KR102055494B1 - Code processor for signature and PCRE search, and method for searching signature and PCRE using the same - Google Patents

Abstract

The present invention relates to a code processor for searching for a signature and a PCRE, and a signature and PCRE searching method using the same. According to the present invention, when a packet or payload is input, the packet is parsed and divided into n-tuples (n is a natural number of two or more), and the payload is classified for each character. After performing a pattern or PCRE search through at least one state processing, the execution result is changed to a preset format and transmitted.
Accordingly, the detection method using the finite automata method as a method for improving signature and PCRE detection performance of signature-based security equipment uses a state transition table generated using a finite automater. In order to overcome the limitation that overall process performance is determined by memory performance because it is stored in one high memory and refers to it, the memory bottleneck is distributed logically by the state transition table. It provides an effect that can solve the performance degradation problem caused by the phenomenon.

Description

Code processor for signature and PCRE search, and method for searching signature and PCRE using the same}

The present invention relates to a code processor for detecting a signature and a PCRE, and a signature and a PCRE searching method using the same. More specifically, the present invention provides a method for improving signature and PCRE detection performance of a signature-based security device. The finite automata detection method uses a finite automater to store the state transition table in one high-capacity memory and finds the next state. In order to overcome this determined limitation, the code processor for searching the signature and PCRE to solve the performance bottleneck problem caused by the memory transition by logically distributing the state transition table by character, and Using relates to the signature and the PCRE search method.

As a system for responding to the security problems caused by the recent explosion of Internet usage, signature-based security devices organized into each intrusion list have been in the spotlight, but the payload of each packet Comparing all registered signatures and payloads by separating (payload) takes too much time and has a practically impossible limitation.

As a result, security devices support Perl Compatible Regular Expressions (PCRE) engines to detect attacks that have many variations and cannot be represented as fixed strings. It's a reality that uses shortcuts.

More specifically, by replacing the time-consuming threshold in the conventional signature-based security device with the security device of the "Finite Automata" method, the payload excluding the header from the packet After dividing by byte and expressing ASCII codes, the signature may be searched using Non-deterministic Finite Automata (NFA) or Deterministic Finite Automata (DFA) as shown in FIG.

First, as shown in FIG. 1A, the non-deterministic finite automata (NFA) method is capable of dividing the first state (a, b) of the string on the signature on the Goto-graph using each state number. By setting the number, a method of reaching the target state number can be taken. That is, the NFA method is non-deterministic because there may be several next state numbers, and various possibilities must be considered in order to select the next state.

As shown in Table 1, in Example 1, when the signature is expressed as ab + cd (+ means repetition of b), in FIG. 1A, state numbers 0-> 1-> 2-> 3-> 1 / Finally, the signature can be searched corresponding to the destination state number (1/4).

division Contents Example 1 ab + cd Example 2 ab + ce Example 3 ab + c. * f Example 4 b [d-f] a Example 5 bdc

However, this non-deterministic finite automata (NFA) approach is not the state number 0-> 1-> 2-> 3-> 1/4, but instead of the end number as 0-> 5-> 6-> 7-> 8/2. If only one character proceeds on the wrong goto-graph, if the state number is incorrect in proceeding from 7-> 8/2, the limitation that needs to proceed from the beginning may occur again.

To overcome this limitation, the signature may be searched using a Deterministic Finite Automata (DFA) as shown in FIG. 1B. That is, in the case of a character without a next state number in the DFA (Deterministic Finite Automata), the signature may be searched through a branched state number for each character rather than proceeding from the beginning.

That is, since the DFA method sets only the next state number defined by the transition function, the number of possibilities for selecting the next state can be reduced compared to the NFA method.

In the DFA (Deterministic Finite Automata), as shown in FIG. 2, a target state number {2, 7, 7, 9} according to various strings {he, she, his hers} may be designated as an output function.

In addition, as shown in FIG. 3, when a next state according to each character string is not found, a failure function is included, and a Goto Table as shown in FIG. 4A and a Goto Table as shown in FIG. 4B are next from each current state number. The state table that summarizes the state numbers, and the failure table that functionalizes the failure function, grows exponentially with each number, which is the relationship between the byte of FIG. 5 and the number of signatures that are table elements. This can be seen in the chart.

As such, when the signature and PCRE search processor store the state transition table represented by Goto Table and Failure Table in memory and search for the signature through memory access by software processing, As the number and size increase, there is a limit of performance as the state transition table increases and the number of memory accesses increases.To overcome this, increase the number of processing processes or The hardware approach is to increase the performance of the processing process, but as the traffic volume increases with a single memory, there is a limit that cannot solve the performance degradation problem caused by the memory bottleneck.

Accordingly, in the technical field, there is a demand for technology development to dramatically improve the efficiency of signature and PCRE search by switching to a process access method through code distribution according to characters in memory access on one memory.

Korean Patent Application No. 10-1999-0056027 "APPARATUS FOR SEARCHING A PREAMBLE SIGNATURE OF ARANDOM ACCESS CHANNEL"

The present invention is to solve the above problems, in order to improve the signature and PCRE detection performance of the signature-based security device by switching to a process access method through the code distribution according to the character in the memory access on one memory, The present invention provides a signature processor and a code processor for retrieving a signature and a PCRE to significantly improve the efficiency of signature and PCRE retrieval, and a signature and PCRE retrieval method using the same.

In addition, the present invention solves a wide range of tables corresponding to the shortcomings of DFA-based signatures and PCRE search, so that the process can be processed regardless of hardware and memory performance, and a code processor for PCRE search and a signature using the same And to provide a PCRE search method.

In addition, the present invention uses multiple code processes instead of one packet process to process packets, payloads, or user data in terms of characters rather than packet perspectives, thereby reducing memory load and reducing the code processor of each character. Not only can be extended to 2 or more depending on the access rate, but also the code processor for signature and PCRE search to enable the distributed processing process for other characters when the code process assigned to one character is idle. And to provide a signature and PCRE search method using the same.

However, the objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, a code processor for searching for a signature and a PCRE according to an embodiment of the present invention may be parsed when a packet, a payload, or user data is input. Patterns are divided into n-tuples (n is a natural number of two or more) and through state processing in which at least one payload or user data is set for each character. Or after performing PCRE Searching, the execution result is changed to a preset format and then transmitted.

In this case, in the code processor for signature and PCRE search according to another embodiment of the present invention, a state engine 124a for processing state processing for each character corresponds to a character in bytes. Is assigned to a predetermined number of characters, and in a state engine (124a) that is in charge of each character, it is assigned to at least two or more when it is equal to or more than a predetermined threshold access rate, and assigned to one character. When the state engine 124a is in an idle state, it is possible to perform a distributed processing process for another character.

Also, a code processor for searching for a signature and a PCRE according to another embodiment of the present invention includes a user interface block (UIB) 110 and a service processing block (SPB) 120, and includes a user interface block (UIB). 110, a Packet / Payload Interface Block (PIB) 111, which plays a role of receiving information through an external I / F (Interface) and delivering the information to a payload distribution block (PDB) 112; A Payload Distribute block (PDB) 112 which performs parsing of input information and is responsible for allocating a payload (Payloa) to a payload processor (PP) 121a; And a RPB (Result Processor Block) in charge of the function of sorting the result of a state engine (124a: 124a-0 to 124a-255) by sorting by payload. 113; It is characterized in that the configuration.

In addition, in the code processor for the signature and PCRE search according to another embodiment of the present invention, the SPB (Service Processing Block) 120, payload (Payload) or user data (user data) from the PDB (112) A Payload Processor Group (PPG) block 121 which receives the received message and performs Signature / Perl Compatible Regular Expressions Matching; A first stage switch engine group (FSEG) 122 and a second stage switch engine group (SSEG) 123 that are responsible for a switching function between the PPG 121 and the state engine group (SEG) 124; And after analyzing the direction of the data (data) input from the PP (Payload Processor) (121a) through the state tree (state tree) generated for each character by the finite automata (Finite Automata), the direction analysis result ( A SEG 124 block for searching for a final signature or PCRE through movement between character state engines 124a assigned to characters according to the next state; Characterized in that it comprises a.

In addition, a code processor for searching for a signature and a PCRE according to another embodiment of the present invention is a block that is in charge of control and state management of the code processor 100 and a control path of the UIB 110. Code processor control block (CCB) 130 for performing control communication through; It characterized in that it further comprises.

In order to achieve the above object, a signature and a PCRE discovery method using a signature and a code processor for PCRE discovery according to an embodiment of the present invention may include a packet, a payload, or user data. A first step of parsing the data into n-tuples (n being a natural number of two or more); And performing a pattern or PCRE search through state processing in which at least one payload or user data is set for each character, and then performing a preset format. A second step of transmitting to change; Characterized in that it comprises a.

In this case, in the signature and the PCRE search method using a signature and a code processor for PCRE search according to another embodiment of the present invention, the second step is the method according to claim 6,

A state engine 124a for processing the state processing for each character is assigned to a predetermined number of characters, and a threshold access rate set in advance in the state engine 124a in charge of each character At least two (or more than an access rate) is allocated, and when the state engine (124a) assigned to one character is in an idle state, a distributed processing process for another character may be performed.

In addition, in the signature and PCRE search method using a signature and a code processor for PCRE search according to another embodiment of the present invention, the first step is a first step of inputting information through an external I / F (Interface) Step 1-1; A first and second steps of parsing the input information and allocating a payload (Payloa) to a payload processor (PP) 121a; Characterized in that it comprises a.

Also, in the signature and PCRE discovery method using a signature and a code processor for PCRE discovery according to another embodiment of the present invention, the second step is to receive a payload or user data Step 2-1 to proceed with Signature / Perl Compatible Regular Expressions Matching; And after analyzing the direction of the data (data) input from the PP (Payload Processor) (121a) through the state tree (state tree) generated for each character by the finite automata (Finite Automata), the direction analysis result ( Searching for the final signature or PCRE by moving between the state engines (124a) for each character assigned to the character according to the next state; Characterized in that it comprises a.

In addition, in the signature and PCRE search method using the signature and the code processor for PCRE search according to another embodiment of the present invention, the state engine (124a) in charge of each character, each character on the Goto Table Extract and reorder the columns (cr), and convert each cell to 1 bit (1, 0) information to indicate the presence of the next state number or state number ID (SID). SE (State) having "VC_Table (124c)" and "SID Table (124d)" for extracting SID using PSID (Pre-State ID) on PSID_Valid table (124b) "and PSID_V Table (124b). Engine) 124a.

Further, in the signature and PCRE discovery method using the signature and the code processor for PCRE discovery according to another embodiment of the present invention, the PSID_V table (PSID_Valid table) 124b is each arranged in a vertical straight form on the Goto Table. The character string cr may be reconfigured into a cell grid m × l like the PSID_Valid table 124b.

A code processor for searching for a signature and a PCRE, and a signature and PCRE searching method using the same, according to an embodiment of the present invention, are methods for improving signature and PCRE detection performance of a signature-based security device. In order to overcome the limitation that the overall process performance is determined by the memory performance, the memory is logically distributed by character, thereby solving the memory bottleneck problem.

Also, a code processor for searching for a signature and a PCRE, and a signature and PCRE searching method using the same according to another embodiment of the present invention solve a wide range of problems corresponding to the shortcomings of a DFA-based signature and a PCRE searching to solve hardware and hardware problems. It can provide a processable effect regardless of memory performance.

In addition, a code processor for searching for a signature and a PCRE according to another embodiment of the present invention, and a method for searching for a signature and a PCRE using the same, use a multiple code process instead of a single packet process. , Payload, or user data to reduce memory overhead and scale up to at least two, depending on the access rate of each character's code processor. In the case of a state, there is an effect that it is possible to perform a distributed processing process for other characters.

1 to 5 are diagrams for explaining the principle and problems of the packet processor-based operation for the signature and PCRE search according to the prior art.
6 is a diagram illustrating the main components of the code processor 100 for signature and PCRE discovery according to an embodiment of the present invention.
FIG. 7 illustrates in detail the components of the code processor 100 for signature and PCRE discovery according to an embodiment of the present invention.
8 is a view illustrating a principle of a process of analyzing and transmitting a direction of an input character through state tree information generated for each character in the code processor 100 for signature and PCRE search according to an embodiment of the present invention. Drawing.

Hereinafter, the detailed description of the preferred embodiment of the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, detailed descriptions of well-known functions or configurations will be omitted when it is deemed that they may unnecessarily obscure the subject matter of the present invention.

6 is a diagram illustrating the main components of the code processor 100 for signature and PCRE discovery according to an embodiment of the present invention. FIG. 7 illustrates in detail the components of the code processor 100 for signature and PCRE discovery according to an embodiment of the present invention. Meanwhile, in the present invention, a signature search method is mainly applied for convenience of description, but may be modified and applied to a code processor for intrusion detection such as PCRE search.

Referring to FIGS. 6 and 7, the code processor 100 extracts and rearranges each character string cr on the Goto Table, but states each cell next to a state number or state number ID. SID by using the PSID_V table (124b) and the PSID (Pre-State ID) on the PSID_V Table 124b. A state engine (SE) 124a having a "VC_Table 124c" and a "SID Table 124d" for extracting the data is utilized.

Here, the PSID_Valid table 124b is a cell grid (m × l) where m and l are the same as or different from each other, as shown in the PSID_Valid table 124b of FIG. 8. Two or more natural numbers).

On the other hand, the code processor 100 may include a packet, a payload, or a packet through an external I / F (Interface) such as 10G, 100G, PCI Express (PCIe), or a local bus. When user data is input, it is parsed and divided into n-tuples (n is a natural number of two or more), and at least payload or user data for each character is obtained. After performing pattern or PCRE Searching through one or more state processing, the result is changed to a preset format and transmitted. For this purpose, the UIB 110 and the UIB 110 are transmitted. Service Processing Block (SPB) 120, and Code Processor Control Block (CCB) 130 that is responsible for control and state management.

In one embodiment of the present invention, the state engine 124a for processing the state processing for each character may be allocated to a predetermined number of characters (eg, corresponding to a character in a byte unit). Per 256 characters from 0 to 255).

Each state engine 124a in charge of each character may be allocated to at least two or more state engines 124a which are assigned to one character when it is equal to or more than a predetermined threshold access rate. ) Is idle, you can perform a distributed processing process on other characters.

First, the UIB 110 is a PIB (Packet / Payload Interface Block) 111 in which information is input through an external I / F (Interface) to perform 100G, 10G, PCIe, and Local Bus interfaces, and input information. Payload Distribute block (PDB) 112, which performs parsing of the payload and allocates payloads to the payload processor (PP) 121a, and a state engine RPB (Result Processor Block) 113, which is responsible for sorting the result of a state engine (124a: 124a-0 to 124a-255) by sorting the payloads by payload, and packetizing them. It consists of.

The SPB 120 receives a payload or user data from the PDB 112 and performs a Payload Processor Group (PPG) 121 performing a signature / Perl Compatible Regular Expressions Matching. Block, First stage Switch Engine Group (FSEG) 122 and Second stage Switch Engine Group (SSEG) 123, which are responsible for the switching function between PPG 121 and State Engine Group (SEG) 124. And, after analyzing the direction of the data (data) input from the payload processor (121a) through the state tree (state tree) generated for each character by the finite automata (Finite Automata), the direction analysis result A SEG 124 block for searching for a final signature or PCRE through movement between character state engines 124a assigned to characters according to (Next State).

The CCB 130 is a block in charge of control and state management of the code processor 100 and performs control communication through a control path of the UIB 110.

8 is a view illustrating a principle of a process of analyzing and transmitting a direction of an input character through state tree information generated for each character in the code processor 100 for signature and PCRE search according to an embodiment of the present invention. Drawing.

Referring to FIG. 8, the SE 124a accesses the PSID_V table 124b using the PSID bits received from the SSEG 123 to enable available PSID locations. '1') to check whether the character for the received PSID (Pre-State ID) corresponds to the character assigned to the user.

Accordingly, when the bit of the PSID position of the PSID_V table 124b is '1' (bit of PSID_V table = '1'), the SE 124a determines the PSID of the PSID_V table (PSID_V table) 124b. SID matched by adding the number of '1's up to the corresponding bit to the row corresponding to the value, and then adding the value of the VC table 124c corresponding to the row matching the summed number. The SID value on the (State ID) table (SID table) 124d can be extracted.

Here, the SID table 124d is formed by a combination of SID values matching the Match value with the value of the VC table 124c as a Match value. The SID value corresponding to the state number to be processed can be extracted.

That is, the SE 124a accesses the SID table 124d and analyzes the match ('1': match) information and the SID information, and then the PP 121a corresponding to the payload processor ID (PPID). To send. When the analyzed information is input, the PP 121a corresponds to the next character of the payload using the PPID (PP 121a) ID and the input SID (State ID) as the PSID (Pre-State ID). The transmission to 124a may be used to search for the final signature or PCRE, or the SE 124a itself may pass the direction analysis result (next state) directly to the SE 124a assigned to another character.

On the contrary, when the PSID bit of the PSID_V table 124b is '0' (bit of PSID_V table = '0'), the SE 124a of the PSID_V Table 124b is moved from the Move Table 124e. SID information is transmitted to the PP 121a corresponding to the PPID by using the location information matching the location bit value of.

Here, the move table 124e is formed to have the same structure as the cell lattice m × l of the PSID_V table 124b, so that the move table 124e corresponds to the order of the PSID (pre-state ID) received from the SSEG 123. On the PSID_V Table 124b, if the PSID bit is '0' (bit of PSID_V table = '0') on the NFA (Non-deterministic Finite Automata) described above with reference to FIG. Each cell can be generated with one bit (0 or 1) to represent return to state number 0 and repetition of the input PSID.

When the value extracted from the Move Table 124e is '0' (bit of Move Table = '0'), the SE 124a uses the PP corresponding to the Payload Processor ID (PPID). 121a), and when the value extracted from the Move Table 124e is '1' (bit of Move Table = '1'), the input PSID is PP corresponding to the Payload Processor ID (PPID). By transmitting to (Keep now state), it is possible to solve the bottleneck problem through memory distribution for each character while performing the same function as the existing NFA and DFA method.

As described above, the present specification and drawings have been described with respect to preferred embodiments of the present invention, although specific terms are used, it is only used in a general sense to easily explain the technical contents of the present invention and to help the understanding of the present invention. It is not intended to limit the scope of the present invention. It will be apparent to those skilled in the art that other modifications based on the technical idea of the present invention can be carried out in addition to the embodiments disclosed herein.

100: Code Processor
110: UIB (User Interface Block)
120: Service Processing Block (SPB)
121: Payload Processor Group (PPG)
121a: Payload Processor
122: Stats Engine Table
130: code processor control block (CCB)

Claims (12)

When a packet, payload or user data is input, it is parsed and divided into n-tuples (n is a natural number of two or more), and a payload or A signature for performing a pattern or a PCRE search through state processing in which at least one user data is set for each character, and then changing the execution result to a predetermined format and transmitting the same. In the code processor for PCRE search,
Extracts and rearranges each character string (cr) on the Goto Table, and converts each cell to 1 bit (1, 0) of information to indicate whether or not there is a next state number or state number ID (SID). "PSID_Valid table 124b" and "VC_Table 124c" and "SID Table 124d" for extracting SIDs using PSID (Pre-State ID) on PSID_V Table 124b. Code processor for signature and PCRE search, characterized in that utilizing the provided state engine (SE) (124a).
The method according to claim 1,
A state engine 124a for processing state processing according to each character is allocated to a predetermined number of characters, and a threshold access rate preset in the state engine 124a in charge of each character (access rate) or more are assigned to at least two, and when the state engine (124a) assigned to one character is idle state, it is possible to perform a distributed processing process for other characters Code processor for signature and PCRE traversal.
The method according to claim 1, Code Processor (Code Processor) 100,
The user interface block (UIB) 110 and the service processing block (SPB) 120, the user interface block (UIB) 110,
A PIB (Packet / Payload Interface Block) 111, which is responsible for receiving information through an external I / F (Interface) and delivering it to a Payload Distribute block (PDB) 112;
A Payload Distribute block (PDB) 112 which performs parsing of input information and is responsible for allocating a payload (Payloa) to a payload processor (PP) 121a; And
Result Processor Block (RPB) that is responsible for sorting the result of the state engine (124a: 124a-0 to 124a-255) by sorting the payloads by payload (113); Code processor for signature and PCRE search, characterized in that configured.
The method according to claim 3, Service Processing Block (SPB) 120,
A Payload Processor Group (PPG) block 121 that receives a payload or user data from the PDB 112 and performs Signature / Perl Compatible Regular Expressions Matching;
A first stage switch engine group (FSEG) 122 and a second stage switch engine group (SSEG) 123 that are responsible for a switching function between the PPG 121 and the state engine group (SEG) 124; And
After analyzing the direction of data input from the PP (Payload Processor) 121a through state tree information generated for each character by Finite Automata, the direction analysis result (next) A SEG 124 block for searching for a final signature or PCRE through movement between character state engines 124a assigned to characters according to states; Code processor for signature and PCRE search, characterized in that it comprises a.
The method according to claim 4,
A code processor control block (CCB) 130 for performing control communication through a control path of the UIB 110 as a block in charge of control and state management of the code processor 100; Code processor for signature and PCRE search further comprising a.
The code processor for signature and PCRE search is parsed when a packet, payload or user data is input, and n-tuple (n is a natural number of two or more). A first step of dividing; And
The code processor for signature and PCRE search performs pattern or PCRE search through state processing in which at least one payload or user data is set for each character. A second step of changing a performance result to a preset format after the performance and transmitting the result; Including;
In the second step, the code processor for signature and PCRE search,
Extracts and rearranges each character string (cr) on the Goto Table, and converts each cell to 1 bit (1, 0) of information to indicate whether or not there is a next state number or state number ID (SID). "PSID_Valid table 124b" and "VC_Table 124c" and "SID Table 124d" for extracting SIDs using PSID (Pre-State ID) on PSID_V Table 124b. Signature and PCRE search method characterized in that using the provided state engine (SE) (124a).
The method of claim 6, wherein the second step,
A state engine 124a for processing the state processing for each character is assigned to a predetermined number of characters, and a threshold access rate set in advance in the state engine 124a in charge of each character access rate) or more, and at least two signatures are assigned, and when the state engine (124a) assigned to one character is idle, the signature may be performed by a distributed processing process for another character. And how to navigate the PCRE.
The method of claim 7, wherein the first step,
A first step in which information is input through an external I / F (Interface); And
Performing a parsing of the input information and assigning a payload to a payload processor (PP) 121a; Signature and PCRE search method comprising a.
The method of claim 8, wherein the second step,
A second step of receiving a payload or user data and performing signature / perl compatible regular expressions matching; And
After analyzing the direction of data input from the PP (Payload Processor) 121a through state tree information generated for each character by Finite Automata, the direction analysis result (next) Searching for a final signature or PCRE by moving between state engines (124a) for each character assigned to the character according to the state; Signature and PCRE search method comprising a.
delete The method according to claim 1, PSID_V table (PSID_Valid table) 124b,
A code processor for retrieving signatures and PCRE, characterized in that each character string (cr) arranged in a vertical straight line on a Goto Table has a form reconstructed into a cell grid (m × l) such as a PSID_Valid table (124b).
The method according to claim 1,
It is formed to have the same structure as the cell grid (m × l) of the PSID_V Table 124b, and the PSID bit on the PSID_V Table 124b corresponding to the sequence number of the PSID (Pre-State ID) received from the SSEG 123 is' If there is no next state number of 0 '(bit of PSID_V table =' 0 '), each cell has 1 bit (0) to express return to state number 0, which is the initial state SID, and the repetition of the input PSID. Or 1) a move table (Move Table) 124e which can be generated as 1).

Images