Pmc-sierra, Inc.

Pmc-sierra Us, Inc.

Raghunath Iyer

Sundar Iyer

Moti Jiandani

Navneet Yadav

Ajit Shelat

Ajay Desai

Vikram Chopra

Ramana Rao

Subhash Bal

As Internet packet flow increases, the demand for high speed packet filtering has grown. The present invention introduces a high-speed rule processing method that may be used for packet filtering. The method pre-processes a set of packet filtering rules such that the rules may be searched in parallel by a set of independent search units. Specifically, the rules are divided into N orthogonal dimensions that comprise aspects of each packet that may be examined and tested. Each of the N dimensions are then divided into a set of dimension rule ranges. Each rule range is assigned a value that specifies the rules that may apply in that range. The rule preprocessing is completed by creating a search structure to be used for classifying a packet into one of the rule ranges in each of the N dimensions. Each search structure may be used by an independent search unit such that all N dimensions may be searched concurrently. The packet processing method of the present invention activates the N independent search units to search the N pre-processor created search structures. The output of each of the N search structures is then logically combined to select a rule to be applied.

Method and apparatus for high-speed network rule processing

As Internet packet flow increases, the demand for high speed packet filtering has grown. The present invention introduces several methods for a high-speed rule processing. The methods are geared towards Internet Protocol (IP) packet processing.

A high-speed parallel pattern searching system is disclosed. The high-speed parallel pattern searching system allows the body of a data packet to be searched for one or more patterns such as a string or a series of strings. These string patterns can be defined by the grammar of regular expressions. In the invention, one or more patterns are loaded into one or more nanocomputers that operate in parallel. A control system then feeds a packet body into the participating nanocomputers such that each participating nanocomputer tests for a match. The various tests performed by the nanocomputers may be combined to perform complex searches. These nanocomputer searches are performed in parallel. Furthermore, several different searches may be combined together using control statements. A combination of these searches engines can be supported such that data is also looked at in parallel.

Parallel string pattern searches in respective ones of array of nanocomputers

A control system for high-speed rule processors used in a gateway system is disclosed. The gateway system employing the current invention can process packets at wire speed by using massive parallel processors, each of the processors operating concurrently and independently. Further, the processing capacities in the gateway system employing the current invention are expandable. The number of packet inspector engines may be increased and all of the engines are connected in a cascade manner. Under the control system, all of the engines operate concurrently and independently and results from each of the engines are collected sequentially through a common data bus. As such the processing speed of packets becomes relatively independent of the complexities and numbers of rules that may be applied to the packets.

Control system for high speed rule processors

A high-speed rule processing apparatus is disclosed that may be used to implement a wide variety of rule processing tasks such as network address translation, firewall protection, quality of service, IP routing, and/or load balancing. The high-speed rule processor uses an array of compare engines that operate in parallel. Each compare engine includes memory for storing instructions and operands, an arithmetic-logic for performing comparisons, and control circuitry for interpreting the instructions and operands. The results from the array of compare engines is prioritized using a priority encoding system.

A method and apparatus for performing network address translation is disclosed. The method generates statistically unique port number for each outgoing connection. The statistically unique port numbers are formed from a subset of bits from the source node's IP address and a subset of bits from the port number assigned by the source node. The statistically unique port number is used as an index into a table containing connection information. When a statistically unique port number fails to be absolutely unique, the method uses a secondary fallback system that generates a unique port number by using sequential numbering system. The information about the connections using unique port numbers that were generated sequentially is stored in a secondary connection table. The secondary connection table is organized as a Patricia tree.

Growing community of inventors

Los Altos, CA, United States of America

Raghunath Iyer