CRC String Mapping for IPS Signature Detection Without Lookup Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion protection systems (IPS) face challenges in efficiently detecting variable length signatures from data packets due to the high resource demands of memory lookup tables, leading to expensive ASIC designs and increasing signature set sizes.
Innovation Solution
A hash-based string detection method using fixed logic memory and cyclic redundancy check (CRC) parity check circuits to map fixed-length CRC outputs to signatures, eliminating the need for memory lookup tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If memory lookup table is used for string detection, then detection accuracy is improved, but device complexity and manufacturing cost increase significantly
Solution Approach 1:
The patent replaces the memory lookup table mechanism with a hash-based detection mechanism using CRC parity check circuits. Instead of storing signatures in memory and performing table lookups, the system computes CRC hashes of incoming data and compares them with pre-computed hash values stored in compact tables, substituting a mechanical memory access system with a computational hash-based system that reduces memory requirements and device complexity.
Solution Approach 2:
The patent creates hash copies (CRC values) of the signature strings rather than storing the original strings themselves. By storing only the compact hash representations (e.g., 32-bit CRC values) instead of full-length signature strings, the system achieves accurate pattern matching with dramatically reduced memory requirements and simplified device architecture.
2Adaptability or versatility
If memory lookup table is used for string detection, then detection capability is improved, but loss of substance increases due to large signature set size
Solution Approach 1:
The patent stores hash copies (CRC values) of signatures instead of the original signature strings. Each signature string is transformed into a compact fixed-length hash value (e.g., 32 bits), which is then stored in the lookup table. This copying approach maintains full detection capability while reducing memory consumption by orders of magnitude compared to storing actual signature strings.
Solution Approach 2:
The patent transforms the signature data from variable-length strings to fixed-length hash values through CRC computation. This parameter transformation changes the representation from human-readable strings to compact binary hashes, enabling efficient storage and comparison while maintaining the ability to uniquely identify signature patterns.
3Adaptability or versatility
If variable length signatures are detected using fixed logic memory, then adaptability is improved, but device complexity increases without memory lookup tables
Solution Approach 1:
The patent employs a bank of CRC parity check circuits that can handle variable-length input strings and produce fixed-length hash outputs. This universal hashing approach allows the same circuit architecture to process signatures of any length by computing CRC values, then using these fixed-length hashes to index into the lookup table, achieving variable-length detection capability without proportionally increasing device complexity.
Data Source
AI summary
A CRC rule is generated for each CRC parity check circuit from a bank of CRC parity check circuits for mapping a fixed-length CRC output to a signature, each of the CRC parity check circuits servicing a specific string length. The selected CRC parity circuit outputs a fixed-length parity-check data for the specific data packet, and the string mapper maps the fixed-length parity-check data for the specific data packet to one of the string identifiers associated with the group of signatures. If a fixed-length parity-check match is found, outputting a string identifier of the match for a security action.