基于TCAM的深部包检测技术研究与实现

Research and implementation of deep packet inspection technology based TCAM

深度包检测技术(DPI)已成为网络信息安全的研究重点。基于硬件实现模式匹配的DPI技术凭借其更强的处理能力受到广泛关注。本文提出一种基于TCAM模式匹配的方法实现DPI,规则表项按字节分别存储在TCAM(三态内容寻址存储器)中,输入字符按不同字节与TCAM中内容进行匹配,提高了DPI中模式匹配的处理速度。针对该技术功耗大的缺点,提出BF(Bloom Filter)和TCAM相结合的两级模式匹配技术,BF可将较少可疑包转发给TCAM处理模块,从而降低了系统功耗,大大提高了系统处理速度。

Deep packet inspection （DPI） technology has become the research focus of network information security. DPI based on the hardware implementation has gained widely attention with its powerful processing ability. This thesis proposes an effective method based on TCAM （ternary content addressable memory） pattern matching to implement DPI. It increased the processing speed of DPI pattern matching that rule tables are stored in the TCAM according to the size in bytes, and input characters are matched with TCAM rules table according to the different byte. For the large power consumption of the technology, combination BF （Bloom Filter） with TCAM two level schema matching technology is proposed. BF will be forward less suspicious packet to the TCAM processing module, thereby reducing the power consumption of the system and greatly improving the processing speed.