Deep Packet Inspection Rule Matching Using Hierarchical State Machine Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The performance of products based on Deep Packet Inspection (DPI) technology needs improvement, particularly in terms of speed and rule matching efficiency, as existing hardware implementations like FPGA can be limited by rule explosion and memory access speeds.
Innovation Solution
A rule matching method and apparatus that groups rules and stores state machines in on-chip and off-chip memory based on usage frequency, prioritizing on-chip memory for faster matching and loading off-chip state machines into on-chip memory as needed, to improve processing speed and reduce the rule explosion problem.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If hardware implementation (FPGA) is used to improve DPI performance, then processing speed is improved, but rule explosion problem occurs and memory access speed becomes a bottleneck
Solution Approach 1:
The patent segments the rule set into multiple rule groups based on classification characteristics (e.g., protocol types). Each rule group is compiled into a separate state machine, which is then stored in a corresponding memory module. This segmentation prevents rule explosion by organizing rules hierarchically and enabling selective loading of only relevant rule groups into high-speed memory, rather than loading all rules simultaneously.
2Speed
If all state machines are stored in on-chip memory for fast access, then matching speed is improved, but memory capacity is insufficient and cost increases
Solution Approach 1:
The patent implements a hierarchical memory architecture with different memory types (on-chip memory, off-chip memory) having different speeds and capacities. Frequently accessed state machines are stored in fast on-chip memory, while less frequently accessed state machines are stored in larger-capacity off-chip memory. This local quality differentiation optimizes the balance between access speed and storage capacity, ensuring that critical matching operations use fast memory while maintaining overall system capability.
3Adaptability or versatility
If software implementation is used for DPI, then flexibility is improved, but performance (speed and rule capacity) deteriorates
Solution Approach 1:
The patent replaces traditional software-based DPI processing with a hardware-accelerated architecture using FPGA. The state machines are compiled from rule sets and implemented as hardware logic circuits that can be configured to match different protocols and patterns. This substitution provides both the flexibility of programmable logic (similar to software) and the high-speed parallel processing capability of hardware, achieving both adaptability and performance.
Data Source
AI summary
The present invention discloses a rule matching method including: receiving a packet; detecting feature information in content of the packet, and determining whether the detected feature information in the packet conforms to a classification characteristic of one rule group among a plurality of preset rule groups; if yes, determining a state machine corresponding to the one rule group as a first state machine; and determining whether the first state machine is stored in an on-chip memory, and if yes, using the first state machine to match the packet to obtain a matching result; and if no, when an off-chip memory stores the first state machine, loading the first state machine from the off-chip memory into the on-chip memory, and using the first state machine to match the packet to obtain a matching result. Embodiments of the present invention enable a product to achieve better performance.