A variable word-width content addressable memory for fast string matching

Abstract

Abstraet:This work deals with off-boding some ,time critical parts in the process of performing intrusion detection from sofmare to reconfigurable hardware (FPGA). Signatures of known attacks must typically be compared io high speed network traffic, and sir@ matching becomes a bottleneck Content Addressable Memories (CAMS) are known to be fast string matchers, but offer little flexibility. For that purpose a Variable Word-Width CAM for fast shirzg matching has been designed and implemented in an FPGA A typical feature for thk CAM is that the length of each word is independent from the others, in contrast to common CAMs where all worak have the same length,The design has been functionally tested on a development board for a CAM of size 1822 bytes (128 words). This design processes 8 bits per clock cycle and has a reported maximum clock speed of 100 MHL This gives a thoughput of 800 Mbit/s IntroductionThe speed of todays networks is of such a kind that a general purpose CPU must struggle to process the network data. The CPU must also have resources left for other application processes. The amount of processing required on network data is increasing due to the need for intrusion detection, cryptographic processing and more [I].One way to free the CPU from heavy tasks is to convert some of the software or parts of a given software, into hardware. In this work a part of an Intrusion Detection System (IDS), Snort [Z], the string matcher will be implemented in hardware.As time goes by, we can expect that new pattems will be discovered and a reconfiguration of the hardware will then be required. For resemh purposes it is expected that pattems will change frequently, and that they are of different sizes. A suited hardware technology is Field Programmable Gate Arrays (FPGA) which is easily reconfigured to accommodate these changes.The main contribution of this paper is to implement a Variable Word-Width Content Addressable Memory (CAM) in FPGA for string matching. Thereby great flexibility is obtained with respect to how the Snort rule set is defmed.In order to design a system for an FPGA, a Hardware Description Language (HDL) is needed. VHDL was chosen for this work in spite of its somewhat restricted programming features. The main reason for this is that VHDL is well known at the University of Oslo. One result from this work is that it is now possible to describe the actual CAM design in VHDL by taking advantage of all programming abilities that are common to any programming language. Thereby reconfigurability of the CAM has been made a simple task.The CAM is implemented in hardware by using Xlinx ISE 6.1.03i. With this tool various reports are generated These reports were be used for giving estimates of how much of the resources of an FPGA will be used by each specific design and the speed obtained.Section 2 gives an overview ofIDS, whereas the CAM design is described in section 3. The results are summarized in section 4 and the conclusion is given in section 5. 2. Intrusion Detection Systems o s )It tums out that there...

Building Dependable Intrusion Prevention Systems

“…The authors of articles [13,21] used Content Addressable Memories to match strings. Various modifications of the brute force algorithm were described in [3,7,8,26].…”

A resource efficient content inspection system for next generation Smart NICs

“…An alternative technique [16] implemented a variable width TCAM to improve resource utilization over a fixed width TCAM. However, this approach suffered from reduced scalability and could only be implemented using FPGAs, which may not provide throughput to sustain high link rates or enough storage capacity for large signature sets.…”

Implementations of Reconfigurable Logic Arrays on FPGAs

“…A reconfigurable logic array can be considered as a generalization of a content addressable memory (CAM) [2,4,6]. A function can be modified by only changing the contents of LUTs or BRAMs.…”

“…The combinational one uses configurable logic blocks (CLBs), while the sequential one uses M4Ks and logic elements (LEs). Such methods are promising for dynamically reconfigurable circuits [2,4,6,15].…”