IP Library › Granted Patent US 10,554,513

Granted Patent B2

US 10,554,513 · App. 16/024,772 · Granted Feb 4, 2020

Technologies for filtering network packets on ingress

Inventors: Patrick Kutch (Beaverton, OR); Andrey Chilikin (Limerick, IE); Mark Gray (Santa Clara, CA); Sugesh Chandran (Santa Clara, CA)

Assignee: Intel Corporation

H04L43/028 H04L47/2441 H04L49/70 H04L69/22

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 10,554,513
App. No.: 16/024,772
Granted: Feb 4, 2020
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Technologies for filtering network packets on ingress include a network interface controller (NIC) to retrieve classification filters based on packet classification identifying information of a network packet received by the NIC, wherein each of the classification filters is usable to identify rules for identifying any operations to be performed on at least a portion of the received network packet. The NIC is further configured to compare the first classification filter to the packet classification identifying information to determine whether the determined packet classification identifying information meets criteria of the first classification filter. Additionally, the NIC is configured to associate a classification filter identifier of the first classification filter with the received network packet and send the received network packet and the classification filter identifier of the first classification filter to a processor of an apparatus associated with the NIC. Other embodiments are described herein.

Claims (50)

1. A network interface controller (NIC) for filtering network packets on ingress, the NIC comprising:

classification filter comparator circuitry to:

determine packet classification identifying information of a network packet received by the NIC,

retrieve a plurality of classification filters, wherein each of the plurality of classification filters includes one or more criterion, and wherein each of the plurality of classification filters is associated with a classification filter identifier usable to identify rules for the determination of one or more operations that are to be performed on at least a portion of the received network packet, and

compare the one or more criterion of a first classification filter to the determined packet classification identifying information to determine whether the determined packet classification identifying information meets the one or more criterion of the first classification filter; and

classification filter identifier insertion circuitry to associate, in response to a determination that the comparison indicated that the determined packet classification identifying information meets the one or more criterion of the first classification filter, a classification filter identifier of the first classification filter with the received network packet.

2. The NIC of claim 1 , wherein the NIC further includes host interface management circuitry to send the received network packet and the classification filter identifier of the first classification filter to a processor of an apparatus associated with the NIC.

3. The NIC of claim 1 , wherein to associate the classification filter identifier of the first classification filter with the received network packet comprises to insert the classification filter identifier of the first classification filter into a descriptor associated with the received network packet.

4. The NIC of claim 1 , wherein to associate the classification filter identifier of the first classification filter with the received network packet comprises to insert the classification filter identifier at an offset in a payload of the received network packet, and wherein the classification filter is usable by an interpreting component to identify the rules and bypass inspection of the received network packet.

5. The NIC of claim 1 , wherein to determine the packet classification identifying information comprises to determine the packet classification identifying information based on at least a portion of the data of the received network packet.

6. The NIC of claim 1 , wherein to determine the packet classification identifying information comprises to determine the packet classification identifying information based on at least one characteristic of the received network packet.

7. The NIC of claim 6 , wherein the at least one characteristic of the received network packet includes an encrypted state of the received network packet, a protocol associated with the received network packet, a source of the received network packet, and a destination of the received network packet.

8. The NIC of claim 1 , wherein the classification filter comparator circuitry is further to compare one or more criterion of a second classification filter to the determined packet classification identifying information to determine whether the determined packet classification identifying information meets the one or more criterion of the second classification filter, and

wherein the classification filter identifier insertion circuitry is further to associate, in response to a determination that the comparison indicated that the determined packet classification identifying information meets the one or more criterion of the second classification filter, a classification filter identifier of the second classification filter with the received network packet.

9. The NIC of claim 1 , wherein the classification filter comparator circuitry is further to:

compare one or more criterion of a second classification filter to the determined packet classification identifying information to determine whether the determined packet classification identifying information meets the one or more criterion of the second classification filter, and

determine, in response to a determination that the comparison indicated that the determined packet classification identifying information meets the one or more criterion of the second classification filter, a priority level of the first classification filter and a priority level of the second classification filter; and

wherein the classification filter identifier insertion circuitry is further to associate, in response to a determination that the priority level of the second classification filter is higher than the priority level of the first classification filter, a classification filter identifier of the second classification filter with the received network packet, and wherein to associate the classification filter identifier of the second classification filter with the received network packet comprises to replace the classification filter identifier of the first classification filter with the classification filter identifier of the second classification filter.

10. The NIC of claim 1 , wherein to associate the classification filter identifier of the first classification filter with the received network packet comprises to insert the classification filter identifier into a field in a header of the received network packet.

11. One or more non-transitory, machine-readable storage media comprising a plurality of instructions stored thereon that, in response to being executed, cause a network interface controller (NIC) to:

determine packet classification identifying information of a network packet received by the NIC;

associate, in response to a determination that the comparison indicated that the determined packet classification identifying information meets the one or more criterion of the first classification filter, a classification filter identifier of the first classification filter with the received network packet.

12. The one or more non-transitory, machine-readable storage media of claim 11 , wherein the plurality of instructions further cause the NIC to send the received network packet and the classification filter identifier of the first classification filter to a processor of an apparatus associated with the NIC.

13. The one or more non-transitory, machine-readable storage media of claim 11 , wherein to associate the classification filter identifier of the first classification filter with the received network packet comprises to insert the classification filter identifier of the first classification filter into a descriptor associated with the received network packet.

14. The one or more non-transitory, machine-readable storage media of claim 11 , wherein to associate the classification filter identifier of the first classification filter with the received network packet comprises to insert the classification filter identifier into at least one of a field in a header of the received network packet and at an offset in a payload of the received network packet, and wherein the classification filter is usable by an interpreting component to identify the rules and bypass inspection of the received network packet.

15. The one or more non-transitory, machine-readable storage media of claim 11 , wherein to determine the packet classification identifying information comprises to determine the packet classification identifying information based on at least a portion of the data of the received network packet.

16. The one or more non-transitory, machine-readable storage media of claim 11 , wherein to determine the packet classification identifying information comprises to determine the packet classification identifying information based on at least one characteristic of the received network packet.

17. The one or more non-transitory, machine-readable storage media of claim 16 , wherein the at least one characteristic of the received network packet includes an encrypted state of the received network packet, a protocol associated with the received network packet, a source of the received network packet, and a destination of the received network packet.

18. The one or more non-transitory, machine-readable storage media of claim 11 , wherein the plurality of instructions further cause the NIC to:

associate, in response to a determination that the comparison indicated that the determined packet classification identifying information meets the one or more criterion of the second classification filter, a classification filter identifier of the second classification filter with the received network packet.

19. The one or more non-transitory, machine-readable storage media of claim 11 , wherein the plurality of instructions further cause the NIC to:

associate, in response to a determination that the priority level of the second classification filter is higher than the priority level of the first classification filter, a classification filter identifier of the second classification filter with the received network packet, wherein to associate the classification filter identifier of the second classification filter with the received network packet comprises to replace the classification filter identifier of the first classification filter with the classification filter identifier of the second classification filter.

20. The one or more non-transitory, machine-readable storage media of claim 11 , wherein to associate the classification filter identifier of the first classification filter with the received network packet comprises to insert the classification filter identifier into at least one of a field in a header of the received network packet and at an offset in a payload of the received network packet, and wherein the classification filter is usable by an interpreting component to identify the rules and bypass inspection of the received network packet.

21. A network interface controller (NIC) for filtering network packets on ingress, the compute device comprising:

means for determining packet classification identifying information of a network packet received by the NIC;

means for retrieving a plurality of classification filters, wherein each of the plurality of classification filters includes one or more criterion, and wherein each of the plurality of classification filters is associated with a classification filter identifier usable to identify rules for the determination of one or more operations that are to be performed on at least a portion of the received network packet;

means for comparing the one or more criterion of a first classification filter to the determined packet classification identifying information to determine whether the determined packet classification identifying information meets the one or more criterion of the first classification filter; and

means for associating, in response to a determination that the comparison indicated that the determined packet classification identifying information meets the one or more criterion of the first classification filter, a classification filter identifier of the first classification filter with the received network packet.

22. The NIC of claim 21 , further comprising circuitry for sending the received network packet and the classification filter identifier of the first classification filter to a processor of an apparatus associated with the NIC.

23. The NIC of claim 21 , wherein the means for associating the classification filter identifier of the first classification filter with the received network packet comprise means for inserting the classification filter identifier of the first classification filter into a descriptor associated with the received network packet.

24. The NIC of claim 21 , further comprising:

means for comparing one or more criterion of a second classification filter to the determined packet classification identifying information to determine whether the determined packet classification identifying information meets the one or more criterion of the second classification filter;

means for determining, in response to a determination that the comparison indicated that the determined packet classification identifying information meets the one or more criterion of the second classification filter, a priority level of the first classification filter and a priority level of the second classification filter; and

means for associating, in response to a determination that the priority level of the second classification filter is higher than the priority level of the first classification filter, a classification filter identifier of the second classification filter with the received network packet, wherein to associate the classification filter identifier of the second classification filter with the received network packet comprises to replace the classification filter identifier of the first classification filter with the classification filter identifier of the second classification filter.

25. The NIC of claim 21 , wherein the means for associating the classification filter identifier of the first classification filter with the received network packet comprise means for inserting the classification filter identifier into at least one of a field in a header of the received network packet and at an offset in a payload of the received network packet, and wherein the classification filter is usable by an interpreting component to identify the rules and bypass inspection of the received network packet.

Assignments (1)

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 12, 2018

From: KUTCH, PATRICK; CHILIKIN, ANDREY; GRAY, MARK; CHANDRAN, SUGESH

To: INTEL CORPORATION

Reel/Frame 046330/0406 →

Continuity (1)

Related Publication 20190044835A1 · Feb 7, 2019