Parallel Packet Scanning via Memory Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security technologies for networks, implemented in different modes (unprivileged, privileged, and hardware), are incompatible and operate serially, requiring data copies and increasing processing time due to different protocol stack layers and memory access limitations.
Innovation Solution
A parallel scanning method that maps, queues, and marks packets to allow multiple scanning technologies to operate in parallel, eliminating the need for data copies and enabling efficient processing by allocating virtual memory space for unprivileged scanners and utilizing a scanq task to manage packet scanning across different modes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple scanning technologies are combined in a single device, then security management becomes easier, but device performance and flexibility demands increase significantly
Solution Approach 1:
The patent segments the scanning system into multiple independent scanning engines (virus scanner, spam filter, etc.), each running in separate memory spaces. This allows each scanner to operate independently with optimized resources while being managed through a unified interface, reducing the management burden while maintaining performance
Solution Approach 2:
The patent introduces a scanning manager as an intermediary component that coordinates between multiple scanning engines and the network traffic flow. The manager handles packet distribution, result aggregation, and scanner configuration, simplifying security management while allowing each scanner to maintain its specialized performance characteristics
2Adaptability or versatility
If scanners run in different modes (unprivileged, privileged, hardware), then technology diversity is achieved, but compatibility and memory sharing become problematic
Solution Approach 1:
The patent creates separate memory spaces for each scanning engine, with unprivileged scanners getting virtual memory allocation and privileged/hardware scanners accessing their respective memory regions. This segmentation allows different mode scanners to coexist without memory conflicts while maintaining their operational characteristics
Solution Approach 2:
The patent implements packet copying mechanisms where packet data is replicated and placed in appropriate memory spaces accessible by different scanner types. Each scanner receives copies of packets in its accessible memory region, eliminating compatibility issues while allowing all scanner types to operate simultaneously
3Use of energy by moving object
If packets are scanned in serialized manner, then resource consumption is reduced, but scanning time increases
Solution Approach 1:
The patent divides packet scanning into multiple parallel scanning operations across different scanning engines. Each engine processes packets independently in its own memory space, enabling simultaneous scanning without requiring excessive resource allocation to a single serial process
Solution Approach 2:
The patent transitions from single-threaded serial scanning to multi-threaded parallel scanning by allocating separate memory spaces and processing contexts for each scanner. This dimensional change from sequential to concurrent processing dramatically reduces scanning time while resource consumption is managed through the virtual memory allocation strategy
4Adaptability or versatility
If data copies are made for each scanner, then memory sharing compatibility is achieved, but processing efficiency decreases
Solution Approach 1:
The patent implements selective packet copying where data is copied only when necessary for compatibility between scanner types. The system determines which scanners need packet copies based on their memory access requirements, minimizing unnecessary copying operations while maintaining compatibility
Solution Approach 2:
The patent creates a universal packet data structure that can be accessed by different scanner types through appropriate memory mapping. This multi-functional data structure serves as a common interface for unprivileged, privileged, and hardware scanners, reducing the need for multiple copies while maintaining compatibility
Data Source
AI summary
A system and method for parallel scanning among multiple scanning entities. According to various embodiments of the present invention, buffers are allocated from a pool of memory pages, with one packet being located on each page. Each of the pages is mapped such that unprivileged scanners, privileged scanners, and hardware-based scanners are all capable of accessing the pages. By having the packets located on separate pages, additional data other than the packets at issue do not have to be shared, and copying is not necessary to complete the scanning process.