Packet Processor Stateful Inspection Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional routers face challenges in performing stateful packet inspection at wire speeds due to the limitations of software-based solutions, which are too slow for high-speed networks, and network processors, which are inflexible and expensive.
Innovation Solution
A packet processor is designed with an extraction circuit, lookup circuit, assignment circuit, rule matching circuit, and action circuit to generate and manage metadata values, allowing for selective rule application and action performance on packets, enabling stateful packet inspection without requiring network processors or software-based speed limitations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software-based processing is used to enable stateful packet inspection, then flexibility and state tracking capability are improved, but processing speed deteriorates (limited to 4-8 Gbps, too slow for 10 Gbps or 40 Gbps wire speed)
Solution Approach 1:
The patent replaces software-based processing with a hardware-based packet processor that includes dedicated circuits for extraction, lookup, assignment, rule matching, and action execution. This hardware implementation achieves wire-speed processing (10 Gbps or 40 Gbps) while maintaining stateful packet inspection capabilities through specialized circuitry rather than general-purpose software execution.
Solution Approach 2:
The patent changes the operational parameters by implementing parallel processing architectures and optimized data structures (metadata tables, rule tables) that enable high-speed stateful inspection. The system uses predefined metadata identifiers and rule sets that can be quickly evaluated in hardware, transforming the processing speed parameter from software-limited to hardware-optimized levels.
2Speed
If network processors are used to achieve wire-speed processing, then processing speed is improved, but flexibility and ease of operation deteriorate (network processors are inflexible and expensive, requiring detailed microprogramming knowledge)
Solution Approach 1:
The patent creates a universal packet processing platform that can handle multiple packet processing functions through configurable rule tables and metadata structures. The system provides both high-speed wire-rate processing and programming flexibility by allowing standard programming languages to define packet processing rules, making it adaptable to different networking requirements without requiring specialized microprogramming expertise.
Solution Approach 2:
The patent introduces an intermediary layer between the hardware packet processor and the programming interface. This layer includes metadata tables and rule matching circuits that translate high-level programming rules into hardware-executable operations, shielding users from hardware complexity while maintaining wire-speed performance.
3Reliability
If network processors are used for specialized packet processing, then processing capability is improved, but cost deteriorates (network processors are much more expensive than standard packet processors)
Solution Approach 1:
The patent uses standard packet processor hardware as a base and copies/adapts it to provide enhanced stateful packet inspection capabilities. Rather than requiring expensive specialized network processors, the system implements the needed functionality using conventional hardware resources organized with specialized circuits for extraction, lookup, and rule matching, achieving comparable reliability at lower cost.
Data Source
AI summary
A packet processor includes an extraction circuit, a lookup circuit, an assignment circuit, a rule matching circuit, and an action circuit. The extraction circuit generates a first set of values based on a first packet. The lookup circuit stores metadata values. Each of the metadata values corresponds to a respective metadata identifier. The assignment circuit assigns a first metadata identifier to the first packet. The lookup circuit selectively retrieves a first metadata value that corresponds to the first metadata identifier. The rule matching circuit selects a first rule from among a predetermined set of rules based on the first set of values and the first metadata value. The action circuit identifies a first action specified by the first rule and performs the first action. The first action includes modifying the first metadata value of the plurality of metadata values.