A New High Performance Multi Gigabit String Matching Engine

International audienceThis paper presents a new high performance hardware implementation of a string matching engine based on a multicharacter variant of the well-known Aho-Corasick algorithm. The proposed architecture is well suited to modern FPGAs. It allows the efficient usage of FPGA's logic and memory resources. Our architecture is optimized to execute string matching in the case of tens of thousands of strings like the ones in intrusion prevention or intrusion detection systems. The proposed design has been validated through the implementation of a search engine on Altera Stratix II FPGA component in the case of a subset of rules in the Snort intrusion detection system. By applying the traffic parallelization and retiming techniques, it was shown that 40 Gbit/s traffic content scanning can be sustained. In comparison with other existing architectures a significant increase in performances has been obtained