100GBPS security and search architecture using programmable intelligent search memory
View Patent ↗Disclosed is a network computer system which may comprise a hardware processor which may comprise a programmable intelligent search memory for content search. The programmable intelligent search memory may perform regular expression based search. The programmable intelligent search memory may use at least one regular expression. The regular expression may be converted into at least one non-deterministic finite state automata (NFA) representing the functionality of the regular expression.
1. A network computer system comprising servers, storage area network and storage, said network computer system further comprising a hardware processor comprising:
a) a programmable intelligent search memory for content search wherein said programmable intelligent search memory performs regular expression based search, said programmable intelligent search memory for content search using at least one regular expression, wherein said regular expression is converted into at least one non-deterministic finite state automata (NFA) representing the functionality of the regular expression, said programmable intelligent search memory comprising a memory circuit for processing the NFA, said memory circuit comprising:
i. a symbol memory circuit to store symbols or characters;
ii. a symbol evaluation circuit coupled to the symbol memory circuit to evaluate match of the symbols or characters with input symbols or characters in said content;
iii. a state dependent vector (SDV) memory circuit to store state transition controls for said non-deterministic finite state automata;
iv. a current state vector (CSV) memory circuit to store a plurality of states; and
v. a state transition circuit coupled to said symbol evaluation circuit, a current state vector memory circuit and said state dependent vector memory circuit to perform state transition from one or more first states to one or more second states of said plurality of states of said non-deterministic finite state automata;
b) a controller comprising:
i. a mechanism to convert said regular expressions in NFA;
ii. a mechanism to program said NFA into said programmable intelligent search memory;
iii. a mechanism to receive said content to be searched; and
iv. a mechanism to present said content to the said programmable search memory for search.
2. The network computer system of claim 1 , wherein the hardware processor further comprises a context memory to store plurality of NFAs that are not used for the said content being searched.
3. The network computer system of claim 1 , wherein the hardware processor further comprises a mechanism to determine the context of the said content being searched, to program context dependent NFA in the programmable intelligent search memory.
4. The network computer system of claim 1 , wherein the hardware processor further comprises a priority encoder to determine a matching NFA result when a plurality of NFAs indicate a match within the content being searched.
5. The network computer system of claim 1 , wherein the hardware processor further comprises an expansion mechanism to expand the size of the programmable intelligent search memory.
6. A network computer system comprising servers, storage area network and storage, said network computer system further comprising an integrated circuit chip processor comprising:
a) a programmable intelligent search memory for content search wherein said programmable intelligent search memory performs regular expression based search, said programmable intelligent search memory for content search using at least one regular expressions, wherein said regular expression is converted into at least one non-deterministic finite state automaton (NFA) representing the functionality of the regular expression, said programmable intelligent search memory comprising a memory circuit for processing the NFA, said memory circuit comprising:
i. a symbol memory circuit to store symbols or characters;
ii. a symbol evaluation circuit coupled to the symbol memory circuit to evaluate match of the symbols or characters with input symbols or characters in said content;
iii. a state dependent vector (SDV) memory circuit to store state transition controls for said non-deterministic finite state automata;
iv. a current state vector (CSV) memory circuit to store a plurality of states; and
v. a state transition circuit coupled to said symbol evaluation circuit, a current state vector memory circuit and said state dependent vector memory circuit to perform state transition from one or more first states to one or more second states of said plurality of states of said non-deterministic finite state automata; and
b) a controller comprising:
i. a mechanism to convert said regular expressions into NFA;
ii. a mechanism to program said NFA into said programmable intelligent search memory;
iii. a mechanism to receive said content to be searched; and
iv. a mechanism to present said content to the said programmable search memory for search.
7. The network computer system of claim 6 , wherein the integrated circuit chip further comprises a context memory to store plurality of NFAs that are not used for the said content being searched.
8. The network computer system of claim 6 , wherein the integrated circuit chip further comprises a mechanism to determine the context of the said content being searched, to program context dependent NFA in the programmable intelligent search memory.
9. The network computer system of claim 6 , wherein the integrated circuit chip further comprises a priority encoder to determine a matching NFA result when a plurality of NFAs indicate a match within the content being searched.
10. The network computer system of claim 6 , wherein the integrated circuit chip further comprises an expansion mechanism to expand the size of the programmable intelligent search memory.