1. Field
The following description relates to a network device, more particularly, to a method of searching for a signature in a payload of a packet received through a network line.
2. Description of the Related Art
Recently, following the ever increasing distribution of high-speed internet networks, the need for improved performance of security device performances is increasing. Conventional network devices detect intrusion and filter packets using specific signature matching in a packet. Such detection and filtering functions of the network devices can be implemented in a hardware manner, in a software manner, or in a combined hardware and software manner. In addition, a variety of requirements for signature matching increases as the network speed becomes faster and invasion methods become more and more diverse. In particular, high-speed signature matching technologies and signature matching technologies using a specific location and a specific range in a packet are increasingly required, and thus research on various methods that can satisfy such requirements has been conducted.
In a high-speed packet processing system such as a firewall and an intrusion detection system, a hardware-based technology such as a ternary content addressable memory (TCAM) is used to detect a match of a packet with a security policy at high speed. TCAM is used for high-speed signature searching in a payload of a packet. The high-speed signature matching is implemented by setting a signature in a TCAM and matching a header and the payload of the packet. Based on the signature matching result, a signature range searching process is performed in hardware and software manners to determine whether the matched signature is located on a specific position in the packet or within a specific range in the packet. Due to the signature range searching process after the TCAM matching, it takes a substantial amount of time for this process, thus impeding high-speed performance of a network device.