Hardware Accelerator Inline Pattern Matching for Firewall Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional Intrusion Prevention System (IPS) security inspections in firewalls are resource-intensive and inefficient due to CPU and GPU usage for parsing and matching operations, leading to impaired performance and unnecessary parsing of non-matching packets.
Innovation Solution
An apparatus and method utilizing a hardware accelerator that performs inline pattern matching on unparsed packets, comparing them with stored signatures, identifying matches, and inserting offsets and indices into packet footers for selective parsing by the CPU, thereby accelerating security inspections by parsing only matching packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IPS parsing and matching operations are performed by CPU and/or GPU, then security inspections can be conducted, but the CPU and/or GPU slow down relative to packet I/O rate and line rate, impairing firewall performance
Solution Approach 1:
The patent replaces the mechanical processing system (CPU/GPU) with an optical processing system (optical engine) for pattern matching operations. The optical engine uses optical fields to perform parallel pattern matching on packet data, achieving line-rate processing without slowing down the packet I/O rate. This substitution of processing mechanism resolves the contradiction between maintaining security inspection capability and preserving firewall performance.
Solution Approach 2:
The patent introduces an optical engine as an intermediary component between the packet input/output interface and the CPU/GPU processing units. The optical engine pre-processes packets by performing pattern matching and identifies matches before forwarding to the CPU/GPU, which then only need to handle confirmed matches. This intermediary approach maintains security inspection reliability while improving overall firewall productivity by reducing the processing burden on the CPU/GPU.
2Reliability
If packets are parsed before being matched with signatures, then matching can be performed, but packets that ultimately result in no match are unnecessarily parsed, decreasing IPS security inspection efficiency
Solution Approach 1:
The patent performs pattern matching as a preliminary action before full packet parsing. The optical engine executes pattern matching on incoming packets first, and only packets that match patterns are then subjected to full parsing by the CPU/GPU. This preliminary filtering action eliminates unnecessary parsing of non-matching packets, thereby reducing time loss while maintaining matching accuracy.
Solution Approach 2:
The patent segments the security inspection process into two distinct stages: (1) optical pattern matching stage that quickly identifies potential matches, and (2) CPU/GPU parsing stage that performs detailed analysis only on matching packets. This segmentation allows the system to apply different processing methods to different packets based on their match status, reducing overall parsing time while preserving matching reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed apparatus may include a physical processing that (1) receives, at a network device, a packet that is destined for a computing device within a network, (2) performs pattern matching on the packet by (A) comparing at least a portion of the packet with a set of signatures that facilitate pattern matching in connection with network traffic and (B) determining, based at least in part on the comparison, that the portion of the packet matches at least one of the signatures, (3) parses, after performing the pattern matching, at least the portion of the packet to determine whether the packet is malicious based at least in part on the portion of the packet, and then (4) upon determining that the portion of the packet is malicious, performs at least one security action in connection with the packet. Various other apparatuses, systems, and methods are also disclosed.