Operation of a dual instruction pipe virus co-processor

• US 10,176,322 B2
• Filed: 09/18/2017
• Issued: 01/08/2019
• Est. Priority Date: 08/10/2007
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Zhou, Xu, Huang, Lin, Xie, Michael
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US15/707,080
• Publication Number:
  US 20180004945A1
• Time in Patent Office: 477 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/755 with measures against power attack
• CPC Class Codes: G06F 2221/031 Protect user input by software means
• CPC Class Codes: G06F 9/3867 using instruction pipelines
• CPC Class Codes: G06F 9/3885 using a plurality of independent parallel functional units
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Circuits and methods are provided for detecting, identifying and/or removing undesired content. According to one embodiment, a method for performing content scanning of content objects is provided. A content object that is to be scanned is stored by a general purpose processor to a system memory of the general purpose processor. Content scanning parameters associated with the content object are set up by the general purpose processor. Instructions from a signature memory of a co-processor that is coupled to the general purpose processor are read by the co-processor based on the content scanning parameters. The instructions contain op-codes of a first instruction type and op-codes of a second instruction type. Those of the instructions containing op-codes of the first instruction type are assigned by the co-processor to a first instruction pipe of multiple instruction pipes of the co-processor for execution. An instruction of the assigned instructions containing op-codes of the first instruction type is executed by the first instruction pipe including accessing a portion of the content object from the system memory.

Claims

1. A method comprising:

storing, by a general purpose processor, a content object that is to be scanned for undesired content to a system memory of the general purpose processor;

setting up, by the general purpose processor, content scanning parameters associated with the content object;

reading, by a co-processor that is coupled to the general purpose processor via an interconnect bus, instructions from a signature memory of the co-processor based on the content scanning parameters, wherein the instructions contain op-codes of a first instruction type and op-codes of a second instruction type, wherein the op-codes of the first instruction type are associated with primitive instructions and wherein the op-codes of the second instruction type are associated with Content Pattern Recognition (CPR) instructions and wherein said reading comprises;

fetching, by a unified fetch and parse module of the co-processor, an instruction from an instruction cache when the instruction is available in the instruction cache; and

otherwise, when the instruction is not available in the instruction cache, then fetching by the unified fetch and parse module, the instruction from the signature memory;

assigning, by the co-processor, those of the instructions containing op-codes of the first instruction type to a first instruction pipe of a plurality of instruction pipes of the co-processor for execution;

assigning, by the co-processor, those of the instructions containing op-codes of the second instruction type to a second instruction pipe of the plurality of instruction pipes for execution; and

executing, by the first instruction pipe, an instruction of the assigned instructions containing op-codes of the first instruction type including accessing a portion of the content object from the system memory.

2. The method of claim 1, further comprising:

determining, by the co-processor, a type of the content object; and

wherein said content scanning parameters include information regarding the type of the content object.

3. The method of claim 1 wherein the instructions contain intermixed op-codes of the first instruction type and the second instruction type and wherein the method further comprises determining if execution, by the second instruction pipe, of a particular instruction of the assigned instructions containing op-codes of the second instruction type is to be delayed to assure ordered execution of the intermixed op-codes.

4. The method of claim 3, further comprising writing, by the first instruction pipe, a result of said executing to the system memory.

5. The method of claim 4, further comprising performing a first write back to the system memory associated with a preceding instruction before performing a second write back to the system memory associated with a succeeding instruction.

6. The method of claim 5, wherein the preceding instruction comprises one of the assigned instructions containing op-codes of the first instruction type and wherein the succeeding instruction comprises one of the assigned instructions containing op-codes of the second instruction type.

7. The method of claim 1, wherein the content object is stored using a virtual address, wherein the system memory has stored therein paging data structures containing information for translating virtual addresses to physical addresses within a physical address space of the system memory and wherein the co-processor further caches a plurality of most recently used entries of the paging data structures within one or more translation lookaside buffers.

8. The method of claim 1, wherein the undesired content comprises a known virus having a virus signature represented within the signature memory in a form of one or more op-codes of the first instruction type and one or more op-codes of the second instruction type.

9. The method of claim 8, wherein the content scanning parameters include a file type indicative of a class of content with which the content object is associated and a pointer to the content object and wherein the file type is used to reduce a number of signatures in the signature memory that are applied to the content object.

10. The method of claim 8, wherein the op-codes of the second instruction type include:

a compare text string op-code that matches a specified string;

a search text string op-code that searches for a first occurrence of a specified string;

a bitmask op-code that applies a specified bitmask to a specified byte;

a checksum op-code that calculates a checksum of a specified number of bytes and compares the calculated checksum to a specified checksum; and

a goto op-code that moves a signature pointer to a specified location within the signature memory.

11. A content scanning system comprising:

a general purpose processor configured to;

store a content object that is to be content scanned to a system memory of the general purpose processor; and

set up content scanning parameters associated with the content object;

and

a co-processor, coupled to the general purpose processor via an interconnect bus, wherein the co-processor is configured to;

read instructions from a signature memory of the co-processor based on the content scanning parameters, the instructions containing op-codes of a first instruction type and op-codes of a second instruction type, wherein the op-codes of the first instruction type are associated with primitive instructions and wherein the op-codes of the second instruction type are associated with Content Pattern Recognition (CPR) instructions by;

fetching, by a unified fetch and parse module of the co-processor, an instruction from an instruction cache when the instruction is available in the instruction cache; and

otherwise, when the instruction is not available in the instruction cache, then fetching by the unified fetch and parse module, the instruction from the signature memory;

assign those of the instructions containing op-codes of the first instruction type to a first instruction pipe of a plurality of instruction pipes of the co-processor for execution;

assign those of the instructions containing op-codes of the second instruction type to a second instruction pipe of the plurality of instruction pipes for execution; and

execute an instruction of the assigned instructions containing op-codes of the first instruction type including accessing a portion of the content object from the system memory.

12. The content scanning system of claim 11, wherein the co-processor is further configured to determine a type of the content object and wherein said content scanning parameters include information regarding the type of the content object.

13. The content scanning system of claim 12, wherein the instructions contain intermixed op-codes of the first instruction type and the second instruction type and wherein the co-processor is further configured to determine if execution, by the second instruction pipe, of a particular instruction of the assigned instructions containing op-codes of the second instruction type is to be delayed to assure ordered execution of the intermixed op-codes.

14. The content scanning system of claim 13, wherein the co-processor is further configured to write, by the first instruction pipe, a result of executing the instruction of the assigned instructions containing op-codes of the first instruction type to the system memory.

15. The content scanning system of claim 14, wherein the co-processor is further configured to perform a first write back to the system memory associated with a preceding instruction before performing a second write back to the system memory associated with a succeeding instruction.

16. The content scanning system of claim 15, wherein the preceding instruction comprises one of the assigned instructions containing op-codes of the first instruction type and wherein the succeeding instruction comprises one of the assigned instructions containing op-codes of the second instruction type.

17. The content scanning system of claim 11, wherein the content object is stored using a virtual address, wherein the system memory has stored therein paging data structures containing information for translating virtual addresses to physical addresses within a physical address space of the system memory and wherein the co-processor is further configured to cache a plurality of most recently used entries of the paging data structures within one or more translation lookaside buffers.

18. The content scanning system of claim 11, wherein the undesired content comprises a known virus having a virus signature represented within the signature memory in a form of one or more op-codes of the first instruction type and one or more op-codes of the second instruction type.

19. The content scanning system of claim 18, wherein the content scanning parameters include a file type indicative of a class of content with which the content object is associated and a pointer to the content object and wherein the file type is used to reduce a number of signatures in the signature memory that are applied to the content object.

20. The content scanning system of claim 18, wherein the op-codes of the second instruction type include:

a compare text string op-code that matches a specified string;

a search text string op-code that searches for a first occurrence of a specified string;

a bitmask op-code that applies a specified bitmask to a specified byte;

a checksum op-code that calculates a checksum of a specified number of bytes and compares the calculated checksum to a specified checksum; and

a goto op-code that moves a signature pointer to a specified location within the signature memory.