Design And Implementation Of Pattern Match Chip Used In UTM Acceleration

As the fast developing of Internet, various network attacks emerge endlessly. It will be a heavy burden for CPU to achieve network protection only based on software. Lots of network protection equipment providers adopt the strategy that using CPU combined with ASIC to protect the network. ASIC takes the responsibility of accelerating pattern match on packet, while CPU is used in flow controlling. The data throughput achieved by ASIC will become one of the critical targets to weigh the performance of network protection equipment under such strategy. Multi-pattern match algorithm is the core technology of the ASIC. The selection and implementation of algorithm will have great influence on data throughput of the ASIC.In this research, we firstly had a deep analysis on the characteristic of both A-C and W-M algorithm which are the most popular multi-pattern match algorithms currently, comparing the performance difference between them, especially focusing on the hardware implementation. We then combined the two improved algorithms of A-C algorithm named bitmap compression algorithm and A-C algorithm without failure function together and implemented it in ASIC. The combined algorithm can retain the advantage of high efficiency of original A-C algorithm under worst case and also introduce the high compression on pattern match database.On the aspect of chip architecture, considering the factors such as parallelizable of hardware, utilization of memory and chip area, we embodied 9 scan engines on chip to realize the multi-scan. Besides, we introduced 3 caches and arranged the proportion between caches and scan engines properly. So the performance of data processing can be greatly enhanced and the 1Gbps target data throughput at frequency of 133Mhz can be achieved by both increasing the pattern match threads and decreasing the time of command fetching and data storing as well as the time of caches accessing by each scan engine in turn.