SIGNATURE SEARCHING METHOD AND APPARATUS USING SIGNATURE LOCATION IN PACKET

• US 20100275261A1
• Filed: 04/20/2010
• Published: 10/28/2010
• Est. Priority Date: 04/22/2009
• Status: Active Grant

• Current Assignee: Sysmate Co. Ltd.
• Original Assignee: Sysmate Co. Ltd.
• Inventors: LEE, Ho-Sug, KIM, Myeong-Seok, KIM, Seung-Kyeom
• Granted Patent: US 8,407,794 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of and apparatus for searching for a signature in a packet according to a signature location. The method may include extracting a sub-payload to be compared with a signature from a payload of a packet, generating an offset that is location information about a location of the sub-payload in the payload, generating a search key that includes the extracted sub-payload and the generated offset, and performing ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry.

Claims

1. A method of searching for a signature in a packet, the method comprising:

extracting a sub-payload to be compared with a signature from a payload of a packet;

generating an offset that is location information about a location of the sub-payload in the payload;

generating a search key that comprises the extracted sub-payload and the generated offset; and

performing ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry.

2. The method of claim 1, wherein the TCAM entry comprises a signature and an offset that is location information about a location of the signature in the payload.

3. The method of claim 2, wherein the offset comprises a first bit group and at least one second bit group located behind the first bit group, the first bit group comprising a plurality of bits that correspond sequentially to sections of the payload, the sections being set by dividing the payload by a predetermined length, and the second bit group comprising a plurality of bits that correspond sequentially to subsections of each section corresponding to each bit of the first bit group, the subsections being set by dividing each section by a predetermined length smaller than the length used for dividing the section.

4. The method of claim 3, wherein the generating of the offset sets one bit belonging to each of the first bit group and the at least one second bit group as a valid bit.

5. The method of claim 3, wherein, in response to the signature being to be matched on a designated offset location, one bit included in each of the first bit group and the second bit group of the offset included in the TCAM entry is set as a valid bit.

6. The method of claim 3, wherein, in response to the signature being to be matched on a location behind or ahead of a designated offset, at least one of the bits belonging to the offset included in the TCAM entry is set as “

Don'"'"'t Care”

bits.

7. An apparatus for searching for a signature in a packet, the apparatus comprising:

an extractor configured to extract a sub-payload to be compared with a signature from a payload of a packet;

an offset generator configured to generate an offset that is location information about a location of the sub-payload in the payload;

a search key generator circuit configured to generate a search key that comprises the extracted sub-payload and the generated offset; and

a performer configured to perform ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry.

8. The apparatus of claim 7, wherein the TCAM entry comprises a signature and an offset that is location information about a location of the signature in the payload.

9. The apparatus of claim 8, wherein the offset comprises a first bit group and at least one second bit group located behind the first bit group, the first bit group comprising a plurality of bits that correspond sequentially to sections of the payload, the sections being set by dividing the payload by a predetermined length, and the second bit group comprising a plurality of bits that correspond sequentially to subsections of each section corresponding to each bit of the first bit group, the subsections being set by dividing each section by a predetermined length smaller than the length used for dividing the section.

10. The apparatus of claim 9, wherein the offset generator is further configured to set one bit belonging to each of the first bit group and the at least one second bit group as a valid bit.

11. The apparatus of claim 9, wherein, in response to the signature being to be matched on a designated offset location, one bit included in each of the first bit group and the second bit group of the offset included in the TCAM entry is set as a valid bit.

12. The apparatus of claim 9, wherein, in response to the signature being to be matched on a location behind or ahead of a designated offset, at least one of the bits belonging to the offset included in the TCAM entry is set as “

Don'"'"'t Care”

bits.