基于TCAM的深部包检测技术研究与实现  

Research and implementation of deep packet inspection technology based TCAM

作　　者：张丽果[1] 

机构地区：[1]西安邮电学院电子工程学院,陕西西安710121

出　　处：《电子设计工程》2013年第10期184-187,共4页Electronic Design Engineering

基　　金：国家自然科学基金重点项目(61136002);国家自然科学基金(60976020;61272120);陕西省教育厅科研计划项目(11JK1063);陕西省工业公关计划(2011K06-47);陕西省13115重大科技专项资助课题(2009ZDKG-43)

摘　　要：深度包检测技术(DPI)已成为网络信息安全的研究重点。基于硬件实现模式匹配的DPI技术凭借其更强的处理能力受到广泛关注。本文提出一种基于TCAM模式匹配的方法实现DPI,规则表项按字节分别存储在TCAM(三态内容寻址存储器)中,输入字符按不同字节与TCAM中内容进行匹配,提高了DPI中模式匹配的处理速度。针对该技术功耗大的缺点,提出BF(Bloom Filter)和TCAM相结合的两级模式匹配技术,BF可将较少可疑包转发给TCAM处理模块,从而降低了系统功耗,大大提高了系统处理速度。Deep packet inspection （DPI） technology has become the research focus of network information security. DPI based on the hardware implementation has gained widely attention with its powerful processing ability. This thesis proposes an effective method based on TCAM （ternary content addressable memory） pattern matching to implement DPI. It increased the processing speed of DPI pattern matching that rule tables are stored in the TCAM according to the size in bytes, and input characters are matched with TCAM rules table according to the different byte. For the large power consumption of the technology, combination BF （Bloom Filter） with TCAM two level schema matching technology is proposed. BF will be forward less suspicious packet to the TCAM processing module, thereby reducing the power consumption of the system and greatly improving the processing speed.

关 键 词：深度包检测 TCAM 规则表 模式匹配 

分 类 号：TP303[自动化与计算机技术—计算机系统结构]