Dynamically Reconfigurable Architecture with Atomic Configuration Updates for Flexible Regular Expressions Matching in FPGA

Abstract

Regular expressions matching is commonly used in network security devices in order to detect malicious network traffic. New network attacks and other threats are emerging frequently. Therefore, the security device must be able to update the set of used regular expressions as soon as possible. The update operation must not disrupt normal operations of the security device. Therefore, the update must be done atomically. Current reconfigurable architectures are not suitable for highly integrated embedded network security devices because they require either additional external memory, ASICs or partial reconfiguration of the FPGA. Also, architectures based on deterministic finite automaton have an exponential time complexity even for real-word sets of regular expressions. Therefore, in this paper, we introduce a reconfigurable architecture with atomic updates suitable for real-world sets of regular expressions. Inspired by previous designs for both ASICs and FPGAs, we propose regular expressions matching architecture with significantly lower consumption of FPGA resources than previous dynamically reconfigurable FPGA design. The proposed architecture uses an interconnection matrix with a linear space complexity, while the previous one uses an interconnection matrix with a quadratic space complexity. The proposed architecture consumes from 6.9 to 48.9 times less LUTs than previous dynamically reconfigurable FPGA design. Single matched symbol utilizes between 4.35 and 32.2 LUTs.