Parallel Finite Automaton Walking for Wire-Speed Pattern Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current networking systems face challenges in processing and securing network protocol layers L4-L7 at wire-speed due to the limitations of general-purpose processors in handling compute-intensive tasks, particularly in content-aware security applications like Intrusion Detection Systems that require inspecting packet contents for suspicious patterns.
Innovation Solution
The method involves using finite automata, specifically deterministic and non-deterministic finite automata, to search for regular expression patterns in an input stream by walking nodes in parallel within a processor, optimizing performance through speculative processing and context management to determine match results and subsequent actions efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If general-purpose processors are used to process L4-L7 network protocols, then intelligent processing capability is improved, but processing speed deteriorates and cannot achieve wire-speed performance
Solution Approach 1:
The patent segments the finite automaton processing into multiple parallel worker threads, each handling a portion of the state space. This allows the system to maintain the intelligence of finite automaton pattern matching while achieving wire-speed performance through parallel processing. Each worker thread independently processes packets or packet segments, dividing the computational burden to improve throughput.
Solution Approach 2:
The patent replaces traditional sequential finite automaton processing with a parallel processing architecture using multiple worker threads and lock-free data structures. This substitution of the processing mechanism enables concurrent execution of pattern matching operations, transforming the mechanical sequential system into a parallel system that achieves wire-speed performance while maintaining intelligent processing capabilities.
2Measurement precision
If deterministic finite automata (DFA) are used for content searching, then matching accuracy is improved, but memory consumption and processing complexity worsen
Solution Approach 1:
The patent applies local quality by making different parts of the finite automaton processing have different properties. Worker threads process different portions of the state space with specialized knowledge about their assigned states, allowing efficient local decision-making without requiring global synchronization. This reduces memory consumption and processing complexity while maintaining DFA matching accuracy.
Solution Approach 2:
The patent introduces a new dimension of parallelism by processing multiple states concurrently across worker threads. Instead of processing the finite automaton sequentially through all states, the system distributes state processing across multiple threads, adding a temporal parallelism dimension that reduces overall processing complexity and memory requirements.
3Ease of operation
If non-deterministic finite automata (NFA) are used for pattern matching, then processing simplicity is improved, but matching reliability and determinism worsen
Solution Approach 1:
The patent implements feedback mechanisms where worker threads continuously exchange information about pattern matches and state transitions. This feedback ensures that NFA processing maintains determinism and reliability by coordinating results across parallel threads, while preserving the processing simplicity of NFA through continued use of non-deterministic state transitions within each thread.
Solution Approach 2:
The patent merges NFA processing simplicity with DFA matching reliability by combining both approaches in the parallel worker thread architecture. Each worker thread uses NFA for simple pattern matching within its assigned state space, while the overall system achieves DFA-level reliability through coordinated results aggregation and deterministic output generation.
4Productivity
If parallel processing of multiple finite automata nodes is implemented, then wire-speed performance is improved, but context storage and retrieval requirements worsen
Solution Approach 1:
The patent applies discarding and recovering by using lock-free data structures that allow worker threads to discard unnecessary context information and recover only essential data. This reduces memory consumption in parallel processing by eliminating redundant context storage while maintaining wire-speed performance through efficient data access patterns.
Solution Approach 2:
The patent extracts only the essential context information needed for parallel finite automaton processing, removing unnecessary data from storage. By taking out only the critical state and match information required for wire-speed performance, the system reduces context storage and retrieval requirements while maintaining processing efficiency.
Data Source
AI summary
A method, and corresponding apparatus and system are provided for optimizing matching at least one regular expression pattern in an input stream by walking at least one finite automaton in a speculative manner. The speculative manner may include walking at least two nodes of a given finite automaton, of the at least one finite automaton, in parallel, with a segment, at a given offset within a payload of a packet in the input stream. The walking may include determining a match result for the segment, at the given offset within the payload, at each node of the at least two nodes. The walking may further include determining at least one subsequent action for walking the given finite automaton, based on an aggregation of each match result determined.