Non-blocking shared state in an intrusion-prevention system
View Patent ↗A system includes a plurality of deep packet inspection engines for performing deep packet inspection on packets in a network. The deep packet inspection engines share at least some state. One of the deep packet inspection engines is assigned responsibility for writing data to the shared state. For one of the deep packet inspection engines to write data to the shared state, the deep packet inspection write provides a write request to the assigned “writer” deep packet inspection engine, which queues the request on a write queue. The writer deep packet inspection engine may queue multiple write requests from multiple deep packet inspection engines. The writer deep packet inspection engine dequeues the write requests and processes them serially, thereby avoiding the need to manage contention using locks.
1. A method for use with a system including a plurality of deep packet inspection engines and state shared by the plurality of deep packet inspection engines, wherein one of the plurality of deep packet inspection engines is a writer deep packet inspection engine, the method comprising:
(A) receiving, at the writer deep packet inspection engine, a first write request from a first one of the plurality of deep packet inspection engines, wherein the plurality of deep packet inspection engines comprise microprocessors and are to perform deep packet inspection on packets in a network traffic for malicious packets;
(B) queueing, at the writer deep packet inspection engine, the first write request on a write queue;
(C) dequeuing, at the writer deep packet inspection engine, the first write request from the write queue when the first write request reaches an end of the write queue, wherein the dequeued first write request comprises first data; and
(D) issuing, by the writer deep packet inspection engine, the dequeued first write request to an interface of the shared state, wherein the interface of the shared state is to write the first data of the dequeued first write request to a first unit of the shared state.
2. The method of claim 1 , further comprising:
(E) receiving, at the writer deep packet inspection engine, a second write request from a second one of the plurality of deep packet inspection engines;
(F) queueing, at the writer deep packet inspection engine, the second write request on the write queue; and
(G) dequeuing, at the writer deep packet inspection engine, the second write request from the write queue when the second write request reaches the end of the write queue; and
(H) issuing, by the writer deep packet inspection engine, the dequeued second write request to the interface of the shared state, wherein the interface of the shared state is to write second data of the dequeued second write request to a second unit of the shared state.
3. The method of claim 2 , wherein (E) and (F) are performed before (C).
4. The method of claim 1 , further comprising:
initializing a second unit of the shared state;
writing the first data to the second unit of the shared state; and said method further comprising:
replacing the first unit of the shared state with the second unit of the shared state.
5. The method of claim 4 , further comprising:
receiving a read request from one of the plurality of deep packet inspection engines to read data from the first unit of the shared state; and
satisfying the read request by reading data from the first unit of the shared state.
6. The method of claim 1 , further comprising:
receiving, at the writer deep packet inspection engine, packets contained in the network traffic; and
performing, at the writer deep packet inspection engine, deep packet inspection on the packets to identify potential threats to the network.
7. The method of claim 1 , wherein the state shared by the plurality of deep packet inspection engines comprises data to be used to track potential port scanning attacks.
8. The method of claim 1 , wherein issuing the deuqueued first write request to the interface of the shared state further comprises issuing, by the writer deep packet inspection engine, the dequeued first write request to the interface of the shared state without using a write lock on the shared state.
9. An intrusion prevention system comprising:
a plurality of deep packet inspection engines, wherein one of the plurality of a deep packet inspection engines is a writer deep packet inspection engine;
state, stored in a non-transitory computer-readable medium, shared by the plurality of deep packet inspection engines; and
wherein the writer deep packet inspection engine is to:
receive a first write request from a first one of the plurality of deep packet inspection engines, wherein the plurality of deep packet inspection engines comprise microprocessors and are to perform deep packet inspection of packets in a network traffic for malicious packets;
queue the first write request on a write queue;
dequeue the first write request from the write queue when the first write request reaches an end of the write queue, wherein the dequeued first write request comprises first data; and
issue the dequeued first write request to an interface of the shared state, wherein the interface of the shared state is to write the first data of the dequeued first write request to a first unit of the shared state.
10. The intrusion prevention system of claim 9 , wherein the state, stored in the non-transitory computer-readable medium, shared by the plurality of deep packet inspection engines comprises data to be used to track potential port scanning attacks.
11. The intrusion prevention system of claim 9 , wherein the plurality of deep packet inspection engines are to receive the packets in the network traffic and to perform deep packet inspection on the packets to identify potential threats to the network.
12. The intrusion prevention system of claim 9 , wherein
the writer deep packet inspection is to issue the dequeued first write request to an interface of the shared state without using a write lock.
13. A non-transitory computer readable storage medium on which is embedded a computer program, said computer program implementing a method for operating a writer deep packet inspection engine, said computer program comprising a set of instructions to:
receive a first write request from a first one of a plurality of deep packet inspection engines, wherein the plurality of deep packet inspection engines are to perform deep packet inspection on packets in a network traffic for malicious packets and wherein the writer deep packet inspection engine is one of the plurality of deep packet inspection engines;
queue the first write request on a write queue;
dequeue the first write request from the write queue when the first write request reaches an end of the write queue, wherein the dequeued first write request comprises first data; and
issue the dequeued first write request to an interface of the shared state, wherein the interface of the shared state is to write the first data of the dequeued first write request to a first unit of a state that is shared by the plurality of deep packet inspection engines.
14. The non-transitory computer readable storage medium of claim 13 , said computer program further comprising a set of instructions to:
receive a second write request from a second one of the plurality of deep packet inspection engines;
queue the second write request on the write queue;
dequeue the second write request from the write queue when the second write request reaches the end of the write queue; and
issue the dequeued second write request to the interface of the shared state, wherein the interface of the shared state is to write second data of the dequeued second write request to a second unit of the shared state.
15. The non-transitory computer readable storage medium of claim 13 , said computer program further comprising a set of instructions to:
initialize a second unit of the shared state;
write the first data to the second unit of the shared state; and
replace the first unit of the shared state with the second unit of the shared state.
16. The non-transitory computer readable storage medium of claim 15 , said computer program further comprising a set of instructions to:
receive, following writing of the first data to the second unit of the shared state, a read request from one of the plurality of deep packet inspection engines to read data from the first unit of the shared state; and
satisfy the read request by reading data from the first unit of the shared state.
17. The non-transitory computer readable storage medium of claim 13 , wherein the state shared by the plurality of deep packet inspection engines comprises data to be used to track potential port scanning attacks.
18. The non-transitory computer readable storage medium of claim 13 , said computer program further comprising a set of instructions to:
receive packets contained in a network traffic; and
perform deep packet inspection on the packets to identify potential threats to the network.
19. The non-transitory computer readable storage medium of claim 13 , said computer program further comprising a set of instructions to:
issue the dequeued first write request to the interface of the shared state without using a write lock on the shared state.