Finite Automata Memory Distribution for Wire-Speed Protocol Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current networking systems face challenges in processing and securing high-level network protocols (L4-L7) at wire-speed due to the limitations of general-purpose processors, particularly in content-aware applications like Intrusion Detection Systems that require inspecting packet contents for security breaches.
Innovation Solution
The method involves generating per-pattern non-deterministic finite automata (NFAs) and unified deterministic finite automata (DFAs) for efficient processing of regular expression patterns, distributing nodes across a memory hierarchy to optimize storage and performance, and configuring storage allocation settings to ensure efficient matching of patterns in input streams.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If general purpose processors are used to process L4-L7 network protocols, then flexibility and intelligence in protocol processing is improved, but processing speed deteriorates and wire-speed performance cannot be achieved
Solution Approach 1:
The system segments the processing task by separating L4-L7 protocol processing from L2-L3 packet forwarding. General purpose processors handle the flexible L4-L7 processing while dedicated network processors handle the high-speed packet forwarding, allowing each component to be optimized for its specific function without compromising the other.
2Measurement precision
If content inspection is performed at wire-speed for security analysis, then detection accuracy is improved, but processing throughput deteriorates
Solution Approach 1:
The patent introduces finite automata (both DFA and NFA) as intermediary data structures that mediate between the packet content and the security detection logic. These automata enable efficient pattern matching and content inspection at wire-speed by pre-compiling security rules into automated state machines that can process data rapidly without requiring complex real-time analysis.
3Reliability
If multiple regular expression patterns are applied for security breach detection, then detection completeness is improved, but processing complexity increases
Solution Approach 1:
The system merges multiple regular expression patterns into unified DFA and per-pattern NFA structures. By combining multiple detection rules into these automated automata, the system maintains comprehensive detection coverage while reducing the operational complexity of processing multiple individual patterns, as the automata handle pattern matching automatically once compiled.
Solution Approach 2:
The patent applies preliminary action by pre-compiling regular expression patterns into DFA and NFA automata before actual security inspection occurs. This compilation phase transforms the complex pattern matching operations into efficient automated state machine transitions, allowing rapid execution during wire-speed packet processing without re-evaluating the complexity of multiple regex patterns.
4Speed
If per-pattern NFAs are distributed across memory hierarchy, then access speed is improved, but memory management complexity increases
Solution Approach 1:
The system applies local quality by distributing different portions of the NFA automata to different memory hierarchies based on their access patterns and performance requirements. Frequently accessed parts of the automata are placed in faster memory, while less critical portions are stored in slower memory, optimizing overall access speed while managing memory resources efficiently.
Data Source
AI summary
At least one per-pattern non-deterministic finite automaton (NFA) may be generated for a single regular expression pattern and may include a respective set of nodes. Nodes of the respective set of nodes of each per-pattern NFA generated may be distributed for storing in a plurality of memories based on hierarchical levels mapped to the plurality of memories and per-pattern NFA storage allocation settings configured for the hierarchical levels, optimizing run time performance for matching regular expression patterns in an input stream.