I.9 DPI use case: Example concerning DPI engine capabilities

I.9 DPI use case: Example concerning DPI engine capabilities

I.9.1 Background

• DPI engine focuses on functions related to DPI scanning, DPI analysing and DPI action execution; and

• DPI policy enforcement function (DPI-PEF) summarizes the DPI engine supported functions plus a DPI policy information base here.

This means that the DPI engine provides all packet processing path functions.

Figure I.9 – The typical relationship of a DPI engine and DPI physical entity

Since the DPI engine does not include the DPI policy information base, the DPI signatures for application (and optional) flow identification would be (also) available in processing elements of the DPI engine. There are some typical DPI signature formats such as:

1) Simple fixed string: A string P of m bytes can be written as P = b₁b₂… b_m, where each b_i represents a byte. Such a string type is also known as byte patterns.

2) Composite Patterns:

a) Negation (!).The notation “!P” is used for the specification of “no appearance of pattern P”.

b) Correlated patterns. If P1 and P2 are two patterns, P3 = P1 + P2 is a correlated pattern, with the meaning that P3 is the concatenation of P1 and P2.

3) Regular Expressions: A regular expression describes a set of strings without enumerating them explicitly. Regular expressions are widely used for pattern matching due to their rich expressive power.

Thus, the DPI engine focuses on DPI application level conditions verification with all these signature formats to do such: simple fixed string matching, composite patterns matching and regular expression matching.

I.9.2 DPI engine use case: Simple fixed string matching for BitTorrent

Appendix II

(This appendix does not form an integral part of this Recommendation)