Protocol-independent multi-table packet routing using shared memory resource

1. A system for routing of an incoming packet within a network, comprising:

one or more memories storing one or more shared hash tables comprising value entries corresponding to lookup key signatures for routing the incoming packet, wherein the value entries are updated with newly generated lookup key signatures based on new protocols;

one or more processors in communication with the one or more memories, the one or more processors configured to generate a first secure signature, wherein to generate the first secure signature comprises:

detecting one or more protocol headers of the incoming packet;

applying an N-tuple definition to the detected one or more protocol headers of the incoming packet,

wherein the N-tuple definition is configurable and protocol-independent to allow selection of any number of sets of bytes in any arrangement of the detected one or more protocol headers of the incoming packet; and

selecting one or more sets of bytes of the incoming packet corresponding to the detected one or more protocol headers to construct a header vector.

2. The system of claim 1 , wherein:

the header vector is a header N-tuple vector;

to generate the first secure signature further comprises forming a hash vector by appending a unique flow table identifier programmed for a first hash table of the one or more shared hash tables to the header vector; and

hashing the header vector with a secret hash key.

3. The system of claim 2 , wherein the one or more memories further store at least one N-tuple definition in association with a first flow table, the N-tuple definition corresponding to the detected one or more protocol headers.

4. The system of claim 3 , wherein the N-tuple definition is a mask of a first number of bytes of a packet header.

5. The system of claim 2 , wherein forming the hash vector further comprises pre-appending metadata to the header N-tuple vector.

6. The system of claim 2 , wherein the one or more processors are further configured to pad the hash vector to a predetermined length.

7. The system of claim 2 , wherein hashing the hash vector comprises using a keyed secure crypto hash.

8. A method, comprising:

generating a plurality of packet flow tables;

detecting one or more protocol headers of an incoming packet;

selecting one or more sets of bytes of the incoming packet corresponding to the detected one or more protocol headers to construct a header vector;

appending, to the header vector, metadata from the incoming packet and an identifier associated with one or more of the plurality of packet flow tables;

generating, a first secure lookup key signature, by hashing the header vector, the appended metadata and the appended identifier together with a secret hash key; and

utilizing, by the one or more of the plurality of packet flow tables, the first secure lookup key signature to access at least one of the one or more shared hash tables to route the incoming packet.

9. The method of claim 8 , wherein:

the header vector is a header N-tuple vector;

generating the first secure lookup key signature further comprises forming a hash vector by appending a unique flow table identifier programmed for a first flow table to the header N-tuple vector; and

hashing the header vector with the secret hash key comprises hashing the hash vector.

10. The method of claim 9 , wherein selecting one or more sets of bytes of the packet comprises programming an N-tuple definition in the first flow table for the one or more protocol headers detected in a packet.

11. The method of claim 10 , wherein the N-tuple definition is a mask of a first number of bytes of a packet header.

12. The method of claim 9 , wherein forming the hash vector further comprises pre-appending metadata to the header N-tuple vector.

13. The method of claim 9 , further comprising zero padding the hash vector.

14. The method of claim 9 , wherein hashing the hash vector comprises using a keyed secure crypto hash.

15. A chip, comprising:

one or more ingress ports for receiving data packets; and

a memory storing a hash table, the hash table being accessible by a plurality of different flow tables;

wherein the chip is adapted to:

detect one or more protocol headers of an incoming packet;

apply an N-tuple definition to the detected one or more protocol headers of the incoming packet,

wherein the N-tuple definition is configurable and protocol-independent to allow selection of any number of sets of bytes in any arrangement of the detected one or more protocol headers of the incoming packet; and

select one or more sets of bytes of the incoming packet corresponding to the detected one or more protocol headers to construct a header vector.

16. The chip of claim 15 , wherein:

the header vector is a header N-tuple vector;

generating the first secure signature further comprises forming a hash vector by appending a unique flow table identifier programmed for a first flow table to the header N-tuple vector; and

hashing the header vector with a secret hash key.

17. The chip of claim 16 , wherein the one or more memories further store at least one N-tuple definition in association with the first flow table, the at least one N-tuple definition corresponding to the detected one or more protocol headers.

18. The chip of claim 17 , wherein the N-tuple definition is a mask of a first number of bytes of a packet header.

19. The chip of claim 16 , wherein forming the hash vector further comprises pre-appending metadata to the N-tuple vector.

20. The chip of claim 16 , wherein the chip is further adapted to pad the hash vector to a predetermined length.