Runtime adaptable search processor

Abstract

A runtime adaptable search processor is disclosed. The search processor provides high speed content search capability to meet the performance need of network line rates growing to 1 Gbps, 10 Gbps and higher. The search processor provides a unique combination of NFA and DFA based search engines that can process incoming data in parallel to perform the search against the specific rules programmed in the search engines. The processor architecture also provides capabilities to transport and process Internet Protocol (IP) packets from Layer 2 through transport protocol layer and may also provide packet inspection through Layer 7 . Further, a runtime adaptable processor is coupled to the protocol processing hardware and may be dynamically adapted to perform hardware tasks as per the needs of the network traffic being sent or received and/or the policies programmed or services or applications being supported. A set of engines may perform pass-through packet classification, policy processing and/or security processing enabling packet streaming through the architecture at nearly the full line rate. A high performance content search and rules processing security processor is disclosed which may be used for application layer and network layer security. Scheduler schedules packets to packet processors for processing. An internal memory or local session database cache stores a session information database for a certain number of active sessions. The session information that is not in the internal memory is stored and retrieved to/from an additional memory. An application running on an initiator or target can in certain instantiations register a region of memory, which is made available to its peer(s) for access directly without substantial host intervention through RDMA data transfer. A security system is also disclosed that enables a new way of implementing security capabilities inside enterprise networks in a distributed manner using a protocol processing hardware with appropriate security features.

1 - 7 . (canceled) 
     
     
         8 . A system for operating on network packets or on local content, said system communicatively couplable to a network, said system comprising a hardware runtime adaptable search processor comprising a runtime adaptable hardware finite state automation search engine comprising computational logic blocks for implementing at least one regular expression, said hardware finite state automation engine having a plurality of states to process content embedded within said network packets or within said local content. 
     
     
         9 . The system of  claim 8  wherein said hardware runtime adaptable search processor further provides runtime adaptable search processor array hardware to dynamically select hardware configurations within said hardware runtime adaptable search processor to support application or service processing needs of said network packets or said local content. 
     
     
         10 . The system of  claim 8  further comprising one or more processors programmed to:
 initialize said hardware runtime adaptable search processor; 
 communicate content search rules to said hardware runtime adaptable search processor; 
 communicate the content to be searched by said hardware runtime adaptable search processor; 
 communicate the results of said content search by said hardware runtime adaptable search processor to said applications; and 
 start and stop said hardware runtime adaptable search processor to start and stop content search. 
 
     
     
         11 . The system of  claim 8  wherein said hardware runtime adaptable search processor enables one or more of the following:
 email security applications comprising one or more of the following: anti-spam, anti-virus, anti-spyware, anti-phishing, confidential leak prevention, and regulatory compliance; and 
 web security applications comprising one or more of the following: firewall, intrusion detection and prevention, application layer security, anti-spam, anti-virus, anti-spyware, anti-phishing, confidential leak prevention, and regulatory compliance, 
 wherein said applications can be performed at network line rates, wherein said network line rates lie within a range of line rates from below 100 Mbps to 10 Gbps and higher. 
 
     
     
         12 . The system of  claim 8  wherein said hardware runtime adaptable search processor receives data packets from a network and sends data packets to said network, and further provides capability to select one or more of the following:
 policy based services, applications, or policies, or a combination thereof, on one or more of the following: the data packets received from said network, and the data packets sent to said network; 
 user selected services, applications, or policies, or a combination thereof, on one or more of the following: the data packets received from said network, and the data packets sent to said network; 
 user defined services, applications, or policies, or a combination thereof, on one or more of the following: the data packets received from said network, and the data packets sent to said network; and 
 user configured services, applications, or policies, or a combination thereof, on one or more of the following: the data packets received from said network, and the data packets sent to said network. 
 
     
     
         13 . The system of  claim 8 , wherein said computational logic blocks comprise FPGA combinational blocks. 
     
     
         14 . An apparatus comprising a runtime adaptable finite state automaton (FSA) architecture for implementing at least one regular expression using computational logic blocks, said FSA architecture having a plurality of states, said FSA architecture comprising:
 a. at least one interconnection between any two of said plurality of states;   b. a state dependent vector (SDV) for each of said plurality of states that is used to enable or disable said at least one interconnection between said two states and other states of said plurality of states;   c. a current state vector (CSV) for each of said plurality of states representing the current state of some of said plurality of states which the state of said plurality of states depends on for its next state evaluation;   d. at least one symbol associated with each of said plurality of states for controlling the transition into or out of said each of said plurality of states;   e. at least one symbol detection logic for receiving symbols, detecting the value of said symbols and generating a received symbol vector (RSV);   f. at least one application state memory for storing a plurality of application state contexts that use said finite state automaton, each of said plurality of application state contexts corresponding to a regular expression; and   g. a state transition logic for each of said plurality of states that uses at least said state dependent vector, said current state vector, and said received symbol vector to generate the next state for each of said plurality of states.   
     
     
         15 . The apparatus of  claim 14 , wherein said FSA architecture further comprises one or more of the following:
 a. a programmable storage for said SDV for enabling runtime configuration of said SDV;   b. a programmable storage for a left-biased (LB) or right-biased (RB) signal for enabling runtime configuration of the realized FSA type;   c. a programmable storage for storing a start flag to indicate if said state is a start state of said FSA;   d. a programmable storage for storing an accept flag to indicate if said state is an accept state of said FSA;   e. a programmable storage for storing an action field to indicate the action that should be taken when said state is activated or reached during said FSA evaluation; and   f. a programmable storage for storing a tag field to indicate a tag that is issued when said state is activated or reached during said FSA evaluation.   
     
     
         15 . The apparatus of  claim 14 , wherein said FSA architecture further comprises a hierarchy of computational logic including compute clusters interconnected using a routing network comprised of routing resources configured to connect each compute cluster to an inter cluster routing switch.