CN102420750B - Single package regular matching apparatus and method - Google Patents

Single package regular matching apparatus and method Download PDF

Info

Publication number
CN102420750B
CN102420750B CN 201110383388 CN201110383388A CN102420750B CN 102420750 B CN102420750 B CN 102420750B CN 201110383388 CN201110383388 CN 201110383388 CN 201110383388 A CN201110383388 A CN 201110383388A CN 102420750 B CN102420750 B CN 102420750B
Authority
CN
Grant status
Grant
Patent type
Prior art keywords
matching
protocol
regular
regular expression
module
Prior art date
Application number
CN 201110383388
Other languages
Chinese (zh)
Other versions
CN102420750A (en )
Inventor
纪奎
李锋伟
姬乃军
刘兴奎
Original Assignee
曙光信息产业(北京)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Grant date

Links

Abstract

本发明提供了一种单包正则匹配设备和方法,所述匹配设备包括:单包正则匹配单元和与所述单包正则匹配单元连接的缓存单元,所述单包正则匹配单元包括:正则表达式匹配模块,与所述正则表达式匹配模块连接的协议变量匹配模块。 The present invention provides a single package regular matching apparatus and method, the matching device comprising: a single package regular matching unit and the single packet positive buffer unit cells connected to the match, the single packet regular matching unit comprises: a regular expression matching module type, the regular expression matching variables protocol matching module connected to the module. 所述匹配方法通过将多个正则表达式根据协议变量进行分组,分别对每个正则表达式组进行编译,得到多个DFA,首先利用协议变量进行报文匹配,再利用匹配结果加载DFA以进行正则表达式匹配。 The method by matching a plurality of regular expressions grouped according to the protocol variables, separately for each group to compile a regular expression, to obtain a plurality of DFA, using the first protocol packets variables match, then using the matching result for loading DFA regular expression matching. 本发明提供的单包正则匹配设备和方法,减少了匹配过程中需要加载的数据,缩短了加载过程,减少了正则表达式匹配时间,提高了匹配性能。 The present invention provides a single package regular matching apparatus and method, the matching process reduces the data to be loaded, the loading process is shortened, the regular expression matching to reduce time, improve the matching performance.

Description

单包正则匹配设备和方法 Single package regular matching apparatus and method

技术领域 FIELD

[0001] 本发明一种网络安全系统,具体讲涉及一种单包正则匹配设备和方法。 [0001] The present invention is one kind of network security system, specifically, to a single apparatus and method for matching a regular packet.

背景技术 Background technique

[0002] 正则表达式描述了一种字符串匹配的模式,用以进行文本匹配,为在给定的字符串中寻找与给定的正则表达式相匹配的部分。 [0002] describes a regular expression pattern string matching for text matching, to find the given string in a given regular expression matching portion. 现有技术中正则表达式的应用范围很广,在通信行业和网络安全领域中主要应用于对数据流量进行模式匹配检查,如进行协议分析、病毒检测和业务分类等等。 The art of regular expression of a wide range of applications in the telecommunications industry and network security fields are mainly used for data traffic pattern matching checks, such as protocol analysis, virus detection and classification of traffic and so on.

[0003] 现有技术中,进行正则表达式匹配检查需要预先将正则表达式转换成DFA(Deterministic Finiter Automata,有限自动机),然后逻辑芯片根据编译后的DFA和输入的数据流中的字符,执行这个DFA。 [0003] In the prior art, regular expression matching requires the preliminary examination of regular expression into a DFA (Deterministic Finiter Automata, finite automaton), then the logic chip in accordance with the input data stream and the DFA compiled characters, the implementation of the DFA. 但是由于使用时,待检查的规则一般不只一条,而是成千上万条,每条规则采用一个DFA对待匹配流量检查几千次甚至上万次显然是不可能的,因此为了不遗漏待检查的规则,一般将多条规则编译成一般有百兆字节的大型DFA,在匹配进行中,将待匹配的流量作为输入,以DFA报告的输出作为匹配规则。 However, due to the use of, the general rule to be examined not only one, but tens of thousands of, each rule using a DFA treat traffic matching check thousands of times even thousands of times obviously impossible, and therefore to be examined in order not to miss rules, general rules are compiled into a plurality of generally large DFA megabytes, for matching, the flow rate to be matched as an input to output as the matching rule DFA report.

[0004] 由于大型DFA大小有几百兆字节,而一般的逻辑芯片内部无法集成这样大容量的内部存储器,只能存储在外部的SRAM (Static Random AccessMemory,静态随机存储器)或者SDRAM (Synchronous Dynamic Random AccessMemory,同步动态随机存储器)中,待匹配时,根据当前状态和输入字符读出一部分DFA片段到逻辑芯片内部进行缓存,在匹配过程中,需要不断加载与当前状态关联的数据表项,并且经常由于状态的跳转而重复加载与状态关联的数据表项,DFA越复杂,加载的数据表项就越多,现有技术的这种匹配的方法所需要的时间长,匹配性能低。 [0004] Due to the large size of a few megabytes DFA, and the general logic chip can not be integrated in the internal memory of such a large capacity, it can only be stored in an external SRAM (Static Random AccessMemory, static random access memory) or SDRAM (Synchronous Dynamic random AccessMemory, synchronous dynamic random access memory), the time to be matched, read the current state and input character a portion DFA fragment to the logic chip cache, in the matching process, the need to constantly load state associated with the current data entry, and because of the more frequently jumps repeated loading state data associated with the state of entry, the more complex the DFA, loading data entries, this prior art a long time required for the matching, matching low performance.

发明内容 SUMMARY

[0005] 为克服上述缺陷,本发明提供了一种单包正则匹配设备和方法,能缩短匹配所需要的时间。 [0005] In order to overcome the above drawbacks, the present invention provides a single package regular matching apparatus and method, can shorten the time required for matching.

[0006] 为实现上述目的,本发明提供一种单包正则匹配设备,所述匹配设备包括:单包正则匹配单元和与其连接的缓存单元,所述单包正则匹配单元包括正则表达式匹配模块,其改进之处在于,与所述正则表达式匹配模块连接的协议变量匹配模块。 [0006] To achieve the above object, the present invention provides an apparatus comprising a single-package regular matching apparatus, the Match: single package regular matching unit and therewith a cache unit connected to said single packet regular matching unit comprises a regular expression matching module , the improvement wherein, said regular expression matching variables protocol matching module connected to the module.

[0007] 本发明提供的优选技术方案中,所述缓存单元包括:设置片外DFA表的片外缓存和设置片内协议变量表的存储片内缓存;所述片外缓存与所述正则表达式匹配模块连接,所述片内缓存与所述协议变量匹配模块连接。 [0007] The preferred aspect of the present invention provides, said buffer unit comprises: an outer sheet DFA table disposed outside of the inner sheet disposed in the buffer cache and variable table stored in the protocol sheet substrate; the off-chip cache with the regular expression type mating connector module, the on-chip cache with the protocol variable matching module.

[0008] 本发明提供的第二优选技术方案中,所述协议变量匹配模块包括:协议变量匹配引擎模块和与其连接的结果处理模块;所述协议变量匹配引擎模块接收所述单包正则匹配单元的报文数据流并读取所述片内缓存中的片内协议变量表;所述结果处理模块设置有正则表达式DFA地址信息表。 [0008] The second aspect of the present invention is preferably provided in the protocol variable matching module comprises: a protocol engine module and the variable matching result processing module is connected thereto; said protocol engine module for receiving the variable matching regular single packet matching unit packet data stream and reads the buffer sheet in the on-chip protocol variable table; the result of the processing module is provided with a regular expression DFA address information table.

[0009] 本发明提供的第三优选技术方案中,所述正则表达式匹配模块包括:正则式匹配引擎(RgxBranchRngine)、分别与所述正则式匹配引擎连接的片外DFA表读取模块(RgxOffChipDfaCtrl)和汇聚模块(RgxResCollecter);所述正则式匹配引擎接收所述协议变量匹配模块的匹配结果。 [0009] The third aspect of the present invention is preferably provided, said regular expression matching module comprises: a regular expression matching engine (RgxBranchRngine), respectively, the regular expression matching outer sheet DFA table reading module (RgxOffChipDfaCtrl engine connected ) and aggregation module (RgxResCollecter); the regular expression matching engine receives the protocol variable matching results matching module.

[0010] 本发明提供的第四优选技术方案中,所述片外缓存是SRAM或者SDRAM。 [0010] A fourth preferred aspect of the present invention provides, said chip buffer is an SRAM or SDRAM.

[0011] 本发明提供的第五优选技术方案中,所述片内协议变量表设置协议变量,所述协议变量包括IP包头、TCP包头和UDP包头。 [0011] a fifth aspect of the present invention is preferably provided in the on-chip protocol protocol variable set variable table, the protocol variables include IP header, TCP header and UDP header.

[0012] 本发明提供的第六优选技术方案中,所述正则式匹配引擎设置有4路引擎或者8路引擎。 [0012] The sixth aspect of the present invention is preferably provided in a regular expression matching engine provided with engine 4 or 8 engine.

[0013] 本发明提供的第七优选技术方案中,所述正则式匹配引擎根据所述协议变量匹配模块的匹配结果,对正则表达式进行分组,将具有相同协议变量的正则表达式分组分成一组,并建立每个正则表达式组与相应协议变量的关系。 [0013] In a seventh preferred aspect of the present invention provides, said regular expression matching engine matches the variable matching result according to the protocol module, a packet of regular expressions, variables having the same protocol packets into a regular expression group, and build relationships with each regex group corresponding protocol variables.

[0014] 本发明提供的第八优选技术方案中,所述片外DFA表由所述正则表达式组形成。 [0014] The eighth preferred aspect of the present invention provides, said chip is formed by the DFA table regex group.

[0015] 本发明提供的第九优选技术方案中,提供一种单包正则匹配设备的单包正则匹配方法,其改进之处在于,所述匹配方法包括如下步骤: [0015] The ninth aspect of the present invention is preferably provided in a single package to provide a matching device regular regular single packet matching method, the improvement wherein, said matching method comprising the steps of:

[0016] (I)所述协议变量匹配引擎模块对接收到的报文提取报头信息,进行协议变量匹配;(2)所述结果处理模块将匹配上协议变量的报文,传递给所述正则式匹配引擎进行关联DFA匹配;(3)所述正则式匹配引擎接收协议变量匹配结果,通过所述片外DFA表读取模块读DFA表,对接收报文进行正则式匹配;(4)所述正则式匹配引擎完成接收报文的正则式匹配后,将匹配结果传输到所述汇聚模块。 [0016] (I) said protocol engine module variable matching the received packet to extract header information, protocol matching variable; (2) the result of the protocol processing module variable matching packets, transmitted to the canonical DFA engine type mating association matching; (3) the regular expression matching engine matches the received protocol variable, by said outer sheet DFA table reading module reads DFA table, the received packet match the regular expression; (4) described later, the regular expression matching engine completes a received message regular expression matching, the matching result is transmitted to the aggregation module.

[0017] 本发明提供的第十优选技术方案中,在所述步骤(I)中: [0017] The tenth aspect of the present invention is preferably provided, in the step (I) in which:

[0018] 所述协议变量匹配模块接收数据流中的每一个报文,提取报头中的相应信号量,在所述片内缓存中进行查找,如果报文匹配了某个协议变量,则将该报文递交给一个正则表达式匹配引擎进行关联DFA匹配,如果报文匹配了N个协议变量,则将该报文递交给不同的正则表达式引擎进行并行DFA匹配;其中,N是自然数2、3、4、5、6、7或8。 [0018] The variable matching module receives the protocol message for each data stream, the respective header semaphore extraction, to find the sheet in the buffer, if the packet matches a protocol variables, the message submitted to a regular expression matching engine matches the DFA association, if the packet matches the N variables protocol, the packet is submitted to a different regular expression engine DFA parallel matching; wherein, N is a natural number of 2, 3,4,5,6,7 or 8.

[0019] 本发明提供的较优选技术方案中,在所述步骤(2)中:所述结果处理模块在所述正则表达式DFA地址信息表中查找与报文对应的DFA地址信息,将报文传递给所述正则式匹配引擎后,根据DFA地址信息在所述正则式匹配引擎中查找相应的正则表达式,对报文进行正则表达式匹配。 [0019] more preferred aspect of the present invention is provided, in the step (2): the result of the processing modules to find DFA address information corresponding to the packet in the regular expression DFA address information table, the reported after the message is transmitted to the regular expression matching engine, the DFA address information of the n-type mating of the respective lookup engine according to a regular expression, packets match the regular expression.

[0020] 与现有技术比,本发明提供的单包正则匹配设备和方法,通过将多个正则表达式根据协议变量进行分组,分别对每个正则表达式组进行编译,得到多个DFA,首先利用协议变量进行报文匹配,再利用匹配结果加载DFA以进行正则表达式匹配,减少了匹配过程中需要加载的数据,缩短了加载过程,减少了正则表达式匹配时间,提高了匹配性能。 [0020] than the prior art, the present invention provides a single package regular matching apparatus and method, expressions grouped according to protocol by a plurality of variable n, separately for each group to compile a regular expression, to obtain a plurality of the DFA, Firstly, the protocol variables packets match, then using the matching result of loading DFA to perform regular expression matching, reducing data during the matching process needs to be loaded, shortens the loading process, reducing the regular expression matching time and improve the matching performance.

附图说明 BRIEF DESCRIPTION

[0021] 图1为单包正则匹配设备的结构示意图。 [0021] FIG. 1 is a schematic structural diagram of a single package positive matching device is.

[0022] 图2为正则表达式匹配模块的结构示意图。 [0022] FIG. 2 is a schematic view of the regular expression matching module structure.

[0023] 图3为正则式匹配的流程图。 [0023] FIG. 3 is a flowchart of the regular expression matching.

[0024]图4为协议变量在片内缓存中的存储格式示意图。 [0024] FIG. 4 is a schematic diagram of a storage format protocol variables chip cache.

具体实施方式 detailed description

[0025] 如图1所示,单包正则式匹配设备,包括:单包正则匹配单元和与所述单包正则匹配单元连接的缓存单元,所述单包正则匹配单元包括:正则表达式匹配模块和与所述正则表达式匹配模块连接的协议变量匹配模块。 [0025] As shown in FIG. 1, a single package regular expression matching device, comprising: a single package regular matching unit and the single covering regular matching buffer unit means connected to said single packet regular matching unit comprising: a regular expression matching protocol module and the variables with the regular expression matching module connected to the matching module.

[0026] 所述缓存单元包括:设置片外DFA表的片外缓存和设置片内协议变量表的存储片内缓存;所述片外缓存与所述正则表达式匹配模块连接,所述片内缓存与所述协议变量匹配模块连接。 [0026] The buffer unit comprises: the buffer is provided in the outer plate outer sheet DFA table cache and set the variable table stored in the protocol sheet substrate; the off-chip cache with the regular expression matching module is connected, the on-chip cache variable matching with the protocol module.

[0027] 所述协议变量匹配模块包括:协议变量匹配引擎模块和与所述协议变量匹配引擎模块连接的结果处理模块;所述协议变量匹配引擎模块接收进入所述单包正则匹配单元的报文数据流并读取所述片内缓存中的片内协议变量表。 [0027] The variables protocol matching module comprises: a protocol engine module and a variable matching variable matching results with the protocol engine module connected to the processing module; variable matching said protocol engine module receives the single packet into the regular packet matching unit and reads the data stream in the buffer in the protocol sheet of the sheet within the variable table. 所述结果处理模块设置有正则表达式DFA地址信息表。 The result of the processing module is provided with a regular expression DFA address information table. 所述片内协议变量表设置协议变量,所述协议变量包括IP包头、TCP包头和UDP包头。 The on-chip protocol protocol variable set variable table, the protocol variables include IP header, TCP header and UDP header.

[0028] 如图2所示,正则表达式匹配模块包括:正则式匹配引擎(RgxBranchRngine)、分别与所述正则式匹配引擎连接的片外DFA表读取模块(RgxOffChipDfaCtrl)以及汇聚模块(RgxResCollecter);所述正则式匹配引擎接收所述协议变量匹配模块的匹配结果。 [0028] As shown, the regular expression matching module 2 comprises: regular expressions matching engine (RgxBranchRngine), respectively, the regular expression matching outer sheet DFA table reading module (RgxOffChipDfaCtrl) connected to the engine and the aggregation module (RgxResCollecter) ; matching the regular expression matching result variable matching engine receives the protocol module. 所述正则式匹配引擎设置有4路引擎;所述正则式匹配引擎根据所述协议变量匹配模块的匹配结果,对正则表达式进行分组,将具有相同协议变量的正则表达式分组分成一组,得到多个正则表达式分组,并建立每个正则表达式组与相应协议变量的关系;所述片外DFA表由所述正则表达式组形成。 The regular expression matching engine 4 is provided with a routing engine; the regular expression matching engine matches a matching result according to the protocol module variable, grouping regular expressions, variables having the same protocol packets into a regular expression set, grouping the plurality of regular expressions obtained, and establish a relationship with each regex group corresponding protocol variables; said outer sheet is formed by the DFA table regex group. 其中,多个正则表达式分组具体有几组需要根据以下确定:1.根据支持协议变量的类型多少,如支持源目IP,源目port以及协议,报文负载长度6种,则应至少编译成6组正则表达式;2.考虑到正则表达式在分组少的情况下可能会造成编译DFA分组需要的时间较长,所以可根据协议变量后的正则式复杂程度,对正则表达式多分几组以减少编译时间,如100条规则可以分成10组〜20组。 Wherein the plurality of regular expressions with a particular packet groups need to determine the following: 1. The protocol supports variable number of types, such as the IP source and destination support, the source and destination port and protocol, six kinds of packet payload length should be at least compiled into six set of regular expressions; 2. Taking into account the regular expression may result in compilation time DFA packet needs long in case of a packet less, it is possible the formula Depending on the complexity positive after the protocol variables, regular expression multisection several group to reduce the compilation time, such as rules 100 may be divided into 10 ~ 20 groups groups.

[0029] 通过将多个正则表达式根据协议变量进行分组,分别对每个正则表达式组进行编译,得到多个DFA,首先利用协议变量进行报文匹配,再利用匹配结果加载有限自动机以进行正则表达式匹配,减少了匹配过程中需要加载的数据,缩短了加载过程,减少了正则表达式匹配时间,提高了匹配性能。 [0029], respectively, for each regex group by grouping a plurality of regular expression compiler variable according to the protocol, to obtain a plurality of the DFA, using the first protocol packets variables match, then using the matching result to loading Finite Automata regular expression matching, the matching process reduces the data to be loaded, the loading process is shortened, the regular expression matching to reduce time, improve the matching performance.

[0030] 对带协议变量的规则进行如下介绍: [0030] protocol with the rules of the following variables are introduced:

[0031]规则为:ip_sip = 10.0.0.l&ip_dip = 192.168.0.l&tcp_payload = HTTP ;其中,ip_sip和ip_dip为协议变量,分别表示IP报头中的源IP地址和目的IP地址,软件解析规则时为报文头中每个信号量进行编码表示不同的类型。 [0031] The rule is: ip_sip = 10.0.0.l & ip_dip = 192.168.0.l & tcp_payload = HTTP; wherein, ip_sip ip_dip and the protocol variables denote an IP header source IP address and destination IP address, the software for the parsing rules each signal represents the amount of different types of encoded packet header. ip_sip和ip_dip的类型编码为Oxl和0x2,则存储在片内缓存的协议变量格式如图4所示;tCp_payload = HTTP为正则表达式,编译为DFA后存储在片外缓存中。 ip_sip and type of encoded ip_dip Oxl and 0x2, the protocol variables are stored in the cache chip format shown in Figure 4; tCp_payload = HTTP as a regular expression compiler after DFA stored in off-chip cache.

[0032] 单包正则式匹配系统主要包括:协议变量匹配模块和正则表达式匹配模块,协议变量存储在逻辑片内缓存中,正则表达式模块存储在片外SRAM中。 [0032] in a single package regular expression matching system includes: a protocol module and a variable matching a regular expression matching module, the protocol variables are stored in the buffer logic chip, the modules are stored in the regular expression in the off-chip SRAM.

[0033] 如图2、3所示,单包正则匹配方法,包括如下步骤: [0033] As shown, a single packet 3 regular matching method, comprising the steps of:

[0034] (I)所述协议变量匹配引擎模块对接收到的报文提取报头信息,进行协议变量匹配;(2)所述结果处理模块将匹配上协议变量的报文,传递给所述正则式匹配引擎进行关联DFA匹配;(3)所述正则式匹配引擎接收协议变量匹配结果,通过所述片外DFA表读取模块读DFA表,对接收报文进行正则式匹配;(4)所述正则式匹配引擎完成接收报文的正则式匹配后,将匹配结果传输到所述汇聚模块。 [0034] (I) said protocol engine module variable matching the received packet to extract header information, protocol matching variable; (2) the result of the protocol processing module variable matching packets, transmitted to the canonical DFA engine type mating association matching; (3) the regular expression matching engine matches the received protocol variable, by said outer sheet DFA table reading module reads DFA table, the received packet match the regular expression; (4) described later, the regular expression matching engine completes a received message regular expression matching, the matching result is transmitted to the aggregation module.

[0035] 在进行所述单包正则匹配方法前,先对片内协议变量表和片外DFA表进行配置。 [0035] The single packet before performing the regular matching method, first the on-chip and off-chip protocol variable table DFA table configuration. 通过PCle下发命令给单包正则匹配设备,配置好所述片内协议变量表和所述片外DFA表。 By issuing a single command packet PCle regular matching device, configure the inner sheets and said protocol chip variable table DFA table.

[0036] 在所述步骤I中:所述协议变量匹配模块接收数据流中的一个报文,提取报头中的信号量,在所述片内缓存中进行查找,如果报文匹配了某个协议变量,则将该报文递交给一个正则表达式匹配引擎进行关联DFA匹配,如果报文匹配了N个协议变量,则将该报文递交给不同的正则表达式引擎进行并行DFA匹配;其中,N是自然数2、3、4、5、6、7或8。 [0036] In the step I: the protocol variable matching module receives a data packet stream, the semaphore extraction head packet, in the buffer to find the sheet, if the packet matches a protocol variable, the packet is delivered to a regular expression matching engine matches the DFA association, if the packet matches the N variables protocol, the packet is submitted to a different regular expression engine DFA parallel matching; wherein, N are natural numbers 2,3,4,5,6,7 or 8.

[0037] 在所述步骤(2)中:所述结果处理模块在所述正则表达式DFA地址信息表中查找与报文对应的DFA地址信息,将报文传递给所述正则式匹配引擎后,根据DFA地址信息在所述正则式匹配引擎中查找相应的正则表达式,对报文进行正则表达式匹配。 [0037] In the step (2): the result of the processing modules to find DFA address information corresponding to the packet in the regular expression DFA address information table, the packet is transmitted back to the regular expression matching engine the DFA is the address information of the n-type matching engine looks up the corresponding regular expression, for packet regular expression matching.

[0038] 在所述步骤3中:首先,主机通过RgxConfigure模块配置DFA到片外缓存(DFATbl)中;其次,正则式匹配引擎(RgxBranchRngine)接收协议变量匹配结果,根据当前字符通过RgxOffChipDfaCtrl模块读DFA表,进行匹配;再次,正则式匹配引擎完成匹配,将匹配结果输出到汇聚模块(RgxResCollecter)进行仲裁并上传至后续模块,匹配结束。 [0038] In the Step 3: First, the host configuration by RgxConfigure module DFA off-chip cache (DFATbl); and secondly, the regular expression matching engine (RgxBranchRngine) receiving protocol variable matching result, read DFA according to the current character by RgxOffChipDfaCtrl module table, matching; again, the regular expression matching engine matching is completed, the matching result is output to the aggregation module (RgxResCollecter) and upload it to a subsequent arbitration module, end match.

[0039] 单包正则式匹配系统可根据网络流量大小和匹配速度可对并行引擎数目和规则存储缓存器进行调整,如果流量大且要求匹配速度快,可将DFA存储在访问速度快但价格高的SRAM中,并将正则表达式引擎数增加至8路或者更多;如果流量小且匹配速度要求不太快的情况,可选择访问速度较慢但价格低的SDRAM存储DFA,总而言之,单包正则式匹配系统可根据规则复杂度、数目和匹配速度进行DFA存储媒介和匹配引擎数目。 [0039] in a single package regular expression matching system can be adjusted to the number of parallel engines and rule memory buffers depending on the network traffic volume and matching speed, if the flow rate and the requirements for matching speed, the DFA may be stored quickly, but the price is high in access speed an SRAM, and the number of the regular expression engine is increased to 8 or more; if the flow rate is small and matches the requirements are not too fast, the slow access select low price but the DFA SDRAM memory, summary, a single package regular expression matching system can match the speed and number of storage media and the number of matches DFA engine according to the complexity of the rules.

[0040] 需要声明的是,本发明内容及具体实施方式意在证明本发明所提供技术方案的实际应用,不应解释为对本发明保护范围的限定。 [0040] need to declare that the present invention and specific embodiments are intended to demonstrate the practical application of the technical solution provided by the invention, it should not be construed as limiting the scope of the present invention. 本领域技术人员在阅读本申请说明书后,在其精神和原理启发下,可作各种修改、等同替换、或改进。 Those skilled in the art upon reading the present specification, the spirit and principle in inspiration, various modifications may be made, equivalents, or improvements. 但这些变更或修改均在申请待批的保护范围内。 However, these changes or modifications are within the scope of the pending application.

Claims (1)

  1. 1.一种单包正则匹配设备的单包正则匹配方法,其特征在于,所述单包正则匹配设备包括:单包正则匹配单元和与其连接的缓存单元,所述单包正则匹配单元包括正则表达式匹配模块,其特征在于,与所述正则表达式匹配模块连接的协议变量匹配模块; 所述缓存单元包括:设置片外DFA表的片外缓存和设置片内协议变量表的存储片内缓存;所述片外缓存与所述正则表达式匹配模块连接,所述片内缓存与所述协议变量匹配模块连接; 所述协议变量匹配模块包括:协议变量匹配引擎模块和与其连接的结果处理模块;所述协议变量匹配引擎模块接收所述单包正则匹配单元的报文数据流并读取所述片内缓存中的片内协议变量表;所述结果处理模块设置有正则表达式DFA地址信息表; 所述正则表达式匹配模块包括:正则式匹配引擎(RgxBranchRngine)、分别与所述正则式匹 A single package regular matching device in a single package regular matching method, wherein said single packet regular matching device comprising: a single package regular matching unit and therewith a cache unit connected to said single packet regular matching unit comprises a regular expression matching module, wherein, the protocol variables match the regular expression matching module connected to the module; said buffer unit comprises: a storage chip chip set DFA table and the buffer chip is provided protocol sheets variable table buffer; the off-chip cache with the regular expression matching module is connected, the on-chip cache with the protocol variable matching module; said protocol variable matching module comprises: a protocol engine module and the variable matching result of the process connected thereto module; variable matching said protocol engine module receives the single packet of data packets matching a regular stream reading unit and the buffer sheet in the on-chip protocol variable table; the result of the processing module is provided with a regular expression address DFA information table; the regular expression matching module comprises: regular expressions matching engine (RgxBranchRngine), respectively, match the regular expression 引擎连接的片外DFA表读取模块(RgxOffChipDfaCtrl)和汇聚模块(RgxResCollecter);所述正则式匹配引擎接收所述协议变量匹配模块的匹配结果; 所述片外缓存是SRAM或者SDRAM ; 所述片内协议变量表设置协议变量,所述协议变量包括IP包头、TCP包头和UDP包头; 所述正则式匹配引擎设置有4路引擎或者8路引擎; 所述正则式匹配引擎根据所述协议变量匹配模块的匹配结果,对正则表达式进行分组,将具有相同协议变量的正则表达式分组分成一组,并建立每个正则表达式组与相应协议变量的关系; 所述片外DFA表由所述正则表达式组形成; 所述匹配方法包括如下步骤: (I)所述协议变量匹配引擎模块对接收到的报文提取报头信息,进行协议变量匹配;(2)所述结果处理模块将匹配上协议变量的报文,传递给所述正则式匹配引擎进行关联DFA匹配;(3)所述正则式匹配引擎接收协 Outer sheet DFA table reading module (RgxOffChipDfaCtrl) connected to the engine and the aggregation module (RgxResCollecter); the regular expression matching engine receives the protocol variable matching results matching module; the off-chip cache SRAM or the SDRAM is; the sheet the agreement protocol variable set variable table, the protocol variables include the IP header, TCP header and UDP header; the regular expression matching engine provided with four engines or engine 8; the regular expression matching engine matches variable according to the protocol positive match result module, the group of regular expressions, variables having the same protocol packets into a set of regular expressions, and establish a relationship with each regex group corresponding protocol variables; said outer sheet by said sheet DFA regex group is formed; the matching method comprising the steps of: (I) said protocol engine module docking variable matching extracted packet header information is received, the protocol matching variable; (2) the result of the matching processing module variable message protocol, transferred to the regular expression matching engine matches associate DFA; (3) the regular expression matching engine receives RA 变量匹配结果,通过所述片外DFA表读取模块读DFA表,对接收报文进行正则式匹配;(4)所述正则式匹配引擎完成接收报文的正则式匹配后,将匹配结果传输到所述汇聚模块; 在所述步骤(I)中: 所述协议变量匹配模块接收数据流中的每一个报文,提取报头中的相应信号量,在所述片内缓存中进行查找,如果报文匹配了某个协议变量,则将该报文递交给一个正则表达式匹配引擎进行关联DFA匹配,如果报文匹配了N个协议变量,则将该报文递交给不同的正则表达式引擎进行并行DFA匹配;其中,N是自然数2、3、4、5、6、7或8 ; 在所述步骤(2)中:所述结果处理模块在所述正则表达式DFA地址信息表中查找与报文对应的DFA地址信息,将报文传递给所述正则式匹配引擎后,根据DFA地址信息在所述正则式匹配引擎中查找相应的正则表达式,对报文进行正则表达式匹配。 Variable matching result, the off-chip DFA table reading module reads DFA table, the received packet regular expression matching; (4) the regular expression matching engine completes a received message regular expression matching, the matching result transmission to the aggregation module; in the step (I) in which: the protocol variable matching module receives each data packet stream, extracts the signal corresponding to the amount of the header, in the cache lookup of the sheet, if packet matches a protocol variables, the packet is submitted to a regular expression matching engine to associate DFA match, if the packet matches the N protocol variables, the packet is delivered to a different regular expression engine DFA parallel matching; wherein, N is a natural numbers 2,3,4,5,6,7 or 8; in the step (2): Finding the address information table, the DFA result of the processing module in the positive expression DFA address information corresponding to the packet, the packet is then transmitted to the regular expression matching engine, looks up the corresponding regular expression the DFA address information of the type matched in the positive engine, for packet regular expression matching.
CN 201110383388 2011-11-28 2011-11-28 Single package regular matching apparatus and method CN102420750B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN 201110383388 CN102420750B (en) 2011-11-28 2011-11-28 Single package regular matching apparatus and method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN 201110383388 CN102420750B (en) 2011-11-28 2011-11-28 Single package regular matching apparatus and method

Publications (2)

Publication Number Publication Date
CN102420750A true CN102420750A (en) 2012-04-18
CN102420750B true CN102420750B (en) 2015-09-23

Family

ID=45944990

Family Applications (1)

Application Number Title Priority Date Filing Date
CN 201110383388 CN102420750B (en) 2011-11-28 2011-11-28 Single package regular matching apparatus and method

Country Status (1)

Country Link
CN (1) CN102420750B (en)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9203805B2 (en) 2011-11-23 2015-12-01 Cavium, Inc. Reverse NFA generation and processing
US9426166B2 (en) * 2013-08-30 2016-08-23 Cavium, Inc. Method and apparatus for processing finite automata
US9507563B2 (en) 2013-08-30 2016-11-29 Cavium, Inc. System and method to traverse a non-deterministic finite automata (NFA) graph generated for regular expression patterns with advanced features
US9426165B2 (en) * 2013-08-30 2016-08-23 Cavium, Inc. Method and apparatus for compilation of finite automata
CN103607313B (en) * 2013-12-09 2017-04-19 深圳市双赢伟业科技股份有限公司 Based on tcp packet matching regular expression
US9904630B2 (en) 2014-01-31 2018-02-27 Cavium, Inc. Finite automata processing based on a top of stack (TOS) memory
US10002326B2 (en) 2014-04-14 2018-06-19 Cavium, Inc. Compilation of finite automata based on memory hierarchy

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7689530B1 (en) * 2003-01-10 2010-03-30 Cisco Technology, Inc. DFA sequential matching of regular expression with divergent states
CN101853301A (en) * 2010-05-25 2010-10-06 华为技术有限公司 Regular expression matching method and system

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7689530B1 (en) * 2003-01-10 2010-03-30 Cisco Technology, Inc. DFA sequential matching of regular expression with divergent states
CN101853301A (en) * 2010-05-25 2010-10-06 华为技术有限公司 Regular expression matching method and system

Also Published As

Publication number Publication date Type
CN102420750A (en) 2012-04-18 application

Similar Documents

Publication Publication Date Title
Becchi et al. A hybrid finite automaton for practical deep packet inspection
Kumar et al. Algorithms to accelerate multiple regular expressions matching for deep packet inspection
Kumar et al. Advanced algorithms for fast and scalable deep packet inspection
Bosshart et al. P4: Programming protocol-independent packet processors
US6789116B1 (en) State processor for pattern matching in a network monitor device
US20100174887A1 (en) Buses for Pattern-Recognition Processors
US6570884B1 (en) Receive filtering for communication interface
US20050238022A1 (en) Stateful flow of network packets within a packet parsing processor
Becchi et al. Extending finite automata to efficiently match perl-compatible regular expressions
US20050013293A1 (en) Statistics collection framework for a network processor
US20060101195A1 (en) Layered memory architecture for deterministic finite automaton based string matching useful in network intrusion detection and prevention systems and apparatuses
US20100293353A1 (en) Task queuing in a network communications processor architecture
US7565380B1 (en) Memory optimized pattern searching
US20100153420A1 (en) Dual-stage regular expression pattern matching method and system
US20060059165A1 (en) Highly scalable subscription matching for a content routing network
US20040174820A1 (en) Lossless, stateful, real-time pattern matching with deterministic memory resources
US7933282B1 (en) Packet classification device for storing groups of rules
US20080034427A1 (en) Fast and scalable process for regular expression search
US20060085533A1 (en) Content search mechanism
US7949683B2 (en) Method and apparatus for traversing a compressed deterministic finite automata (DFA) graph
US8180803B2 (en) Deterministic finite automata (DFA) graph compression
Lin et al. Optimization of pattern matching circuits for regular expression on FPGA
Vasiliadis et al. Regular expression matching on graphics hardware for intrusion detection
US8301788B2 (en) Deterministic finite automata (DFA) instruction
So et al. Named data networking on a router: Fast and DoS-resistant forwarding with hash tables

Legal Events

Date Code Title Description
C06 Publication
C10 Entry into substantive examination
C14 Grant of patent or utility model
TR01
TR01