Circuits and methods for efficient data transfer in a virus co-processing system

#The present application may relate to subject matter disclosed in one or more of U.S. patent application Ser. No. 10/624,948 entitled “Detecting Network Traffic Content” and filed Jul. 21, 2003 by Xie; U.S. patent application Ser. No. 10/624,941 entitled “Network Traffic Flow” and filed Jul. 21, 2003 by Xie; U.S. patent application Ser. No. 10/624,452 entitled “Content Pattern Recognition Language Processor and Methods of Using the Same” and filed Jul. 21, 2003 by Xie et al.; and U.S. patent application Ser. No. 10/624,914 entitled “Hardware Based Detection Devices For Detecting Network Traffic Content and Methods for Using the Same” and filed Jul. 21, 2003 by Xie. Each of the aforementioned applications is assigned to an entity common hereto and shares an inventor common hereto. Further, the entirety of each and every one of the aforementioned applications is incorporated herein by reference for all purposes.

#The present invention is related to circuits and methods used for processing information, and more particularly to circuits and methods for detecting, identifying and/or removing undesired content.

#The generation and spreading of computer viruses are major problems in computer systems and computer networks. A computer virus is a program that is capable of attaching to other programs or sets of computer instructions, replicating itself, and performing unsolicited actions. Viruses may be embedded, for example, in email attachments, files downloaded from the Internet, and various application files. In some cases, such computer viruses may result in mild interference with system performance up to destruction of data and/or undermining of system integrity.

#A further understanding of the various embodiments of the present invention may be realized by reference to the figures which are described in remaining portions of the specification. In the figures, like reference numerals are used throughout several drawings to refer to similar components. In some instances, a sub-label consisting of a lower case letter is associated with a reference numeral to denote one of multiple similar components. When reference is made to a reference numeral without specification to an existing sub-label, it is intended to refer to all such multiple similar components.

#FIG. 1 depicts a combined hardware and software virus processing system in accordance with one or more embodiments of the present invention;

#FIG. 2 is a flow diagram depicting a process for preparing bifurcated hardware and software virus processing in accordance with various embodiments of the present invention;

#The present invention is related to circuits and methods used for processing information, and more particularly to circuits and methods for detecting, identifying and/or removing undesired content.

#Turning to FIG. 1, a combined hardware and software virus processing system 100 is shown in accordance with one or more embodiments of the present invention. System 100 includes a general purpose processor 120 and a virus co-processor 110. General purpose processor 120 executes virus software 140 that is operating on a platform of an operating system 130. Virus software 140 is capable of detecting, identifying and/or cleaning or quarantining a number of different viruses. Virus software 140 may be written in any software language known in the art, and compiled using a compiler tailored for the particular software language and target platform. Based on the disclosure provided herein, one of ordinary skill in the art will recognize a variety of software languages, compilers and/or operating systems that may be employed in relation to different embodiments of the present invention.

#Processing for some of the viruses is done purely in software. Such software processing involves general purpose processor 120 executing software instructions tailored for virus processing and is identified as software processed viruses 150. Software processed viruses may include one or more of a general set of virus signatures 180 that are compiled for execution on general purpose processor 120. Processing for others of the viruses may be done using a combination of software processing and hardware processing. Such combination software and hardware processing includes performing one or more virus processing functions on virus co-processor 110 and executing one or more instructions on general purpose processor 120. These viruses are identified as hardware processed viruses 160. Such hardware processed viruses may include one or more of the general set of virus signatures 180 that are compiled for execution on virus co-processor 110. Thus, in some cases, virus software 140 includes a compiled set of virus signatures that may be executed by virus co-processor 110. This compiled set of virus signature may be written to a memory associated with virus co-processor 110 through execution by general purpose processor 120 of one or more instructions included in virus software 140. It should be noted that the terms software and hardware are used somewhat loosely as virus co-processor may execute one or more local instructions, and general purpose processor is itself a hardware device. However, these words are used herein to refer to processes performed by the general purpose processor 120 at the direction of virus software 140 (i.e., software processing) and processes performed by virus co-processor 110 either purely in hardware or under the direction of software instructions (i.e., hardware processing). Virus co-processor 110 may be implemented as a semiconductor device such as, for example, a programmable gate array or an application specific integrated circuit. Based on the disclosure provided herein, one of ordinary skill in the art will recognize a variety of technologies that may be used to implement virus co-processor 110.