Network Interface Circuitry Ingress Packet Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network interface circuitry filters packets based on implicit connection properties, which limits its ability to efficiently process and manage packets not associated with offloaded connections, requiring additional processing resources from the host computer.
Innovation Solution
Implementing ingress packet filtering and rewriting capabilities in network interface circuitry based on explicit packet header fields, using a flexible set of filtering rules that can be dynamically updated, allowing for actions such as accept, reject, or modify packets, and utilizing Ternary Content Addressable Memory (TCAM) for efficient rule lookup and processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packet filtering is performed by the host computer (e.g., netfilter capability), then filtering can be applied to all packets, but it increases host processing overhead and reduces processing efficiency
Solution Approach 1:
The patent extracts the packet filtering function from the host computer and relocates it to the network interface circuitry. The NIC now performs filtering based on explicit packet properties (header fields) independently, extracting only the filtering workload from the host while maintaining the host's primary computational tasks.
Solution Approach 2:
The network interface circuitry acts as an intermediary between the network and the host computer, performing packet filtering before packets reach the host. This intermediary layer handles filtering operations using TCAM-based rule matching, preventing unnecessary packets from consuming host resources.
2Productivity
If conventional connection-based filtering is used, then offloaded connection packets are handled efficiently, but packets not associated with offloaded connections require additional host processing
Solution Approach 1:
The network interface circuitry is enhanced with universal filtering capabilities that handle both offloaded connection packets and non-offloaded packets. The same TCAM-based filtering mechanism applies to all incoming packets regardless of their connection status, providing a unified filtering approach that maintains efficiency across different packet types.
3Speed
If simple filtering rules are used, then processing is fast and simple, but advanced network functions (firewalls, load balancing, NAT) cannot be implemented
Solution Approach 1:
The patent changes the parameter space of filtering rules from simple connection-based criteria to explicit packet property matching with multiple header field comparisons. This allows the system to support complex network functions while maintaining high-speed processing through hardware-accelerated TCAM lookup and pattern matching capabilities.
Data Source
AI summary
Transfer of data is facilitated between at least one peer application and a host, via a network and network interface circuitry associated with the host. That is, data destined for the host is provided from the peer to the network interface circuitry via the network. The NIC has the capability to offload the processing of data provided according to particular protocols. In addition, based on characteristics of the data, a filtering rule associated with those characteristics may be applied to the data prior to providing the data to the host. When there are a plurality of filter rules associated with characteristics of the data, in some examples, it is automatically determined which one of the plurality of filter rules associated with characteristics of the data to apply to the data.