Reverse NFA Processing for Wire-Speed Security Pattern Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current networking systems face challenges in processing and securing high-level network protocols (L4-L7) at wire-speed due to the limitations of general-purpose processors, which struggle with the computational intensity required for advanced regular expressions and deep packet inspections for security applications.
Innovation Solution
The implementation of a reverse non-deterministic finite automata (rNFA) generation and processing method within a security appliance, which enables efficient processing of advanced regular expressions by converting patterns into revised forms and using rNFA graphs to determine matches and offsets, allowing for wire-speed processing of complex security patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If general purpose processors are used to process L4-L7 network protocols, then intelligent processing capability is improved, but processing speed deteriorates and cannot achieve wire-speed forwarding
Solution Approach 1:
The patent segments the processing task by separating pattern matching (performed by specialized hardware using DFA/NFA) from intelligent processing (performed by general purpose processors). This allows the hardware to handle high-speed packet filtering while the processor handles complex L4-L7 protocol processing, resolving the contradiction between speed and intelligence.
Solution Approach 2:
The patent introduces an intermediary layer (hardware accelerator with DFA/NFA engines) that sits between the network interface and the general purpose processor. This intermediary performs preliminary pattern matching and filtering, reducing the workload on the processor while maintaining wire-speed forwarding capability.
2Adaptability or versatility
If advanced regular expressions with back-references and capture groups are implemented, then pattern matching capability is improved, but computational complexity increases and processing performance deteriorates
Solution Approach 1:
The patent performs preliminary pattern compilation during system initialization, converting complex regular expressions with back-references and capture groups into optimized DFA/NFA state machines. This preliminary action transforms computationally intensive patterns into efficient hardware-executable formats, reducing runtime complexity while maintaining full pattern matching capability.
3Measurement precision
If deep packet inspection is performed for security applications, then detection accuracy is improved, but processing time increases and wire-speed forwarding is compromised
Solution Approach 1:
The patent implements partial deep packet inspection by applying pattern matching to only the necessary portions of packets based on pre-configured rules. The DFA/NFA hardware performs selective inspection of packet contents against security patterns, achieving high detection accuracy for targeted threats while maintaining wire-speed forwarding for normal traffic that does not match security criteria.
Data Source
AI summary
In a processor of a security appliance, an input of a sequence of characters is walked through a finite automata graph generated for at least one given pattern. At a marked node of the finite automata graph, if a specific type of the at least one given pattern is matched at the marked node, the input sequence of characters is processed through a reverse non-deterministic finite automata (rNFA) graph generated for the specific type of the at least one given pattern by walking the input sequence of characters backwards through the rNFA beginning from an offset of the input sequence of characters associated with the marked node. Generating the rNFA for a given pattern includes inserting processing nodes for processing an input sequence of patterns to determine a match for the given pattern. In addition, the rNFA is generated from the given type of pattern.