RULE SWAPPING IN A PACKET NETWORK

• US 20140201123A1
• Filed: 01/11/2013
• Published: 07/17/2014
• Est. Priority Date: 01/11/2013
• Status: Active Grant

• Current Assignee: Centripetal Networks, Inc.
• Original Assignee: Centripetal Networks, Inc.
• Inventors: Ahn, David K., Rogers, Steven, Moore, Sean
• Granted Patent: US 9,203,806 B2
• Time in Patent Office: Days
• US Class Current: 706/47
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

In some variations, first and second rule sets may be received by a network protection device. The first and second rule sets may be preprocessed. The network protection device may be configured to process packets in accordance with the first rule set. Packets may be received by the network protection device. A first portion of the packets may be processed in accordance with the first rule set. The network protection device may be reconfigured to process packets in accordance with the second rule set. A second portion of the packets may be processed in accordance with the second rule set.

Claims

1. A method comprising:

at a network protection device;

receiving a first rule set;

receiving a second rule set;

preprocessing the first rule set and the second rule set;

configuring the network protection device to process packets in accordance with the first rule set;

receiving packets;

processing a first portion of the packets in accordance with the first rule set;

reconfiguring the network protection device to process packets in accordance with the second rule set; and

processing a second portion of the packets in accordance with the second rule set.

2. The method of claim 1, wherein the network protection device comprises a plurality of processors, wherein at least two of the plurality of processors are utilized for processing the first portion of the packets in accordance with the first rule set, and wherein reconfiguring the network protection device to process packets in accordance with the second rule set comprises synchronizing the at least two of the plurality of processors.

3. The method of claim 2, wherein synchronizing the at least two of the plurality of processors comprises:

signaling each of the at least two of the plurality of processors to process packets in accordance with the second rule set;

responsive to the signaling to process packets in accordance with the second rule set;

ceasing, by each of the at least two of the plurality of processors, processing of the packets;

caching, by each of the at least two of the plurality of processors, unprocessed packets;

reconfiguring each of the at least two of the plurality of processors to process packets in accordance with the second rule set; and

signaling, by each of the at least two of the plurality of processors, completion of reconfiguration to process packets in accordance with the second rule set; and

responsive to receiving signaling that each of the at least two of the plurality of processors has completed reconfiguration to process packets in accordance with the second rule set, processing, by the at least two of the plurality of processors, the cached unprocessed packets.

4. The method of claim 1, comprising:

storing configuration information for configuring the network protection device to process packets in accordance with the first rule set;

utilizing the stored configuration information to reconfigure the network protection device to process packets in accordance with the first rule set; and

processing a third portion of the packets in accordance with the first rule set.

5. The method of claim 1, comprising storing the first rule set and the second rule set in a memory buffer, the memory buffer being dynamically sized based on at least one of a size of the first rule set and a size of the second rule set.

6. The method of claim 1, wherein the first rule set specifies a first set of network addresses for which packets should be forwarded, and wherein the second rule set specifies a second set of network addresses for which packets should be forwarded, the second set of network addresses comprising fewer network addresses than the first set of network addresses.

7. The method of claim 1, wherein the first rule set specifies a first set of network addresses for which packets should be forwarded, and wherein the second rule set specifies a second set of network addresses for which packets should be forwarded, the second set of network addresses comprising more network addresses than the first set of network addresses.

8. The method of claim 1, wherein the first rule set specifies a first set of network addresses for which packets should be dropped, and wherein the second rule set specifies a second set of network addresses for which packets should be dropped, the second set of network addresses comprising fewer network addresses than the first set of network addresses.

9. The method of claim 1, wherein the first rule set specifies a first set of network addresses for which packets should be dropped, and wherein the second rule set specifies a second set of network addresses for which packets should be dropped, the second set of network addresses comprising more network addresses than the first set of network addresses.

10. The method of claim 1, wherein reconfiguring the network protection device to process packets in accordance with the second rule set is performed in response to receiving a message invoking the second rule set.

11. The method of claim 1, wherein reconfiguring the network protection device to process packets in accordance with the second rule set is performed in response to one or more detected network conditions indicating a network attack.

12. An apparatus, comprising:

at least one processor; and

a memory storing instructions that when executed by the at least one processor cause the apparatus to;

receive a first rule set;

receive a second rule set;

preprocess the first rule set and the second rule set;

configure to process packets in accordance with the first rule set;

receive packets;

process a first portion of the packets in accordance with the first rule set;

reconfigure to process packets in accordance with the second rule set; and

process a second portion of the packets in accordance with the second rule set.

13. The apparatus of claim 12, comprising a plurality of processors, wherein at least two of the plurality of processors are configured to process the first portion of the packets in accordance with the first rule set, and wherein the instructions when executed by the at least one processor cause the apparatus to synchronize the at least two of the plurality of processors.

14. The apparatus of claim 13, wherein the instructions when executed by the at least one processor cause the apparatus to:

signal each of the at least two of the plurality of processors to process packets in accordance with the second rule set;

responsive to signaling to process packets in accordance with the second rule set;

cease, by each of the at least two of the plurality of processors, processing of the packets;

cache, by each of the at least two of the plurality of processors, unprocessed packets;

reconfigure each of the at least two of the plurality of processors to process packets in accordance with the second rule set; and

signal, by each of the at least two of the plurality of processors, completion of reconfiguration to process packets in accordance with the second rule set; and

responsive to receiving signaling that each of the at least two of the plurality of processors has completed reconfiguration to process packets in accordance with the second rule set, process, by the at least two of the plurality of processors, the cached unprocessed packets.

15. The apparatus of claim 12, wherein the instructions when executed by the at least one processor cause the apparatus to:

store configuration information for configuring to process packets in accordance with the first rule set;

utilize the stored configuration information to reconfigure to process packets in accordance with the first rule set; and

process a third portion of the packets in accordance with the first rule set.

16. The apparatus of claim 12, wherein the instructions when executed by the at least one processor cause the apparatus to store the first rule set and the second rule set in a memory buffer, the memory buffer being dynamically sized based on at least one of a size of the first rule set and a size of the second rule set.

17. The apparatus of claim 12, wherein the first rule set specifies a first set of network addresses for which packets should be forwarded, and wherein the second rule set specifies a second set of network addresses for which packets should be forwarded, the second set of network addresses comprising fewer network addresses than the first set of network addresses.

18. The apparatus of claim 12, wherein the first rule set specifies a first set of network addresses for which packets should be forwarded, and wherein the second rule set specifies a second set of network addresses for which packets should be forwarded, the second set of network addresses comprising more network addresses than the first set of network addresses.

19. The apparatus of claim 12, wherein the first rule set specifies a first set of network addresses for which packets should be dropped, and wherein the second rule set specifies a second set of network addresses for which packets should be dropped, the second set of network addresses comprising fewer network addresses than the first set of network addresses.

20. The apparatus of claim 12, wherein the first rule set specifies a first set of network addresses for which packets should be dropped, and wherein the second rule set specifies a second set of network addresses for which packets should be dropped, the second set of network addresses comprising more network addresses than the first set of network addresses.

21. The apparatus of claim 12, wherein the instructions when executed by the at least one processor cause the apparatus to reconfigure to process packets in accordance with the second rule set in response to receiving a message invoking the second rule set.

22. The apparatus of claim 12, wherein the instructions when executed by the at least one processor cause the apparatus to reconfigure to process packets in accordance with the second rule set in response to one or more detected network conditions indicating a network attack.

23. One or more non-transitory computer-readable media having instructions stored thereon, that when executed by one or more computers, cause the one or more computers to:

receive a first rule set;

receive a second rule set;

preprocess the first rule set and the second rule set;

configure to process packets in accordance with the first rule set;

receive packets;

process a first portion of the packets in accordance with the first rule set;

reconfigure to process packets in accordance with the second rule set; and

process a second portion of the packets in accordance with the second rule set.

24. The one or more non-transitory computer readable media of claim 23, wherein the one or more computers comprise a plurality of processors, wherein at least two of the plurality of processors are configured to process the first portion of the packets in accordance with the first rule set, and wherein the instructions, when executed by the one or more computers, cause the one or more computers to synchronize the at least two of the plurality of processors.