Signature searching method and apparatus using signature location in packet
AssigneeSysmate Co., Ltd.
InventorsSeung-Kyeom Kim, Ho-Sug Lee, Myeong-Seok Kim
Life of this patent
Estimating the term…
Abstract
A method of and apparatus for searching for a signature in a packet according to a signature location. The method may include extracting a sub-payload to be compared with a signature from a payload of a packet, generating an offset that is location information about a location of the sub-payload in the payload, generating a search key that includes the extracted sub-payload and the generated offset, and performing ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry.
Claims9
A method of an apparatus searching for a signature in a packet, the method comprising:
- extracting a sub-payload to be compared with a signature from a payload packet;
- generating a search key that comprises the extracted sub-payload;
- and
- performing ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry,
- wherein the TCAM entry comprises an offset that comprises a bit sequence, and the bit sequence of the offset is capable of being set according to the following conditions:
- where the bit sequence indicates that the signature is matched at a location of the offset in the payload of the packet,
- where the bit sequence indicates that the signature is matched at a location behind the offset in the payload of the packet, and
- where the bit sequence indicates that the signature is matched at a location ahead of the offset in the payload of the packet, and
- wherein the offset of the TCAM entry comprises a first bit group and at least one second bit group located behind the first bit group, the first bit group comprising a plurality of bits that correspond sequentially to sections of the payload, the sections being set by dividing the payload by a predetermined length, and the second bit group comprising a plurality of bits that correspond sequentially to subsections of each section corresponding to each bit of the first bit group, the subsections being set by dividing each section by a predetermined length smaller than the length used for dividing the section.
An apparatus for searching for a signature in a packet, the apparatus comprising:
- an extractor configured to extract a sub-payload to be compared with a signature from a payload of a packet;
- an offset generator configured to generate an offset that comprises location information about a location of the sub-payload in the payload;
- a search key generator circuit configured to generate a search key that comprises the extracted sub-payload and the generated offset;
- and
- a performer configured to perform ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry,
- where the bit sequence indicates that the signature is matched at a location of the offset in the payload of the packet,
- where the bit sequence indicates that the signature is matched at a location behind the offset in the payload of the packet, and
- where the bit sequence indicates that the signature is matched at a location ahead of the offset in the payload of the packet, and
- wherein the offset of the TCAM entry comprises a first bit group and at least one second bit group located behind the first bit group, the first bit group comprising a plurality of bits that correspond sequentially to sections of the payload, the sections being set by dividing the payload by a predetermined length, and the second bit group comprising a plurality of bits that correspond sequentially to subsections of each section corresponding to each bit of the first bit group, the subsections being set by dividing each section by a predetermined length smaller than the length used for dividing the section.
Dependencies are inferred from the claim text.