DPI Core Isolation for Packet Inspection Reliability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Deep Packet Inspection (DPI) systems face challenges in maintaining network security and efficiency, particularly in data centers, where large amounts of data are processed, as they struggle to isolate DPI operations from the general-purpose core and OS, leading to potential access issues and inefficiencies in packet inspection and transmission.
Innovation Solution
The implementation of a DPI-module residing on a DPI-core, which is statically mapped and isolated from the general-purpose core and OS, using DMA, I/O MMU, interrupt controller, and memory controller to perform DPI operations independently, ensuring only the DPI-module can access DPI memory, thereby maintaining isolation and improving inspection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If DPI operations are performed on the general-purpose core and OS, then device complexity is reduced, but reliability and security deteriorate due to potential access issues and interference
Solution Approach 1:
The system is segmented into a general-purpose core/OS and a dedicated DPI core, each handling specific functions. The DPI core is isolated with its own memory space (DPI memory) that is separate from the OS memory space, allowing independent operation without interference while maintaining system reliability.
Solution Approach 2:
The DPI functionality is extracted from the general-purpose core and placed on a separate DPI core. This extraction eliminates the risk of DPI operations interfering with OS operations or being interfered with, thereby improving reliability while the overall system architecture remains manageable.
2Reliability
If DPI-module is isolated on a separate DPI-core, then reliability and security improve, but device complexity increases due to additional hardware components and isolation mechanisms
Solution Approach 1:
The DPI core is designed as a universal processing unit that can handle various DPI operations (packet inspection, filtering, routing decisions) independently. This multi-functionality consolidates multiple DPI tasks into a single dedicated core, improving reliability without proportionally increasing complexity.
Solution Approach 2:
An intermediary interface is provided between the DPI core and the general-purpose core/OS, allowing controlled communication through defined protocols and data structures. This intermediary layer manages the complexity of isolation while enabling necessary interactions, thereby improving reliability without overwhelming system complexity.
3Reliability
If DPI memory is exclusively accessible by DPI-module through isolation mechanisms, then security improves, but ease of operation deteriorates due to restricted access
Solution Approach 1:
Memory is segmented into distinct spaces: OS memory accessible by the general-purpose core and DPI memory accessible only by the DPI core. This segmentation ensures security by preventing unauthorized access while maintaining ease of operation within each segmented space through dedicated access paths.
Solution Approach 2:
An intermediary memory management mechanism is provided that allows the DPI core to access necessary data from OS memory through controlled interfaces, while preventing unauthorized access to DPI memory by the OS. This intermediary layer maintains security while preserving operational ease through defined access protocols.
Data Source
AI summary
Illustrated is a system for performing Deep Packet Inspection (DPI) that includes a core to prepare a data packet for transmission. Further, the system includes a memory controller to direct the data packet to a DPI core. Additionally, the system includes a Network Interface Card to receive the data packet for transmission after DPI is performed on the data packet by the DPI core. The system includes a Direct Memory Management module to update a descriptor that references a received data packet stored in an Operating System buffer. Moreover, the system includes an Input/Output Memory Management Unit to direct the descriptor to be stored in a DPI memory. Additionally, the system includes an interrupt controller to transmit an interrupt to the DPI core to such that the DPI core retrieves the descriptor from the DPI memory and performs DPI on the data packet stored in the OS buffer.