Rule based IP data processing

• US 6,598,034 B1
• Filed: 09/21/1999
• Issued: 07/22/2003
• Est. Priority Date: 09/21/1999
• Status: Expired due to Term

• Current Assignee: Infineon Technologies AG
• Original Assignee: Infineon Technologies North America Corporation (Infineon Technologies AG)
• Inventors: Kloth, Axel K.
• Primary Examiner(s): Follansbee, John
• Assistant Examiner(s): Booker, Kelvin
• Application Number:
  US09/401,030
• Time in Patent Office: 1,400 Days
• Field of Search: 706/47, 706/45, 717/141, 709/223-225, 709/230, 709/236, 709/238, 707/3, 370/338
• US Class Current: 706/47
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/302 Route determination based on requested QoS
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/563 Software download or update
• CPC Class Codes: H04L 69/06 Notations for structuring of protocol data, e.g. abstract syntax notation one [ASN.1]
• CPC Class Codes: H04L 69/12 Protocol engines
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/168 specially adapted for link layer protocols, e.g. asynchronous transfer mode [ATM], synchronous optical network [SONET] or point-to-point protocol [PPP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A apparatus and method that provides a routing engine for processing data packets based upon certain rules that are compiled and applied real-time via a just-in-time (JIT) compiler, a runtime compiler, or the like. The routing engine parses and analyzes an incoming IP flow. A set of rules are developed and stored for use by the JIT. The rules establish a set of patterns, and the incoming data is compared to those patterns. If certain patterns are detected, then the associated action established by the rule is applied to the processing of the data packet. Packets are classified according to any rule, as applied to any packet, as early as possible in the process (i.e. first or second stage of process), with the route lookup and packet attribute processes performed in parallel. Data packets might be assigned or mapped to various traffic service levels. Traffic types and priorities, as well as service levels, can be mapped onto existing QoS/CoS definitions and assignments. The data packets can be altered or modified as a result of the detected patterns. Data packets can also be discarded or dropped if the detected patterns and associated rule indicate such a desire. The apparatus and method might be implemented as a hardware and software configuration. A software configuration might also be loaded into existing router hardware.

Claims

1. An apparatus for applying rules to the processing of data packets over a network, the apparatus comprising:

a network interconnecting device for directing packet based data over an associated network;

a parser associated with the network interconnecting device for analyzing bit patterns from incoming IP flows of data packets;

a rule generator for providing rules for processing the data packets according to the analyzed bit patterns;

a compiler for compiling the rules, wherein the rules are applied to the bit patterns which are parsed from the IP flow; and

a buffering device, the buffering device buffering packets for later forwarding according to rules applied to that type of packet.

2. The apparatus according to claim 1, wherein the networking interconnection device includes router functions, firewall functions, and/or gateway functions, and the rules relating to device functionality can be combined into a common set of rules for processing the data packets according to any set of rules.

3. The apparatus according to claim 2, wherein the functions include traffic policing.

4. The apparatus according to claim 3, wherein the packets are distinguished by different service levels.

5. The apparatus according to claim 2, wherein the functions include traffic shaper.

6. The apparatus according to claim 1, wherein the compiler is a Just-In-Time (JIT) compiler for achieving real-time application of the rules.

7. The apparatus according to claim 1, wherein the compiler provides runtime application of the rules.

8. The apparatus according to claim 1, wherein a processor is associated with the forwarding, parser, rule generator, and compiler devices.

9. The apparatus according to claim 1, wherein the rules can be edited via a graphical interface for real-time application to incoming IP flows.

10. The apparatus according to claim 1, wherein the analyzed bit patterns are derived from IP packet header fields.

11. The apparatus according to claim 1, wherein the analyzed bit patterns are derived from IP packet data.

12. The apparatus according to claim 1, wherein the analyzed bit patterns are associated with a virus and the packets are discarded.

13. The apparatus according to claim 1, wherein certain packets are discarded if the associated network is congested.

14. The apparatus according to claim 13, wherein the certain packets are discarded via a leaky bucket implementation.

15. The apparatus according to claim 13, wherein the certain packet has been assigned a low priority relative to other packets.

16. The apparatus according to claim 1, wherein the packets are modified according to the rules applied to that packet.

17. An apparatus for applying rules to the processing of data packets over a network, the apparatus comprising:

a network interconnecting device for directing packet based data over an associated network;

a parser associated with the network interconnecting device for analyzing bit patterns from incoming IP flows of data packets;

a rule generator for providing rules for processing the data packets according to the analyzed bit patterns; and

a compiler for compiling the rules, wherein the rules are applied to the bit patterns which are parsed from the IP flow and IP packet traffic types and priorities resulting from application of the rules are mapped onto existing Quality of Service (QoS) assignments.

18. An apparatus for applying rules to the processing of data packets over a network, the apparatus comprising:

a network interconnecting device for directing packet based data over an associated network;

a parser associated with the network interconnecting device for analyzing bit patterns from incoming IP flows of data packets;

a rule generator for providing rules for processing the data packets according to the analyzed bit patterns; and

a compiler for compiling the rules, wherein the rules are applied to the bit patterns which are parsed from the IP flow and IP packet traffic types and priorities resulting from application of the rules are mapped onto existing Class of Service (CoS) assignments.

19. A method for applying rules to the processing of data packets within an IP flow over a network, the method comprising:

formulating at least one rule for application to the data packets of an IP flow;

receiving an IP flow from a source;

parsing the IP flow to detect data patterns within the data stream;

applying the at least one formulated rule to classify all the data packets in at least one step before processing the data packets, the at least one rule being used to establish data traffic types, the data traffic types including assigned priorities.

20. The method according to claim 19, wherein the at least one rule is compiled using a just-in-time compiler, whereby the compiled rule is used to process the data packets according to the detected data patterns.

21. The method according to claim 19, wherein the at least one rule is compiled using a runtime compiler, whereby the compiled rule is used to process the data packets according to the detected data patterns.

22. The method of claim 19, wherein the data packet priority assignments are mapped onto mapped onto existing Quality of Service (QoS) assignments.

23. The method of claim 19, wherein the data packet priority assignments are mapped onto mapped onto existing Class of Service (CoS) assignments.

24. A method for applying rules to the processing of data packets within an IP flow over a network, the method comprising:

formulating a set of rules associated with each network interconnection device for application to the data packets of an IP flow;

receiving an IP flow into the forwarding device;

classifying the incoming data packets according to the rules and all other information available for the data packets;

modifying the data packets according to desired forwarding instructions,

wherein the entire set of rules are applied to all incoming data packets during at least one step to determine forwarding for all the packets.

25. The method according to claim 24, wherein the traffic policing is applied in the at least one step without having to reclassify the data packets.

26. The method of claim 24, wherein the IP flow is encapsulated into network transport technologies.

27. The method of claim 26, wherein decapsulation is performed in hardware.

28. The method of claim 26, wherein decapsulation is performed in software.

29. The method of claim 24, wherein traffic policing functions are applied to the data packets.