NFA Byte Detector Hardware Engine for Packet Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network processors face inefficiencies in handling packet traffic and virus detection, particularly in parsing HTTP requests to identify and block malicious files, due to limitations in automaton hardware engines and indexing methods.
Innovation Solution
The implementation of a Non-deterministic Finite Automaton (NFA) hardware engine with a transition table organized into 2n rows, allowing for efficient encoding and processing of multiple NFAs, along with a pipeline and controller architecture, and interaction with transactional memory for byte stream analysis, enables effective detection and processing of packet patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If multiple NFAs are encoded into the same transition table, then the device complexity is reduced and memory utilization is improved, but the indexing complexity increases and processing speed may be affected
Solution Approach 1:
The transition table is segmented into multiple sections, with each section dedicated to a specific NFA. Each section contains state transition information for one NFA, allowing independent indexing and processing. This segmentation enables parallel access to different NFA sections without interference, resolving the contradiction between memory consolidation and processing speed.
Solution Approach 2:
An intermediary indexing mechanism is introduced that maps NFA identifiers to specific sections within the transition table. This intermediary layer allows the system to efficiently locate and process specific NFAs without scanning the entire consolidated table, maintaining high processing speed while benefiting from reduced device complexity.
2Quantity of substance
If a consolidated transition table is used for multiple NFAs, then memory usage is optimized, but the indexing efficiency deteriorates
Solution Approach 1:
The transition table is divided into distinct sections, each containing state transition data for a specific NFA. This segmentation allows the indexing mechanism to directly access the relevant section based on the NFA identifier, eliminating the need to search through the entire consolidated table and thus reducing indexing time while maintaining memory efficiency.
Solution Approach 2:
The transition table is pre-organized into sections during initialization, with each section dedicated to a specific NFA. This preliminary organization enables fast direct access during runtime operations, preventing indexing delays while maintaining the memory consolidation benefits.
3Adaptability or versatility
If all rows in the transition table are made usable for storing entry values, then the adaptability and versatility of the system is improved, but the device complexity increases
Solution Approach 1:
The transition table is designed with a universal structure where all rows can serve dual purposes: storing state transition entry values for their respective NFAs and providing indexing information for other NFAs. This multi-functionality allows the system to maximize adaptability while managing complexity through a standardized, repeatable pattern across all rows.
Solution Approach 2:
The transition table employs a nested structure where each row contains both local state transition information and global indexing information that points to other rows. This nesting allows compact representation of multiple NFAs within the same table structure, improving versatility without proportionally increasing management complexity.
Data Source
AI summary
An NFA (Non-deterministic Finite Automaton) circuit includes a hardware byte characterizer, a first matching circuit (performs a TCAM match function), a second matching circuit (performs a wide match function), a multiplexer that outputs a selected output from either the first or second matching circuits, and a storage device. N data values stored in first storage locations of the storage device are supplied to the first matching circuit as an N-bit mask value and are simultaneously supplied to the second matching circuit as N bits of an N+O-bit mask value. O data values stored in second storage locations of the storage device are supplied to the first matching circuit as the O-bit match value and are simultaneously supplied to the second matching circuit as O bits of the N+O-bit mask value. P data values stored in third storage locations are supplied onto the select inputs of the multiplexer.