以內容為基礎之網路安全─子計畫一:研究與實做在SoC環境下考慮狀態之網路內容分類的語言、編譯器與執行引擎

In this year of the project, we developed
a new stateful content-based packet
classification called SConPaC. The
motivation for developing SConPaC is
stated as follow: compared to the traditional
packet classifier, this architecture is capable
to inspect the packet application content,
maintain and track protocol state transition
dynamically, and handle both IPv4 and IPv6
packets.
We study numerous applications and
protocols in wide-spread use. We generalize
their features which are commonly utilized
when inspecting the application content and
packet header. Our Script Language covers sufficient types of matches to satisfy the
requirement of convenience and flexibility.
Script Language Compiler compiles the
script language into codes and stores the rule
specifications into a rule table. Along with
the rule s, SConPaC Engine can perform the
procedure of packet classification.
SConPaC Engine comprises several
functional components. Separating the
filtering procedure into multiple stages is
one of the features of Classification Engine.
Each stage is implemented as different
building blocks consistent with the
characteristics of the matches. In addition,
classification engine maintains and tracks
the state transition of protocols in order to
understand the evolution of connections.
The architecture we proposed not only
meets the requirements of current packet
classification (stateful and content
inspection), but also brings up some original
ideas and design.