Dynamically Reconfigurable Architecture with Atomic Configuration Updates for Flexible Regular Expressions Matching in FPGA

FPGA, NFA, Regular Expressions

Regular expressions matching is commonly used in network security devices in order to detect malicious network traffic. The security device must be able to update set of used regular expressions as soon as possible. The update operation must not disrupt normal operations of the security device. Therefore, the update must be done atomically. Current reconfigurable architectures are not suitable for highly integrated embedded network security devices because they require either additional external FPGA memory, external ASICs or require partial reconfiguration of the FPGA. Also, architectures based on deterministic finite automaton suffers from significant time complexity even for real-word sets of regular expressions. Therefore, in this paper we introduce reconfigurable architecture with atomic updates suitable for real-world sets of regular expressions. We take inspiration from previous designs for both ASICs and FPGAs and propose regular expressions matching architecture with significantly lower consumption of FPGA resources than previous reconfigurable FPGA design. The proposed architecture uses an interconnection matrix with a linear space complexity, while the previous one uses an interconnection matrix with a quadratic space complexity. The proposed architecture consumes from 6,9 to 48.9 times less LUTs than previous dynamically reconfigurable FPGA design. Single matched symbol utilizes between 4,35 and 32,2 LUTs.