International Business Machines Corporation

Everett Arthur Corl, Jr

Clark Debs Jeffries

Gordon Taylor Davis

Colin Beaton Verrilli

Marco C Heddes

Piyush Chunilal Patel

Ravinder Kumar Sabhikhi

Anthony Matteo Gallo

Natarajan Vaidhyanathan

Steven Richard Perrin

Brahmanand Kumar Gorti

Victoria Sue Thio

Hiroshi Takada

Jean Louis Calvignac

Michael Steven Siegel

Malcolm Scott Ware

Jan Van Lunteren

Ganesh Balakrishnan

Mark Anthony Rinaldi

Seeta Hariharan

Raj Kumar Singh

Rama Mohan Yedavalli

Brooks Johnston

Olga Golovanevsky

Avraham Zehavi

Plyush C Patel

Randall William Worzella

Colin Beaton Verilli

Robert Franklin Kantner, Jr

A method for increasing the capacity of a connection table in a firewall accelerator by means of mapping packets in one session with some common security actions into one table entry. For each of five Network Address Translation (NAT) configurations, a hash function is specified. The hash function takes into account which of four possible arrival types a packet at a firewall accelerator may have. When different arrival types of packets in the same session are processed, two or more arrival types may have the same hash value.

Efficiently hashing packet keys into a firewall connection table

The classification system of a network device includes a cache in which a mapping between predefined characteristics of TCP/IP packets and associated actions are stored in response to the first 'Frequent Flyer' packet in of a session. Selected characteristics from subsequent received packets of that session are correlated with the predefined characteristics and the stored actions are applied to the received packets if the selected characteristics and the predefined characteristics match, thus reducing the processing required for subsequent packets. The packets selected for caching may be data packets. For mismatched characteristics, the full packet search of the classification system is used to determine the action to apply to the received packet.

Caching lookups based upon TCP traffic flow characteristics

Method for compressing search tree structures used in rule classification is provided. The method includes classifying packets based on filter rules, compressing a tree structure comprising multiple levels of single bit test nodes and leaf nodes, storing the compressed tree structure in a first memory structure of a storage such that the multiple levels of single bit test nodes and leaf nodes can be accessed from the first memory structure through a single memory access of the storage, collecting single bit test nodes of the tree structure that are in a lowest level of the tree structure, storing only the collected single bit test nodes within a second memory structure of the storage that is contiguous to the first memory structure, collecting leaf nodes of the tree structure, and storing only the collected leaf nodes within a third memory structure of the storage that is contiguous to second memory structure.

System for defining data mappings between data structures

The present invention relates to a system for managing a plurality of multi-field classification rules. The system provides a first table that includes a plurality of entries corresponding to a plurality of rules relating to an ingress context and a second table that includes a plurality of entries corresponding to a plurality of rules relating to an egress context. The system also includes a network processor for classifying packets of information, wherein the network processor is programmed to utilize the first table and the second table to identify any rules relating to the ingress context and any one rules relating to the egress context that match a search key.

System for managing multi-field classification rules relating to ingress contexts and egress contexts

The present invention relates to a method and computer system device for applying a plurality of rules to data packets within a network computer system. A filter rule decision tree is updated by adding or deleting a rule. If deleting a filter rule then the decision tree is provided to a network data plane processor with an incremental delete of the filter rule. If adding a filter rule then either providing an incremental insertion of the filter rule to the decision tree or rebuilding the first decision tree into a second decision tree responsive to comparing a parameter to a threshold. In one embodiment the parameter and thresholds relate to depth values of the tree filter rule chained branches. In another the parameter and thresholds relate to a total count of rule additions since a building of the relevant tree.

Decision tree multi-field classification dynamic rules updating and rebuilding

A wire-speed forwarding platform and method for supporting multifield classification of a packet fragmented into a plurality of fragments in the wire-speed forwarding platform, comprising: receiving a fragment of the fragmented packet at the forwarding platform and deriving a key from one or more fields of the received fragment; and performing multifield classification of the received fragment by matching the key to a rule out of a plurality of rules, the rule comprising a plurality of fields including at least one field for specifying whether the received fragment's fragmentation characteristics are to be applied when performing the multifield classification.

Classification support system and method for fragmented IP packets

Method for efficiently hashing packet keys into a firewall connection table

The present invention relates to a system and computer-readable medium for storing a plurality of multi-field classification rules in a computer system. Each multi-field classification rule includes a rule specification that itself includes a plurality of fields and a plurality of field definitions corresponding to the fields. The method of the present invention includes providing a virtual rule table, where the table stores a plurality of field definitions, and for each of the plurality of multi-field classification rules, compressing the rule specification by replacing at least one field definition with an associated index into the virtual rule table. The method also includes storing each of the compressed rule specifications and the virtual rule table in a shared segment of memory.

System and computer program for compressing multi-field classification rules

A process control method and system including partitioning transmit decisions and certain measurements into one logical entity (Data Plane) and partitioning algorithm computation to update transmit probabilities into a second logical entity (Control Plane), the two entities periodically communicating fresh measurements from Data Plane to Control Plane and adjusted transmit probabilities from Control Plane to Data Plane. The transmit probability may be used in transmit/discard decisions of packets or instructions exercised at every arrival of a packet or instruction. In an alternative embodiment, the transmit probability may be used in transmit/delay decisions of awaiting instructions or packets exercised at every service event.

System and method for automatic management of many computer data processing system pipes

A system for reducing the size of a database includes a memory in which the database configured in a ternary matrix array structure is stored. A processor executing at least one reduction algorithm scans the database tagging superfluous entries that are subsequently deleted. The tagging and deleting are done in such a way that the logical contents of the original database is unchanged, even though the size of the database is reduced.

Reduction of ternary rules with common priority and actions

Multi-field classification dynamic rule updates

Method for caching lookups based upon TCP traffic flow characteristics

The present invention relates to a method for storing a plurality of multi-field classification rules in a computer system. Each multi-field classification rule includes a rule specification that itself includes a plurality of fields and a plurality of field definitions corresponding to the fields. The method of the present invention includes providing a virtual rule table, where the table stores a plurality of field definitions, and for each of the plurality of multi-field classification rules, compressing the rule specification by replacing at least one field definition with an associated index into the virtual rule table. The method also includes storing each of the compressed rule specifications and the virtual rule table in a shared segment of memory.

Method for compressing multi-field rule specifications

The present invention relates to a method for managing a plurality of multi-field classification rules. The method includes providing a first table that includes a plurality of entries corresponding to a plurality of rules relating to an ingress context and providing a second table that includes a plurality of entries corresponding to a plurality of rules relating to an egress context. The method also includes utilizing the first table and the second table to identify any rules relating to the ingress context and any rules relating to the egress context that match a search key.

Method for managing multi-field classification rules relating to ingress

Growing community of inventors

Raleigh, NC, United States of America

Everett Arthur Corl, Jr