NFA Graph Accelerator for High-Speed Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
General-purpose processors are inefficient in handling high-capacity network and storage workloads, particularly in processing packet streams due to their poor performance in handling regular expressions and other data-processing functions.
Innovation Solution
A highly programmable data processing unit with specialized hardware-based accelerators, such as a RegEx accelerator unit, that compiles regular expressions into non-deterministic finite automata (NFA) graphs to efficiently evaluate patterns in high-speed data streams, offloading tasks from processing units.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If general-purpose processors are used to process packet streams, then device versatility is maintained, but processing speed and productivity deteriorate
Solution Approach 1:
The patent segments the packet processing function into two distinct parts: a general-purpose processor that handles control plane tasks and a specialized hardware accelerator (RegEx engine) that handles data plane pattern matching. This segmentation allows each component to be optimized for its specific function, achieving high packet processing speed while keeping the overall system manageable in complexity.
Solution Approach 2:
The patent introduces a hardware-based RegEx accelerator as an intermediary component between the network interface and the general-purpose processor. This intermediary handles the computationally intensive regular expression matching in hardware, offloading this task from the general-purpose processor and significantly improving packet processing throughput.
2Speed
If hardware-based RegEx accelerators are implemented, then regular expression evaluation speed is improved, but device complexity increases
Solution Approach 1:
The patent replaces the software-based regular expression evaluation (mechanical/system-level operation) with a hardware-based finite state machine implementation. This substitution executes pattern matching at the circuit level, achieving dramatically higher speeds by leveraging hardware parallelism and eliminating software interpretation overhead.
Solution Approach 2:
The patent transforms the regular expression pattern into a finite state automaton representation, changing the parameter of pattern evaluation from software algorithm execution to hardware state transition. This parameter change enables constant-time character classification and efficient path traversal through the state machine, improving evaluation speed while managing hardware complexity through systematic compilation.
3Productivity
If specialized hardware accelerators are used, then processing efficiency is improved, but adaptability to different data-processing functions deteriorates
Solution Approach 1:
The patent designs the hardware accelerator with a universal finite state machine architecture that can be configured to perform multiple data-processing functions. By loading different compiled regular expression patterns into the same hardware engine, the system achieves high processing efficiency for various tasks including intrusion detection, anti-virus scanning, search, and indexing without requiring separate dedicated hardware for each function.
Solution Approach 2:
The patent implements dynamic reconfigurability in the hardware accelerator, allowing the finite state machine to be reprogrammed with different regular expression patterns during operation. This dynamic capability enables the same hardware infrastructure to adapt to different data-processing requirements, maintaining versatility while preserving processing efficiency through hardware acceleration.
Data Source
AI summary
An example integrated circuit includes a memory including a non-deterministic finite automata (NFA) buffer configured to store a plurality of instructions defining an ordered sequence of instructions of at least a portion of an NFA graph, the portion of the NFA graph comprising a plurality of nodes arranged along a plurality of paths. The NFA engine determines a current symbol and one or more subsequent symbols of a payload segment that satisfy a match condition specified by a subset of instructions of the plurality of instructions for a path of the plurality of paths and in response to determining the current symbol and the one or more subsequent symbols of the payload segment that satisfy the match condition, outputs an indication that the payload data has resulted in a match.