SAC Signature Database

Signature Database

Signature identification is the basic method of service detection technology. Different applications use different protocols and each protocol has its characteristics, which can be a specific port, a character string, or a bit sequence. The characteristics that can identify a protocol are called character codes. Signature identification determines an application by detecting character codes in packets. Because character codes of some protocols are embedded in multiple packets, the device must collect and analyze multiple packets to identify the protocol type. The system analyzes service flows passing through the device, and compares the analysis result with the signature file loaded on the device. It identifies an application by detecting character codes in data packets, and implements fine-grained QoS management according to the identification result. Figure 12-1 shows the SAC working mechanism.

Figure 12-1  SAC working mechanism

The device identifies application protocol packets based on character codes of application protocols. As application software is upgraded and updated continuously, the character codes also change. As a result, the original character codes cannot correctly or accurately match application protocols. Therefore, character codes must be updated in a timely manner. If character codes are inherited in the software package, the software version must be updated, greatly affecting services. Huawei device separates the signature file from the system software. The signature file can be loaded and upgraded at any time, without affecting services.

Huawei analyzes various common applications to form a signature file. The signature file is pre-defined and loaded on the device. After the SAC signature database file is loaded, the system automatically generates 45 application groups, for example, Instant_Messaging. The Instant_Messaging application group contains the common instant messaging software including QQ_IM, MSN_IM, ICQ_IM, YahooMsg_IM, SinaUC_IM, Fetion_IM, AliTalk_IM, DoShow_IM, XiaoNeiTong, Skype_IM, Lava_Lava_IM, and GoogleTalk_IM. The predefined SAC signature database file cannot be manually modified. Modifications can only be made through upgrades. Table 12-1 lists the commonly used application groups and corresponding application protocols in the predefined SAC signature database.

The AR cannot identify packets that are based on regular expression rules and SSL-encrypted passerby packets.