Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

A Fast Adaptative Secure Technology for high-speed NetworkResearch Staff : Sylvain GombaultKeywords : Traffic filtering, Packet classification, Reconfigurable components, String matchingApplications : Intrusion detection sensor and Firewall for high speed networkPartners & Funding : IRISA, partially funded by Région Bretagne in the framework of PRIR FastnetIntroductionThe development of high-speedcommunication networks led to a growinginterest for the deployment of securitymechanisms related to the specificity of theseenvironments. The Fastnet project (FastAdaptative Secure Technology for high-speedNETwork) tackles the problematic of high-ratenetwork traffic analysis: the proposedapproach is to combine software security ruleanalysis and hardware architectures based onreconfigurable components. Network intrusiondetection probe (NIDS) Snort [2] has beenchosen as a use case, and the considerednetwork link is Ethernet 10 Gb/s, up to 40Gb/s.Fastnet is a PRIR (PRojet d’Intérêt Régional)project funded by the Britany Region (2005-2008). In this project, TELECOM Bretagne isassociated with the R2D2 project (IRISA).RealizationWe carried out a state of the art on thesoftware algorithms used or which could beused in Snort. Based on this work, a firstselection of hardware filtering and stringmatching techniques adapted to the needs ofsnort was proposed [3].We have designed a new hardwareimplementation of a string matching enginebased on a multi-character variant of the wellknownAho-Corasick algorithm [4]. Theproposed architecture model optimally exploitsthe current FPGA reconfigurable components.It combines in an efficient way, the use of thelogic and memory resources of the FPGA. It issuited for searches on very large set of strings(tens of thousand of strings) and the proposeddesign has been validated through theimplementation of a search engine suited tothe processing of a subset of the Snort rules.An Altera Stratix FPGA component is targeted.By using traffic parallelization and circuitretiming techniques, we then show that 40Gbit/s traffic content scanning can besustained [4].fig. 1 : Preprocessor Polsec in Snort ArchitectureWe have also proposed a new functionality toSnort : a preprocessor dealing with « networkpolicy monitoring ». To ensure the security ofits information system, an orgnisation definesa security policy which applies to all itsequipments. This policy is then translated insecurity mechanisms on each equipment. Onetranslation of this policy applies to networktraffic : it describes allowed and prohibitedtraffic in network policy rules. With these rules,we can describe both internal andinbound/outbound trafic. The role of IDS is tocheck that no policy violation occurs. As snortrules cannot be used to write network policyrules, thanks to its flexibility, we havedevelopped a snort software preprocessorbased on policy rules which monitors thenetwork trafic [5].ConclusionAs a future work, we plan to process byhardware all the parameters of a Snort rule.This means that we have to combine packetclassification to select packets into whichlooking for string matching. Packetclassification is also useful to monitor networkpolicy and we will see how to implement oursnort preprocessor in hardware.References[1] Alfred V. Aho and Margaret J.Corasick.1975, Efficient string matching: An aidto bibliographic search, Communications of the52 Pracom’s Annual Report 2008