Korea Advanced Institute of Science and Technology

S2w Inc.

Myoung Sung You

Seung Won Shin

Sang Duk Suh

Chang Hoon Yoon

Seung Hyeon Lee

Yeon Keun Kim

According to the present specification, a method for inspecting a high-speed network packet payload by a terminal includes: a step of receiving L7 (Layer 7) policy related to containers from a user; a step of extracting string patterns to be inspected for each of the containers on the basis of the L7 policy through a pattern compiler; a step of creating a deterministic finite automaton (DFA) on the basis of the extracted string patterns through the pattern complier; and a step of converting a state transition table of the deterministic finite automaton into a match-action table through the pattern compiler and storing the match-action table in an eBPF (extended Berkeley Packet Filter) map for a payload inspection engine.

High-speed network packet payload inspection system based on eBPF (extended Berkeley Packet Filter)/XDP (express data path) for container environment

A method for securing network communication between containers by a terminal, includes: a step of installing an HSI (Hyperion Secure Interface) for communication with a secure bridge included in an NIC (Network Interface Chip) in a secure container through a manager module; a step of changing a source address of a transmission packet to a specific token on the basis of a map of the HSI through the manager module; a step of delivering the transmission packet to the secure bridge through the HSI; a step of determining whether the specific token of the transmission packet is valid; and a step of changing the specific token to the source address and delivering the transmission packet to a target container when the specific token is valid.

Hardware-based reliable and secure container network

Growing community of inventors

Daejeon, South Korea

Myoung Sung You