|Publication number||USRE42135 E1|
|Application number||US 11/429,636|
|Publication date||Feb 8, 2011|
|Filing date||May 4, 2006|
|Priority date||Jul 19, 2001|
|Also published as||US6732228|
|Publication number||11429636, 429636, US RE42135 E1, US RE42135E1, US-E1-RE42135, USRE42135 E1, USRE42135E1|
|Original Assignee||Richard Willardson|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (11), Non-Patent Citations (1), Classifications (14), Legal Events (3)|
|External Links: USPTO, USPTO Assignment, Espacenet|
1. Field of the Invention
The present invention relates to the field of networking. More specifically, the present invention relates to multi-protocol data classification using on-chip content addressable memory (CAM).
2. Background Information
The continued proliferation of digital communication devices, including personal computers, personal digital assistants (PDAs), and cellular- and PCS-based telephones, as well as the proliferation of associated data communications networks such as the Internet, have enabled as well as promoted the global exchange of electronic data. As technological advancements continue to be made in the field of data communications, the volume and complexity of data exchanged locally and globally via communications networks such as the Internet similarly continue to increase. For example, real time audio and video streaming over networks requires very large amounts of bandwidth as well as the utilization of complex encoding and decoding algorithms. Simple network applications such as on-line commerce and electronic mail, on the other hand, generally require only small amounts of bandwidth, but nonetheless encompass a large portion of network data transmissions.
As the volume and complexity of data transmitted throughout the various networks continues to grow, the likelihood of encountering mischievous attacks such as denial of service attacks from unfriendly sources becomes more likely. To thwart such attempts before they occur, devices known as firewalls are often utilized to effectively hide devices sharing a network with the firewall from potentially untrustworthy external sources. In order to differentiate between data communicated from the various trustworthy “internal” sources and the untrustworthy “external” sources, the firewall often inspects the source address of the data packet to determine the identity of the data packet source. The firewall then typically blocks passage of the data into the network from sources deemed untrustworthy, and passes data from sources deemed trustworthy. Although important, these data inspections unfortunately can be time consuming, especially in networks with operating frequencies at and above 10 Gigabit/second.
Furthermore, as the amount of data on the Internet continues to increase, new uses for that data are continually being introduced. For example, with the popularity of Internet based e-commerce, many companies are now requiring individuals to provide personal and/or demographic information before being allowed to complete the requested transaction. In hopes of recouping revenue, many more companies are beginning to collect and ultimately sell web-related statistical information such as user browsing habits, web sites visited, and so forth. In order for this data to prove useful, however, it needs to be classified prior to being analyzed. Given the enormous volumes of such data that is currently in existence classification has proven extremely slow and difficult to accomplish
The present invention will be described by way of exemplary embodiments, but not limitations, illustrated in the accompanying drawings in which like references denote similar elements, and in which:
In the following description, various aspects of the present invention will be described. However, it will be apparent to those skilled in the art that the present invention may be practiced with only some or all aspects of the present invention. For purposes of explanation, specific numbers, materials and configurations are set forth in order to provide a thorough understanding of the present invention. However, it will also be apparent to one skilled in the art that the present invention may be practiced without the specific details. In other instances, well-known features are omitted or simplified in order not to obscure the present invention. Further, the description repeatedly uses the phrase “in one embodiment”, which ordinarily does not refer to the same embodiment, although it may.
Referring now to
In accordance with the teachings of the present invention, membership Groups I, II, and III may represent any number of distinct categories or classes of data types that share common characteristics. For example, in the context of an Ethernet data packet, membership Group I may represent a group of data packets containing source addresses that share one or more common characteristics (e.g., geographic location), whereas membership Group II may represent a group of destination addresses sharing common characteristics, and membership Group III may represent a group of Virtual Local Area Network (VLAN) tags similarly sharing common characteristics.
In one embodiment of the present invention, each of the various membership groups of
In accordance with the teachings of the invention, data memberships such as those shown in
Group 215 is further subdivided into subclasses of data represented by regions 216-218, and group 220 is further subdivided into subclasses of data represented by regions 221-223. For example, region 218 might represent a first income range of $0 to $40,000, region 217 might represent a second income range of $40,001 to $100,000, and region 216 might represent a third income range of $100,001 and greater. Likewise, region 223 might represent a first occupation, region 222 might represent a second occupation, and region 221 might represent a third occupation. In one embodiment of the invention, each subclass of data (i.e., represented by the respective regions 216-218 and 220-223 of groups 215 and 220 of
In one embodiment of the invention, the various data class and subclass relationships depicted in
In frame 300, the preamble and start delimiter fields are used for synchronization between sending and receiving devices. Destination MAC address field 304 identifies the device or devices that are to receive the frame, and source MAC address field 306 identifies the device that originated the frame. Although both destination MAC address field 304 and source MAC address field 306 are each shown as being 6-bytes in length, other variations may also be utilized. For example the Institute of Electrical and Electronic Engineers (IEEE) 802.3 standard provides for source and destination addresses that are 2-bytes in length: If the value of length/type field 310 is less than or equal to 1500, then length/type field 310 indicates the number of bytes in subsequent data field 312. If the value of length/type field 310 is greater than or equal to 1536 bytes, then length/type field 310 indicates the nature of the MAC client protocol. Data field 312 contains the data transferred from the source device to the destination device or devices. In one embodiment, the size of data field 312 varies between 64 and 1500 bytes. If the size of the data is less than 64 bytes, pad field 314 is utilized to provide extra data to bring the frame length up to its minimum size. Frame 300 and its constituent fields are well known in the art and will not be further described except in relation to the present invention.
Referring now to
In one embodiment of the invention, classifier 102 utilizes multiple CAMs configured in a parallel arrangement to facilitate simultaneous classification of numerous data keys. In one embodiment of the invention, eight CAMs are cooperatively utilized in association with eight extracted data keys. In order to facilitate concurrent extraction of multiple data keys, extraction logic 103 utilizes a number of pointers and registers to track and store packet-related information such as multiple offset values, start of packet (SOP) and end of packet (EOP) indicators, and VLAN tag information for use in association with one or more data packets or frames. In one embodiment of the invention, extraction logic 103 includes a programmable byte offset for determining which packet data to extract. In one embodiment, the programmable byte offset provides for offsets from the SOP indicator ranging from 0 to 16 bytes. In one embodiment, 64-contiguous bits are extracted from the indicated offset point, however any number of bits may be extracted depending upon the implementation and hardware configuration of classifier 102.
In one embodiment of the invention, four words of data from the incoming data stream are gathered in a gathering register prior to the extraction of the one or more data keys. In one embodiment, a state machine is responsible for determining where the next incoming word is to be written in the gathering register.
As has been previously mentioned, extraction logic 103 is equipped to extract one or more data keys from a data stream based upon a dynamically programmable offset, and compare such data keys with key entries stored within one or more CAMs. In one embodiment, each key entry stored within the one or more CAMs is associated with a corresponding key tag such that when any of the extracted data keys is determined to be equivalent to a key entry in a CAM, the associated key tag corresponding to the key entry is output. If the data key is not equivalent to any key entry in any CAM, a value indicating such (e.g., binary “0”) is output. In one embodiment, the key-tags that are output as a result of the comparison are concatenated together to form a categorization vector.
In accordance with one embodiment of the invention, nybble masks 310 and 320 may be independently programmed to store data to “mask off” at least part of the corresponding data key for comparison against key entries 1-5 stored within CAMs 314 and 324. In one embodiment of the invention, MUXs 304 and 306 may be configured to select or bypass nybble masks 310 and 320 respectively, as deemed appropriate. For example, by selecting signal line 312, MUX 304 may bypass nybble mask 310, and by selecting signal line 322, MUX 306 may bypass nybble mask 320. In an alternative embodiment, MUXs 304 and 306 may operate in association with an n-bit configuration register coupled to the SEL lines of the respective MUXs to function as extraction logic 103. In one embodiment, this can be accomplished by coupling signal line 302 to the above-mentioned gathering register and enabling only select subsets (or the entire set) of bits from the gathering register to pass through MUXs 304 and 306.
If, when compared to the key entries stored within the CAMs, it is determined that go any of the extracted data keys matches a key entry, the corresponding key tag (315, 325) associated with the matched key entry is output to form at least part of categorization vectors 316 and 326.
By programming CAMs 314 and 324 (i.e. through a simple software interface), it is possible to define packet filtering rules that will influence which data packets are passed from one network segment to another, which packets are diverted to a host processor or other device for further processing, which packets are dropped from the network based upon group membership principles, and so forth. For example, a network administrator might configure a switching device to allow data originating from a first set of devices from within the organization (i.e. members of a first group) to pass, while blocking other data that originates from one or more devices external to the organization (i.e., members of a second group). In a more complex situation, an administrator may wish to configure the switching device to only pass data transmitted to a particular destination address unless the data originates from a specific source address and is from a particular geographic location. In accordance with the teachings of the present invention, one or more data keys are programmably extracted from each received data packet and compared to one or more key entries in one or more CAMs to create a categorization vector. By performing automatic and programmable combinational logic-based comparisons on the categorization vector, a determination may be made as to the final disposition of each data packet based at least in part upon the previously programmed packet filtering rules.
In one embodiment of the invention, filters 1 to N are priority encoded such that one filter is given precedence over all other filters in determining the action to be taken with respect to the data packet. In one embodiment, the highest numbered filter is given the highest priority, and the default filter is given the lowest priority. In one embodiment, categorization vector 110 is passed in parallel to all the priority encoded filters (including the default filter), which perform one or more combinational logic based operations on categorization vector 110 to determine the disposition of the data packet. In one embodiment of the invention, function logic 605, further includes independently programmable value logic 607 and independently programmable mask logic 609 to store programmable value data and logic to store programmable mask data respectively. The value data and the mask data are used together to compare expected values (as determined e.g. by a system administrator) against the values represented by categorization vector 110. Each packet filter in which the categorization vector satisfies the specified criteria is then enabled. In one embodiment, the enabled packet filter having the highest relative priority is selected to dispose of the data packet. If the categorization vector does not satisfy the criteria set forth in any of the packet filters, then the default filter unconditionally disposes of the data packet by performing the action programmed within action logic 620. Optionally, any one or more of the priority encoded filters may be disabled such that the disabled filter takes no action with respect to the data packet. In one embodiment, function logic 605 and polarity logic 610 may be dynamically reconfigured while the respective filter is disabled.
Additional information pertaining to programmable packet filtering in association with the above-mentioned filter logic is described in co-pending U.S. patent application, Ser. No. 09/910,116, entitled PROGRAMMABLE PACKET FILTERING IN A PRIORITIZED CHAIN filed contemporaneously with the present application and hereby fully incorporated by reference.
Thus, it can be seen from the above descriptions, a novel method and apparatus for data classification has been described. While the present invention has been described in terms of the above-described embodiments, those skilled in the art will recognize that the invention is not limited to the embodiments described. The present invention can be practiced with modification and alteration within the spirit and scope of the appended claims. Thus, the description is to be regarded as illustrative instead of restrictive on the present invention.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US5805855 *||Oct 5, 1994||Sep 8, 1998||International Business Machines Corporation||Data cache array having multiple content addressable fields per cache line|
|US5842040 *||Jun 18, 1996||Nov 24, 1998||Storage Technology Corporation||Policy caching method and apparatus for use in a communication device based on contents of one data unit in a subset of related data units|
|US6181699 *||Jul 1, 1998||Jan 30, 2001||National Semiconductor Corporation||Apparatus and method of assigning VLAN tags|
|US6289414 *||Oct 8, 1998||Sep 11, 2001||Music Semiconductors, Inc.||Partially ordered cams used in ternary hierarchical address searching/sorting|
|US6374326 *||Oct 25, 1999||Apr 16, 2002||Cisco Technology, Inc.||Multiple bank CAM architecture and method for performing concurrent lookup operations|
|US6467019 *||Nov 8, 1999||Oct 15, 2002||Juniper Networks, Inc.||Method for memory management in ternary content addressable memories (CAMs)|
|US6484170 *||Nov 30, 2000||Nov 19, 2002||Mosaid Technologies, Inc.||Generating searchable data entries and applications therefore|
|US6633567 *||Aug 31, 2000||Oct 14, 2003||Mosaid Technologies, Inc.||Method and apparatus for searching a filtering database with one search operation|
|US7133409 *||Jul 19, 2001||Nov 7, 2006||Richard Willardson||Programmable packet filtering in a prioritized chain|
|US20020126672||Jan 10, 2001||Sep 12, 2002||Nelson Chow||Method and apparatus for a flexible and reconfigurable packet classifier using content addressable memory|
|US20020163909||May 4, 2001||Nov 7, 2002||Terago Communications, Inc.||Method and apparatus for providing multi-protocol, multi-stage, real-time frame classification|
|1||Office Action, issued in U.S. Patent Application No. 09/910,119, mailed Mar. 17,2003.|
|U.S. Classification||711/108, 370/392, 370/389, 707/999.006, 707/E17.035, 365/49.1|
|International Classification||G06F7/02, G11C15/00, G06F17/30|
|Cooperative Classification||Y10S707/99936, G11C15/00, G06F17/30982|
|European Classification||G11C15/00, G06F17/30Z2P3|
|May 4, 2006||AS||Assignment|
Owner name: NETWORK ELEMENTS, INC., OREGON
Effective date: 20010719
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:WILLARDSON, RICHARD;REEL/FRAME:017843/0291
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:NETWORK ELEMENTS, INC.;REEL/FRAME:017889/0312
Owner name: TRIQUINT SEMICONDUCTOR, INC., OREGON
Effective date: 20041217
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:TRIQUINT SEMICONDUCTOR, INC.;REEL/FRAME:017878/0460
Owner name: NULL NETWORKS LLC, NEVADA
Effective date: 20050908
|May 31, 2011||CC||Certificate of correction|
|Sep 23, 2011||FPAY||Fee payment|
Year of fee payment: 8