100GBPS security and search architecture using programmable intelligent search memory

• US 9,129,043 B2
• Filed: 05/15/2012
• Issued: 09/08/2015
• Est. Priority Date: 12/08/2006
• Status: Active Grant

• Current Assignee: Infosil Inc.
• Original Assignee: Ashish A. Pandya
• Inventors: Pandya, Ashish A.
• Primary Examiner(s): VINCENT, DAVID ROBERT
• Application Number:
  US13/472,042
• Publication Number:
  US 20130018835A1
• Time in Patent Office: 1,211 Days
• Field of Search: 706 45- 47, 706/62, 711/100, 711/103, 711/108, 707/706, 707/758, 707/736, 707/769, 707/737
• US Class Current: 1/1
• CPC Class Codes: G06F 16/90344 by using string matching techniques
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Disclosed is a network computer system which may comprise a hardware processor which may comprise a programmable intelligent search memory for content search. The programmable intelligent search memory may perform regular expression based search. The programmable intelligent search memory may use at least one regular expression. The regular expression may be converted into at least one non-deterministic finite state automata (NFA) representing the functionality of the regular expression.

Claims

1. A network computer system comprising servers, storage area network and storage, said network computer system further comprising a hardware processor comprising:

a) a programmable intelligent search memory for content search wherein said programmable intelligent search memory performs regular expression based search, said programmable intelligent search memory for content search using at least one regular expression, wherein said regular expression is converted into at least one non-deterministic finite state automata (NFA) representing the functionality of the regular expression, said programmable intelligent search memory comprising a memory circuit for processing the NFA, said memory circuit comprising;

i. a symbol memory circuit to store symbols or characters;

ii. a symbol evaluation circuit coupled to the symbol memory circuit to evaluate match of the symbols or characters with input symbols or characters in said content;

iii. a state dependent vector (SDV) memory circuit to store state transition controls for said non-deterministic finite state automata;

iv. a current state vector (CSV) memory circuit to store a plurality of states; and

v. a state transition circuit coupled to said symbol evaluation circuit, a current state vector memory circuit and said state dependent vector memory circuit to perform state transition from one or more first states to one or more second states of said plurality of states of said non-deterministic finite state automata;

b) a controller comprising;

i. a mechanism to convert said regular expressions in NFA;

ii. a mechanism to program said NFA into said programmable intelligent search memory;

iii. a mechanism to receive said content to be searched; and

iv. a mechanism to present said content to the said programmable search memory for search.

2. The network computer system of claim 1, wherein the hardware processor further comprises a context memory to store plurality of NFAs that are not used for the said content being searched.

3. The network computer system of claim 1, wherein the hardware processor further comprises a mechanism to determine the context of the said content being searched, to program context dependent NFA in the programmable intelligent search memory.

4. The network computer system of claim 1, wherein the hardware processor further comprises a priority encoder to determine a matching NFA result when a plurality of NFAs indicate a match within the content being searched.

5. The network computer system of claim 1, wherein the hardware processor further comprises an expansion mechanism to expand the size of the programmable intelligent search memory.

6. A network computer system comprising servers, storage area network and storage, said network computer system further comprising an integrated circuit chip processor comprising:

a) a programmable intelligent search memory for content search wherein said programmable intelligent search memory performs regular expression based search, said programmable intelligent search memory for content search using at least one regular expressions, wherein said regular expression is converted into at least one non-deterministic finite state automaton (NFA) representing the functionality of the regular expression, said programmable intelligent search memory comprising a memory circuit for processing the NFA, said memory circuit comprising;

i. a symbol memory circuit to store symbols or characters;

ii. a symbol evaluation circuit coupled to the symbol memory circuit to evaluate match of the symbols or characters with input symbols or characters in said content;

iii. a state dependent vector (SDV) memory circuit to store state transition controls for said non-deterministic finite state automata;

iv. a current state vector (CSV) memory circuit to store a plurality of states; and

v. a state transition circuit coupled to said symbol evaluation circuit, a current state vector memory circuit and said state dependent vector memory circuit to perform state transition from one or more first states to one or more second states of said plurality of states of said non-deterministic finite state automata; and

b) a controller comprising;

i. a mechanism to convert said regular expressions into NFA;

ii. a mechanism to program said NFA into said programmable intelligent search memory;

iii. a mechanism to receive said content to be searched; and

iv. a mechanism to present said content to the said programmable search memory for search.

7. The network computer system of claim 6, wherein the integrated circuit chip further comprises a context memory to store plurality of NFAs that are not used for the said content being searched.

8. The network computer system of claim 6, wherein the integrated circuit chip further comprises a mechanism to determine the context of the said content being searched, to program context dependent NFA in the programmable intelligent search memory.

9. The network computer system of claim 6, wherein the integrated circuit chip further comprises a priority encoder to determine a matching NFA result when a plurality of NFAs indicate a match within the content being searched.

10. The network computer system of claim 6, wherein the integrated circuit chip further comprises an expansion mechanism to expand the size of the programmable intelligent search memory.