Mellanox Technologies, Ltd.

Chen Rozenbaum

Roni Bar Yanai

Jiawei Wang

Shie Mannor

Shahaf Shuler

Bartley Richardson

Vadim Gechman

Ahmad Saleh

Rami Ailabouni

Nir Rosen

Haim Elisha

Gary Mataev

Shauli Arazi

Adi Peled

Elad Haimovich

Katya Egert-Berg

Yossef Efraim

Shaul Arazi

Ohad Peres

Technologies for configuring flexible hardware-accelerated rules in a Service Function Chaining (SFC) architecture are described. A DPU includes an acceleration hardware engine to provide a single accelerated data plane, and a processing device that generates a first virtual bridge and a second virtual bridge. The first virtual bridge is controlled by a first network service hosted on the DPU and has a first set of one or more network rules. The second virtual bridge has a second set of one or more user-defined network rules. The processing device generates a combined set of network rules based on the first set of one or more network rules and the second set of one or more user-defined network rules. The acceleration hardware engine processes network traffic data in the single accelerated data plane using the combined set of network rules.

Hardware-accelerated flexible steering rules over service function chaining (SFC)

Apparatuses, systems, and techniques of using one or more circuits (e.g., of a network interface) to obtain assembly code for one or more machine code segments loaded and/or injected into a process, and determine whether the assembly code is likely to perform at least one unauthorized task.

Detecting potential malware in host memory

In one embodiment, a data communication device includes a network interface controller to process packets received from at least one of a host device for sending over a network, and at least one remote device over the network, at least one processor to execute computer instructions to receive a configuration, and extract filtering rules from the configuration, and at least one hardware accelerator to receive the filtering rules from the at least one processor, and filter the packets based on the rules so that some of the packets are dropped and some of the packets are forwarded to the at least one processor to send data based on the forwarded packets to another device.

Efficient and flexible flow inspector

A method includes providing a library of hardware-agnostic packet-processing functions. A functional hardware-agnostic specification of a packet-processing pipeline is received from a user. The specification is defined in terms of one or more of the packet-processing functions drawn from the library. A hardware-specific design of the packet-processing pipeline, which is suited to given hardware, is derived from the specification.

Hardware-agnostic specification of packet-processing pipelines

Apparatuses, systems, and techniques for detecting that a host device is subject to a malicious network attack using a machine learning (ML) detection system are described. A computing system includes a graphics processing unit (GPU) and an integrated circuit with a network interface, and a hardware acceleration engine. The integrated circuit hosts a hardware-accelerated security service to extract features from network data and metadata from the hardware acceleration engine and sends the extracted features to the GPU. Using the ML detection system, the GPU determines whether the host device is subject to a malicious network attack using the extracted features. The GPU can send an enforcement rule to the integrated circuit responsive to a determination that the host device is subject to the malicious network activity.

Accelerated data movement between data processing unit (DPU) and graphics processing unit (GPU) to address real-time cybersecurity requirements

A method includes providing a library of hardware-agnostic packet-processing functions. A functional hardware-agnostic specification of a packet-processing pipeline, for use in a network device, is received from a user. The specification is defined in terms of one or more of the packet-processing functions draws from the library. A hardware-specific design of the packet-processing pipeline, which is suited to given hardware, is derived from the specification.

Growing community of inventors

Beer Yaakov, Israel

Chen Rozenbaum