Scalable filtering and policing mechanism for protecting user traffic in a network

A method of policing data on a network, the method comprising:

• receiving a data packet from a first user at an index module of a computing device;
• hashing, by the index module, the data packet using one or more fields in the data packet to generate a bin identification and a user signature, wherein the user signature for the first user is the same as the user signature for a second user;
• processing, by the index module, the bin identification to associate the user signature with a first bin included in a plurality of bins;
• comparing, at a bin module of the computing device, the user signature of the first user to zero or more stored user signatures associated with the first bin;
• transmitting, by the bin module, the data packet to a transmission module of the computing device based on the comparing;
• transmitting, by the transmission module, the data packet to an output module of the computing device based on a criterion;
• wherein the criterion is rate control;
• wherein the rate control is a rate limit;
• and
• wherein the rate limit dynamically adapts based on a number of stored user signatures in the first bin.

A system for policing data on a network, the system comprising a computing device comprising:

• an index module configured and adapted to receive a data packet, hash the data packet to generate a bin identification and a user signature, and associate the bin identification of the data packet to a first bin included in a plurality of bins;
• a bin module configured and adapted to compare the user signature to zero or more stored user signatures associated with the first bin;
• a transmission module configured and adapted to transmit a matched data packet to an output module based on a criterion;
• wherein, if a capacity of the first bin is exceeded, then the data packet is transmitted to the transmission module without comparing the user signature to the zero or more stored user signatures.

A system for policing data on a network, the system comprising a computing device comprising:

• an index module configured and adapted to receive a data packet from a first user, hash the data packet to generate a bin identification and a user signature, wherein the user signature for the first user is the same as the user signature for a second user, and associate the bin identification of the data packet to a first bin included in a plurality of bins;
• a bin module configured and adapted to compare the user signature of the first user to zero or more stored user signatures associated with the first bin;
• a transmission module configured and adapted to transmit a matched data packet to an output module based on a criterion;
• wherein the criterion is rate control;
• wherein the rate control is a rate limit;
• and
• wherein the rate limit dynamically adapts based on a number of stored user signatures in the first bin.