Hardware-based packet filtering accelerator

• US 20040039940A1
• Filed: 08/23/2002
• Published: 02/26/2004
• Est. Priority Date: 08/23/2002
• Status: Abandoned Application

• Current Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Cox, George, Courington, Jeff
• Application Number:
  US10/227,368
• Publication Number:
  US 20040039940A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/12 Protocol engines
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A data packet filtering accelerator processor operates in parallel with a host processor and is arranged on an integrated circuit with the host processor. The accelerator processor classifies data packets by executing a sequence machine code instructions converted directly from a set of rules. Portions of data packets are passed to the accelerator processor from the host processor. The accelerator processor includes packet parser circuit for parsing the data packets into relevant data units and storing the relevant data units in memory. A packet analysis circuit executes the sequence of machine code instructions converted directly from the set of rules. The machine code instruction sequence operates on the relevant data units to classify the data packet. The packet analysis circuit returns the results of the classification to the host processor by storing the classification results in a register accessible by the host processor.

Claims

1. An accelerator processor for classifying data packets according to a set of rules, the accelerator processor and a host processor arranged as an integrated circuit, the accelerator processor operating in parallel with the host processor and communicating with the host processor by a parallel bus, the accelerator processor comprising:

a bus interface coupled to the parallel bus and adapted to transfer portions of the data packets from the host processor and to return results of a classification of the data packets to the host processor;

a memory coupled to the bus interface and adapted to store a program of machine code instructions converted directly from the set of rules to be applied to the data packets and to store the results of the classification of the data packets;

a packet parser circuit coupled to the bus interface and adapted to parse each data packet portion transferred from the host processor into relevant data units and to store the relevant data units in the memory; and

a packet analysis circuit coupled to the memory and arranged to classify each data packet by executing the program of machine code instructions using the relevant data units stored in the memory.

2. The accelerator processor of claim 1, wherein the host processor is implemented using a processor core.

3. The accelerator processor of claim 1, wherein the data packets classified are IP datagrams.

4. The accelerator processor of claim 1, wherein the memory includes an instruction cache accessible by the host processor and registers for storing the relevant data units.

5. The accelerator processor of claim 1, wherein the relevant data units stored in the memory include sections of a datagram header.

6. The accelerator processor of claim 1, wherein the program of machine code instructions for classifying the data packets is stored in the memory by the host processor.

7. The accelerator processor of claim 6, wherein the program of machine code instructions is updated by the host processor in accordance with changes in the set of rules.

8. The accelerator processor of claim 1, wherein the memory includes a command register for receiving commands from the host processor directed to the packet analysis circuit for controlling the classification of the data packets.

9. The accelerator processor of claim 8, wherein the commands received from the host processor include a memory location to begin execution of the machine code instructions for classifying each data packet.

10. The accelerator processor of claim 1, wherein the memory includes a compare register for reporting the outcome of a comparison instruction to the host processor.

11. The accelerator processor of claim 1, wherein the memory includes an exit register for passing the results of the classification of the data packet to the host processor.

12. The accelerator processor of claim 1, wherein the packet analysis circuit comprises a very reduced instruction set computer.

13. The accelerator processor of claim 1, wherein the packet analysis circuit receives commands from the host processor controlling the classification of each data packet.

14. The accelerator processor of claim 1, wherein the packet analysis circuit receives commands from the host processor directing the packet analysis circuit to the memory location to begin execution of the machine code instructions stored in the memory to classify the data packet.

15. The accelerator processor of claim 14, wherein the starting point of the machine code instructions executed by the packet analysis circuit is determined by the set of rules to be applied to the data packet.

16. The accelerator processor of claim 1, wherein the machine code instructions operate on one or more of the relevant data units to classify the data packet.

17. The accelerator processor of claim 1, wherein the packet analysis circuit is configured to store an indication of the classification in a return register of the memory, the return register arranged to be accessible by the host processor.

18. The accelerator processor of claim 1, wherein the packet analysis circuit is configured to store a value resulting from a comparison operation performed by the packet analysis circuit.

19. The accelerator processor of claim 1, wherein the portions of the data packets are passed to the accelerator processor by the host processor.

20. The accelerator processor of claim 1, wherein the portions of the data packets are passed to the accelerator processor by direct memory access circuitry.

22. A method for classifying data packets in accordance with a set of rules, comprising:

storing in a memory unit of an accelerator processor a program of machine code instructions converted directly from the set of rules;

transferring one or more portions of the data packets from a host processor to the accelerator processor;

parsing portions of the data packets into relevant data units and storing the relevant data units in the memory unit of the accelerator processor;

classifying each data packet by executing the program of machine code instructions in the accelerator processor using the relevant data units; and

returning results of the classification from the accelerator processor to the host processor.

23. The method of claim 22, wherein returning the results of the classification comprises storing the results in a register accessible by the host processor.

24. The method of claim 22, wherein classifying the data packet further comprises classifying an IP datagram.

25. The method of claim 22, wherein parsing the portions of the data packet into relevant data units further comprises parsing an IP datagram header into relevant data units.

26. The method of claim 22, wherein storing the program of machine code instructions further comprises updating the program of machine code instructions in accordance with changes in the set of rules.

27. The method of claim 22, wherein classifying each data packet by executing the program of machine code instructions further comprises beginning execution of the program of machine code instructions at a location indicated by the host processor.

28. The method of claim 22, wherein classifying each data packet further comprises transferring commands from the host processor to the accelerator processor, the transferred commands controlling the classification of each data packet.

29. A system for classifying data packets, comprising:

means for storing in a memory unit of an accelerator processor a program of machine code instructions converted directly from the set of rules;

means for transferring one or more portions of the data packets from a host processor to the accelerator processor;

means for parsing portions of the data packets into relevant data units and storing the relevant data units in the memory unit of the accelerator processor;

means for classifying each data packet by executing the program of machine code instructions in the accelerator processor using the relevant data units; and

means for returning results of the classification from the accelerator processor to the host processor.