Signature searching method and apparatus using signature location in packet

• US 8,407,794 B2
• Filed: 04/20/2010
• Issued: 03/26/2013
• Est. Priority Date: 04/22/2009
• Status: Active Grant

• Current Assignee: Sysmate Co. Ltd.
• Original Assignee: Sysmate Co. Ltd.
• Inventors: Kim, Seung-Kyeom, Lee, Ho-Sug, Kim, Myeong-Seok
• Primary Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US12/763,832
• Publication Number:
  US 20100275261A1
• Time in Patent Office: 1,071 Days
• Field of Search: 726 22- 25, 709/224, 713/160, 713/162, 713/188, 708/212, 711/108
• US Class Current: 726/24
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of and apparatus for searching for a signature in a packet according to a signature location. The method may include extracting a sub-payload to be compared with a signature from a payload of a packet, generating an offset that is location information about a location of the sub-payload in the payload, generating a search key that includes the extracted sub-payload and the generated offset, and performing ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry.

Claims

1. A method of an apparatus searching for a signature in a packet, the method comprising:

extracting a sub-payload to be compared with a signature from a payload packet;

generating a search key that comprises the extracted sub-payload; and

performing ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry,

wherein the TCAM entry comprises an offset that comprises a bit sequence, and the bit sequence of the offset is capable of being set according to the following conditions;

where the bit sequence indicates that the signature is matched at a location of the offset in the payload of the packet,

where the bit sequence indicates that the signature is matched at a location behind the offset in the payload of the packet, and

where the bit sequence indicates that the signature is matched at a location ahead of the offset in the payload of the packet, and

wherein the offset of the TCAM entry comprises a first bit group and at least one second bit group located behind the first bit group, the first bit group comprising a plurality of bits that correspond sequentially to sections of the payload, the sections being set by dividing the payload by a predetermined length, and the second bit group comprising a plurality of bits that correspond sequentially to subsections of each section corresponding to each bit of the first bit group, the subsections being set by dividing each section by a predetermined length smaller than the length used for dividing the section.

2. The method of claim 1, wherein the generating of the offset sets one bit belonging to each of the first bit group and the at least one second bit group as a valid bit.

3. The method of claim 1, wherein, in response to the signature being to be matched on a designated offset location, one bit included in each of the first bit group and the second bit group of the offset included in the TCAM entry is set as a valid bit.

4. The method of claim 1, wherein, in response to the signature being to be matched on a location behind or ahead of a designed offset, at least one of the bits belonging to the offset included in the TCAM entry is set as “

Don'"'"'t Care”

bits.

5. An apparatus for searching for a signature in a packet, the apparatus comprising:

an extractor configured to extract a sub-payload to be compared with a signature from a payload of a packet;

an offset generator configured to generate an offset that comprises location information about a location of the sub-payload in the payload;

a search key generator circuit configured to generate a search key that comprises the extracted sub-payload and the generated offset; and

a performer configured to perform ternary content addressable memory (TCAM) matching to check if the generated search key matches a TCAM entry,

where the bit sequence indicates that the signature is matched at a location of the offset in the payload of the packet,

where the bit sequence indicates that the signature is matched at a location behind the offset in the payload of the packet, and

where the bit sequence indicates that the signature is matched at a location ahead of the offset in the payload of the packet, and

wherein the offset of the TCAM entry comprises a first bit group and at least one second bit group located behind the first bit group, the first bit group comprising a plurality of bits that correspond sequentially to sections of the payload, the sections being set by dividing the payload by a predetermined length, and the second bit group comprising a plurality of bits that correspond sequentially to subsections of each section corresponding to each bit of the first bit group, the subsections being set by dividing each section by a predetermined length smaller than the length used for dividing the section.

6. The apparatus of claim 5, wherein the offset generator is further configured to set one bit belonging to each of the first bit group and the at least one second bit group as a valid bit.

7. The apparatus of claim 5, wherein, in response to the signature being to be matched on a designated offset location, one bit included in each of the first bit group and the second bit group of the offset included in the TCAM entry is set as a valid bit.

8. The apparatus of claim 5, wherein, in response to the signature being to be matched on a location behind or ahead of a designated offset, at least one of the bits belonging to the offset included in the TCAM entry is set as “

Don'"'"'t Care”

bits.

9. The apparatus of claim 5, wherein the bit sequence of the offset comprises a first bit group, a second bit group, and a third bit group, the first bit group dividing the payload of the packet into a plurality of sections, the second bit group dividing a respective section into a plurality of subsections, and the third bit group indicating a location of the offset in the respective subsection.