Back to results
US 9,544,273 B2Granted
Network traffic processing system
AssigneeTrend Micro Incorporated
InventorsDamon E. Fleury, James M. Rolette
Life of this patent
Estimating the term…
Abstract
A system for processing network traffic includes a hardware-accelerated inspection unit to process network traffic in hardware-accelerated inspection mode, and a software inspection unit to process the network traffic in software inspection mode. The software inspection unit processes a connection in in the software inspection mode at least for a consecutive predetermined number of bytes of the connection. The connection may be transitioned to the hardware-accelerated inspection mode if the connection is determined to be clean.
Claims12
A system for processing network traffic in a computer network, the system comprising:
- a hardware-accelerated inspection unit to process the network traffic in hardware-accelerated inspection mode, the hardware-accelerated unit comprising an integrated circuit that is customized to inspect the network traffic for signatures;
- and
- a software inspection unit to process the network traffic in software inspection mode, the software inspection unit comprising a processor that executes instructions in memory to inspect the network traffic for signatures,
- wherein the software inspection unit processes a connection in the network traffic in the software inspection mode to detect a signature match, and if the connection is determined by the software inspection unit to not have a signature match or a potential signature match for at least a consecutive predetermined number of bytes of the connection, the connection is transitioned to the hardware-accelerated inspection mode for processing by the hardware-accelerated inspection unit,
- wherein if the hardware-accelerated inspection unit detects a potential signature match, the connection is transitioned back to the software inspection mode to perform deep packet inspection on the connection.
2 more elements
An intrusion prevention system (IPS) comprising:
- an interface to receive network traffic in a computer network and output the network traffic toward its destination if it is determined by the IPS to not have a signature match;
- a hardware-accelerated inspection unit to process a connection in the network traffic in hardware-accelerated inspection mode to determine whether the connection has a potential signature match, the hardware-accelerated unit comprising an integrated circuit that is customized to inspect the network traffic for signatures;
- and
- a software inspection unit to process the connection in software inspection mode to determine whether the connection has a signature match, the software inspection unit comprising a processor that executes instructions in memory to inspect the network traffic for signatures,
- wherein the software inspection unit processes the connection in the software inspection mode, and if the connection is determined to not have a signature match or a potential signature match for a consecutive predetermined number of bytes of the connection, the connection is transitioned to the hardware-accelerated inspection mode for processing by the hardware-accelerated inspection unit,
- wherein if the hardware-accelerated inspection unit determines the connection has a potential signature match, the connection is transitioned back to the software inspection unit to perform additional inspection on the connection.
3 more elements
A method of processing network traffic comprising:
- receiving, on an interface of a network processing system, a connection in a network traffic in a computer network;
- processing the connection in a software inspection mode for a predetermined number of bytes of the connection to determine whether the connection has a signature match;
- if the connection is determined to not have a signature match or a potential signature match for the predetermined number of bytes, transitioning processing of the connection to a hardware-accelerated inspection mode, wherein connection processing in the hardware-accelerated inspection mode includes inspection of the communication using a custom integrated circuit and is faster than in the software inspection mode;
- and
- if the processing in the hardware-accelerated inspection mode determines the connection has a potential signature match, the connection processing is transitioned back to the software inspection mode.
2 more elements
Dependencies are inferred from the claim text.