System and method of high volume rule engine

• US 9,491,069 B2
• Filed: 07/29/2013
• Issued: 11/08/2016
• Est. Priority Date: 07/29/2012
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Yitshak, Yishay, Goldfarb, Eithan
• Primary Examiner(s): Hussain, Tauqir
• Assistant Examiner(s): Guzman, Javier O
• Application Number:
  US13/953,090
• Publication Number:
  US 20140089498A1
• Time in Patent Office: 1,198 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 45/742 Route cache; Operation thereof
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 45/7459 using Bloom filters
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A rule engine configured with at least one hash table which summarizes the rules managed by the engine. The rule engine receives rules and automatically adjusts the hash table in order to relate to added rules and/or in order to remove cancelled rules. The adjustment may be performed while the rule engine is filtering packets, without stopping. The rules may be grouped into a plurality of rule types and for each rule type the rule engine performs one or more accesses to at least one hash table to determine whether any of the rules of that type match the packet. In some embodiments, the rule engine may automatically select the rule types responsive to a set of rules provided to the rule engine and adapt its operation to the specific rules it is currently handling, while not spending resources on checking rule types not currently used.

Claims

1. A method of screening data packets for matching rules by a packet filter comprising a processing unit, the method performed by the packet filter comprising:

receiving data packets, by the packet filter;

generating for each received packet, one or more first lookup keys from one or more fields of the packet;

accessing a data structure comprising a hash table using the one or more first lookup keys, wherein the hash table comprises an array of pointers, wherein entries in the array of pointers include a four byte pointer field which either has a null value indicating there are no corresponding rules or includes a pointer to a linked list, wherein the pointer comprises a data unit which indicates a memory location having absolute address values and relative offsets, wherein the linked list includes one or more records of the hash table which each include (a) a corresponding key value for verification that the packet matches the record, and (b) further handling instructions, wherein the further handling instructions includes a pointer to a rule record generated by a rule database, wherein the rule record includes a test that needs to be applied to the packet to determine whether the packet matches a rule, wherein at least some of the records in the hash table indicate a second one or more lookup keys to be used in one or more additional accesses to the data structure;

performing the further handling instructions to determine whether the packet matches the rule; and

upon the packet matching a rule, applying the matching rule to the matching packets.

2. The method of claim 1, wherein generating the one or more first lookup keys comprises generating at least one first lookup key based on a plurality of fields of the packet.

3. The method of claim 1, wherein generating at least one of the lookup keys comprises generating a key based on a result of applying an operator to one or more fields of the packet.

4. The method of claim 1, wherein at least some of the records in the data structure indicate a plurality of second lookup keys to be used in a further access to the data structure.

5. The method of claim 1, wherein at least one first record indicates a single second lookup key and at least one second record indicates a plurality of second lookup keys.

6. The method of claim 1, wherein the data structure comprises a TRIE.

7. The method of claim 1, wherein the data structure comprises a TCAM.

8. The method of claim 1, wherein accessing the data structure comprises accessing a bloom filter which is a part of the data structure.

9. The method of claim 1, wherein generating for each received packet one or more first lookup keys comprises generating for one or more packet a plurality of different first lookup keys.

10. The method of claim 9, wherein the accesses to the data structure for the plurality of different first keys of the packet are performed for all the first keys even if a matching rule was already found for the packet.

11. The method of claim 1, comprising storing the results of the determination of whether the packet matches a rule in a session flow table, for at least some packet sessions, for further use on subsequently received packets of the session.