APPARATUS AND METHOD FOR HIGH THROUGHPUT NETWORK SECURITY SYSTEMS

• US 20080077793A1
• Filed: 09/21/2007
• Published: 03/27/2008
• Est. Priority Date: 09/21/2006
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Sensory Networks, Inc. (Intel Corporation)
• Inventors: Place, Anthony, Barrie, Robert, Williams, Darren, Tan, Teewoon
• Application Number:
  US11/859,530
• Publication Number:
  US 20080077793A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

An accelerated network security system includes, in part, a network security engine and a processing module configured to perform network security functions. The network security engine includes an input module configured to receive input data and generate an intermediate data in response, a core engine configured to perform security function operations on the first intermediate data to generate a first output data, and an output module configured to receive the first output data and generate a processed output data in response. The processing module includes a multitude of processing cores configured to operate concurrently, a memory configured to store processing core instructions and processing core data associated with the multitude of processing cores, and a processing controller configured to periodically allocate to each processing core one or more discrete blocks of processing time. The number of processing core data is greater than the number of processing cores.

Claims

1. An accelerated network security system comprising:

a network security engine comprising;

an input module configured to receive input data and generate a first intermediate data in response;

a core engine configured to perform a security function operation on the first intermediate data to generate a first output data; and

an output module configured to receive the first output data and generate a processed output data in response; and

a processing module configured to perform the security function, the processing module comprising;

a plurality of processing cores configured to operate concurrently;

a memory configured to store data associated with the plurality of processing cores, wherein the data stored in the memory includes processing core instructions and processing core data, wherein the processing core instructions control the execution of the plurality of processing cores to implement the security function; and

a processing controller configured to periodically allocate to each processing core one or more discrete blocks of processing time, each processing of each portion of core data representing at least one execution thread, wherein the periodic allocation of processing time is performed according to a processing time allocation algorithm, wherein a number of processing core data is greater than a number of the plurality of processing cores.

2. The system of claim 1 wherein the core engine is configured to perform a security function on the first intermediate data using one or more processing channels, wherein each of the one or more processing channels is configured to use the processing module to perform at least part of the security function.

3. The system of claim 2 wherein the one or more processing channels use the processing module via at least a channel data scheduler.

4. The system of claim 1 wherein the processing module is an integrated circuit comprising a graphics processing unit.

5. The system of claim 1 wherein the processing module is a stream processing device.

6. The system of claim 1 wherein the processing time allocation algorithm maximizes amount of data that is transferred between the plurality of processing cores and the memory over a given time period.

7. The system of claim 1 wherein the processing time allocation algorithm maximizes utilization of the plurality of processing cores.

8. The system of claim 1 wherein the processing module comprises at least four processing cores.

9. The system of claim 1 wherein the plurality of processing cores include pixel shaders in a graphics processing unit.

10. The system of claim 1 wherein the plurality of processing cores include vertex shaders in a graphics processing unit.

11. The system of claim 1 wherein the plurality of processing cores are disposed in a central processing unit.

12. The system of claim 1 wherein the core engine is configured to perform at least one security function selected from a group of security functions consisting of Pattern matching operations, Regular expression matching operations, String literal matching operations, Decoding operations, Encoding operations, Compression operations, Decompression operations, Encryption operations, Decryption operations, and Hashing operations.

13. The system of claim 12 wherein the plurality of processing cores are configured to perform at least one operation selected from a group of operations consisting of Floating point operations, Integer operations, Mathematical operations, Bit operations, Branching operations, Loop operations, Logic operations, Transcendental function operations, Memory read operations, and Memory write operations.

14. The system of claim 12 wherein the at least one of the plurality of processing cores comprise an arithmetic logic unit.

15. A method for operating network security engines at high throughput rates, the method comprising:

receiving input data;

processing the received input data to generate an intermediate data;

processing the intermediate data to generate a first output data by performing a security function using a processing module configured to perform the security function, the processing module comprising;

a plurality of processing cores configured to operate concurrently;

a memory configured to store data associated with the plurality of processing cores, wherein the data stored in the memory includes processing core instructions and processing core data, wherein the processing core instructions control the execution of the plurality of processing cores to implement the security function; and

a processing controller configured to periodically allocate to each processing core one or more discrete blocks of processing time, each processing of each portion of core data representing at least one execution thread, wherein the periodic allocation of processing time is performed according to a processing time allocation algorithm, wherein a number of processing core data is greater than a number of the plurality of processing cores.

processing the first output data to generate a processed output data; and

transmitting the processed output data.

16. The method of claim 15 wherein the steps of processing the first input data to generate the first output data further comprises:

generating one or more scheduled data in response to the intermediate data;

transmitting the one or more scheduled data;

generating and transmitting a first channel data and a second channel data in response to receiving the one or more scheduled data;

transmitting the first channel data to the processing module;

processing the second channel data to generate a controller input data;

transmitting the controller input data to the processing module;

performing a security function on the processing module;

generating and transmitting a return channel data in response to receiving output of the processing module;

generating channel results in response to the return channel data; and

generating the output data in response to the channel results by performing a security function.

17. The method of claim 15 wherein the processing module is an integrated circuit comprising a graphics processing unit.

18. The method of claim 15 wherein the processing module is a stream processing device.

19. The method of claim 15 wherein the processing time allocation algorithm maximizes an amount of data transferred between the plurality of processing cores and the memory over a given time period.

20. The method of claim 15 wherein the processing time allocation algorithm maximizes utilization of the plurality of processing cores.

21. The method of claim 15 wherein the processing module comprises at least four processing cores.

22. The method of claim 15 wherein the plurality of processing cores include pixel shaders disposed in a graphics processing unit.

23. The method of claim 15 wherein the plurality of processing cores include vertex shaders in a graphics processing unit.

24. The method of claim 15 wherein the plurality of processing cores are disposed in a central processing unit.

25. The method of claim 15 wherein the security function is selected from a group consisting of Pattern matching operations, Regular expression matching operations, String literal matching operations, Decoding operations, Encoding operations, Compression operations, Decompression operations, Encryption operations, Decryption operations, and Hashing operations.

26. The method of claim 25 wherein the plurality of processing cores are configured to perform at least one operation selected from a group of operations consisting of Floating point operations, Integer operations, Mathematical operations, Bit operations, Branching operations, Loop operations, Logic operations, Transcendental function operations, Memory read operations, and Memory write operations.

27. The method of claim 25 wherein at least one of the plurality of processing cores comprises an arithmetic logic unit.