Hybrid hardware/software packet filter

• US 20030074458A1
• Filed: 09/18/2001
• Published: 04/17/2003
• Est. Priority Date: 09/18/2001
• Status: Abandoned Application

• Current Assignee: Regents of the University of California (University of California)
• Original Assignee: Regents of the University of California (University of California)
• Inventors: Gokhale, Maya B.
• Application Number:
  US09/954,866
• Publication Number:
  US 20030074458A1
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: H04L 45/742 Route cache; Operation thereof
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A hybrid software/hardware packet filter in which rule compiling means creates a rule table, assembles packet acceptance rules, and outputs the acceptance rules to a configurable hardware circuit to create hardware circuits representing the acceptance rules and applying the acceptance rules to the packet and outputting a single bit for each rule indicating whether the packet matched the rule. Linking means receives the match bit vector and links each bit in the match bit vector with the corresponding entry in the rule table and directs the packet to a destination determined by the rule table.

Claims

1. A hybrid hardware/software packet filter comprising:

rule compiling means for assembling packet acceptance rules and creating a rule table, and outputting said rule table;

a configurable hardware circuit receiving said rule table and creating hardware circuits representing said rule table for applying said rule table to said packet and outputting a match bit vector indicating whether said packet matched a corresponding entry in said rule table;

linking means receiving said match bit vector for linking said match bit vector with said corresponding entry in said rule table and for directing said packet to a destination determined by said rule table.

2. The hybrid software/hardware packet filter as described in claim 1, wherein said configurable hardware circuit is mapped onto a Field Programmable Gate Array.

3. The hybrid software/hardware packet filter as described in claim 1, wherein said rule compiler means also outputs a Hardware Description Language entity definition.

4. The hybrid software/hardware packet filter as described in claim 3, wherein said Hardware Description Language Description entity definition comprises a Very High Speed Integrated Circuit Hardware Description Language Description.

5. The hybrid software/hardware packet filter as described in claim 3, wherein said Hardware Description Language Description entity definition comprises Verilog.

6. The hybrid software/hardware packet filter as described in claim 1, wherein said destination includes logging or an alert being generated in the case of suspicious packets.

7. A method of filtering incoming packets comprising the steps of:

compiling a set of rules to be applied to incoming packets;

configuring hardware to create circuits representative of said set of rules;

comparing said incoming packets with said circuits representative of said set of rules;

outputting a single bit indicative of whether a packet is accepted or rejected;

linking said single bit with a rule table; and

directing said incoming packets to destinations determined by said rule table.

8. The method as described in claim 7, wherein said step of configuring hardware includes a VDHL entity definition.

9. The method as described in claim 7, wherein said directing step includes directing said incoming packets to destinations where suspicious packets are logged.

10. The method as described in claim 7, wherein said directing step includes directing said incoming packets to destinations where suspicious packets cause an alert of some type to be generated.