Embedded data set processing

• US 20040039939A1
• Filed: 08/23/2002
• Published: 02/26/2004
• Est. Priority Date: 08/23/2002
• Status: Active Grant

• Current Assignee: Future Link Systems, LLC (Vector Capital Corporation)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Cox, George Edward, Courington, Jeff
• Granted Patent: US 7,467,406 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/12 Protocol engines
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A hardware-based method and system classifies and processes data sets according to a set of rules. In one aspect of the invention, the operations associated with data set analysis and classification are offloaded from an interface processor to one or more embedded processors operating in parallel with the interface processor. A set of rules for classifying a data set is represented by instruction sequences stored in the embedded processors'"'"' memory. The embedded processors include data set parser logic to decompose data sets into relevant units and rules engine logic for executing the sequence of instructions to determine the classification of data sets. The rules engine logic returns the results of classifying the data sets to the interface processor.

Claims

1. An interface circuit for processing data sets transferred between a source and a destination terminal in accordance with a set of rules, comprising:

an interface processor arranged to process each data set according to a classification of the data set;

an embedded processor operating in parallel with the interface processor, the embedded processor configured to classify each data set in accordance with the set of rules and provide the result of the classification to the interface processor; and

a parallel data bus coupled between the interface processor and the embedded processor, the parallel data bus configured to deliver data sets from the interface processor to the embedded processor and to deliver the result of the classification to the interface processor.

2. The circuit of claim 1, wherein the interface processor is implemented as a processor core.

3. The circuit of claim 1, wherein the interface processor implements a microdriver, the microdriver converting the set of rules into a sequence of machine code instructions executable by the embedded processor for classifying each data set according to the set of rules.

4. The circuit of claim 1, wherein the embedded processor further comprises:

a bus interface arranged to couple the embedded processor to the parallel bus;

a data set analysis circuit coupled to the bus interface and configured to classify each data set according to the set of rules; and

a memory unit coupled to the bus and the data set analysis circuit for storing a program of instructions representing the set of rules to be applied to the data set.

5. The circuit of claim 4, further comprising:

a data set parser circuit coupled to the bus interface and arranged to extract relevant data units from each data set; and

a plurality of registers coupled to the data set parser circuit and the data set analysis circuit for storing the relevant data units.

6. The circuit of claim 5, wherein the program of instructions representing the set of rules is applied to the relevant data units to classify the data set.

7. The circuit of claim 5, wherein the program of instructions includes one or more comparison instructions applied to the relevant data units stored in one or more of the plurality of registers to classify the data set.

8. The circuit of claim 5, wherein the interface processor controls the transfer of the data set to the data set parser circuit.

9. The circuit of claim 5, wherein the data set is transferred from the interface processor to the data set parser circuit by a DMA circuit.

10. The circuit of claim 4, wherein the memory unit is configured to receive a sequence of machine code instructions representing the set of rules transferred to the embedded processor from the interface processor over the bus.

11. The circuit of claim 10, wherein the machine code instructions are updated by the interface processor in response to modification of the set of rules.

12. The circuit of claim 4, wherein the data set analysis circuit includes a very reduced instruction set computer operating in parallel with the interface processor.

13. The circuit of claim 4, wherein the data set analysis circuit receives commands from the interface processor that control execution of the program of instructions.

14. The circuit of claim 4, wherein the program of instructions representing the set of rules to be applied to the data set comprises a series of machine code instructions and the data set analysis circuit is configured to execute the series of machine code instructions to classify the data set.

15. The circuit of claim 14, wherein the interface processor indicates to the embedded processor the starting address for execution of the series of machine code instructions for each data set.

16. The circuit of claim 14, wherein the series of machine code instructions includes a comparison operation using one or more values stored in one or more registers of the embedded processor.

17. The circuit of claim 4, wherein the data set analysis circuit is configured to indicate the result of classifying each data set to the interface processor.

18. The circuit of claim 17, wherein the data set analysis circuit indicates the result of classifying each data set by storing a value in a register accessible by the interface processor through the bus.

19. The circuit of claim 4, wherein the data set analysis circuit executes a sequence of machine code instructions to search for one or more data units in the data set indicative of a computer virus.

20. The circuit of claim 19, wherein the data set analysis circuit, in response to detecting the sequence of data units in the data set indicative of a computer virus, indicates a result of detecting the sequence of data units to the interface processor.

21. The circuit of claim 4, wherein the data set analysis circuit searches for one or more particular text strings in the data set.

22. The circuit of claim 21, wherein the data set analysis circuit, in response to detecting one or more particular text strings in the data set, indicates a result of detecting the one or more particular text strings to the interface processor.

23. The circuit of claim 4, wherein the data set analysis circuit determines if the data set derives from a prohibited source.

24. The circuit of claim 23, wherein the data set analysis circuit, indicates a result of determining the data set derives from a prohibited source to the interface processor in response to determining the data set derives from a prohibited source.

25. A method for processing data sets, comprising:

transferring data sets from an interface processor to an embedded processor operating in parallel with the interface processor;

classifying the data sets in accordance with a set of rules;

providing results of the classifications to the interface processor; and

processing the data sets in accordance with the classifications of the data sets.

26. The method of claim 25, further comprising:

converting the set of rules into a sequence of machine code instructions executable by the embedded processor;

transferring the sequence of machine code instructions from the interface processor to the embedded processor; and

executing the sequence of machine code instructions in the embedded processor to classify the data sets.

27. The method of claim 26, further comprising updating the sequence of machine code instructions in accordance with changes in the set of rules.

28. The method of claim 26, wherein executing the sequence of machine code instructions further comprises executing at least one compare instruction.

29. The method of claim 25, further comprising:

extracting relevant data units from the data sets;

storing the relevant data units; and

using the stored relevant data units to classify the data sets.

30. The method of claim 25, wherein transferring data sets from the interface processor to the embedded processor comprises transferring data sets by direct memory access.

31. The method of claim 25, wherein transferring data sets from the interface processor to the embedded processor comprises transferring data sets under the control of the interface processor.

32. The method of claim 25, wherein providing results of the classifications to the interface processor comprises storing a value in a register of the embedded processor accessible by the interface processor.

33. The method of claim 25, wherein processing the data sets comprises processing the data sets in accordance with a set of rules providing virus detection.

34. The method of claim 25, wherein processing the data sets comprises processing the data sets in accordance with a set of rules providing search capability for detecting one or more particular text strings in the data set.

35. The method of claim 25, wherein processing the data sets comprises processing the data sets in accordance with a set of rules providing intrusion detection criteria.

36. The method of claim 25, wherein processing the data sets comprises processing the data sets in accordance with a set of rules providing private network address translation criteria.

37. A system for embedded data set processing, comprising:

means for transferring data sets from an interface processor to an embedded processor operating in parallel with the interface processor;

means for classifying the data sets in accordance with a set of rules;

means for providing results of the classifications to the interface processor; and

means for processing the data sets in accordance with the classifications of the data sets.

38. The system of claim 37, further comprising:

means for converting the set of rules into a sequence of machine code instructions executable by the embedded processor;

means for transferring the sequence of machine code instructions from the interface processor to the embedded processor; and

means for executing the sequence of machine code instructions in the embedded processor to classify the data sets.

39. A method for processing data sets according to a set of rules, comprising:

providing one or more embedded processors operating in parallel with an interface processor, the embedded processors classifying the data sets according to the set of rules and the interface processor processing the data sets in accordance with the classification of the data sets;

representing the set of rules as a one or more instruction sequences;

transferring one or more of the instruction sequences from the interface processor to one or more of the embedded processors;

passing portions of the data sets from the interface processor to one or more of the embedded processors;

extracting relevant data units from the data set portions passed to the one or more of the embedded processors;

executing the one or more instruction sequences in the embedded processors to classify the data set, the instruction sequences using the relevant data units;

reporting the result of classifying the data sets to the interface processor; and

processing the data sets in accordance with the classification of the data sets.

40. The method of claim 39, wherein providing one or more embedded processors comprises providing one or more very reduced instruction set computers.

41. The method of claim 39, wherein representing the set of rules comprises representing the set of rules as machine code instruction sequences executable by the embedded processors.

42. The method of claim 39, wherein passing the portions of the data set to one or more of the embedded processors comprises passing the portions of the data sets from the interface processor to one or more of the embedded processors over a parallel-connected bus.

43. The method of claim 39, wherein extracting relevant data units from the portions of the data sets comprises storing relevant data units in one or more registers of the embedded processors.

44. The method of claim 39, wherein executing the instruction sequences comprises executing a machine code sequence to classify the data set.

45. The method of claim 39, wherein executing the instruction sequences includes executing comparison instructions using one or more values stored in registers of the embedded processors.

46. The method of claim 39, wherein reporting the result of classifying the data sets comprises storing values in registers accessible by the interface processor.

47. The method of claim 39, wherein executing the instruction sequences to classify the data sets comprises searching the portions of the data sets for one or more data units indicative of a computer virus.

48. The method of claim 39, wherein executing the instruction sequences to classify the data sets comprises searching the portions of the data sets for one or more particular data strings.

49. The method of claim 39, wherein executing the instruction sequences to classify the data sets comprises determining if the data sets originate from any of a group of prohibited sources.

50. The method of claim 39, wherein executing the instruction sequences to classify the data sets comprises providing classification of the data sets to implement private network address translation.

51. A system for classifying data sets according to a set of rules, comprising:

means for operating one or more embedded processors in parallel with an interface processor, the embedded processors classifying the data sets according to the set of rules and the interface processor processing the data sets in accordance with the classification of the data sets;

means for representing the set of rules as a sequence of instructions;

means for transferring the sequence of instructions from the interface processor to one or more of the embedded processors;

means for passing portions of the data set from the interface processor to one or more of the embedded processors;

means for extracting one or more relevant data units from each portion of the data sets passed to one or more of the embedded processors;

means for executing the sequence of instructions in one or more of the embedded processors to classify the data set, the sequence of instructions including one or more operations using the relevant data units;

means for reporting the results of classifying the data sets to the interface processor; and

means for processing the data sets in accordance with the classifications of the data sets.

52. The system of claim 51, further comprising means for representing the set of rules as a machine code instruction sequence.

53. The system of claim 51, further comprising means for storing one or more relevant data units in one or more registers of the embedded processors.

54. The system of claim 51, further comprising means for executing comparison instructions using one or more values stored in registers of the embedded processors.

55. The system of claim 51, further comprising means for storing values in registers accessible by the interface processor.