NFA Node Distribution Across Memory Hierarchy for Wire-Speed Protocol Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current networking systems face challenges in processing and securing network protocol layers L4-L7 at wire-speed due to the limitations of general-purpose processors, particularly in content-aware inspection and intrusion detection, where regular expressions are used to detect security breaches.
Innovation Solution
The method involves compiling and runtime processing of finite automata, specifically walking nodes of a per-pattern non-deterministic finite automaton (NFA) to match regular expression patterns in an input stream, with nodes distributed across a memory hierarchy for efficient storage and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If general purpose processors are used to process L4-L7 network protocols, then intelligent processing capability is improved, but processing speed deteriorates and cannot achieve wire-speed forwarding
Solution Approach 1:
The patent segments the NFA nodes into different memory hierarchies (fast memory and slow memory) based on their access frequency and importance. This segmentation allows the system to maintain complex pattern matching capabilities in fast memory while storing less frequently accessed nodes in slow memory, thereby achieving both intelligent processing and high-speed forwarding.
Solution Approach 2:
The patent introduces a new dimension of memory hierarchy organization by distributing NFA nodes across multiple memory levels rather than using a single flat memory structure. This dimensional change enables the system to optimize both processing intelligence and speed by strategically placing nodes at different hierarchical levels.
2Measurement precision
If more patterns and rules are applied for intrusion detection, then detection accuracy is improved, but processing overhead increases and wire-speed performance deteriorates
Solution Approach 1:
The patent applies local quality by assigning different storage locations to different NFA nodes based on their individual access characteristics. Frequently accessed nodes related to critical detection patterns are placed in fast memory, while less frequently accessed nodes are stored in slow memory. This localized optimization maintains high detection accuracy for critical patterns while preserving wire-speed performance overall.
3Device complexity
If NFA nodes are stored in a single memory location, then system complexity is reduced, but access efficiency deteriorates due to memory hierarchy utilization
Solution Approach 1:
The patent segments the NFA node storage across multiple memory locations in the memory hierarchy rather than using a single centralized storage location. This segmentation strategy distributes nodes based on their access patterns, with hot nodes in fast memory and cold nodes in slow memory, significantly improving access efficiency while maintaining manageable system complexity through systematic node distribution.
4Productivity
If wire-speed processing is achieved through hardware optimization, then processing speed is improved, but flexibility and adaptability for complex protocol analysis deteriorate
Solution Approach 1:
The patent implements universality by creating a memory hierarchy system that can accommodate multiple types of NFA nodes and support various pattern matching operations. The system maintains flexibility for complex protocol analysis by allowing dynamic configuration of node distributions across memory levels while achieving wire-speed processing through optimized access patterns to the hierarchical memory structure.
Data Source
AI summary
At least one processor may be operatively coupled to a plurality of memories and a node cache and configured to walk nodes of a per-pattern non-deterministic finite automaton (NFA). Nodes of the per-pattern NFA may be stored amongst one or more of the plurality of memories based on a node distribution determined as a function of hierarchical levels mapped to the plurality of memories and per-pattern NFA storage allocation settings configured for the hierarchical levels, optimizing run time performance of the walk.