Circuits and methods for efficient data transfer in a virus co-processing system

• US 8,286,246 B2
• Filed: 08/10/2007
• Issued: 10/09/2012
• Est. Priority Date: 08/10/2007
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Zhou, Xu, Huang, Lin, Xie, Michael
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US11/837,053
• Publication Number:
  US 20090044273A1
• Time in Patent Office: 1,887 Days
• Field of Search: 726/24, 713/188
• US Class Current: 726/24
• CPC Class Codes: G06F 12/1009 using page tables, e.g. page table structures
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/152 Virtualized environment, e.g. logically partitioned system
• CPC Class Codes: G06F 2212/657 Virtual address space management

Abstract

Various embodiments of the present invention provide circuits and methods for improved virus processing. As one example, such methods may include providing a system memory, a general purpose processor and a virus co-processor. The methods further include receiving a data segment at the general purpose processor, and storing the data segment to the system memory using virtual addresses. The data segment is accessed from the system memory by the virus co-processor using the virtual addresses. The virus co-processor then scans the data segment for viruses and returns a result.

Claims

1. A virus processing system, the virus processing system comprising:

a system memory, wherein the system memory is operable to store at least one data segment, and wherein the system memory is operable to store a task control, the task control comprising a file type indicator for the at least one data segment, a pointer to the at least one data segment, and a return result location;

a general purpose processor, wherein the general purpose processor is communicably coupled to the system memory, and wherein the general purpose processor is operable to store a data segment to the system memory using virtual addresses;

a virus co-processor, wherein the virus co-processor is communicably coupled to the system memory, and wherein the virus co-processor is operable to retrieve the data segment from the system memory using the virtual addresses and to execute one or more virus signatures against the data segment, and wherein the one or more virus signatures are selected based on a file type indicator in the task control, wherein the virus co-processor is operable to store a virus scan result in the return result location.

2. The virus processing system of claim 1, wherein the virus co-processor is communicably coupled to the system memory via a first memory interface;

and wherein the virus processing system further comprises;

an instruction memory;

wherein the virus co-processor is communicably coupled to the instruction memory via a second memory interface.

3. The virus processing system of claim 2, wherein the first memory interface includes a PCI interface.

4. The virus processing system of claim 2, wherein the first memory interface includes a page table.

5. The virus co-processing system of claim 4, wherein the page table is accessed from the system memory via the first memory interface.

6. The virus co-processing system of claim 4, wherein the first memory interface includes an invalidation register, and wherein the general purpose processor is responsible for writing the invalidation register whenever the page table becomes invalid.

7. The virus processing system of claim 1, wherein the virtual addresses include a directory portion, a page table portion, and an offset portion.

8. The virus processing system of claim 7, wherein the directory portion indicates a particular page table, wherein the page table portion indicates a particular page, and wherein the offset portion indicates a particular entry within the particular page.

9. The virus processing system of claim 1, wherein the virtual addresses include a directory portion and an offset portion.

10. The virus processing system of claim 9, wherein the directory portion indicates a particular page, and wherein the offset portion indicates a particular entry within the particular page.

11. A method for virus co-processing, the method comprising:

providing a system memory,

providing a general purpose processor;

providing a virus co-processor;

receiving a data segment at the general purpose processor;

storing the data segment to the system memory using virtual addresses;

storing a file type indicator for the data segment in the system memory;

accessing the data segment by the virus co-processor using the virtual addresses;

selecting one or more virus signatures based on the file type indicator;

scanning the data segment for viruses using the one or more virus signatures; and

returning a result of the scanning.

12. The method of claim 11, wherein the virtual addresses include a directory portion, a page table portion, and an offset portion;

wherein the directory portion indicates a particular page table;

wherein the page table portion indicates a particular page; and

wherein the offset portion indicates a particular entry within the particular page.

13. The method of claim 11, wherein the virtual addresses include a directory portion and an offset portion;

wherein the directory portion indicates a particular page; and

wherein the offset portion indicates a particular entry within the particular page.

14. The method of claim 11, wherein accessing the data segment by the virus co-processor using the virtual addresses includes:

accessing a page table from the system memory.

15. The method of claim 14, wherein accessing the data segment by the virus co-processor using the virtual addresses further includes:

receiving an indication that the page table has been invalidated by the general purpose processor; and

based at least in part on the indication that the page table has been invalidated, accessing the page table from system memory.

16. The method of claim 11, wherein the method further comprises:

accessing a virus signature from an instruction memory.

17. The method of claim 16, wherein scanning the data segment for viruses includes executing the virus signature against the data segment.

18. The method of claim 11, wherein returning the result of the scanning includes writing the result to the system memory at an absolute address.

19. A virus co-processor, the virus co-processor comprising:

a memory controller, wherein the memory controller includes a start pointer, wherein the memory controller provides for virtual addressing of the system memory, wherein the memory controller is operable to access a data segment from the system memory using virtual addresses beginning at the start pointer, and wherein the start pointer is writable by a general purpose processor;

a processing core, wherein the processing core is operable to receive the data segment, wherein the processing core is operable to execute one or more virus signatures against the data segment;

wherein the processing core is operable to select the one or more virus signatures based on a file type indicator stored in the system memory for the data segment; and

wherein the processing core is operable to return a result of the comparison to the memory controller; and

wherein the memory controller is operable to write the result to the system memory at an absolute address.

20. The virus co-processor of claim 19, wherein the memory controller includes a page table and an invalidation register, wherein the invalidation register is writable by the general purpose processor, and wherein the virus co-processor is operable to refresh the page table from the system memory upon writing of the invalidation register.