Firewall including local bus

• US 20040158744A1
• Filed: 01/26/2004
• Published: 08/12/2004
• Est. Priority Date: 04/01/1999
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: NetScreen Technologies Inc. (Juniper Networks Incorporated)
• Inventors: Luo, Dongping, Ke, Yan, Deng, Feng
• Granted Patent: US 7,363,653 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 49/90 Buffering arrangements
• CPC Class Codes: H04L 49/901 using storage descriptor, e.g. read or write pointers
• CPC Class Codes: H04L 49/9057 Arrangements for supporting packet reassembly or resequencing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A gateway for screening packets transferred over a network. The gateway includes a plurality of network interfaces, a memory and a memory controller. Each network interface receives and forwards messages from a network through the gateway. The memory temporarily stores packets received from a network. The memory controller couples each of the network interfaces and is configured to coordinate the transfer of received packets to and from the memory using a memory bus. The gateway includes a firewall engine coupled to the memory bus. The firewall engine is operable to retrieve packets from the memory and screen each packet prior to forwarding a given packet through the gateway and out an appropriate network interface. A local bus is coupled between the firewall engine and the memory providing a second path for retrieving packets from memory when the memory bus is busy.

Claims

1. A gateway for screening packets received from a network, comprising:

a firewall engine;

a memory coupled to the firewall engine for storing packets to be screened by the firewall engine;

a primary memory bus coupling the firewall engine and the memory for providing a path for retrieval of packets from the memory; and

a local memory bus coupling the firewall engine and the memory, the local memory bus providing an alternative parallel path for retrieval of packets from the memory.

2. The gateway of claim 1, wherein:

the primary memory bus is parallel over an extent to the local memory bus;

a portion of the primary memory bus is not parallel to the local memory bus; and

the primary memory bus is not coextensive with the local memory bus.

3. The gateway of claim 1, wherein:

the firewall engine is operable to retrieve packets from the memory using the primary memory bus and the local memory bus at a same time.

4. The gateway of claim 1, wherein:

the firewall engine is operable to send packets from the firewall engine to the memory using the primary memory bus and the local memory bus at a same time.

5. A method for screening packets transferred over a network, comprising:

providing a firewall engine coupled directly to a first memory bus and a parallel second memory bus; and

transferring packets between the firewall engine and a memory using one of the first memory bus and the second memory bus.

6. The method of claim 5, wherein:

transferring packets between the firewall engine and a memory includes sending packets from the firewall engine to the memory and includes a contemporaneous transfer of packets on the first memory bus and the second memory bus.

7. The method of claim 5, wherein:

transferring packets between the firewall engine and a memory includes retrieving packets from the memory and sending packets to the firewall engine and includes a contemporaneous transfer of packets on the first memory bus and the second memory bus.

8. The method of claim 5, further comprising:

determining a bus for transferring the packets, wherein the bus is one of the first memory bus and the second memory bus.

9. An improved gateway for screening packets transferred over a network, the gateway including a plurality of network interfaces, each receiving and forwarding messages from a network through the gateway, a memory for temporarily storing packets received from a network, a memory controller coupled to each of the network interfaces and configured to coordinate the transfer of received packets to and from the memory, a memory bus for transferring the received packets to and from the memory, the memory bus providing a first path for retrieving packets from the memory, a firewall engine coupled to the memory bus, the firewall engine operable to retrieve packets from the memory and screen each packet prior to forwarding a given packet through the gateway and out an appropriate network interface, wherein the improvement comprises:

a local bus coupled between the firewall engine and the memory providing a parallel second path for the firewall engine to retrieve packets from the memory.

10. The gateway of claim 9, wherein the improvement includes accessing the memory using the local bus when the memory bus is busy.

11. The gateway of claim 9, wherein the improvement includes selecting one of the primary memory bus and the local bus to transfer packets.

12. The gateway of claim 11, wherein the improvement includes selecting the local bus when the primary memory bus is busy.

13. The gateway of claim 9 wherein the improvement comprises control logic operable to select a bus from among the local bus and the memory bus for use in transfer of a packet between the memory to the firewall engine.

14. The gateway of claim 13, wherein the control logic includes a direct memory access engine.