Control key capable of storing multiple and variable data packet classification results

A method for generating a control key appended to a data packet being processed by an integrated network security device, the control key controlling the dispatching of one or more data packets across a plurality of applications running on the integrated network security device, the method comprising:

• dividing the control key in two sections, the two sections being an operations section, and an application section;
• subdividing the operations section in two subsections, the two sub-sections being an ingress section, and an egress section, wherein the ingress section is applied to a data packet entering the device, and the egress section is applied to the data packet leaving the device;
• encoding the operations section by using bits, wherein each bit identifying a invariable-order operation using its position in the control key, wherein the bits indicate the invariable order of applying operations, the invariable order being invariable for control keys appended to data packets associated with different connections;
• and
• encoding the application section by using binary application encoding, wherein the binary application coding encodes applications in a variable order for control keys appended to data packets associated with different connections.

A system for generating a control key, the control key being appended to a data packet being transmitted through an integrated network security device, the control key controlling the dispatching of the data packet across a plurality of applications running on the integrated network security device, the system comprising:

• one or more processors;
• and
• logic encoded in one or more tangible media for execution by the one or more processors and when executed operable to:
• divide the number of bits allocated for a control key into an operations section, and an application section of the control key;
• encode the operations to be encoded at the operation section, wherein each encoded bit identifies an operation requirement based on the bit status at its position in the control key, wherein bit positions indicate the invariable order of applying operations, the invariable order being invariable for control keys appended to data packets associated with different connections;
• and
• encode the identifiers on the application section of the control key, the binary encoder programming the sequence of the applications being encoded in the application section, wherein the sequence of applications are in the variable order for control keys appended to data packets associated with different connections.

A method for dispatching a data packet in an integrated network security device, the data packet having a control key attached, the control key controlling the dispatching of the data packet across a plurality of applications running on the integrated network security device, the method comprising:

• dividing the control key in two sections, the two sections being an operations section, and an application section;
• subdividing the operations section in two subsections, the two sub-sections being an ingress section, and an egress section, the ingress section being applied to a data packet entering the device, and the egress section being applied to a data packet leaving the device;
• identifying the operations being encoded in the ingress and the egress operations section, the step comprising
• decoding bits being encoded in the ingress operations section, wherein the bits identify an invariable order of operations, the decoding being based on the position of the operations in the control key, comprising;
• ignoring the operations marked as ‘0’ (zero) in the control key
• dispatching the data packet to the next decoded operation marked as ‘1’ (one) in the control key, while setting to zero its corresponding bit within the control key;
• receiving the data packet from the operation software module once the computation is done;
• and
• continue processing the ingress operations section on the control key until all bits have been cleared;
• identifying the applications being encoded in the application section, the step comprising
• decoding bits being encoded in the application section, the bits identifying the applications, and the sequencing of the identified applications, the sequencing of the applications being based on the position of applications in the application section, comprising
• ignoring the applications marked as ‘0’ in the control key;
• dispatching the data packet to the next decoded application, while setting to zero its corresponding field within the control key;
• receiving the data packet from the application software module once the computation is done;
• and
• continue processing the application section on the control key until all bits have been cleared;
• identifying the next operation being encoded in the egress section, the step comprising
• decoding bits being encoded in the egress operations section, wherein the bits identify an invariable order of operations, the decoding being based on the position of the operations in the control key, comprising
• ignoring the operations marked as ‘0’ (zero) in the control key;
• dispatching the data packet to the next decoded operation marked as ‘1’ (one) in the control key, while setting to zero its corresponding bit within the control key;
• receiving the data packet from the operation software module once the computation is done;
• and
• continue processing the egress operations section on the control key until all bits have been cleared.

A system for dispatching a data packet through an integrated network security device, the data packet having a control key attached, the control key controlling the dispatching of the data packet across a plurality of applications running on the integrated network security device, the system comprising:

• a packet sending/receiving interface with hardware devices connected to the outside of the device;
• a packet sending/receiving interface with one or more of the operation and application software/hardware modules;
• one or more processors;
• and
• logic encoded in one or more tangible media for execution by the one or more processors and when executed operable to:
• divide the number of bits allocated for a control key into an operations section, and an application section of the control key;
• encode the operations to be encoded at the operation section, wherein each encoded bit identifies an operation requirement based on the bit status at its position in the control key, wherein bit positions indicate the invariable order of applying operations, the invariable order being invariable for control keys appended to data packets associated with different connections;
• encode the identifiers on the application section of the control key, the binary encoder programming the sequence of the applications being encoded in the application section, wherein the sequence of applications are in the variable order for control keys appended to data packets associated with different connections;
• and
• allow clearing each of the entries in the operations sections and the application sections of the control key that data the packet is being dispatched with.

An apparatus for generating a control key appended to a data packet being transmitted through a integrated network security device, the control key controlling the dispatching of a data packet to across a plurality of software modules running on the integrated network security device, the apparatus comprising:

• a processing system including a processor coupled to a display and user input device;
• and
• a machine-readable medium including instructions executable by the processor comprising
• one or more instructions for dividing the control key in three sections, the three sections being an ingress section, an egress section, and an application section;
• one or more instructions for encoding the operations to be performed on both the ingress section and the egress section using bits wherein, each bit identifying an operation using its position in the control key, wherein the bits indicate the invariable order of applying operations, the invariable order being invariable for control keys appended to data packets associated with different connections;
• and
• one or more instructions for encoding the application section using binary application coding, wherein the binary application coding encodes applications in a variable order for control keys appended to data packets associated with different connections.

A machine-readable medium including instructions executable by the processor for generating a control key appended to a data packet being transmitted through a integrated network security device, the control key controlling the dispatching of a data packet to across a plurality of software modules running on the integrated network security device, the machine-readable medium comprising:

• one or more instructions for dividing the control key in three sections, the three sections being an ingress section, an egress section, and an application section;
• one or more instructions for encoding the operations to be performed on both the ingress section and the egress section using bits wherein, each bit identifying an operation using its position in the control key, wherein the bits indicate the invariable order of applying operations, the invariable order being invariable for control keys appended to data packets associated with different connections;
• and
• one or more instructions for encoding the application section using binary application coding, wherein the binary application coding encodes applications in a variable order for control keys appended to data packets associated with different connections.

A system for generating a control key, the control key being appended to a data packet being processed by an integrated network security device, the control key controlling the dispatching of the data packet across a plurality of applications running on the integrated network security device, the system comprising:

• a network device comprising:
• means for dividing the control key in two sections, the two sections being an operations section, and an application section;
• means for subdividing the operations section in two subsections, the two sub-sections being an ingress section, and an egress section, the ingress section being applied to data packets entering the device, and egress section being applied to data packets leaving the device;
• means for encoding the operations section by using bits, wherein each bit identifies a invariable-order operation using its position in the control key, wherein the bits indicate the invariable-order of applying operations, the invariable-order being invariable for control keys appended to data packets associated with different connections;
• and
• means for encoding the application section by using binary application encoding, wherein the binary application coding encodes applications in a variable order for control keys appended to data packets associated with different connections.