Fortinet, Inc.

Ampere Computing LLC

Shushan Wen

Zhi Guo

John Cortes

Keyur Chudgar

Iyappan Subramanian

Yuwei Zhang

Linna Mai

Tianrui Wei

Various embodiments provide systems and methods for a heuristic policy search tree optimization using a prioritized dimension selection. A computer-implemented method for optimizing a policy search tree includes differentiating, with a network appliance, dimensions based on multiple priority levels of a priority dimension configurable setting, determining whether a first dimension having a first priority level for a node of the policy search tree satisfies configurable thresholds for characteristics of a policy set, and selecting the first dimension having the first priority level if no configurable threshold violation for the first dimension.

Systems and methods for a heuristic tree optimization using a prioritized dimension selection for policies with multiple given dimensions

A raw policy set is received for the network processor and a dimension bitmap corresponding to the raw policy set. From the raw policy set, a policy tree builder generates a policy tree image from a set of recursive operations on the raw policy set including selecting boundaries of the raw policy set from cuts on a given dimension of the raw policy set, the dimension cut based on a dimension selection and a partition number selection for the raw policy set. Network processor hardware is configured according to the policy tree image including at least one set of registers, at least one set of tables, and at least one sequence of instructions. At runtime, the network processor applies the optimized policy set to processing of the packet session from the data communication network by the network processor hardware.

Generic tree policy search optimization for high-speed network processor configuration

During high-speed network policy searching for data packets, an upper limit and a lower limit for a policy count are predefined for a ratio of the policy count to the sum of the policy count and the range count. A policy tree builder generates a policy tree image from a set of recursive operations on the raw policy set including an on-the-fly determination of whether a specific node is a leaf based on a leaf policy count limit, wherein for a selected dimension, the specific node is converted to the leaf if the policy count does not exceed the leaf policy count limit and the range count for the selected dimension does not exceed a product of the leaf policy count limit and a range count limit coefficient, and otherwise the specific node is converted to two or more child nodes. A network processor configures at least one set of registers, at least one set of tables, and at least one sequence of instructions according to the policy tree image.

Dynamic leaf determination for tree creations for high-speed network policy search during data packet scanning

A policy tree of nodes and leaves is automatically created from a network security policy set, by identifying density zones of policy subsets. Responsive to identifying an uneven density zone in a node of the policy tree, child nodes are generated with normal density zones from the uneven density zones. A policy bitmap is generated from a set of network security policies. A partition number is configured during bitmap labeling for the policy bitmap. A configurable threshold during bitmap labeling is adjustable according to network security policies. Further, a plurality of boundaries between low-density zones and high-density zones utilizing bitmap labeling on the policy bitmap by counting lead zeros and tail zeros.

Fast gap reduction in policy tree creation for policy set with uneven density

Systems, devices, and methods for correlating security policies to received packets are provided. In one example, a network device, maintains information regarding multiple security policies within a dual bitmap based search tree including a first bitmap and a second bitmap formatted as information embedded in a node structure. A packet is received by the network. A first field of the packet is compared with a first range, corresponding to a first bit location in the first bitmap in which the first bit location in the first bitmap is associated with at least a first security policy. After determining the first field is within the first range, the network device accesses a second bit location in the second bitmap, corresponding to the first bit location. Based at least in part upon a value in the second bit location, a set of one or more security policies are applied to the packet.

Systems and methods for security policy organization using a dual bitmap

A CRC rule is generated for each CRC parity check circuit from a bank of CRC parity check circuits for mapping a fixed-length CRC output to a signature, each of the CRC parity check circuits servicing a specific string length. The selected CRC parity circuit outputs a fixed-length parity-check data for the specific data packet, and the string mapper maps the fixed-length parity-check data for the specific data packet to one of the string identifiers associated with the group of signatures. If a fixed-length parity-check match is found, outputting a string identifier of the match for a security action.

Intrusion protection system (IPS) for hash-based string detection without memory lookup table

A compiler (CPL) plugin comprises a TC to, responsive to a new DV test, read configuration settings and selects appropriate plugin processes based on the configuration settings. An API interface can generate images that control the special purpose processor during a stage of a plurality of stages for a CPL-related design verification (DV) test and call selected plugin processes. A common compiler module comprising a common function codebase. A DV specialized support module comprising a DV function only codebase, wherein the DV has access to the common compiler module. An RP specialized support module can comprise an RP function only codebase, wherein the codebase is common for both DV and RP, and wherein top-level APIs are designed for both DV and RP. Responsive to completing the DV test, TC disables the plugins and injects traffic for the DV test, and wherein TC reports testing results.

Compiler plugin for special-purpose computer processors with dual support for design verification and release packaging

At a first stage, cells of a row of the index table are searched, using a portion of the unified hash value bits as index to identify the row of the index table. Also, a pointer to the content table is identified by comparing an index table tag of an entry of a cell with a calculated tag of the hash to identify a cell in the row. At a second stage, a cell is looked up in the content table, responsive to a match of calculated tag of the hash and index table tag of entry, comparing the current full key value and the full key value in the content table entry. The content table full key value is retrieved using a pointer from the cell of the index table to the content table from the cell entry.

Cache look up during packet processing by uniformly caching non-uniform lengths of payload data in a dual-stage cache of packet processors

Systems, devices, and methods are discussed for classifying a number of security policies in relation to criteria for applying those security policies to yield a dual bitmap scheme representing a correlation between security policies and one or more criteria.

Systems, devices, and methods are discussed for identifying security policies applicable to a received information packet based upon a dual bitmap scheme accounting for bit position mergers and/or policies common to multiple bit positions.

Systems and methods for security policy application based upon a dual bitmap scheme

A packet parser generates a key from TCP metadata of a data packet for a specific session. A packet cache stores recent network policy identifiers associated with a plurality of network sessions, wherein the key is used as an index to search the packet cache. The packet cache responsive to a cache miss, checks a TFO cookie field for a rule ID stored by the client during a previous session as generated by the network processor. If there is no rule ID, a classification pipeline is activated. On the other hand, responsive to a cache hit, or responsive to identifying a rule ID for the session from the TFO cookie, the classification pipeline is bypassed for the data packets of the specific session.

TCP (transmission control protocol) fast open for classification acceleration of cache misses in a network processor

Systems and methods for generating design verification test cases using a restricted randomization process are provided. According to one embodiment, a processor of a hardware design verification system receives a set of restrictions and defines a scenario involving the values that is to be excluded from the test case. The processor also receives pre-assigned values for one or more variables. For each variable other than the one or more variables, the processor assigns a first random value to the variable that is within a valid range for the variable. The processor then identifies a conflict between a first pair of variables, and resolves the conflict by assigning a second random value to a first variable or a second variable of the first pair of variables within their respective valid ranges.

Generating design verification test cases using a restricted randomization process based on variable dependencies

A mapping technique sets coalescing latency values for computing systems that use multiple data queues having a shared base timer. A computing system having at least one receive queue and at least one transmit queue receives user-provided coalescing latency values for the respective queues, and converts these user-provided latencies to coalescing latency hardware register values as well as a base timer register value for the shared base timer. The hardware register values for the coalescing latencies together with the shared base timer register value determine the coalescing latencies for the respective queues. This mapping technique allows a user to conveniently set coalescing latencies for multi-queue processing systems while shielding the user settings from hardware complexity.

Growing community of inventors

Pleasant Hill, CA, United States of America

Shushan Wen