Techniques for metadata processing
AssigneeThe Charles Stark Draper Laboratory, Inc.
InventorAndre' DeHon
Life of this patent
Estimating the term…
Abstract
A method of and system for performing metadata tag compression in security policy enforcement system may comprise conveying a set of data elements, each with an associated metadata tag, from a first processor subsystem to a second processor subsystem. The first processor subsystem may be configured to process conventional tasks, the second processor configured to apply one or more policy decisions to the data element. The conveying may further comprise sending the set of data elements along with an index element that identifies one or more metadata tags, and sending one or more of the metadata tags identified by the index element.
Claims36
A method comprising:
- at an input/output (IO) metadata processor having a cache configured to store one or more rules, receiving, from a first fabric, a direct memory access (DMA) request directed to an address of a second fabric;
- generating an unvalidated request based on the DMA request and at least one of the one or more rules;
- obtaining DMA data requested by the unvalidated request at the address of the second fabric and obtaining tags associated with the DMA data;
- attempting to load at least one of the one or more rules from the cache of the IO metadata processor based on the tags obtained;
- if the at least one rule based on the tags obtained is not found in the cache, executing rule miss handling;
- and
- if the at least one rule based on the tags obtained is found in the cache, allowing the DMA request.
A system comprising:
- an input/output (TO) cache;
- and
- an input/output (TO) metadata processor having a cache configured to store one or more rules, the IO metadata processor configured to:
- receive, from a first fabric, a direct memory access (DMA) request directed to an address of a second fabric;
- generate an unvalidated request based on the DMA request and at least one of the one or more rules;
- obtain DMA data requested by the unvalidated request at the address of the second fabric and obtain tags associated with the DMA data;
- and
- attempt to load at least one of the one or more rules from the TO cache of the TO metadata processor based on the tags obtained;
- if the at least one rule based on the tags obtained is not found in the TO cache, execute rule miss handling;
- if the at least one rule based on the tags obtained is found in the TO cache, allowing the DMA request.
A method comprising acts of:
- receiving a direct memory access (DMA) request to access data at a memory address, wherein the memory address has associated therewith a metadata tag;
- obtaining one or more metadata tags associated with the DMA request, the one or more metadata tags comprising the metadata tag associated with the memory address;
- using the one or more metadata tags associated with the DMA request to query a rule cache storing one or more rules of a DMA policy;
- and
- determining whether to allow the DMA request, based at least in part on whether the one or more metadata tags associated with the DMA request match any rule in the rule cache.
A method comprising acts of:
- receiving a direct memory access (DMA) request to access data at a memory address, wherein the memory address has associated therewith a metadata tag;
- obtaining one or more metadata tags associated with the DMA request, the one or more metadata tags comprising the metadata tag associated with the memory address;
- and
- determining whether to allow the DMA request, comprising:
- using hardware logic to process the one or more metadata tags associated with the DMA request, wherein the hardware logic implements one or more rules of a DMA policy.
Dependencies are inferred from the claim text.