Distributed network security system and a hardware processor therefor

• US 8,181,239 B2
• Filed: 07/21/2008
• Issued: 05/15/2012
• Est. Priority Date: 06/11/2002
• Status: Expired due to Term

• Current Assignee: Memory Access Technologies LLC
• Original Assignee: Ashish A. Pandya
• Inventors: Pandya, Ashish A.
• Primary Examiner(s): Nguyen, Hanh
• Application Number:
  US12/176,613
• Publication Number:
  US 20090019538A1
• Time in Patent Office: 1,394 Days
• Field of Search: 370/469, 370/389, 370/465, 370/392, 370/396, 370/410, 370/412, 709/200, 709/230, 709/223, 709/225, 709/232, 726/1, 726/2, 726/4, 726/13, 726/14, 726/17, 726/11, 726/3, 726/12
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/12 Protocol engines

Abstract

An architecture provides capabilities to transport and process Internet Protocol (IP) packets from Layer 2 through transport protocol layer and may also provide packet inspection through Layer 7. A set of engines may perform pass-through packet classification, policy processing and/or security processing enabling packet streaming through the architecture at nearly the full line rate. A scheduler schedules packets to packet processors for processing. An internal memory or local session database cache stores a session information database. The session information that is not in the internal memory is stored and retrieved to/from an additional memory. An application running on an initiator or target can a region of memory, which is made available to its peer for access without substantial host intervention through RDMA data transfer. A security system is also disclosed that enables a new way of implementing security capabilities inside enterprise networks in a distributed manner.

Claims

1. A security system comprising a storage area network comprising an integrated circuit processor providing transport layer protocol processing and IP storage area network protocol processing, said integrated circuit processor comprising a protocol processing engine for performing transport layer protocol termination, transport layer protocol origination, and transport layer protocol processing, said security system providing multiple protocol layer security in said storage area network.

2. The security system of claim 1, wherein the storage area network is configured to transport storage area network traffic, said integrated circuit processor further comprising:

a storage protocol processing engine for performing storage protocol processing;

a programmable rule-matching engine for analyzing the storage area network traffic for security rule matching or taking actions on matched security rules;

an authentication engine for performing encryption, decryption, authorization or authentication using standard or proprietary security protocols;

a packet classification engine for classifying the storage area network traffic; and

a packet processing engine for performing packet processing tasks.

3. The security system of claim 2, wherein said packet processing tasks comprises one or more of header processing and deep packet processing.

4. The security system of claim 1, wherein the multiple protocol layer security comprises a plurality of security functions performed at one or more protocol layers of the OSI stack for providing one or more of packet filtering, intrusion detection, denial of service attack detection, port scanning detection, virus scan, spam filtering, and unauthorized access.

5. A security system comprising:

an integrated circuit providing a remote direct memory access (RDMA) capability, said integrated circuit comprising;

an RDMA processor configured to execute a plurality of RDMA data transfers; and

a protocol processor for executing transport layer protocol processing, said protocol processor further configured to perform transport layer protocol termination and transport layer protocol origination;

said security system providing multiple protocol layer security.

6. The security system of claim 5, wherein said security system is configured to transport network traffic, and said integrated circuit processor further comprises:

a programmable rule-matching engine for analyzing the network traffic for security rule matching or taking actions on matched security rules;

an authentication engine for performing encryption, decryption, authorization or authentication using standard or proprietary security protocols;

a packet classification engine for classifying the network traffic; and

a packet processing engine for performing packet processing tasks.

7. The security system of claim 6, wherein said packet processing comprises one or more of header processing and deep packet processing.

8. The security system of claim 5, wherein said integrated circuit provides a transport layer remote direct memory access capability.

9. The security system of claim 5, wherein the multiple protocol layer security comprises a plurality of security functions performed at one or more protocol layers of an OSI stack for providing one or more of packet filtering, intrusion detection, denial of service attack detection, port scanning detection, virus scan, spam filtering, unauthorized access, and detect other security attacks.

10. A security system comprising:

a remote direct memory access (RDMA) processor configured to execute a plurality of RDMA data transfers; and

an integrated circuit processor for performing transport layer protocol termination, transport layer protocol packet origination, and for executing transport layer protocol, said integrated circuit processor further configured to provide a transport layer RDMA capability;

said security system providing multiple protocol layer security in said network.

11. The security system of claim 10, wherein said integrated circuit processor comprises an RDMA mechanism for performing the RDMA data transfers.

12. The security system of claim 11 wherein said integrated circuit processor comprises:

a protocol processing engine for performing transport layer protocol processing;

a programmable rule-matching engine for analyzing network traffic for security rule matching or taking actions on matched security rules;

an authentication engine for performing encryption, decryption, authorization or authentication using standard or proprietary security protocols;

a packet classification engine to classify the network traffic; and

a packet processing engine to perform packet processing tasks.

13. The security system of claim 12, wherein said packet processing comprises one or more of header processing and deep packet processing.

14. The security system of claim 10, wherein said integrated circuit processor comprises a transport layer remote direct memory access capability.

15. A security system comprising:

a storage area network comprising a remote direct memory access (RDMA) capability; and

an integrated circuit processor for performing IP storage area network protocol processing, transport layer protocol termination, transport layer protocol packet origination, and RDMA data transfers, said security system providing multiple protocol layer security in said storage area network.

16. The security system of claim 15, wherein said integrated circuit processor further comprises:

a storage protocol processing engine for performing protocol processing;

a protocol processing engine for performing transport layer protocol processing;

a programmable rule-matching engine for analyzing storage area network traffic for security rule matching or taking actions on matched security rules;

an authentication engine for performing encryption, decryption, authorization or authentication using standard or proprietary security protocols;

a packet classification engine to classify the storage area network traffic; and

a packet processing engine to perform packet processing tasks.

17. The security system of claim 16, wherein said packet processing comprises one or more of header processing and deep packet processing.

18. The security system of claim 15, wherein said integrated circuit processor provides a transport layer remote direct memory access capability.