System and method for processing packets using location and content addressable memories

• US 20060029038A1
• Filed: 07/22/2005
• Published: 02/09/2006
• Est. Priority Date: 06/23/2000
• Status: Active Grant

• Current Assignee: Lookingglass Cyber Solutions, LLC
• Original Assignee: CloudShield Technologies, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Jungck, Peder J.
• Granted Patent: US 7,330,908 B2
• Time in Patent Office: Days
• US Class Current: 370/351
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/19 at layers above the network layer network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

An apparatus and method for enhancing the infrastructure of a network such as the Internet is disclosed. A packet interceptor/processor apparatus is coupled with the network so as to be able to intercept and process packets flowing over the network. Further, the apparatus provides external connectivity to other devices that wish to intercept packets as well. The apparatus applies one or more rules to the intercepted packets which execute one or more functions on a dynamically specified portion of the packet and take one or more actions with the packets. The apparatus is capable of analyzing any portion of the packet including the header and payload. Actions include releasing the packet unmodified, deleting the packet, modifying the packet, logging/storing information about the packet or forwarding the packet to an external device for subsequent processing. Further, the rules may be dynamically modified by the external devices.

Claims

1. A system for processing a plurality of packets according to an application defined by at least one entity, each of the plurality of packets being communicated via a network from a source to a destination intended by the source, each of the plurality of packets comprising a plurality of portions, the system comprising:

a processor coupled with the network and operative to examine each of the plurality of packets;

a location addressable memory operative to store a plurality of reference data specified by the application, each of the plurality of reference data stored at a particular address in the location addressable memory, wherein the location addressable memory is further operative to receive an address and return the reference data stored at the received address in the location addressable memory;

a content addressable memory operative to store a plurality of query data specified by the application, each of the plurality of query data being stored in the content addressable memory associated with at least one location data, the at least one location data comprising at least one address in the location addressable memory of the particular reference data associated with the particular query data, wherein the content addressable memory is further operative to receive at least one query data of the plurality of query data and respond with the associated at least one location data; and

an interface coupled between the processor, the location addressable memory and the content addressable memory, the interface operative to receive a first query data of the plurality of query data from the processor based on the examination, and, in response to receiving the first query data, access the content addressable memory based on the first query data to obtain the at least one location data associated with the first query data, access the location addressable memory based on the obtained at least one location data to obtain the reference data stored in the location addressable memory at the address identified by the obtained at least one location data, and provide the stored reference data to the processor, the processor being further operative to process at least one of the plurality of packets based on the stored reference data.

2. The system of claim 1, wherein the location addressable memory comprises a random access memory.

3. The system of claim 1, further comprising:

an indirect address memory operative to store a plurality of alternate address data each of which is associated with at least one of a plurality of primary address data, each of the plurality of primary address data comprising a first address in the location addressable memory and the associated alternate address data of the plurality of alternate address data comprising a second address in the location addressable memory different from the first address, wherein the indirect address memory is further operative to receive a first primary address data and provide the associated of the plurality of alternate address data in response thereto; and

wherein the interface is further coupled with the indirect address memory and further operative to access the indirect address memory, instead of the location addressable memory, based on the at least one location data and access the location addressable memory based on the address identified by the alternate address data provided in response thereto to obtain the reference data stored in the location addressable memory at the address identified by the provided alternate address data.

4. The system of claim 1, wherein the interface comprises at least one of a field programmable gate array, an application specific integrated circuit, a microcoded processor or combinations thereof.

5. The system of claim 1, wherein the interface and processor are comprised by a field programmable gate array.

6. The system of claim 1, wherein the location addressable memory and the content addressable memory are modifiable independent of the communication of the plurality of packets.

7. The system of claim 1, wherein the location addressable memory and the content addressable memory are modifiable independent of the accesses to the location addressable memory and the content addressable memory.

8. The system of claim 1, wherein the processor may operate synchronously with the communication of the plurality of packets.

9. The system of claim 1, wherein the processor is further operative to examine each of the plurality of packets prior to the receipt of that packet by the intended destination.

10. The system of claim 1, wherein the processor is further operative to determine the first query data based on at least one of the plurality of portions of the examined packet.

11. The system of claim 1, wherein the processor is further operative to store the stored reference data in a storage memory for use in processing subsequent packets of the plurality of packets without having to access the location addressable memory and the content addressable memory.

12. A database comprising:

a location addressable memory operative to store a plurality of reference data specified by an application, each of the plurality of reference data stored at a particular address in the location addressable memory, wherein the location addressable memory is further operative to receive an address and return the reference data stored at the received address in the location addressable memory;

a content addressable memory operative to store a plurality of query data specified by the application, each of the plurality of query data being stored in the content addressable memory associated with at least one location data, the at least one location data comprising at least one address in the location addressable memory of the particular reference data associated with the particular query data, wherein the content addressable memory is further operative to receive at least one query data of the plurality of query data and respond with the associated at least one location data; and

an interface coupled between the location addressable memory and the content addressable memory, the interface operative to receive a first query data of the plurality of query data from a processor coupled with the interface, and, in response to receiving the first query data, access the content addressable memory based on the first query data to obtain the at least one location data associated with the first query data, access the location addressable memory based on the obtained at least one location data to obtain the reference data stored in the location addressable memory at the address identified by the obtained at least one location data, and provide the stored reference data to the processor.

13. The database of claim 12, wherein the processor is coupled with a network and operative to examine each of a plurality of packets being communicated via the network from a source to a destination intended by the source, each of the plurality of packets comprising a plurality of portions;

the first query data being determined by the processor based on the examination, the processor being further operative to process at least one of the plurality of packets based on the provided stored reference data.

14. The database of claim 12, wherein the location addressable memory comprises a random access memory.

15. The database of claim 12, further comprising:

an indirect address memory operative to store a plurality of alternate address data each of which is associated with at least one of a plurality of primary address data, each of the plurality of primary address data comprising a first address in the location addressable memory and the associated of the plurality of alternate address data comprising a second address in the location addressable memory different from the first address, wherein the indirect address memory is further operative to receive a first primary address data and provide the associated of the plurality of alternate address data in response thereto; and

wherein the interface is further coupled with the indirect address memory and further operative to access the indirect address memory, instead of the location addressable memory, based on the at least one location data and access the location addressable memory based on the address identified by the alternate address data provided in response thereto to obtain the reference data stored in the location addressable memory at the address identified by the provided alternate address data.

16. The database of claim 12, wherein the interface comprises at least one of a field programmable gate array, an application specific integrated circuit, a microcoded processor or combinations thereof.

17. The database of claim 12, wherein the location addressable memory and the content addressable memory are modifiable independent of the accesses to the location addressable memory and the content addressable memory.

18. A method of processing a plurality of packets, each of the plurality of packets being communicated via a network from a source to a destination intended by the source, each of the plurality of packets comprising a plurality of portions, the method comprising:

receiving an application defined by at least one entity, the application specifying how the plurality of packets are to be processed, the application further specifying a plurality of reference data and a plurality of query data associated with the plurality of reference data;

storing, in a location addressable memory, the plurality of reference data, each of the plurality of reference data stored at a particular address in the location addressable memory, wherein the location addressable memory is further operative to receive an address and return the reference data stored at the received address in the location addressable memory;

storing, in a content addressable memory, the plurality of query data, each of the plurality of query data being stored in the content addressable memory associated with at least one location data, the at least one location data comprising at least one address in the location addressable memory of the particular reference data associated with the particular query data, wherein the content addressable memory is further operative to receive at least one query data of the plurality of query data and respond with the associated at least one location data;

examining each of the plurality of packets;

determining a first query data of the plurality of query data based on the examination;

accessing the content addressable memory based on the first query data to obtain the at least one location data associated with the first query data;

accessing the location addressable memory based on the obtained at least one location data to obtain the reference data stored in the location addressable memory at the address identified by the obtained at least one location data; and

processing at least one of the plurality of packets in accordance with the stored reference data.

19. The method of claim 18, wherein the receiving, the storing of the plurality of reference data and the storing of the plurality of query data may occur asynchronously to the communication of the plurality of packets.

20. The method of claim 18, wherein the examining may occur synchronously with the communication of the plurality of packets.

21. The method of claim 18, wherein the location addressable memory comprises a random access memory.

22. The method of claim 18, further comprising performing the examining, the determining, the accessing the content addressable memory, the accessing the location addressable memory and the processing using at least one of a field programmable gate array, an application specific integrated circuit, a microcoded processor or combinations thereof.

23. The method of claim 18, further comprising receiving modifications to the plurality of query data, the plurality of reference data, or combinations thereof and updating the location addressable memory and content addressable memory according to the received modifications.

24. The method of claim 18, wherein the accessing the location addressable memory further comprises accessing the location addressable memory in response to the obtaining of the at least one location data associated with the first query data.

25. The method of claim 18, wherein the examining further comprises examining each of the plurality of packets prior to the receipt of that packet by the intended destination.

26. The method of claim 18, wherein the determining further comprises determining the first query data based on at least one of the plurality of portions of the examined packet.

27. A method of accessing a database, the method comprising:

receiving a specification of a plurality of reference data and a plurality of query data associated with the plurality of reference data;

storing, in a location addressable memory, the plurality of reference data, each of the plurality of reference data stored at a particular address in the location addressable memory, wherein the location addressable memory is further operative to receive an address and return the reference data stored at the received address in the location addressable memory;

storing, in a content addressable memory, the plurality of query data, each of the plurality of query data being stored in the content addressable memory associated with at least one location data, the at least one location data comprising at least one address in the location addressable memory of the particular reference data associated with the particular query data, wherein the content addressable memory is further operative to receive at least one query data of the plurality of query data and respond with the associated at least one location data;

receiving a first query data from a requester;

accessing the content addressable memory based on the first query data to obtain the at least one location data associated with the first query data;

accessing the location addressable memory based on the obtained at least one location data to obtain the reference data stored in the location addressable memory at the address identified by the obtained at least one location data; and

providing the stored reference data to the requestor.

28. The method of claim 27, wherein the requester comprises a processor operative to process a plurality of packets, each of the plurality of packets being communicated via a network from a source to a destination intended by the source, each of the plurality of packets comprising a plurality of portions, the method further comprising:

receiving an application defined by at least one entity, the application being executable by the processor to specify how the plurality of packets are to be processed, the application further defining the specification of the plurality of reference data and the plurality of query data associated with the plurality of reference data;

examining each of the plurality of packets by the processor to determine the first query data of the plurality of query data based on the examination; and

processing at least one of the plurality of packets in accordance with the provided stored reference data.

29. The method of claim 27, wherein the receiving, the storing of the plurality of reference data and the storing of the plurality of query data may occur independent of the accessing of the content addressable memory and the accessing of the location addressable memory.

30. The method of claim 27, wherein the location addressable memory comprises a random access memory.

31. The method of claim 27, further comprising receiving modifications to the plurality of query data, the plurality of reference data, or combinations thereof and updating the location addressable memory and content addressable memory according to the received modifications.

32. The method of claim 27, wherein the accessing the location addressable memory further comprises accessing the location addressable memory in response to the obtaining of the at least one location data associated with the first query data.

33. A system for processing a plurality of packets, each of the plurality of packets being communicated via a network from a source to a destination intended by the source, each of the plurality of packets comprising a plurality of portions, the system comprising:

means for receiving an application defined by at least one entity, the application specifying how the plurality of packets are to be processed, the application further specifying a plurality of reference data and a plurality of query data associated with the plurality of reference data;

means for storing, in a location addressable memory, the plurality of reference data, each of the plurality of reference data stored at a particular address in the location addressable memory, wherein the location addressable memory is further operative to receive an address and return the reference data stored at the received address in the location addressable memory;

means for storing, in a content addressable memory, the plurality of query data, each of the plurality of query data being stored in the content addressable memory associated with at least one location data, the at least one location data comprising at least one address in the location addressable memory of the particular reference data associated with the particular query data, wherein the content addressable memory is further operative to receive at least one query data of the plurality of query data and respond with the associated at least one location data;

means for examining each of the plurality of packets;

means for determining a first query data of the plurality of query data based on the examination;

means for accessing the content addressable memory based on the first query data to obtain the at least one location data associated with the first query data;

means for accessing the location addressable memory based on the obtained at least one location data to obtain the reference data stored in the location addressable memory at the address identified by the obtained at least one location data; and

means for processing at least one of the plurality of packets in accordance with the stored reference data.

34. A database comprising:

means for receiving a specification of a plurality of reference data and a plurality of query data associated with the plurality of reference data;

means for storing, in a location addressable memory, the plurality of reference data, each of the plurality of reference data stored at a particular address in the location addressable memory, wherein the location addressable memory is further operative to receive an address and return the reference data stored at the received address in the location addressable memory;

means for storing, in a content addressable memory, the plurality of query data, each of the plurality of query data being stored in the content addressable memory associated with at least one location data, the at least one location data comprising at least one address in the location addressable memory of the particular reference data associated with the particular query data, wherein the content addressable memory is further operative to receive at least one query data of the plurality of query data and respond with the associated at least one location data;

means for receiving a first query data from a requestor;

means for accessing the content addressable memory based on the first query data to obtain the at least one location data associated with the first query data;

means for accessing the location addressable memory based on the obtained at least one location data to obtain the reference data stored in the location addressable memory at the address identified by the obtained at least one location data; and

means for providing the stored reference data to the requester.