A Distributed TCAM coprocessor architecture for integrated longest prefix matching, policy filtering, and content filtering

IEEE Transactions on Computers

Volumn 62, Issue 3, 2013, Pages 417-427

  Cai, Zhiping ^a   Wang, Zhijun ^b   Zheng, Kai ^b   Cao, Jiannong ^c  

^a NATIONAL UNIVERSITY OF DEFENSE TECHNOLOGY   (China)

^b HONG KONG POLYTECHNIC UNIVERSITY   (Hong Kong)

^c IBM CHINA RESEARCH LAB   (China)

Author keywords

content filtering; intrusion detection; Longest prefix matching; policy filtering

Indexed keywords

10 GBPS; CACHE SYSTEMS; CO-PROCESSOR ARCHITECTURE; CONTENT FILTERING; INTEGRATED SOLUTIONS; LINE RATE; LONGEST-PREFIX MATCHING; LOOKUPS; TERNARY CONTENT ADDRESSABLE MEMORIES; TRAFFIC TRACES;

INTRUSION DETECTION;

TERNARY CONTENT ADRESSABLE MEMORY;

EID: 84873479181     PISSN: 00189340     EISSN: None     Source Type: Journal    
DOI: 10.1109/TC.2011.255     Document Type: Article

References (35)

1. V. Paxson, K. Asanovic, S. Dharmapurikar, J. Lockwood, R. Pang, R. Sommer, and N. Weaver, "Rethinking Hardware Support for Network Analysis and Intrusion Prevention," Proc. USENIX Workshop Hot Topics in Security, pp. 1-6, 2006.
2. A. Bremler-Barr and D. Hay, "Space-Efficient TCAM-Based Classification Using Gray Coding," IEEE Trans. Computers, vol. 61, no. 1, pp. 18-30, Jan. 2012.
3. M. Faezipour and M. Nourani, "Wire-Speed TCAM-Based Architectures for Multimatch Packet Classification," IEEE Trans. Computers, vol. 58, no. 1, pp. 5-17, Jan. 2009.
4. M. Akhbarizadeh, M. Nourani, R. Panigrahy, and S. Sharma, "TCAM-Based Parallel Architecture for High-Speed Packet Forwarding," IEEE Trans. Computers, vol. 56, no. 1, pp. 58-72, Jan. 2007.
5. K. Zheng, H. Che, Z. Wang, and B. Liu, "PPC-RE: TCAM-Based Distributed Parallel Packet Classification Algorithm with Range- Matching," IEEE Trans. Computers, vol. 55, no. 8, pp. 947-961, Aug. 2006. (Pubitemid 44193983)
6. K. Zheng, C. Hu, H. Lu, and B. Liu, "TCAM-Based Distributed Parallel IP Lookup Scheme and Performance Analysis," ACM/ IEEE Trans. Networking, vol. 14, no. 4, pp. 863-875, Aug. 2006. (Pubitemid 46405446)
7. R. Cohen and D. Raz, "Simple Efficient TCAM Based Range Classification," Proc. IEEE INFOCOM, pp. 461-465, Mar. 2010.
8. O. Rottenstreich and I. Keslassy, "Worst-Case TCAM Rule Expansion," Proc. IEEE INFOCOM, pp. 456-460, Mar. 2010.
9. Y. Chang, C. Lee, and C. Su, "Multi-Field Range Encoding for Packet Classification in TCAM," Proc. IEEE INFOCOM, pp. 196- 200, Apr. 2011.
10. H. Che, Z. Wang, K. Zheng, and B. Liu, "DRES: Dynamic Range Encoding Scheme for TCAM Coprocessor," IEEE Trans. Computers, vol. 57, no. 7, pp. 902-915, July 2008.
11. A. Bremler-Barr, D. Hay, D. Hendler, and R. Roth, "PEDS: Parallel Error Detection Scheme for TCAM Devices," IEEE/ACM Trans. Networking, vol. 18, no. 5, pp. 1665-1675, Oct. 2010.
12. Z. Wang, H. Che, J. Cao, and J. Wang, "TCAM-Based Solution for Integrated Traffic Anomaly Detection and Policy Filtering," Computer Comm., vol. 32, no. 17, pp. 1893-1901, Nov. 2009.
13. F. Yu, R. Katz, and T. Lakshman, "Gigabit Rate Packet Pattern Matching Using TCAM," Proc. IEEE Int'l Conf. Network Protocols (ICNP), pp. 174-183, 2004. (Pubitemid 40574708)
14. SNORT system, http://www.snort.org, 2012.
15. K. Lakshminarayanan, A. Rangarajan, and S. Venkatachary, "Algorithms for Advanced Packet Classification with Ternary CAMs," Proc. ACM SIGCOMM, pp. 193-204, 2005. (Pubitemid 46323504)
16. V. Ravikumar, R. Mahapatra, and L. Bhuyan, "EaseCAM: An Energy and Storage Efficient TCAM-Based Router Architecture for IP Lookup," IEEE Trans. Computers, vol. 54, no. 5, pp. 521-533, May 2005. (Pubitemid 40784351)
17. W. Lu and S. Sahni, "Low-Power TCAMs for very Large Forwarding Tables," IEEE Trans. Networking, vol. 18, no. 3, pp. 948-959, June 2010.
18. Z. Wang, H. Che, M. Kumar, and S. Das, "CoPTUA: Consistent Policy Table Update Algorithm for TCAM without Locking," IEEE Trans. Computers, vol. 53, no. 12, pp. 1602-1614, Dec. 2004. (Pubitemid 40055692)
19. A. Liu, C. Meiners, and E. Torng, "TCAM Razor: A Systematic Approach Towards Minimizing Packet Classifiers in TCAMs," IEEE/ACM Trans. Networking, vol. 18, no. 2, pp. 490-500, Apr. 2010.
20. R. McGeer and P. Yalagandula, "Minimizing Rulesets for TCAM Implementation," Proc. IEEE INFOCOM, pp. 1314-1322, Apr. 2009.
21. H. Hwang, S. Ata, K. Yamamoto, K. Inoue, and M. Murata, "A New TCAM Architecture for Managing ACL in Routers," IEICE Trans. Comm., vol. E93-B, no. 11, pp. 3004-3012, 2010.
22. E. Spitznagel, D. Taylor, and J. Turner, "Packet Classification Using Extended TCAMs," Proc. IEEE Int'l Conf. Network Protocols (ICNP), pp. 120-131, Nov. 2003.
23. L. Foschini, Stateful Intrusion Detection in High-speed Networks: A Formalization and Analysis of High-speed Stateful Signature Matching for Intrusion Detection. VDM Verlag, 2009.
24. C. Kruegel and F. Valeur, "Stateful Intrusion Detection for High- Speed Networks," Proc. IEEE Symp. Research on Security and Privacy, pp. 285-293, 2002. (Pubitemid 34648120)
25. C. Lin, C. Huang, C. Jiang, and S. Chang, "Optimization of Pattern Matching Circuits for Regular Expression on FPGA," IEEE Trans. Very Large Scale Integration (VLSI) Systems, vol. 15, no. 12, pp. 1303- 1310, Dec. 2007.
26. H. Wang, S. Pu, G. Knezek, and J. Liu, "A Modular NFA Architecture for Regular Expression Matching," Proc. Ann. ACM/ SIGDA Int'l Symp. Field Programmable Gate Arrays (FPGA), pp. 209- 218, Feb. 2010.
27. I. Sourdis, D. Pnevmatikatos, and S. Vassiliadis, "Scalable Multigigabit Pattern Matching for Packet Inspection," IEEE Trans. Very Large Scale Integration (VLSI) Systems, vol. 16, no. 2, pp. 156-166, Feb. 2008.
28. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. Lockwood, "Deep Packet Inspection Using Parallel Bloom Filters," IEEE Micro, vol. 24, no. 1, pp. 52-61, Jan./Feb. 2004.
29. P. Lin, Y. Lin, Y. Lai, Y. Zheng, and T.-H. Lee, "Realizing a Sublinear Time String-Matching Algorithm with a Hardware Accelerator Using Bloom Filters," IEEE Trans. Very Large Scale Integration (VLSI) Systems, vol. 17, no. 8, pp. 1008-1020, Aug. 2009.
30. A. Goel and P. Gupta, "Small Subset Queries and Bloom Filters Using Ternary Associative Memories, with Applications," Proc. ACM SIGMETRICS Int'l Conf. Measurement and Modeling of Computer Systems (SIGMETRICS), pp. 143-154, 2010.
31. Y. Weinsberg, S. Tzur-David, D. Dolev, and T. Anker, "High Performance String Matching Algorithm for a Network Intrusion Prevention System (NIPS)," Proc. Workshop High Performance Switching and Routing, pp. 151-157, June 2006.
32. C. Meiners, J. Patel, E. Norige, E. Torng, and A. Liu, "Fast Regular Expression Matching Using Small TCAMs for Network Intrusion Detection and Prevention Systems," Proc. 19th USENIX Conf. Security, pp. 111-126, Aug. 2010.
33. "MIT DARPA Intrusion Detection Data Sets," http://www.ll. mit.edu/mission/communications/ist/corpora/ideval/data/ 1999data.html, 2012.
34. D. Taylor and J. Turner, "ClassBench: A Packet Classification Benchmark," IEEE/ACM Trans. Networking, vol. 15, no. 3, pp. 499- 511, June 2007. (Pubitemid 46979733)
35. RouteViews: http://archive.routeviews.org/, 2011.