High Speed Deep Packet Inspection Algorithm Research Based On Hardware Support

The skill of deep packet inspection can deeply distinguish and detect the header and the payload of the packets in the Internet.This skill has been widely used in application awareness,network traffic management,network security and analyse and control user's action,and so on.However,as Internet gains ground and develops,the skill of DPI has been faced with great challenges.First,the rate of backbone requests that the skill of DPI achieves bigger matching rate. Second, the number of keywords becomes more and more.Third,the integration of the hardware requests we look for power efficient algorithm to improve the reliability and the life of the hardware.According to the project of New Generation Network with High Trustability, this thesis research on the skill of DPI from the point of algorithm. The contributions present in this paper include:At first, this thesis carefully studies the classic matching algorithm.Through analyse, we conclude the advantages and shortcomings of these algorithms.Secondly, the thesis proposes a power efficient multi-match algorithm for fixed keywords matching based on TCAM.This algorithm makes full use of the inherent characteristic of the hardware and proposes a novel partitioning scheme based on filters and their intersection properties.we consider full requirement of rate,memory,power and analyse the relationship of the entries and bulid mathematic model based on analysising the requirement of reducing the hardware power consumption. The result of simulation shows that the algorithm could not only match the rate of backbone,but also save72.25% and 87.29% in power consumption to other algorithms.Thirdly, the thesis proposes an unfixed keywords matching algorithm based on fixed-length shift and TCAM.This algorithm reduces the frequency of memory access from controlling the lenth of the keyword shifting.Compare to other algorithm,it has obvious advantage in memory consumption. The result of simulation shows that the algorithms could match the keywords of any length in line speed and hold ten thousand keywords.At last, Consolidating of these key issues researches, a realizable deep inspection hardware scheme of IP packet for engineering is proposed with the supportable project.The scheme introduces a structure of integrating software as well as hardware and separating controlling layer and data layer which could filte available information and give up unavailable information in the rate of 10Gbps of the backbone.