Fortinet, Inc.

Hongbin Lu

Xu Zhou

Michael Xie

Lin Huang

Zhi Guo

Wei Wang

Juneng Zheng

Junfeng Jia

Systems and methods for high performance IDS/IPS with efficient metadata filtering are provided. According to one embodiment, a signature database of an IDS/IPS is configured with multiple metadata signatures. A pre-match engine identifies a candidate packet of network traffic received by the IDS/IPS for full-feature match processing by: (i) categorizing the metadata signatures based on characteristics thereof; and (ii) processing and filtering a first set of the metadata signatures that forms part of a hash key based metadata signature category. The hash key based metadata signature category represents a category resulting from the categorization and each of the first set of metadata signatures is associated with a fixed unique hash key based on which respective metadata signatures are matched with the received network traffic to identify the candidate packet. Finally, a potential intrusion is identified by performing the full-feature match processing on the candidate packet based on full-feature match signatures.

Filtering of metadata signatures

Methods and systems for improving accuracy, speed, and efficiency of context-aware pattern matching are provided. According to one embodiment, a packet stream is received by a first stage of a hardware accelerator of a network device. A pre-matching process is performed by the first stage to identify a candidate packet that matches a string or over-flow pattern associated with access control (e.g., IPS or ADC) rules. A candidate rule is identified based on a correlation of results of the pre-matching process. The candidate packet is tokened to produce matching tokens and corresponding locations. A full-match process is performed on the candidate packet by a second stage of the hardware accelerator to determine whether it satisfies the candidate rule by performing one or more of (i) context-aware pattern matching, (ii) context-aware string matching and (iii) regular expression matching based on contextual information, the matching tokens and the corresponding locations.

Context-aware pattern matching accelerator

Systems and methods for rating of signature patterns are provided. According to one embodiment, a frequency of occurrence is determined by a network security system of each of multiple patterns within a pattern database containing a set of candidate patterns from which a set of patterns or sub-patterns thereof will be selected for inclusion within a pre-match list. For each pattern, the network security device determines whether a length of the pattern exceeds a pre-defined length; and, if so, cuts the pattern to generate multiple sub-patterns having the pre-defined length. A rating for each pattern or, as the case may be, each sub-pattern is then determined by the network device based on any or a combination of the frequency of occurrence of the pattern within the pattern database, the length of the pattern or the sub-pattern and a measure of redundancy within the pattern or sub-pattern.

Rating of signature patterns for pattern matching

Methods and systems for improving efficiency of direct cache access (DCA) are provided. According to one embodiment, a set of DCA control settings are defined by a network interface controller (NIC) of a network security device for each of multiple I/O device queues. The control settings specify portions of network packets that are to be copied to a cache of the corresponding CPU. A packet is received by the NIC. The packet is parsed to identify boundaries of portions of the packet and is queued onto an I/O device queue. The packet is then transferred from the I/O device queue to a host memory of the network security device and the specified portions are concurrently copied to the cache of the corresponding CPU based on the control setting associated with the I/O device queue.

Direct cache access for network input/output devices

Systems and methods for inline security protocol inspection are provided. According to one embodiment, a security device receives an encrypted packet from a first network appliance and buffers the encrypted packet in a buffer. An inspection module accesses the encrypted packet from the buffer, decrypts the encrypted packet to produce plain text and scans the plain text by the inspection module.

Inline inspection of security protocols

Methods and systems for improving accuracy, speed, and efficiency of context-aware pattern matching are provided. According to one embodiment, a packet stream is received by a first stage of a CPMP hardware accelerator of a network device. A pre-matching process is performed by the first stage to identify a candidate packet that matches a string or over-flow pattern associated with IPS or ADC rules. A candidate rule is identified based on a correlation of results of the pre-matching process. The candidate packet is tokened to produce matching tokens and corresponding locations. A full-match process is performed on the candidate packet by a second stage of the CPMP hardware accelerator to determine whether it satisfies the candidate rule by performing one or more of (i) context-aware pattern matching, (ii) context-aware string matching and (iii) regular expression matching based on contextual information, the matching tokens and the corresponding locations.

Systems and methods for inline security protocol inspection are provided. According to one embodiment, a security device receives an encrypted raw packet from a first network appliance and buffers the encrypted raw packet in a buffer. An inspection module accesses the encrypted raw packet from the buffer, decrypts the encrypted raw packet to produce a plain text and scans the plain text by the inspection module.

Methods and systems for improving efficiency of direct cache access (DCA) are provided. According to one embodiment, a set of DCA control settings are defined by a network I/O device of a network security device for each of multiple I/O device queues based on network security functionality performed by corresponding CPUs of a host processor. The control settings specify portions of network packets that are to be copied to a cache of the corresponding CPU. A packet is received by the network I/O device. Information associated with the packet is queued onto an I/O device queue. The information is then transferred from the I/O device queue to a host memory of the network security device. Based on the control settings for the I/O device queue only those portions of the information corresponding to the one or more specified portions are copied to the cache of the corresponding CPU.

Methods and systems for improving efficiency of direct cache access (DCA) are provided. According to one embodiment, a DCA control is defined by a network Input/Output (I/O) device for an I/O device queue corresponding to a central processing unit (CPU) of a host processor. A part of an incoming packet is configured by the DCA control to be copied to a cache of the CPU. The incoming packet is parsed by the network I/O device based on one or more of packet analysis, packet protocol, header format and payload data information. The parsed incoming packet is transferred from an I/O device queue of the network I/O device to a host queue of a host memory that is operatively coupled with the host processor. The specified part of the parsed incoming packet is copied by a host controller to the cache of the CPU based on the DCA control.

Methods and systems for improving accuracy, speed, and efficiency of context-aware pattern matching are provided. According to one embodiment, a packet stream is received and pre-matched by an acceleration device with one or more conditions to identify packets meeting the one or more conditions. The acceleration device then correlates at least one identified packet based on the one or more conditions to generate matching tokens of the packet that meet the one or more conditions and sends, to one or more processors of the acceleration device, the matching tokens along with identifiers of the one or more conditions so that the processors can process the matching tokens and the identifiers of the one or more conditions based on one or more of context aware string matching, regular expression matching, and packet field value matching to extract packets that match context of the one or more conditions.

Growing community of inventors

San Jose, CA, United States of America

Hongbin Lu