. To overcome the performance bottleneck, researchers attempted to use hardware acceleration schemes based on FPGAs or ASICs. However, in ultra-high-speed network environments, existing DPI hardware implementations still face significant challenges.

[0004] Traditional DFA or AC automata-based algorithms face a severe "state explosion" problem when processing large-scale rule sets, leading to an exponential increase in storage requirements, making them difficult to implement within the limited on-chip storage resources of FPGAs. While NFA-based solutions offer compact storage, they involve numerous backtracking operations, resulting in unpredictable throughput performance and failing to meet line-rate processing requirements. Bloom filters, although highly efficient in storage, only support existence detection and cannot provide specific rule location information. Furthermore, the false positive rate increases significantly with the number of rules, placing excessive pressure on the backend precise matching module and creating a system bottleneck. Although the Cuckoo filter, proposed in recent years, outperforms Bloom filters in query performance and space efficiency, its storage density has a theoretical upper limit due to the need to reserve some empty buckets to resolve hash collisions and support dynamic insertion.

[0005] Achieving high-throughput matching, low false alarm filtering, and low-power operation for massive rules simultaneously within limited on-chip storage resources has become crucial for the practical deployment of high-performance DPI (Data Point Interaction) technology. In recent years, pipelined heterogeneous processing architectures have offered new solutions to these problems by hierarchically deploying lightweight indexing logic and heavyweight exact matching logic, thereby reducing traffic pressure at each level. However, existing multi-level architectures still have room for optimization in terms of storage density of the index structure, resource consumption of filtering algorithms, and interaction efficiency of each pipeline level.

[0006] Therefore, there is an urgent need for a high-performance hardware DPI system that can simultaneously resolve concurrent access conflicts, reduce storage overhead, and achieve low-power operation. Summary of the Invention

[0007] This invention provides a high-performance hardware deep packet inspection method and system based on heterogeneous pipelines, aiming to solve the technical problems faced by deep packet inspection in ultra-high-speed network environments, such as storage bottlenecks, concurrent access conflicts of memory ports, excessive system power consumption, insufficient throughput, high false alarm rate, and large resource consumption of existing solutions when performing large-scale rule matching.

[0008] Other features and advantages of the invention will become apparent from the following detailed description, or may be learned in part by practice of the invention.

[0009] According to a first aspect of the present invention, a high-performance hardware deep packet inspection method based on heterogeneous pipelines is provided, the method comprising: Step S101, Software Preprocessing and Configuration Distribution: Perform feature clustering and bucketing on the rule set to be detected, generate an XOR lookup table containing the rule bucket ID, and simultaneously construct a half-byte segmentation shift NSSO mask table and a cuckoo hash table based on the bit segmentation strategy. Step S102, First-level pre-filtering and indexing: In the hardware pipeline, the feature fingerprints of all byte offset positions of the current data segment are extracted by a parallel hash calculation array, and the feature fingerprints are sent to an XOR retrieval unit for parallel retrieval. Only when the retrieval is successful is a valid rule bucket activation token output. Step S103, Second-level deep filtering: In response to the rule bucket activation token, the corresponding matching engine is dynamically activated, and the high-bit and low-bit orthogonal mask sub-tables are indexed in parallel using a bit sharding architecture to update the matching status. Candidate matching tuples are generated only when the state machine detects a successful match. Step S104, Level 3 On-Demand Precise Verification: For the candidate matching tuples generated in step S103, query the on-chip hash table to extract metadata; for short rule matching, directly index the on-chip group cache; for long rules, read the complete content in the off-chip memory through the direct memory access (DMA) mechanism for comparison, and output the final detection result.

[0010] In some exemplary embodiments, the XOR retrieval table is constructed using a perfect hash structure, supporting the existence verification of rule prefixes and the retrieval of rule IDs. The XOR retrieval completes the routing resolution from feature fingerprint to rule bucket ID within a single clock cycle by reading multiple storage blocks in parallel and performing bitwise XOR operations.

[0011] In some exemplary embodiments, the NSSO mask table adopts a rule normalization strategy to adapt to a fixed-bit-width hardware engine, specifically: For multiple short rules whose length is less than the hardware bit width, their character masks are concatenated and mapped to the same mask table entry, and at least one logical isolation bit is inserted between adjacent rules; the logical isolation bit is preset to an invalid matching state in the mask definition of all characters; For long rules whose length is greater than the hardware bit width, only the prefix portion whose header length is equal to the hardware bit width is extracted to generate a mask as a pre-filtering feature.

[0012] In some exemplary embodiments, the specific steps for generating the NSSO mask table in step S101 are as follows: Extract the character features of each rule within the rule bucket; Bucket allocation is performed based on character characteristics; The standard 256-depth character mask table is reconstructed into a 16-depth high-table and a 16-depth low-table. The high-table is made sparse by using the characteristics of rule clustering, which provides a decision basis for hardware dynamic clock gating.

[0013] In some exemplary embodiments, the parallel feature extraction in step S102 specifically involves: Maintain a sliding window across clock cycles, concatenate the tail data of the previous cycle with the data of the current cycle, and use multi-path independent hash calculation logic adapted to the data bus width to calculate the prefix fingerprint of each possible N-gram starting position in the window in parallel.

[0014] In some exemplary embodiments, the XOR retrieval in step S102 employs a storage architecture based on multiple replica clusters and orthogonal row division, specifically: The multi-path parallel query requests are divided into M logical clusters, and the XOR lookup table is completely copied M times, so that each logical cluster has its own storage copy. Each storage copy is physically divided into 3 independent memory segments, corresponding to the 3 addresses required by the XOR retrieval algorithm, and each memory segment is horizontally partitioned using multi-bank technology.

[0015] In some exemplary embodiments, step S103 further includes a dual dynamic low-power control mechanism, specifically: Level 1 gating: If the rule bucket activation token indicates that the current bucket is not activated, then turn off the clock of the corresponding matching engine; Secondary gating: In the active matching engine, if the high-bit mask entry indexed by the high 4 bits of the current input character is completely invalid, then the state register flipping is suppressed during that cycle.

[0016] In some exemplary embodiments, the on-demand precise verification in step S104 employs a hybrid storage method, specifically: Construct an on-chip multi-level lookup table based on the cuckoo hash algorithm and a bit vector-based hash collision buffer to store the rule's metadata and storage address; For short rule matching, the on-chip group cache is directly indexed. For long rule matching, the burst read length is calculated based on the metadata provided by the on-chip lookup table, and the rule is read from the off-chip storage area using the DMA controller for comparison.

[0017] A high-performance hardware deep packet inspection device based on a heterogeneous pipeline, the device comprising: The configuration management module is used to divide the configurable address space of the XOR lookup table, NSSO mask table and Cuckoo Hash table, and to distribute configuration data. The pre-filtering and indexing module, as the first stage of the hardware pipeline, is used to implement primary filtering and routing of line-speed traffic. It includes N parallel feature extraction circuits and a multi-port XOR retrieval memory group. The memory group is configured with fingerprint information and rule bucket activation tokens. The token is passed to the next stage as a global trigger signal. The NSSO deep filtering module, as the second stage of the hardware pipeline, is used to perform deep filtering on data packets. It contains multiple parallel matching engines. The core matching logic of each engine adopts a bit-slicing architecture, including high-bit and low-bit orthogonal mask memory and mask hybrid logic circuit. The matching engine responds to the activation token to complete state mask reconstruction and state transition. The precision verification module, as the third stage of the hardware pipeline, is used to perform the final matching verification of candidate data. It includes an on-chip lookup table built based on the Cuckoo Hash algorithm and a DMA controller for accessing off-chip DDR memory. The DMA controller initiates a burst read operation on the off-chip DDR memory only when it receives the candidate matching signal output by the second stage. The results output module is used to collect matching results and output the detection logs in timestamp order.

[0018] In some exemplary embodiments, the pre-filtering and indexing module uses a hardware-level multi-replica cluster architecture to resolve port conflicts, specifically: The N parallel feature extraction circuits are divided into M physical clusters; The XOR retrieval memory group contains M physical storage copies with identical content, and each physical cluster has an independent read data channel connected to its corresponding storage copy; Each storage replica is divided into three independent physical memory segments, each corresponding to one of the three hash index addresses of the XOR retrieval algorithm. Furthermore, each memory segment is horizontally partitioned using multi-bank technology.

[0019] This invention provides a high-performance hardware deep packet inspection method and apparatus based on heterogeneous pipelines. By combining a three-stage pipeline architecture of pre-filtering and indexing, deep filtering, and on-demand precise verification with a hardware-software co-configuration, it achieves an ultimate balance between storage efficiency and processing performance. Compared with existing technologies, this invention has the following significant advantages: This invention boasts extremely high throughput and parallelism, overcoming the bottleneck of wide bus access. For parallel search requirements in scenarios of 100Gbps and above, this invention proposes a multi-replica cluster and orthogonal row-based storage architecture to resolve memory port conflicts during large-scale concurrent feature retrieval. This ensures that the feature indexing module can process matching requests with arbitrary byte offsets in a single cycle with deterministic low latency, achieving true line-speed detection.

[0020] To address the high resource consumption issue of traditional algorithms, this invention employs the NSSO algorithm, compressing the massive 256-depth mask table of the traditional Shift-Or algorithm into two smaller tables with a depth of 16, saving 87.5% of LUT / BRAM resources. Simultaneously, in the final stage of precise verification, massive long rules are stored in off-chip DDR memory, ensuring that expensive on-chip resources are used solely for high-speed indexing of the core, significantly optimizing storage cost-effectiveness.

[0021] In terms of low-power design, thanks to rule-based clustering preprocessing, this invention constructs a dual-gating mechanism based on data features. Not only are missed rule buckets coarsely closed, but in the active engine, by utilizing the sparsity of the High-Nibble mask table, the hardware can implement fine-grained clock gating, significantly reducing the system's dynamic power consumption and heat dissipation pressure.

[0022] In terms of deep packet inspection performance, the first level is built on the perfect hash theory, which mathematically guarantees no missed detections for the recorded features. Combined with the second level of deep filtering and the third level of full rule-based accurate comparison, the system achieves an extremely low false alarm rate and accurate attack identification while maintaining line speed.

[0023] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0025] Figure 1 This is a flowchart of a depth packet detection method based on a heterogeneous pipeline provided by an embodiment of the present invention; Figure 2 This is a software compilation flowchart provided by an embodiment of the present invention; Figure 3 This is an overall architecture diagram of a heterogeneous pipeline hardware device provided by an embodiment of the present invention; Figure 4 This is an architecture diagram of a pre-filtering and indexing module (L1) provided in this invention. Figure 5 This is an architecture diagram of a deep filtering module (L2) provided in an embodiment of the present invention; Figure 6 This invention provides a cuckoo hash table structure and its bit field definition. Figure 7 This is a network switch architecture diagram provided by an embodiment of the present invention. Detailed Implementation

[0026] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the invention will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0027] Furthermore, the accompanying drawings are merely illustrative of the invention and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0028] To address the shortcomings and deficiencies of existing technologies, this invention provides a high-performance hardware deep packet inspection method based on heterogeneous pipelines. (Reference) Figure 1As shown, the specific steps may include: Step S101, Software Preprocessing and Configuration Distribution: Perform feature clustering and bucketing on the rule set to be detected, generate an XOR lookup table containing the rule bucket ID, and simultaneously construct a half-byte split shift (NSSO) mask table and a cuckoo hash table based on the bit fragmentation strategy. Step S102, First-level pre-filtering and indexing: In the hardware pipeline, the feature fingerprints of all byte offset positions of the current data segment are extracted by the parallel hash calculation array, and the feature fingerprints are sent to the XOR retrieval unit for parallel retrieval. Only when the retrieval is successful will a valid rule bucket activation token be output. Step S103, Second-level deep filtering: In response to the rule bucket activation token, the corresponding matching engine is dynamically activated. The high-bit and low-bit orthogonal mask sub-tables are indexed in parallel using a bit sharding architecture to update the matching status. Candidate matching tuples are generated only when the state machine detects a successful match. Step S104, Level 3 On-Demand Precise Verification: For the candidate matching tuples generated in step S103, the on-chip hash table is queried to complete the short rule verification. For long rules, the complete content in the off-chip memory is read through the direct memory access (DMA) mechanism for comparison, and the final detection result is output.

[0029] Step S105: Collect the matching IDs and action codes generated by the precise verification module, and reassemble them in timestamp order to output the detection log.

[0030] Furthermore, the XOR retrieval table is constructed using a perfect hash structure, which not only supports the existence verification of rule prefixes but also supports rule ID retrieval. The XOR retrieval completes the routing resolution from feature fingerprint to rule bucket ID within a single clock cycle by reading multiple storage blocks in parallel and performing bitwise XOR operations, thereby ensuring line-speed processing capability.

[0031] Furthermore, the NSSO mask table employs a regular normalization strategy to adapt to hardware engines with fixed bit widths: For multiple short rules whose length is less than the hardware bit width, their character masks are mapped end-to-end to the same mask table entry, and at least one logical isolation bit is inserted between adjacent rules; the logical isolation bit is preset to an invalid matching state in the mask definition of all characters, and is used to forcibly block the matching state of the previous rule from being passed on to the next rule during the shift operation; For long rules whose length is greater than the hardware bit width, only the prefix portion of its header with a length equal to the hardware bit width is extracted to generate a mask, which is then used as the pre-filtering feature of the long rule. This allows rules of arbitrary length to be standardized into mask entries of uniform bit width for parallel processing.

[0032] Furthermore, the step of generating the NSSO mask table in step S101 specifically includes: Extract the character features of each rule within the rule bucket; Bucket allocation is performed based on character characteristics; The standard 256-depth character mask table is reconstructed into a 16-depth high-table and a 16-depth low-table. The high-bit mask table is made sparse by utilizing the characteristics of rule clustering, with most entries being invalid, which provides a basis for decision-making for hardware dynamic clock gating.

[0033] Furthermore, the parallel feature extraction described in step S102 specifically includes: Maintain a sliding window spanning clock cycles, concatenate the tail data of the previous cycle with the data of the current cycle, and use multi-path independent hash calculation logic adapted to the data bus width to calculate the prefix fingerprint of each possible N-gram starting position in the window in parallel.

[0034] Furthermore, the XOR retrieval described in step S102 adopts a storage architecture based on multiple replica clusters and orthogonal row division: The multi-path parallel query requests are divided into M logical clusters, and the XOR retrieval table is completely copied M times, so that each logical cluster has its own storage copy. Each storage copy is physically divided into 3 independent memory segments, corresponding to the 3 addresses required by the XOR retrieval algorithm. Each memory segment is further horizontally partitioned using multi-bank technology to support conflict-free parallel reading.

[0035] Furthermore, step S103 also includes a dual dynamic low-power control mechanism: Level 1 gating: If the rule bucket activation token indicates that the current bucket is not activated, then turn off the clock of the corresponding matching engine; Secondary gating: In the active matching engine, if the high-bit mask table entry indexed by the high 4 bits of the current input character is completely invalid, then the state register flipping within that cycle is suppressed.

[0036] Furthermore, the on-demand precise verification described in step S104 employs a hybrid storage approach, specifically including: An on-chip multi-level lookup table based on the Cuckoo Hash algorithm and a bit-vector-based hash collision buffer are constructed to store rule metadata and storage addresses. For short rule matching, the on-chip block buffer is directly indexed; for long rule matching, the burst read length is calculated based on the metadata provided by the on-chip lookup table, and the rule is read from off-chip memory using the DMA controller for comparison.

[0037] It should be noted that, as another aspect, this application also provides a high-performance hardware deep packet inspection device based on heterogeneous pipelines, including: The configuration management module is used to divide the configurable address space of the XOR lookup table, NSSO mask table and cuckoo hash table, and to distribute configuration data. The pre-filtering and indexing module, as the first level of the system, is used to implement primary filtering and routing of line-rate traffic. It adopts a storage architecture based on multi-replica clusters and orthogonal row-based storage, including N parallel feature extraction circuits and a multi-port XOR retrieval memory group. The memory group is configured with fingerprint information and rule bucket activation tokens; the fingerprint information is used for comparison filtering, and the token serves as a global trigger signal passed to the next level. The NSSO deep filtering module, as the second level of the system, is used for deep filtering of data packets. It contains multiple parallel matching engines. The core matching logic of each engine adopts a bit-slicing architecture, including high-bit and low-bit orthogonal mask memory and mask hybrid logic circuit. The matching engine responds to the activation token to complete state mask reconstruction and state transition. The precise verification module, as the third level of the system, is used to perform final matching verification on the candidate data; it includes an on-chip lookup table built based on the Cuckoo Hash algorithm, and a DMA controller for accessing the off-chip DDR memory; the DMA controller is configured to initiate a burst read operation on the off-chip DDR memory only when it receives the candidate matching signal output by the second level. The results output module is used to collect matching results and output the detection logs in timestamp order.

[0038] Furthermore, the pre-filtering and indexing module adopts a hardware-level multi-replica cluster architecture to resolve port conflicts: The N-way parallel feature extraction circuit is divided into M physical clusters; the XOR retrieval memory group contains M physical storage copies with identical content, and each physical cluster has an independent read data channel connected to its corresponding storage copy; each storage copy is further divided into 3 independent physical memory segments, which correspond to the three hash index addresses of the XOR retrieval algorithm; each memory segment is further horizontally partitioned using multi-bank technology to support conflict-free parallel reading.

[0039] Furthermore, the NSSO filtering module also integrates a hierarchical dynamic clock gating unit: Level 1 gating circuit: connected in series on the main clock path of the matching engine, and its on / off state is controlled by the rule bucket activation token; Second-level write enable circuit: connected to the write enable terminal (WE) of the shift register array, its control input terminal is connected to the data output terminal of the High-RAM, and it is configured to suppress register writing when the High-RAM outputs a mask of all "1"s.

[0040] Furthermore, the device also includes a rule compiler software component that runs on the control plane processor. It is responsible for analyzing rule set features, generating an XOR index table, an NSSO mask table, and a cuckoo hash table, and dynamically loading the binary configuration stream into the hardware device through the configuration management module.

[0041] The following is a more detailed description in conjunction with the accompanying drawings and embodiments.

[0042] Example 1 The high-performance hardware deep packet inspection method based on heterogeneous pipelines provided in Embodiment 1 of this disclosure includes: S101. Software Preprocessing and Configuration Distribution: On the software side, preprocessing is performed based on specific detection rule sets (such as Snort and Suricata rule bases) to generate configuration information, which is then distributed through the control plane. This process is specifically divided into five stages, such as... Figure 2 As shown: (1) Rule clustering and bucketing: Features are extracted from the set of rules to be detected. Using a clustering algorithm, rules with similar features are merged into K logical buckets, and each rule is assigned its own rule bucket ID. (2) Construction of XOR retrieval table: Based on the bucketing results, the compiler extracts the fixed-length prefix of each rule in the bucket as the feature key value, solves the linear equation system, and constructs an XOR retrieval table based on perfect hash theory. (3) NSSO mask generation: Generate a standard 256-depth ASCII character mask table according to the rules, and then reconstruct it into two sub-tables: High-Nibble and Low-Nibble; (4) Construction of precise verification table: Extract the complete content and metadata of all rules, such as rule ID, rule length and attack type description, and construct a multi-level hash lookup table; (5) The generated binary configuration stream is sent to the hardware system via PCIe or AXI interface.

[0043] S102, Pre-filtering and Indexing: In the hardware pipeline, a parallel hash calculation array concurrently extracts feature fingerprints from all byte offsets of the current data segment within a single clock cycle. The fingerprints are then fed into an XOR retrieval unit for parallel table lookup and XOR verification. Only when the verification passes (i.e., a search hits) is the decoded output containing a rule ID and offset, serving as a trigger signal for subsequent matching; otherwise, it is directly filtered and discarded without further processing.

[0044] S103, Deep Filtering: In response to an activation token, a specific NSSO matching engine is dynamically activated. The high-order and low-order orthogonal mask sub-tables are retrieved in parallel, and the status register is updated through shifting, injection, or logic. This process utilizes bit-parallel techniques to simultaneously track the states of multiple rules. Only when the state machine detects that the end bit of a rule is set, i.e., a prefix match is successful, is a candidate matching tuple containing the rule ID and position information assembled and output.

[0045] S104, On-Demand Precise Verification: Receives the candidate matching tuples output from S103 and initiates the on-demand verification process. A hierarchical strategy is executed based on rule type: For short rules, the on-chip memory block of the FPGA is directly queried for immediate comparison; for long rules, the context is suspended and a DMA mechanism is triggered to move the complete rule content from off-chip DDR memory for verification. Only after the full content comparison is consistent is a final detection result containing the five-tuple information generated and reported.

[0046] S105. Collect the matching information and action codes generated by the precise verification module, and reassemble them in timestamp order to output the detection log.

[0047] Example 2 Embodiment 2 of this disclosure provides a high-performance deep packet inspection (DPI) hardware acceleration device based on FPGA. This device employs a fully pipelined processing architecture, with a main clock frequency designed to be 250MHz. It is typically deployed in the network processing card of a smart network interface card (NIC) or a core router, aiming to solve the performance bottleneck problem of massive rule matching in network environments with speeds of 100Gbps and above. (Reference) Figure 3 The overall system structure diagram includes: Configuration Management Module: Serving as a bridge between hardware and software, it is used to partition the address space for configurable information such as XOR lookup tables, NSSO mask tables, and cuckoo hash tables. Its core function is to implement protocol conversion between AXI / PCIe protocols and internal configuration channels, as well as cross-clock domain processing. It supports high-speed delivery and dynamic updating of binary configuration streams generated by the software compiler, and provides the CPU with a southbound hardware configuration interface. The pre-filtering and indexing module (L1) is used to implement primary classification and routing of line-rate traffic. This module includes a parallel feature extraction unit adapted to the data bus width, an XOR filtering and indexing unit, and N XOR index tables. It filters all data within the window and generates bucket activation tokens for the next step.

[0048] Deep Filtering Module (L2): This module performs deep filtering of the data load. It includes multiple parallel NSSO matching engine channels. The core matching logic is implemented using a bit-slicing architecture. Each NSSO match contains a segmented mask memory, mask hybrid logic circuitry, and a shift-or state machine engine. In response to the activation token, it reconstructs the segmented character index into a complete state mask and performs state transitions within a single operation cycle, generating the data to be matched for the next-level precise verification module.

[0049] The precision verification module (L3) is associated with the NSSO filtering module and is used for the final precision verification of candidate matches. It includes an on-chip lookup table built using the Cuckoo Hash algorithm, a BV-based overflow buffer, and a DMA controller for accessing off-chip DDR memory. The results output module is used to collect the matching IDs and action codes generated by the precise verification module, organize the detection results of the data that have undergone pipeline processing and bypassing in order, and reassemble the detection logs according to the timestamp order.

[0050] Specifically, the pre-filtering and indexing module (L1) The L1 module is the primary matching core of this device. It innovatively improves the XOR filter into an XOR retriever, replacing the traditional Bloom filter or Cuckoo filter, thereby achieving simultaneous completion of existence verification and metadata retrieval with extremely low storage overhead.

[0051] During the offline configuration phase, the accompanying compiler first collects the feature fingerprints of all rules to be detected and constructs a key-value mapping table based on static perfect hashing. Specifically, the compiler maps each feature K to a 32-bit target value V. Crucially, this target value V is logically divided into two bit fields: the high 12 bits are the fingerprint verification segment, used to store the hash digest of the feature to reduce the false alarm rate; with a 12-bit fingerprint verification segment, the false alarm rate is approximately 0.02%; the low 20 bits are the payload segment, directly storing the rule bucket index corresponding to the feature. Subsequently, the compiler uses the Peeling Algorithm to calculate the values ​​in the storage array, ensuring that for any valid feature K, the equation is satisfied. The design rationale for choosing a 3-XOR structure instead of a 2-XOR structure is that the former can increase the memory load rate from 50% to over 90%, greatly saving expensive FPGA BRAM resources.

[0052] refer to Figure 4The diagram shows the architecture of the pre-filtering and indexing module. The hardware circuit of the L1 module includes parallel hash units, a memory array, and XOR verification logic. In each clock cycle, the hash units calculate three independent hash values ​​of the input data in parallel, which are then used as read addresses and sent to three BRAM memory banks respectively. The data bus outputs three data blocks in the next clock cycle. The XOR logic is then executed. Finally, the hardware comparator compares the high 12 bits of the result R with the fingerprint calculated in real time. If they match, a match is determined, and the low 20 bits of R are directly extracted as a valid Rule ID and output to the next level; if they do not match, it is determined to be background traffic, and an invalid signal is output. This process eliminates the need for secondary table lookups, significantly reducing access latency and storage resource consumption, and achieving existence verification and ID retrieval within a single cycle.

[0053] Specifically, the depth filtering module (L2) To address the issues of mixed long and short rules and state machine storage explosion in multi-pattern matching, the L2 module adopts the NSSO algorithm proposed in this application.

[0054] To improve hardware parallelism, the compiler performs rule concatenation during the offline phase. It links multiple short rules together, mapping them to a logical vector with a bit width of W. The core innovation of this embodiment lies in the introduction of an isolation bit: a special bit is inserted at the connection point between rule A and rule B. In the generated character mask table, the column corresponding to this isolation bit is forcibly set to all logical "1". This means that regardless of the input character, any shift operation attempting to cross this position will be cleared to zero after a bitwise AND operation. This mechanism physically prevents the propagation of the matching state of the previous rule backward, thus allowing multiple independent state machines to be maintained in parallel within the same set of registers without branch jump logic, and with almost zero logical overhead.

[0055] refer to Figure 5 This is the architecture diagram of the deep filtering module (L2). As shown, the deep filtering module (L2) adopts a bit-slicing-based parallel NSSO architecture. Its core logic consists of two sets of orthogonal mask sub-tables, High-Table and Low-Table, and their back-end merging logic. The input byte is split into high and low nibbles, which are indexed into the corresponding sub-tables, and then reassembled into a complete character mask by the merging logic. During runtime, the L2 module maintains a state register S with a width of W. For each byte in the input character stream, the hardware circuit performs atomic state update operations: .in, The injection vector is set to "1" at the beginning of all rules to ensure that any rule can respond to a new match start at any time; M[char] is the concatenated mask vector. When a bit in the status register is set to "0" and that bit corresponds to the end bit of a rule, the priority encoder inside the module is triggered, encoding the position of that bit into a rule ID, and combining it with the current data packet offset to generate a match event report.

[0056] Specifically, the precise verification module (L3) The L3 module, serving as the final verification stage, is responsible for performing a full and accurate comparison of the candidate data output by L1 and L2. To achieve a balance between limited on-chip resources and massive storage requirements, this embodiment employs a hybrid architecture based on on-chip cuckoo hash index and hierarchical rule storage.

[0057] At the core of the L3 module is a cuckoo hash table entirely deployed on the FPGA's on-chip storage resources. This table serves as the primary index for rules, configured with two independent hash paths, each bucket containing four slots. Each slot no longer simply stores a pointer, but rather a compact rule metadata descriptor. (Reference) Figure 6 Define the structure and bit fields of the Cuckoo Hash Table. The hash signature (Signature, 16 bits) is used to quickly eliminate hash collisions; the rule type flag (Type, 2 bits) indicates whether the rule is stored in the on-chip short rule area or the off-chip long rule area; the rule length (Length, 14 bits) records the exact number of bytes in the rule content; and the storage address (Address, 32 bits) points to the starting offset of the rule content in the corresponding storage area.

[0058] Depending on the rule length, this embodiment stores the rule content entities in different physical media to optimize access efficiency. For short rules with a length less than a threshold (e.g., 64 bytes), their content is densely stored in the FPGA on-chip resources. To improve storage density, the BRAM pool can be further subdivided into 16-byte, 32-byte, and 64-byte areas, allocating the most compact storage blocks according to the rule length. When the index table is hit and the type is a short rule, the hardware logic directly reads the complete rule from the on-chip BRAM using the Address and immediately compares it with the message data. The latency of this path is deterministic and extremely low. For long rules exceeding the threshold, their content is stored in a large-capacity DDR outside the chip. When the index table is hit and the type is a long rule, the hardware state machine suspends the processing context of the current stream and initiates a read request to the built-in DMA controller. After the DMA moves the data from DDR4 to the on-chip cache, the comparison logic is woken up to perform verification.

[0059] To ensure deterministic retrieval under hash collisions, this embodiment employs a fully parallel register array based on bit vectors to implement Stash. This mechanism stores overflow rules in multiple sets of parallel registers. During a query, synchronous comparisons are performed by broadcasting the input fingerprint, generating one-hot or multi-hot hit bit vectors. Combinational logic is used to prioritize the BV (Bit Vector Value), directly locating and selecting the hit entry.

[0060] Figure 7 This paper demonstrates a system-level application example of the DPI hardware acceleration device provided by this invention in a network switch. This example aims to illustrate how a deep packet inspection system can be used in an existing switching architecture to achieve line-speed security defense. The following describes the data flow of a network packet in this network switch. Data is extracted from the Ethernet interface by a parser, and the packet header vector (PHV) and payload are output to the MAU module and DPI module respectively. Matching is performed on the header and payload portions respectively. Based on the matching results, the frame processing module processes the data, and then the queue scheduling and switching modules forward the data. The role of this deep packet inspection system is that the ME module performs security checks on the data payload while processing the header, and then passes the detection results to the frame processing module for processing. Based on the security context provided by DPI, the frame processing module makes the final decision on the packet. Packets matching attack characteristics are directly dropped or redirected, while secure packets are forwarded normally, and then output via the queue scheduling and switching modules. This architecture achieves parallel co-processing of L2-L4 layer forwarding logic and L7 layer security checks, ensuring that the switch throughput performance is not compromised when deep packet inspection is enabled.

[0061] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0062] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention herein. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.

[0063] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is defined only by the appended claims.

Claims

1. A high-performance hardware deep packet inspection method based on heterogeneous pipelines, characterized in that, The method includes: Step S101, Software Preprocessing and Configuration Distribution: Perform feature clustering and bucketing on the rule set to be detected, generate an XOR lookup table containing the rule bucket ID, and simultaneously construct a half-byte segmentation shift NSSO mask table and a cuckoo hash table based on the bit segmentation strategy. Step S102, First-level pre-filtering and indexing: In the hardware pipeline, the feature fingerprints of all byte offset positions of the current data segment are extracted by a parallel hash calculation array, and the feature fingerprints are sent to an XOR retrieval unit for parallel retrieval. Only when the retrieval is successful is a valid rule bucket activation token output. Step S103, Second-level deep filtering: In response to the rule bucket activation token, the corresponding matching engine is dynamically activated, and the high-bit and low-bit orthogonal mask sub-tables are indexed in parallel using a bit sharding architecture to update the matching status. Candidate matching tuples are generated only when the state machine detects a successful match. Step S104, Level 3 On-Demand Precise Verification: For the candidate matching tuples generated in step S103, query the on-chip hash table to extract metadata; for short rule matching, directly index the on-chip group cache; for long rules, read the complete content in the off-chip memory through the direct memory access (DMA) mechanism for comparison, and output the final detection result.

2. The high-performance hardware deep packet inspection method based on heterogeneous pipelines according to claim 1, characterized in that, The XOR retrieval table is constructed using a perfect hash structure, supporting the existence verification of rule prefixes and the retrieval of rule IDs. The XOR retrieval completes the routing resolution from feature fingerprint to rule bucket ID within a single clock cycle by reading multiple storage blocks in parallel and performing bitwise XOR operations.

3. The high-performance hardware deep packet inspection method based on heterogeneous pipelines according to claim 1, characterized in that, The NSSO mask table adopts a regular normalization strategy to adapt to the fixed-bit-width hardware engine, specifically: For multiple short rules whose length is less than the hardware bit width, their character masks are concatenated and mapped to the same mask table entry, and at least one logical isolation bit is inserted between adjacent rules; the logical isolation bit is preset to an invalid matching state in the mask definition of all characters; For long rules whose length is greater than the hardware bit width, only the prefix portion whose header length is equal to the hardware bit width is extracted to generate a mask as a pre-filtering feature.

4. The high-performance hardware deep packet inspection method based on heterogeneous pipelines according to claim 1, characterized in that, The specific steps for generating the NSSO mask table in step S101 are as follows: Extract the character features of each rule within the rule bucket; Bucket allocation is performed based on character characteristics; The standard 256-depth character mask table is reconstructed into a 16-depth high-table and a 16-depth low-table. The high-table is made sparse by using the characteristics of rule clustering, which provides a decision basis for hardware dynamic clock gating.

5. The high-performance hardware deep packet inspection method based on heterogeneous pipelines according to claim 1, characterized in that, The parallel feature extraction in step S102 is specifically as follows: Maintain a sliding window across clock cycles, concatenate the tail data of the previous cycle with the data of the current cycle, and use multi-path independent hash calculation logic adapted to the data bus width to calculate the prefix fingerprint of each possible N-gram starting position in the window in parallel.

6. The high-performance hardware deep packet inspection method based on heterogeneous pipelines according to claim 1, characterized in that, The XOR retrieval in step S102 adopts a storage architecture based on multi-replica clusters and orthogonal row division, specifically as follows: The multi-path parallel query requests are divided into M logical clusters, and the XOR lookup table is completely copied M times, so that each logical cluster has its own storage copy. Each storage copy is physically divided into 3 independent memory segments, corresponding to the 3 addresses required by the XOR retrieval algorithm, and each memory segment is horizontally partitioned using multi-bank technology.

7. The high-performance hardware deep packet inspection method based on heterogeneous pipelines according to claim 1, characterized in that, Step S103 also includes a dual dynamic low-power control mechanism, specifically: Level 1 gating: If the rule bucket activation token indicates that the current bucket is not activated, then turn off the clock of the corresponding matching engine; Secondary gating: In the active matching engine, if the high-bit mask entry indexed by the high 4 bits of the current input character is completely invalid, then the state register flipping is suppressed during that cycle.

8. The high-performance hardware deep packet inspection method based on heterogeneous pipelines according to claim 1, characterized in that, The on-demand precise verification described in step S104 adopts a hybrid storage method, specifically as follows: Construct an on-chip multi-level lookup table based on the cuckoo hash algorithm and a bit vector-based hash collision buffer to store the rule's metadata and storage address; For short rule matching, the on-chip group cache is directly indexed. For long rule matching, the burst read length is calculated based on the metadata provided by the on-chip lookup table, and the rule is read from the off-chip storage area using the DMA controller for comparison.

9. A high-performance hardware depth packet detection device based on heterogeneous pipelines, characterized in that, The device includes: The configuration management module is used to divide the configurable address space of the XOR lookup table, NSSO mask table and Cuckoo Hash table, and to distribute configuration data. The pre-filtering and indexing module, as the first stage of the hardware pipeline, is used to implement primary filtering and routing of line-speed traffic. It includes N parallel feature extraction circuits and a multi-port XOR retrieval memory group. The memory group is configured with fingerprint information and rule bucket activation tokens. The token is passed to the next stage as a global trigger signal. The NSSO deep filtering module, as the second stage of the hardware pipeline, is used to perform deep filtering on data packets. It contains multiple parallel matching engines. The core matching logic of each engine adopts a bit-slicing architecture, including high-bit and low-bit orthogonal mask memory and mask hybrid logic circuit. The matching engine responds to the activation token to complete state mask reconstruction and state transition. The precision verification module, as the third stage of the hardware pipeline, is used to perform the final matching verification of candidate data. It includes an on-chip lookup table built based on the Cuckoo Hash algorithm and a DMA controller for accessing off-chip DDR memory. The DMA controller initiates a burst read operation on the off-chip DDR memory only when it receives the candidate matching signal output by the second stage. The results output module is used to collect matching results and output the detection logs in timestamp order.

10. The high-performance hardware depth packet detection device based on heterogeneous pipeline according to claim 9, characterized in that, The pre-filtering and indexing module uses a hardware-level multi-replica cluster architecture to resolve port conflicts, specifically: The N parallel feature extraction circuits are divided into M physical clusters; The XOR retrieval memory group contains M physical storage copies with identical content, and each physical cluster has an independent read data channel connected to its corresponding storage copy; Each storage replica is divided into three independent physical memory segments, each corresponding to one of the three hash index addresses of the XOR retrieval algorithm. Furthermore, each memory segment is horizontally partitioned using multi-bank technology.

Images