US 2004/0165588 A1 · Distributed network security system and a hardware processor therefor

Abstract

An architecture provides capabilities to transport and process Internet Protocol (IP) packets from Layer 2 through transport protocol layer and may also provide packet inspection through Layer 7. A set of engines may perform pass-through packet classification, policy processing and/or security processing enabling packet streaming through the architecture at nearly the full line rate. A scheduler schedules packets to packet processors for processing. An internal memory or local session database cache stores a session information database for a certain number of active sessions. The session information that is not in the internal memory is stored and retrieved to/from an additional memory. An application running on an initiator or target can in certain instantiations register a region of memory, which is made available to its peer(s) for access directly without substantial host intervention through RDMA data transfer. A security system is also disclosed that enables a new way of implementing security capabilities inside enterprise networks in a distributed manner using a protocol processing hardware with appropriate security features.

Claims27

Dependent claims

A security system comprising a network,

said network comprising one or more networked systems of one or more types,
a plurality of said one or more networked systems comprising a hardware processor providing transport layer protocol processing,
said hardware processor comprising
a protocol processing engine to do transport layer protocol processing;
or
a programmable rule processing engine to analyze network traffic for rule matching or taking actions on matched rules or a combination thereof;
or
a security processing engine to do encryption, decryption, authorization or authentication or a combination thereof using standard or proprietary security protocols;
or
a packet classification engine to classify the network traffic;
or
a packet processing engine to perform packet processing tasks;
or
a combination of any of the foregoing,
said security system providing multiple protocol layer security in said network.

12 more elements

A security system for a storage area network,

said storage area network comprising one or more networked systems of one or more types,
said security system comprising a set of systems from said one or more networked systems,
a plurality of said set of systems comprising a hardware processor providing transport layer protocol processing,
said hardware processor comprising
a storage protocol processing engine to do protocol processing;
or
a protocol processing engine to do transport layer protocol processing;
or
a programmable rule processing engine to analyze storage area network traffic for rule matching or taking actions on matched rules or a combination thereof;
or
a security processing engine to do encryption, decryption, authorization or authentication or a combination thereof using standard or proprietary security protocols;
or
a packet classification engine to classify the storage area network traffic;
or
a packet processing engine to perform packet processing tasks like header processing or deep packet processing or a combination thereof;
or
a combination of any or the foregoing,
said security system providing multiple protocol layer security in said storage area network.

15 more elements

A security system comprising a network,

said network comprising one or more networked systems of one or more types,
a plurality of said one or more networked systems comprising a hardware processor providing remote direct memory access capability,
said hardware processor comprising
an RDMA mechanism for performing RDMA data transfer or
a protocol processing engine to do transport layer protocol processing;
or
a programmable rule processing engine to analyze network traffic for rule matching or taking actions on matched rules or a combination thereof;
or
a security processing engine to do encryption, decryption, authorization or authentication or a combination thereof using standard or proprietary security protocols;
or
a packet classification engine to classify the network traffic;
or
a packet processing engine to perform packet processing tasks like header processing or deep packet processing or a combination thereof;
or
a combination of any of the foregoing,
said security system providing multiple protocol layer security in said network.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application

10/783,890Filed 20 Feb 2004

Priority

11 Jun 2002

Published

26 Aug 2004

Term ends

Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/0218
Architectural arrangements, e.g. perimeter networks or demilitarized zones: distributed architectures, e.g. distributed firewalls
H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks
H04L 69/12
Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass:…
H04L 67/1097
In which an application is distributed across nodes in the network: for distributed storage of data in networks, e.g. transport arrangements for…

Family

Application60/388,407Us provisional application · filed 11 Jun 2002

Application10/459,674Continuation in part · filed 10 Jun 2003

Application10/459,349Continuation in part · filed 10 Jun 2003

Application10/459,350Continuation in part · filed 10 Jun 2003

Application10/459,019Continuation in part · filed 10 Jun 2003

Application10/458,855Continuation in part · filed 10 Jun 2003

Application10/459,297Continuation in part · filed 10 Jun 2003

Application10/458,844Continuation in part · filed 10 Jun 2003

Application10/783,890Continuation in part · filed 20 Feb 2004

US 2004/0010545 A1Published application

US 2004/0010612 A1Published application