Fortinet, Inc.

John Cortes

Zhi Guo

Shushan Wen

Xu Zhou

Hao Wang

Yujiao Zheng

Systems, devices, and methods for correlating security policies to received packets are provided. In one example, a network device, maintains information regarding multiple security policies within a dual bitmap based search tree including a first bitmap and a second bitmap formatted as information embedded in a node structure. A packet is received by the network. A first field of the packet is compared with a first range, corresponding to a first bit location in the first bitmap in which the first bit location in the first bitmap is associated with at least a first security policy. After determining the first field is within the first range, the network device accesses a second bit location in the second bitmap, corresponding to the first bit location. Based at least in part upon a value in the second bit location, a set of one or more security policies are applied to the packet.

Systems and methods for security policy organization using a dual bitmap

Systems, devices, and methods are discussed for classifying a number of security policies in relation to criteria for applying those security policies to yield a dual bitmap scheme representing a correlation between security policies and one or more criteria.

Systems, devices, and methods are discussed for identifying security policies applicable to a received information packet based upon a dual bitmap scheme accounting for bit position mergers and/or policies common to multiple bit positions.

Systems and methods for security policy application based upon a dual bitmap scheme

Systems and methods for programming a network device using a domain-specific language (DSL) are provided. According to one embodiment, source code in a form of a DSL, describing a slow-path task that is to be performed by a network device, is received by a processing resource. A determination is made regarding one or more types of processors are available within the network device to implement the slow-path task. For each portion of the source code, a preferred type of processor is determined by which the portion of the source code would be most efficiently implemented. When the preferred type of processor is available within the network device, executable code is generated targeting the preferred type of processor based on the portion of the source code; otherwise, intermediate code is generated in a form of a high-level programming language, targeting a general purpose processor of the network device.

Compiling domain-specific language code to generate executable code targeting an appropriate type of processor of a network device

Systems and methods for generating design verification test cases using a restricted randomization process are provided. According to one embodiment, a processor of a hardware design verification system receives a set of restrictions and defines a scenario involving the values that is to be excluded from the test case. The processor also receives pre-assigned values for one or more variables. For each variable other than the one or more variables, the processor assigns a first random value to the variable that is within a valid range for the variable. The processor then identifies a conflict between a first pair of variables, and resolves the conflict by assigning a second random value to a first variable or a second variable of the first pair of variables within their respective valid ranges.

Generating design verification test cases using a restricted randomization process based on variable dependencies

Systems and methods for accelerating computer network policy searching are provided. According to one embodiment, a packet is received by a policy search engine (PSE) of a packet processing device. A set of candidate policies are identified from among multiple policies of the packet processing device by screening the multiple policies by a speculation unit of the PSE based on metadata associated with the received packet. Finally, a matching policy for the received packet is identified by a policy search processor (PSP) of the PSE by executing policy-search-specific instructions and general purpose instructions.

Accelerating computer network policy search

Systems and methods for packet classification hardware acceleration are provided. According to one embodiment, a packet classification hardware accelerator system includes multiple packet classification hardware units, a memory and a cache subsystem. The packet classification hardware units are each capable of operation in parallel on a corresponding decision tree of multiple decision trees that have been derived from respective subsets of a common ruleset defining packet classification rules based on header fields of packets. The memory has stored therein non-leaf nodes, leaf nodes and rules associated with the decision trees. The cache subsystem is coupled in communication with packet classification hardware units and the memory and has stored therein (i) a cached portion of the non-leaf nodes distributed among multiple non-leaf node caches, (ii) a cached set of the leaf nodes in a leaf node cache and (iii) a cached set of the rules.

Growing community of inventors

Santa Clara, CA, United States of America

John Cortes