FIREWALL INCLUDING LOCAL BUS

• US 20100281532A1
• Filed: 07/15/2010
• Published: 11/04/2010
• Est. Priority Date: 04/01/1999
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: LUO, Dongping, KE, Yan, DENG, Feng
• Granted Patent: US 8,490,158 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 49/90 Buffering arrangements
• CPC Class Codes: H04L 49/901 using storage descriptor, e.g. read or write pointers
• CPC Class Codes: H04L 49/9057 Arrangements for supporting packet reassembly or resequencing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A gateway for screening packets transferred over a network. The gateway includes a plurality of network interfaces, a memory and a memory controller. Each network interface receives and forwards messages from a network through the gateway. The memory temporarily stores packets received from a network. The memory controller couples each of the network interfaces and is configured to coordinate the transfer of received packets to and from the memory using a memory bus. The gateway includes a firewall engine couples to the memory bus. The firewall engine is operable to retrieve packets from the memory and screen each packet prior to forwarding a given packet through the gateway and out an appropriate network interface. A local bus is coupled between the firewall engine and the memory providing a second path for retrieving packets from memory when the memory bus is busy.

Claims

1. A network device comprising:

an interface to receive, from a first network, a plurality of packets that are destined for a second network;

a controller to transfer, via a first bus, a first packet, of the plurality of packets, from the interface to a storage device within the network device; and

a processor to;

retrieve, via a second bus, the first packet from the storage device, and

perform a plurality of security-related packet processing operations on the first packet, wherein the controller is to concurrently transfer, via the first bus, a second packet, of the plurality packets, from the interface to the storage device.