Control system for high speed rule processors

• US 6,611,875 B1
• Filed: 04/30/1999
• Issued: 08/26/2003
• Est. Priority Date: 12/31/1998
• Status: Expired due to Term

• Current Assignee: PMC-Sierra Incorporated (Microchip Technology Incorporated)
• Original Assignee: PMC-Sierra Incorporated (Microchip Technology Incorporated)
• Inventors: Iyer, Sundar, Yadav, Navneet, Shelat, Ajit, Chopra, Vikram, Desai, Ajay, Jiandani, Moti, Iyer, Raghunath
• Primary Examiner(s): VOELTZ, EMANUEL T
• Application Number:
  US09/305,783
• Time in Patent Office: 1,579 Days
• Field of Search: 709/238, 709/245
• US Class Current: 709/245
• CPC Class Codes: H04L 49/205 Quality of Service based
• CPC Class Codes: H04L 49/25 Routing or path finding in a switch fabric
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/355 Application aware switches, e.g. for HTTP
• CPC Class Codes: H04L 49/50 Overload detection or protection within a single switching element
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A control system for high-speed rule processors used in a gateway system is disclosed. The gateway system employing the current invention can process packets at wire speed by using massive parallel processors, each of the processors operating concurrently and independently. Further, the processing capacities in the gateway system employing the current invention are expandable. The number of packet inspector engines may be increased and all of the engines are connected in a cascade manner. Under the control system, all of the engines operate concurrently and independently and results from each of the engines are collected sequentially through a common data bus. As such the processing speed of packets becomes relatively independent of the complexities and numbers of rules that may be applied to the packets.

Claims

1. A method for controlling rule processors in a gateway managing data traffic between two networks, said method comprising:

receiving packet information derived from a packet arrived in the gateway;

looking up control words in internal registers;

processing, concurrently and respectively, said packet information within a plurality of nanocomputers with respect to a set of rules, said plurality of nanocomputers organized into nanocomputer groups, each of said nanocomputers controlled and operating under the control words;

returning match results from said plurality of nanocomputers to a nanocomputer group if said packet information matches any of the rules;

prioritizing said match results within said nanocomputer group that contains a match and returning a group prioritized result from said nanocomputer group to a control unit; and

prioritizing said group prioritized results respectively from said each nanocomputer group to generate a said final prioritized result.

2. The method as claimed in claim 1, wherein said receiving packet information comprises:

writing said packet information into an internal buffer; and

determining if said packet information exceeds a threshold, said threshold indicating the amount of data that can be received for processing.

3. The method as claimed in claim 1, wherein said looking up control words comprises:

accessing said control words from a memory through a data bus;

wherein said control words comprises instructions for operation cycles to be executed.

4. The method as claimed in claim 3, further comprising:

returning match results from said plurality of nanocomputers if said packet information matches any of the rules.

5. The method as claimed in claim 4;

wherein said match results are group prioritized results within each nanocomputer group; and

said method further comprising determining a final prioritized result from said group prioritized results.

6. The method as claimed in claim 5 wherein said determining a final prioritized result comprises:

prioritizing said final prioritized result from said group prioritized results respectively from said each nanocomputer group that produces said match results.

7. The method as claimed in claim 1, still further comprising:

storing said final prioritized result in a local memory; and

releasing said final prioritized result from said local memory to said data bus upon detecting an enable signal therefrom.

8. The method as claimed in claim 7, wherein said local memory is a result merge logic circuit coupled to said data bus.

9. An apparatus for managing packet data in a gateway managing data traffic between two networks, said apparatus comprising:

an interface receiving packet information derived from a packet arrived in the gateway when said interface sends out a ready signal;

said interface further comprising;

a number of attribute registers, each storing one aspect of attributes in said packet information, and

at least one threshold register containing a value specifying a limited amount of data said interface can accommodate for subsequent processing;

an array of nanocomputers, each processing, concurrently and respectively, said packet information with respect to an allocated set of rules;

a match result generated when said packet information matches any of said rules;

a plurality of group logic circuits for receiving respective match results from a respective group of nanocomputers, said group logic circuits generating a prioritized group result; and

a control unit for receiving respective prioritized group results from said group logic circuits, said control unit generating a prioritized final result from said prioritized group results.

10. The apparatus as claimed in claim 9, wherein said control unit receives instructions and distributes said instructions to said array of nanocomputers according to control words from a control RAM coupled to a data bus.

11. The apparatus as claimed in claim 10, wherein said instructions comprise rules and control parameters under which said array of nanocomputers operate.

12. The apparatus as claimed in claim 11;

wherein said plurality of group logic circuits is also coupled to said data bus.