Lossless, stateful, real-time pattern matching with deterministic memory resources
AssigneeForte 10 Networks, Inc.
InventorLivio Ricciulli
Life of this patent
Estimating the term…
Abstract
In one embodiment, the method for inspecting packets comprises broadcasting data units of packets to a plurality of finite state machine (FSM) comparison units, where each of the FSM comparison units implements a portion of a signature. The method further includes comparing the data units of the packets to signatures, including each FSM comparison unit of the plurality of FSM comparison units independently comparing one of the data units to its associated portion of one signature. The method also includes combining results of the plurality of FSM comparison units independently processing the data units using a logic combinatorial circuit.
Claims23
A method comprising:
- a processor and a memory for performing the steps of
- broadcasting data units of packets to a plurality of finite state machine (FSM) comparison units, each of the FSM comparison units implementing a portion of a signature;
- comparing the data units of the packets to a plurality of signatures, including each FSM comparison unit of the plurality of FSM comparison units independently and concurrently comparing one of the data units to the corresponding portion of a signature implemented by said each of the FSM comparison units;
- and
- combining results of the plurality of FSM comparison units independently processing the data units using a logic combinatorial circuit wherein combining results comprises logically ANDing results from a subset of the plurality of FSM comparison units, each FSM in the plurality matching a portion of a first signature from the plurality of signatures, and translating information on the match of the first signature into one or more values.
An apparatus having a processor and a memory, comprising:
- a bus system to broadcast data units of a packet;
- a plurality of finite state machine (FSM) comparison units coupled to the bus system to compare the data units of the packet to a plurality of signatures, each of the FSM comparison units implementing a portion of a signature, wherein each FSM comparison unit of the plurality of FSM comparison units independently and concurrently compares one of the data units to its associated portion of one signature;
- and
- a logic combinatorial circuit to combine results of the plurality of FSM comparison units independently processing the data units the logical combinatorial circuit comprising a logic circuit to logically AND results from each FSM implementing a portion of a first signature from the plurality of signatures to determine if a match for the signature exists, and to translate information on the match into one or more values.
An apparatus having a processor and a memory, comprising:
- means for broadcasting data units of packets to a plurality of finite state machine (FSM) comparison units, each of the FSM comparison units implementing a portion of a signature;
- means for comparing the data units of the packets to a plurality of signatures, including each FSM comparison unit of the plurality of FSM comparison units independently and concurrently comparing one of the data units to the corresponding portion of a signature implemented by said each of the FSM comparison units;
- and
- means for combining results of the plurality of FSM comparison units independently processing the data units using a logic combinatorial circuit, wherein combining results comprises logically ANDing results from a subset of the plurality of FSM comparison units, each FSM in the plurality matching a portion of a first signature from the plurality of signatures, and translating information on the match of the first signature into one or more values.
Dependencies are inferred from the claim text.