HNA Processor Architecture for Wire-Speed Regular Expression Matching

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current networking systems face challenges in processing and securing high-level network protocols like HTTP and TCP at wire-speed, particularly in detecting security breaches using regular expressions, due to the computational intensity of pattern matching processes.

Innovation Solution

A security appliance with a Hyper Non-Deterministic Automata (HNA) processor is introduced, which includes multiple super-clusters of HNA processing units, an on-chip instruction queue, and unified memory to accelerate non-deterministic finite automata processing, offloading general-purpose CPUs from compute-intensive tasks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If general purpose processors are used to process L4-L7 network protocols and perform content inspection, then computational flexibility and protocol processing capability are improved, but processing speed and throughput deteriorate due to compute-intensive tasks

Engineering Contradiction:

Improveprotocol processing capabilityVSAvoidprocessing speed

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The system segments processing tasks by separating deterministic finite automata (DFA) processing from non-deterministic finite automata (NFA) processing. DFA processing is handled by specialized hardware for high-speed packet forwarding, while NFA processing is offloaded to dedicated NFA processing units for content inspection. This segmentation allows each component to optimize for its specific function, resolving the contradiction between versatility and speed.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces NFA processing units as intermediary components between the CPU and the packet processing pipeline. These units act as mediators that handle compute-intensive NFA-based content inspection tasks, freeing the general purpose CPU to maintain protocol processing versatility while the NFA units provide accelerated processing for security patterns and intrusion detection.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If multiple patterns and rules are applied for security breach detection, then detection accuracy and security coverage are improved, but processing time and computational load increase

Engineering Contradiction:

Improvesecurity detection accuracyVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system dynamically selects between DFA and NFA processing modes based on the pattern type and security requirements. For simple patterns requiring high speed, DFA is used. For complex patterns requiring high accuracy, NFA processing is invoked. This dynamic approach allows the system to optimize the balance between detection accuracy and processing time for different security scenarios.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent replaces traditional CPU-based mechanical processing with specialized NFA processing units that are optimized for finite automata operations. This substitution provides hardware-accelerated processing for complex security patterns, maintaining high detection accuracy while significantly reducing processing time compared to general purpose processors.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Productivity

If deterministic finite automata (DFA) are used for pattern matching, then processing speed is improved, but pattern complexity and flexibility are limited

Engineering Contradiction:

Improvepattern matching speedVSAvoidpattern complexity

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The system merges DFA and NFA processing capabilities into a unified architecture. DFA processing units handle simple patterns at wire speed, while NFA processing units handle complex patterns with higher computational requirements. The CPU coordinates between both processing types, creating a hybrid system that achieves both high speed for simple patterns and high complexity support for advanced security requirements.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS10466964B2Engine architecture for processing finite automata

Publication Date: 2019.11.05 MARVELL ASIA PTE LTD

AI summary

An engine architecture for processing finite automata includes a hyper non-deterministic automata (HNA) processor specialized for non-deterministic finite automata (NFA) processing. The HNA processor includes a plurality of super-clusters and an HNA scheduler. Each super-cluster includes a plurality of clusters. Each cluster of the plurality of clusters includes a plurality of HNA processing units (HPUs). A corresponding plurality of HPUs of a corresponding plurality of clusters of at least one selected super-cluster is available as a resource pool of HPUs to the HNA scheduler for assignment of at least one HNA instruction to enable acceleration of a match of at least one regular expression pattern in an input stream received from a network.