Corsa Technology Inc.

Ciena Corporation

Catena Networks, Inc.

Peter Bengough

Stacey Sheldon

Jonathan Sewter

Ian Dublin

Jeffery Thomas Nichols

Ian Mes

Andre Sabourin

Yuri Kolomiyets

Carolyn Raab

Stuart Reid

The present disclosure relates to scalable network security functions and handling of packet flows between network security zones in a communications network. Packets that are part of a bidirectional packet flow between the network security zones are received, and a determination is made as to an instance of a security application to which to assign the bidirectional packet flow for security processing. The determination is made based on relative loading of a plurality of identical instances of the security application running on a host machine. All of the received packets that are part of the bidirectional packet flow are directed for processing on the host machine by the one of the security application instances.

Methods and apparatus for scalable network security functions

A key is descriptive of a data packet, and a fingerprint hash function is applied to such a key to generate a fixed length fingerprint of the key. An index value is determined based on a portion of the fingerprint. A hash table could be populated by storing in a memory, at a memory location associated with the index value: a remainder of the fingerprint other than the portion of the fingerprint that was used to determine the index value, to indicate that data packets consistent with the key are to be handled in accordance with packet handling metadata. During packet processing, if a memory location associated with an index value stores a remainder of the fingerprint other than the portion of the fingerprint that was used to determine the index value, a data packet is handled according to packet handling metadata associated with the fingerprint.

Packet classification using fingerprint hash table

A packet sub-engine coupled to a packet buffer determines which of multiple look up tables (LUTs) is to be searched for a matching entry that matches a received data packet. Each LUT corresponds to a different type of packet handling action and includes multiple entries, each with a match field and a corresponding collection of one or more actions for handling packets that match the match field. The packet sub-engine searches the determined LUT for a matching entry, processes the received data packet according to the action(s) in the matching entry, and determines whether a further LUT is to be searched for a further matching entry. The processed data packet is provided as an output if no further LUT is to be searched, or otherwise the packet sub-engine searches the further LUT and further processes the processed packet according to the action(s) in the further matching entry.

Single stage look up table based match action processor for data packets

The present disclosure relates to handling of packet flows between a pair of network security zones in a communications network. A packet that is sent from one of the network security zones toward the other of the network security zones is directed to a packet processing service chain, based on a packet handling classification of a packet flow of which the packet is a part. The service chain has multiple identical service chain instances to perform a service on packets, and the packet is directed to one of the service chain instances within the service chain. A packet that is processed by any of the service chain instances is transmitted to the other network security zone.

Methods and systems for network security universal control point

Look up table based match action processor for data packets

The present disclosure provides a structured, pipelined large time-space switch and method of operation resolving interconnect complexity. The time-space switch results in an interconnect complexity that does not grow as the spatial dimension is increased and results in a reduction of long high fan-out nets, a quicker layout, and improved clock speed. With respect to time-space switch fabric implementation, the present invention improves the maximum clock frequency of the switch fabric, and improves integrated circuit layout time by eliminating long high fan-out nets. Certain high-speed large switch fabrics may not be realizable without this implementation, and it significantly reduces implementation time (and cost). The present invention may include link encoding of switch frames by mapping 8B10B control characters into an 64B65B format (similar to Generic Framing Protocol-Transparent (GFP-T)), wrapping 32 65B encoded words with an 11-bit error correcting code, and scrambling the frame with a frame synchronous scrambler.

Extensible time space switch systems and methods

A time-space switch in a ring architecture includes input circuitry including N links each receiving M timeslots, a two-dimensional matrix of a plurality of switching circuits, the two-dimensional matrix is configured to receive from the input circuitry each of the M timeslots from the N links in a pipelined manner, and output circuitry including N links configured to receive any of the M timeslots from any of the N links from the two-dimensional matrix. The input circuitry, the two-dimensional matrix, and the output circuitry are arranged in a ring architecture therebetween. A link encoding protocol method performed in electrical circuitry includes receiving a plurality of time slots, grouping the plurality of time slots into time slot groups, performing a cyclic redundancy check between adjacent time slot groups, 64/65B encoding the time slot groups, and forward error correction encoding a plurality of 65B codewords from the 64/65B encoding.

Extensible time space switch systems and methods for high capacity multi-service applications

A forward error correction system for reducing the transmission error in a data transmission is provided. The system comprises an encoder for encoding data, an interleaver for interleaving the encoded data to an output data stream and a first buffer for storing the interleaved data. A transmitter is operatively associated with the first buffer for transmitting the interleaved data. A deinterleaver receives and deinterleaves the transmitted interleaved data and a second buffer operatively coupled with the deinterleaver stores the deinterleaved data. A decoder operatively coupled with the second buffer decodes the deinterleaved data. The deinterleaved data is decoded without intermediate storage, reducing the storage requirements.

Growing community of inventors

Kanata, Canada

Peter Bengough