US20110153657A1 - Fsa extension architecture for programmable intelligent search memory - Google Patents

Fsa extension architecture for programmable intelligent search memory Download PDF

Info

Publication number
US20110153657A1
US20110153657A1 US13/006,265 US201113006265A US2011153657A1 US 20110153657 A1 US20110153657 A1 US 20110153657A1 US 201113006265 A US201113006265 A US 201113006265A US 2011153657 A1 US2011153657 A1 US 2011153657A1
Authority
US
United States
Prior art keywords
state
memory
fsa
prism
search
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US13/006,265
Inventor
Ashish A. Pandya
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to US13/006,265 priority Critical patent/US20110153657A1/en
Publication of US20110153657A1 publication Critical patent/US20110153657A1/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C15/00—Digital stores in which information comprising one or more characteristic parts is written into the store and in which information is read-out by searching for one or more of these characteristic parts, i.e. associative or content-addressed stores
    • G11C15/04—Digital stores in which information comprising one or more characteristic parts is written into the store and in which information is read-out by searching for one or more of these characteristic parts, i.e. associative or content-addressed stores using semiconductor elements
    • G11C15/043—Digital stores in which information comprising one or more characteristic parts is written into the store and in which information is read-out by searching for one or more of these characteristic parts, i.e. associative or content-addressed stores using semiconductor elements using capacitive charge storage elements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/903—Querying
    • G06F16/90335—Query processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/903—Querying
    • G06F16/90335—Query processing
    • G06F16/90339—Query processing by using parallel associative memories or content-addressable memories
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/903—Querying
    • G06F16/90335—Query processing
    • G06F16/90344—Query processing by using string matching techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/448—Execution paradigms, e.g. implementations of programming paradigms
    • G06F9/4498—Finite state machines
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C15/00—Digital stores in which information comprising one or more characteristic parts is written into the store and in which information is read-out by searching for one or more of these characteristic parts, i.e. associative or content-addressed stores
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C15/00—Digital stores in which information comprising one or more characteristic parts is written into the store and in which information is read-out by searching for one or more of these characteristic parts, i.e. associative or content-addressed stores
    • G11C15/04—Digital stores in which information comprising one or more characteristic parts is written into the store and in which information is read-out by searching for one or more of these characteristic parts, i.e. associative or content-addressed stores using semiconductor elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Definitions

  • U.S. patent application Ser. No. 11/952,110, filed Dec. 6, 2007 also claims priority to U.S. patent application Ser. No. 11/952,028 filed on Dec. 6, 2007 entitled “Embedded programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,043 filed on Dec. 6, 2007 entitled “100 Gbps security and search architecture using programmable intelligent search memory”; U.S. patent application Ser. No. 11/952,103 filed on Dec. 6, 2007 entitled “Signature search” architecture for programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,104 filed on Dec. 6, 2007 entitled “Interval symbol architecture for programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,108 on Dec.
  • the PRISM memory performs simultaneous search of regular expressions and other patterns (also referred to as “rules” or “regular expression rules” or “pattern search rules” or “patterns” or “regular expressions” in this patent) against the content being examined.
  • the content may be presented to the search memory by a companion processor or PRISM controller or content stream logic or a master processor or the like which may be on the same integrated circuit chip as the PRISM memory or may be on a separate device.
  • the content to be searched may be streaming content or network packets or data from a master processor or data from a disk or a file or reside in on-chip memory or off-chip memory or buffers or the like from which a controller may present it to the search memory arrays for examination.
  • FIG. 1 c illustrates DFA (prior art)
  • FIG. 2 a illustrates a left-biased NFA and state transition table (prior art)
  • FIG. 6A illustrates Right-biased Tagged FSA Rule block in PRISM
  • FIG. 8 a illustrates PRISM Memory Cluster Block Diagram
  • the PRISM memory may also be embodied on dedicated content search acceleration cards that may be used inside various systems described in this patent.
  • PRISM memory may also be embodied as a content search memory inside a variety of hardware and/or integrated circuits like ASSPs, ASICs, FPGA, microprocessors, multi-core processors, network processors, TCP Offload Engines, network packet classification engines, protocol processors, regular expression processors, content search processors, mainframe computers, grid computers, servers, workstations, personal computers, laptops, handheld devices, cellular phones, wired, or wireless networked devices, switches, routers, gateways, XML accelerators, VOIP servers, Speech recognition systems, bio informatics systems, genetic and proteomics search systems, web search servers, electronic vault application networks and systems, Data Warehousing systems, Storage area network systems, content indexing appliances like web indexing, email indexing and the like, chipsets and the like or any combination thereof
  • PRISM memory blocks may be embedded inside other memory technologies like DRAM,
  • Block 102 represents state 2 and 104 represents state 3 .
  • the transition from state 2 to state 3 is triggered on the symbol x, 103 and is represented as a directed edge between the two states.
  • Thompson's NFA comprises of ‘ ⁇ ’ transitions, 116 , which are transitions among states which may be taken without any input symbol.
  • each state may get marked as a start state or an accept state or tagged NFA state or a combination or neither start or accept or tagged state through the start, tag and accept flags.
  • the init logic block, 408 receives control signals that indicate if the state needs to be initialized from the start state or cleared or disabled from updates, or loaded directly with another state value, or may detect a counter value and decide to accept a transition or not and the like.
  • the init block also detects if the FSA has received a symbol not recognized by the language of the regular expression and then may take the FSA into a predefined initial state to start processing the stream at the next symbol and not get into a state where it stops recognizing the stream.
  • FIG. 5 a illustrates State transition logic (STL) for a state in a left-biased FSA.
  • STL State transition logic
  • This figure illustrates state transition logic for a state of an FSA when the logic illustrated above for FIG. 4 a is simplified with the LB/RB# set to active and symbol detection logic for one of the states illustrated.
  • the symbol bits are illustrated as ‘m-bit’ wide as S 1m . . . S 11 illustrated in block 502 .
  • the input character symbol bits are labeled as cIn m . . . cIn 1 , 501 .
  • the symbol detection logic illustrated in FIG. 4 a , 400 is illustrated as individual bits labeled E m . . .
  • the rule parser may read the rules from files of rules or directly from the command line or a combination depending on the output of the rule engines like blocks 901 , 902 and 903 .
  • the rules for a specific node are parsed to recognize the language specific tokens used to describe the rules or regular expression tokens and outputs regular expression (RE) rules, 905 .
  • the parser then presents the REs to the PRISM FSA compiler flow which processes the REs and generates NFA for RE.
  • the PRISM memory may preferably be a memory mapped or may optionally be an 10 mapped device in the master processor space for it to receive the content and other configuration information in a look-aside or accelerator configuration.
  • PRISM memory optionally may be polled by the master processor or may provide a doorbell or interrupt mechanism to the master to indicate when it is done with a given packet or content or when it finds a content match to the programmed rules.
  • the local context memory, block 812 , or global context memory, block 712 , or external memory (not illustrated) coupled to external memory controller, block 1221 , or a combination thereof may be used to save the state of active FSAs for a given context before the FSAs are switched to operate on a different context. Further, the new context may have its saved context restored in the specific FSAs before content from that context starts to be processed.
  • the local context memory along with global context memory affords the benefit of very fast context switching for active contexts simultaneously across multiple clusters and FSAs without creating a context switch bottleneck.
  • the number of contexts being store locally per cluster and those stored globally or externally is a function of the manufacturing cost and other tradeoffs which will be apparent to the one with ordinary skill in the art.
  • the block 802 may he operating during the configuration, context switching or other maintenance operations like storing and retrieving specific NFA or FSA state information, or refreshing specific PRISM FSA memory hits if appropriate and the like.
  • the block 802 may be dormant unless there is a match or an error or the like when it may start performing the necessary tasks like communicating the match, action, policy, error or the like to the PRISM controller, initiating context switching and the like.
  • the PRISM controller, block 703 coupled with the content stream logic, block 708 , content staging buffer, 709 , address decode and control logic, block 704 , and the cluster FSA controllers, block 802 , may present the content to be examined to the PRISM FSA rule blocks.
  • the NFA rule blocks perform their inspection and indicate whether there is any rule match or optionally if there is any CAM pattern match or optionally any tag match and the like.
  • the match signals are looked at by cluster level local priority encoder and evaluation processor, block 815 , which may determine if there is a match and if there are multiple matches which match should be used, or all matches should be used or the like depending on the configuration.
  • This block 815 may be coupled to global priority encoder and evaluation processor, block 713 , which may perform a similar operation by examining match signals from multiple clusters.
  • the local and global evaluation processors of these blocks may optionally generate address(es) for the winning matches) to the global action memory or external memory or a combination that may store appropriate action information that needs to be retrieved and processed to determine action(s) that need to be taken as a result of specific rule match(es).
  • Each PSE of a PRISM memory cluster may be addressed using one PRISM Memory location or a set of PRISM memory locations or a combination thereof. All internal memory elements of a PSE like the each state dependent symbol memory, mask vector memory, SDV memory, or the initialization vector memory and the like may each be mapped as individual memory locations in the PRISM memory address space or may each be addressable in a PSE address space once the PSE is selected from a PRISM memory address or the like as may be appreciated by one with ordinary skill in the art.
  • One preferred embodiment may comprise of 22 PRISM Memory address bits where in the upper 17 address bits are used to select a specific PSE in an embodiment with 128,000 PSEs and the lower 5 address bits are used to select a specific memory element of the selected PSE as described.
  • the 10-bit address for selecting a specific PSE of a PRISM memory cluster may further be allocated such that upper 7-bits of that may be used as a PSE row address selection and the remaining 3-bits of the address used as a PSE column address selection.
  • the GSDV may optionally be an N-bit Vector, where each bit of the vector may enable a transition into the corresponding state of the FSA from a state external to the FSA. It is possible to restrict the number of Global entry points into an FSA, in which case the GSDV may be a vector with fewer than. N-bits corresponding to the states that may be entered from other FSAs using the FSA extension mechanisms described in this patent. Similarly GCV and GTL may also be N-bit vectors or vectors with fewer bits. The decision to use N-bits or less bits for these vectors may depend on the RE characteristics, application requirements, device size, implementation costs and the like as will he apparent to those with ordinary skill in the art.
  • the RE 1 is programmed to include two terms ‘abc’ and ‘jkL’ of the RE 1 in the FSA in Row 1 .
  • the term ‘defghi’ is programmed using the column-wise FSA extension mechanisms described above and is distributed between FSAs in Row 1 and Row 2 .
  • the state ‘d’ is assigned to Row 1 and column B 3 , block 1514 .
  • the local vector of this state bit is set to ‘1’.
  • the output from B 3 Row 1 to 133 Row 2 , arrow 1508 is activated.
  • the UC vector bit 3 for the Row 2 state hit 3 is set to a ‘1’ which enables the transition into state ‘e’, Row 2 column B 3 , if the received symbol is ‘e’.
  • the downward transition, arrow 1508 will be taken and the FSA in Row 2 will be in state ‘e’.
  • the state ‘e’ is not activated.
  • the states of FSA in Row 2 are programmed such that they transition from ‘e’ to ‘f’ to ‘g’ to ‘h’ when a sequence of ‘efgh’ is received after a symbol ‘d’.
  • the FSA states are programmed to transition in the order ‘ijkLmnop’, if a string corresponding to that sequence is received after ‘abcdefgh’.
  • the state ‘p’, 1511 is reached, the RE 2 is matched and the match signal for this RE is asserted to the cluster local priority encoder and evaluation processor, block 815 , which takes appropriate actions that are programmed based on activation of RE 2 .
  • a regular expression When a regular expression is read by the block, 1005 , it is parsed, block 1006 , to understand various constructs of the regular expression.
  • the PRISM compiler flow may at this stage indicate an error if there are any issues with the regular expression like any syntax being invalid or the like.
  • the error flow is not illustrated in the figure but may optionally comprise of logging the regular expression with an error, informing the user or the application or the like of the error, ignore the error and move on to the next regular expression, or stop the processing altogether or the like or a combination of the foregoing. However, if no errors are discovered, the regular expressions syntax tree is constructed, block 1007 , and various symbols of the regular expression are extracted, block 1008 .
  • the compiler assigns the RE to multiple FSAs and couples them together using row-wise, column-wise, or rule group FSA extensions or a combination there of or may split the RE into multiple rules to fit the specific embodiment of PRISM, its characteristics and the like.
  • This RE in the PRISM compiled form may either be kept in memory or storage or the like and once all such REs are processed they may all be stored in a compiled rules database, block 1018 .
  • Each compiled RE may be deposited individually in the database or all rules may be deposited once they are all processed or a combination.
  • the PRISM memory further comprises an array of search memory circuits that provide the regular expression search functions for searching content from documents, messages or packets or other data received from the network or the local host or a master processor or a network processor or TCP Offload Engine or Processor or Storage Network processor or a security processor or other processor or a combination thereof.
  • the memory elements of the PRISM memory comprise of static memory cells.
  • the memory elements are each independently addressable in a random order.
  • the PRISM memory further comprises of circuits to couple the content search memory with other logic to provide coupling with processors that can interface to the PRISM memory integrated circuits.
  • the PRISM memory further comprises of a controller for interfacing with the processors to receive the content to be searched.
  • the PRISM memory may further comprise of address decode logic circuits which decode the received address to select the specific static memory cells location to be read or written.
  • the memory elements of the search memory may each be uniquely addressed to read or write appropriate values in the memory elements.
  • the address decoding logic and the controller generate control signals necessary to address the appropriate memory locations of the static memory cells based search memory.
  • the control signals are coupled to the PRISM arrays as a series of word lines and bit lines that can randomly be used to access desired memory locations.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computational Linguistics (AREA)
  • Data Mining & Analysis (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

Memory architecture provides capabilities for high performance content search. The architecture creates an innovative memory that can be programmed with content search rules which are used by the memory to evaluate presented content for matching with the programmed rules. When the content being searched matches any of the rules programmed in the Programmable Intelligent Search Memory (PRISM) action(s) associated with the matched rule(s) are taken. Content search rules comprise of regular expressions which are converted to finite state automata (FSA) and then programmed in PRISM for evaluating content with the search rules. PRISM architecture comprises of a plurality of programmable PRISM Search Engines (PSE), each capable of supporting a predetermined size FSAs. FSA extension architecture is created to extend the predetermined size limit of an FSA supported by PSE, by coupling multiple PSEs together to behave as a composite PSE to support larger FSAs.

Description

    RELATED APPLICATIONS
  • This application is a continuation of U.S. patent application Ser. No. 11/952,110, filed Dec. 6, 2007, which claims priority to Provisional Application Serial No. 60/965,267 filed on Aug. 17, 2007 entitled “Embedded programmable intelligent search memory”, Provisional Application Serial No. 60/965,170 filed on Aug. 17, 2007 entitled “100 Gbps security and search architecture using programmable intelligent search memory”, Provisional Application Ser. No. 60/963,059 filed on Aug. 1, 2007 entitled “Signature search architecture for programmable intelligent search memory”, Provisional Application Serial No. 60/961,596 filed on Jul. 23, 2007 entitled “Interval symbol architecture for programmable intelligent search memory”, Provisional Application Ser. No. 60/933,313 filed on Jun. 6, 2007 entitled “FSA context switch architecture for programmable intelligent search memory”, Provisional Application Ser. No. 60/933,332 filed on Jun. 6, 2007 entitled “FSA extension architecture for programmable intelligent search memory”, Provisional Application Ser. No. 60/930,607 filed on May 17, 2007 entitled “Compiler for programmable intelligent search memory”, Provisional Application Ser. No. 60/928,883 filed on May 10, 2007 entitled “Complex symbol evaluation for programmable intelligent search memory”, Provisional Application Ser. No. 60/873,632 filed on Dec. 8, 2006 entitled “Programmable intelligent search memory”, Provisional Application Ser. No. 60/873,889 filed on Dec. 8, 2006 entitled “Dynamic programmable intelligent search memory”, which are all incorporated herein by reference in their entirety as if fully set forth herein.
  • U.S. patent application Ser. No. 11/952,110, filed Dec. 6, 2007 also claims priority to U.S. patent application Ser. No. 11/952,028 filed on Dec. 6, 2007 entitled “Embedded programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,043 filed on Dec. 6, 2007 entitled “100 Gbps security and search architecture using programmable intelligent search memory”; U.S. patent application Ser. No. 11/952,103 filed on Dec. 6, 2007 entitled “Signature search” architecture for programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,104 filed on Dec. 6, 2007 entitled “Interval symbol architecture for programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,108 on Dec. 6, 2007 entitled “FSA context switch architecture for programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,111 filed on Dec. 6, 2007 entitled “Compiler for programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,112 filed on Dec. 6, 2007 entitled “Complex symbol evaluation for programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,114 filed on Dec. 6, 2007 entitled “Programmable intelligent search memory”, U.S. patent application Ser. No. 11/952,117 filed on Dec. 6, 2007 entitled “Dynamic programmable intelligent search memory” which are all co-pending U.S. patent applications of common ownership.
    • BACKGROUND OF THE INVENTION
  • This invention relates generally to memory technology and in particular to a new high performance intelligent content search memory and a regular expression compiler for it.
  • Many modem applications depend on fast information search and retrieval. With the advent of the world-wide-web and the phenomenal growth in its usage, content search has become a critical capability. A large number of servers get deployed in web search applications due to the performance limitations of the state of the art microprocessors for regular expression driven search.
  • There have been significant research and development resources devoted to the topic of searching of lexical information or patterns in strings. Regular expressions have been used extensively since the mid 1950s to describe the patterns in strings for content search, lexical analysis, information retrieval systems and the like. Regular expressions were first studied by S. C. Kleene in mid-1950s to describe the events of nervous activity. It is well understood in the industry that regular expression (RE) can also be represented using finite state automata (FSA). Non-deterministic FSA (NFA) and deterministic FSA (DFA) are two types of FSAs that have been used extensively over the history of computing. Rabin and Scott were the first to show the equivalence of DFA and NFA as far as their ability to recognize languages in 1959. In general a significant body of research exists on regular expressions. Theory of regular expressions can be found in “Introduction to Automata Theory, Languages and Computation” by Hoperoft and Ullman and a significant discussion of the topics can also be found in book “Compilers: Principles, Techniques and Tools” by Aho, Sethi and Ullman.
  • Computers are increasingly networked within enterprises and around the world. These networked computers are changing the paradigm of information management and security. Vast amount of information, including highly confidential, personal and sensitive information is now being generated, accessed and stored over the network. This information needs to be protected from unauthorized access. Further, there is a continuous onslaught of spam, viruses, and other inappropriate content on the users through email; web access, instant messaging, web download and other means, resulting in significant loss of productivity and resources.
  • Enterprise and service provider networks are rapidly evolving from 10/100 Mbps line rates to 1 Gbps, 10 Gbps and higher line rates: Traditional model of perimeter security to protect information systems pose many issues due to the blurring boundary of an organization's perimeter. Today as employees, contractors, remote users, partners and customers require access to enterprise networks from outside, a perimeter security model is inadequate. This usage model poses serious security vulnerabilities to critical information and computing resources for these organizations. Thus the traditional model of perimeter security has to be bolstered with security at the core of the network. Further, the convergence of new sources of threats and high line rate networks is making software based perimeter security to stop the external and internal attacks inadequate. There is a clear need for enabling security processing in hardware inside core or end systems beside a perimeter security as one of the prominent means of security to thwart ever increasing security breaches and attacks.
  • FBI and other leading research institutions have reported in recent years that over 70% of intrusions in organizations have been internal. Hence a perimeter defense relying on protecting an organization from external attacks is not sufficient as discussed above. Organizations are also required to screen outbound traffic to prevent accidental or malicious disclosure of proprietary and confidential information as well as to prevent its network resources from being used to proliferate spam, viruses, worms and other malware. There is a clear need to inspect the data payloads of the network traffic to protect and secure an organization's network for inbound and outbound security.
  • Data transported using TCP/IP or other protocols is processed at the source, the destination or intermediate systems in the network or a combination thereof to provide data security or other services like secure sockets layer (SSL) for socket layer security, Transport layer security, encryption/decryption, RDMA, RDMA security, application layer security, virtualization or higher application layer processing, which may further involve application level protocol processing (for example, protocol processing for HTTP, HTTPS, XML, SGML, Secure XML, other XML derivatives, Telnet, FTP, IP Storage, NTS, CIFS, DAPS, and the like). Many of these processing tasks put a significant burden on the host processor that can have a direct impact on the performance of applications and the hardware system. Hence, some of these tasks need to be accelerated using dedicated hardware for example SSL, or TLS acceleration. As the usage of XML increases for web applications, it is creating a significant performance burden on the host processor and can also benefit significantly from hardware acceleration. Detection of spam, viruses and other inappropriate content require deep packet inspection and analysis. Such tasks can put huge processing burden on the host processor and can substantially lower network line rate. Hence, deep packet content search and analysis hardware is also required.
  • Internet has become an essential tool for doing business at small to large organizations. HTML based static web is being transformed into a dynamic environment over last several years with deployment of XML based services. XML is becoming the lingua-franca of the web and its usage is expected to increase substantially. XML is a descriptive language that offers many advantages by making the documents self-describing for automated processing but is also known to cause huge performance overhead for best of class server processors. Decisions can be made by processing the intelligence embedded in XML documents to enable business to business transactions as well as other information exchange. However, due to the performance overload on the best of class server processors from analyzing XML documents, they cannot be used in systems that require network line rate XML processing to provide intelligent networking. There is a clear need for acceleration solutions for XML document parsing and content inspection at network line rates which are approaching 1 Gbps and 10 Gbps, to realize the benefits of a dynamic web based on XML services.
  • Regular expressions can be used to represent the content search strings for a variety of applications like those discussed above. A set of regular expressions can then form a rule set for searching for a specific application and can be applied to any document, file, message, packet or stream of data for examination of the same. Regular expressions are used in describing anti-spam rules, anti-virus rules, anti-spyware rules, anti-phishing rules, intrusion detection rules, extrusion detection rules, digital rights management rules, legal compliance rules, worm detection rules, instant message inspection rules, VOIP security rules, XML document security and search constructs, genetics, proteomics, XML based protocols like XMPP, web search, database search, bioinformatics, signature recognition, speech recognition, web indexing and the like. These expressions get converted into NFAs or DFAs for evaluation on a general purpose processor. However, significant performance and storage limitations arise for each type of the representation. For example an N character regular expression can take up to the order of 2N memory for the states of a DFA, while the same for an NFA is in the order of N. On the other hand the performance for the DFA evaluation for an M byte input data stream is in the order of M memory accesses and the order of (N*M) processor cycles for the NFA representation on modern microprocessors.
  • When the number of regular expressions increases, the impact on the performance deteriorates as well. For example, in an application like anti-spam, there may be hundreds of regular expression rules. These regular expressions can be evaluated on the server processors using individual NFAs or DFAs. It may also be possible to create a composite DFA to represent the rules. Assuming that there are X REs for an application, then a DFA based representation of each individual RE would result up to the order of (X*2N) states however the evaluation time would grow up to the order of (X*N) memory cycles. Generally, due to the potential expansion in the number of states for a DFA they would need to be stored in off chip memories. Using a typical access time latency of main memory systems of 60 ns, it would require about (X*60 ns*N*M) time to process an X RE DFA with N states over an M byte data stream. This can result in tens of Mbps performance for modest size of X, N & M. Such performance is obviously significantly below the needs of today's network line rates of 1 Gbps to 10 Gbps and beyond. On the other hand, if a composite DFA is created, it can result in an upper bound of storage in the order of 2N*X which may not be within physical limits of memory size for typical commercial computing systems even for a few hundred REs. Thus the upper bound in memory expansion for DFAs can be a significant issue. Then on the other hand NFAs are non-deterministic in nature and can result in multiple state transitions that can happen simultaneously. NFAs can only be processed on a state of the art microprocessor in a scalar fashion, resulting in multiple executions of the NFA for each of the enabled paths. X REs with N characters on average can be represented in the upper bound of (X*N) states as NFAs. However, each NFA would require M iterations for an M-byte stream, causing an upper bound of (X*N*M* processor cycles per loop). Assuming the number of processing cycles are in the order of 10 cycles, then for a best of class processor at 4 GHz, the processing time can be around (X*N*M*2.5 ns), which for a nominal N of 8 and X in tens can result in below 100 Mbps performance. There is a clear need to create high performance regular expression based content search acceleration which can provide the performance in line with the network rates which are going to 1 Gbps and 10 Gbps.
  • The methods for converting a regular expression to Thompson's NFA and DFA are well known. The resulting automata are able to distinguish whether a string belongs to the language defined by the regular expression however it is not very efficient to figure out if a specific sub-expression of a regular expression is in a matching string or the extent of the string. Tagged NFAs enable such queries to be conducted efficiently without having to scan the matching string again. For a discussion on Tagged NFA refer to the paper “NFAs with Tagged Transitions. their Conversion to Deterministic Automata and. Application to Regular Expressions”, by Ville Laurikari, Helsinki University of Technology, Finland.
    • SUMMARY OF THE INVENTION
  • A programmable intelligent search memory (PRISM) is a memory technology that supports orders of magnitude larger number of regular expressions in a single chip for current and emerging content search applications. PRISM memory supports FSAs of a number of states ‘n’ which may be any integer like 8, 16, 32 and the like. However, at times there may be a need to support regular expressions with number of states which are more than that represented in a single PRISM FSA. For such cases it may be necessary to allow multiple PRISM FSAs to be coupled together to support the bigger REs. Further, there are certain applications where the rules are specified as a group of rules that are evaluated together and there may be nesting amongst the rule groups. Such applications may have groups of rules that may be evaluated simultaneously or one after the other and need a means of communicating from one FSA to another. My invention describes an architecture that enables creation of extensible FSAs to support needs such as the ones described above and the like. There is a need for creating a compiler flow that can target converting regular expression rules in to a form that PRISM based search engines can use to process input data for content specified by the regular expression rules. My invention describes a compiler for regular expressions that can be used for PRISM.
  • I describe an FSA extension architecture and a compiler .for a high performance Programmable Intelligent Search Memory™ (PRISM™) for searching content with regular expressions as well as other pattern searches. Prograrn.mable intelligent search memory of this patent can have many uses wherever any type of content needs to be searched for example in networking, storage, security, web search applications, XML processing, bio informatics, signature recognition, genetics, proteomics, speech recognition, database search, enterprise search and the like. The programmable intelligent search memory of my invention may be embodied as independent PRISM memory integrated circuits working with or may also be embodied within microprocessors, multi-core processors, network processors, TCP Offload Engines, network packet classification engines, protocol processors, regular expression processors, content search processors, network search engines, content addressable memories, mainframe computers, grid computers, servers, workstations, personal computers, laptops, notebook computers, PDAs, handheld devices, cellular phones, wired or wireless networked devices, switches, routers, gateways, unified threat management devices, firewalls, VPNs, intrusion detection and prevention systems, extrusion detection systems, compliance management systems, wearable computers, data warehouses, storage area network devices, storage systems, data vaults, chipsets and the like or their derivatives or any combination thereof.
  • The regular expressions may optionally be tagged to detect sub expression matches beside the full regular expression match. The regular expressions are converted into equivalent FSAs that may optionally be NFAs and may optionally be converted into tagged NFAs. The PRISM memory also optionally provides ternary content addressable memory functionality. So fixed string searches may optionally be programmed into the PRISMTM memory of my invention. PRISM memory of this invention enables a very efficient and compact realization of intelligent content search using FSA to meet the needs of current and emerging content search applications. For clarity, as used in this patent the terms “programmable intelligent search memory”, “search memory”, “content search memory”, or “PRISM memory” are used interchangeably and have the same meaning unless specifically noted. Further for clarity, as used in this patent the term “memory” when used independently is used to refer to random access memory or RAM or Dynamic RAM (DRAM) or DDR or QDR or RLDRAM or RDRAM or FCRAM or Static RAM (SRAM) or read only memory (ROM) or FLASH or cache memory or the like or any future derivatives of such memories.
  • The PRISM memory performs simultaneous search of regular expressions and other patterns (also referred to as “rules” or “regular expression rules” or “pattern search rules” or “patterns” or “regular expressions” in this patent) against the content being examined. The content may be presented to the search memory by a companion processor or PRISM controller or content stream logic or a master processor or the like which may be on the same integrated circuit chip as the PRISM memory or may be on a separate device. The content to be searched may be streaming content or network packets or data from a master processor or data from a disk or a file or reside in on-chip memory or off-chip memory or buffers or the like from which a controller may present it to the search memory arrays for examination. The content search memory arrays may initially be configured with the regular expression rules converted into NFAs or tagged NFAs and optionally other pattern search rules. I describe a compiler for converting regular expressions into rules supported by PRISM. PRISM memory may optionally comprise of configuration control logic which may be distributed or central or a combination thereof. The configuration control logic may optionally address PRISM memory cells to read and/or write FSA rules or other patterns to be searched. Once the PRISM memory is setup with all the related information about the NFAs and other rules, the content to be examined can be presented to the PRISM memory. PRISM memory provides capabilities to update rules or program new rules or additional rules, in line with the content examination within a few clock cycles unlike the current regular expression processors which require the content evaluation to stop for long periods of time until large tables of composite DFAs are updated in an external or internal memory. Typically the content is presented as a stream of characters or symbols which get examined against the rules in the PRISM memory simultaneously and whenever a rule is matched the PRISM memory array provides that indication as a rule match signal which is interpreted by the control logic of the PRISM. There may be multiple rule matches simultaneously in which case a priority encoder which may also be prottrammable is used to select one or more matches as the winner(s). The priority encoder may then provide a tag or an address or an action or a combination that may have already been programmed in the priority encoder which may be used to look-up related data from associated on-chip or off-chip memory that may optionally determine the next set of actions that may need to be taken on the content being examined. For example, in case of a security application if a set of regular expressions are defined and programmed for spain detection, then if one or more of these rules when matched can have action(s) associated with them that the message or content may need to quarantined for future examination by a user or it can have an action that says the content should be dropped or enable a group of regular expressions in the PRISM memory to be applied to the content or the like depending on the specific application. The PRISM memory architecture comprises of means or circuits or the like for programming and reprogramming of the FSA rules and optionally CAM signatures and masks. It further comprises of means or circuits or the like to stream the content to be searched to the PRISM memory arrays. It May further comprise of priority encoder which may optionally be programmable. The PRISM memory may optionally comprise of random access memory (on-chip or off-chip) which is used to store actions associated with specific rule matches. The PRISM memory may optionally comprise of database extension ports which may be optionally used when the number of rules is larger than those that may fit in a single integrated circuit chip. The PRISM memory may optionally comprise of clusters of PRISM memory cells that enable a group of FSA rules to be programmed per cluster. The PRISM clusters may optionally comprise of memory for fast storage and retrieval of FSA states for examination of content that belongs to different streams or contexts or flows or sessions or the like as described below referred to as context memory. For clarity, context memory or global context memory or local context memory or cluster context memory, all comprise of memory like random access memory or RAM or Dynamic RAM (DRAM) or DDR or QDR or RLDRAM or RDRAM or FC.RAM or Static RAM (SRAM) or read only memory (ROM) or FLASH or cache memory or the like or any future derivatives of such memories as discussed above. The PRISM memory may optionally comprise of global context memory beside the local cluster context memory for storage and retrieval of FSA states of different contexts and enable supporting a large number of contexts. The cluster context memory may optionally cache a certain number of active contexts while the other contexts may be stored in the global context memory. There may optionally be off-chip context memory as well, which can be used to store and retrieve FSA states for much larger number of contexts. The PRISM memory may optionally comprise of cache or context control logic (also referred as “context controller”) that manages the cluster, global or external context memory or cache or a combination thereof. The cache or context control logic may optionally be distributed per cluster or may be central for the PRISM memory or any combination thereof. The PRISM controller or the content stream logic that streams the content to be searched may be provided with an indication of the context of the content being searched or it may detect the context of the content or a combination thereof, and may optionally direct the context memory and associated control logic i.e. the context controller to get the appropriate context ready. Once the context memory has the required context available an indication may be provided to PRISM configuration control logic that it may program or load the context states in the PRISM memory. The PRISM configuration control logic (also referred as “configuration controller” in this patent) may optionally first save the current context loaded in the set of active FSA blocks before loading the new context. The configuration controller(s) and the context controller(s) may thus optionally store and retrieve appropriate contexts of the FSAs and start searching the content against the programmed rules with appropriate context states of the FSAs restored. Thus PRISM memory may optionally dynamically reconfigure itself at run-time based on the context of the content or the type of the application or the like or a combination thereof enabling run-time adaptable PRISM memory architecture. The contexts as referred to in this patent may, as examples without limitation, be related to specific streams, or documents, or network connections or message streams or sessions or the like. The PRISM memory may process content from multiple contexts arriving in data groups or packets or the like. For content search in applications where the content belonging to one context may arrive interspersed with content from other contexts, it may be important to maintain the state of the content searched for a context up to the time when content from a different context gets searched by PRISM memory. The context memory or cache with the associated controllers as described in this patent enable handling of multiple contexts.
  • For clarification, the description in this patent application uses term NFA to describe the NFAs and optionally, when tagging is used in regular expressions, to describe tagged NFA unless tagged NFA is specifically indicated. All NFAs may optionally be tagged to form tagged NFAs, hence the description is not to be used as a limiter to apply only to tagged NFAs. The descriptions of this patent are applicable for non-tagged NFAs as well and tagging is an optional function which may or may not be implemented or used, and thus non-tagged NFAs are covered by the teachings of this patent as will be appreciated by one skilled in the art. At various places in this patent application the term content search memory, content search memory, search memory and the like are used interchangeably for programmable intelligent search memory or PRISM memory. These usages are meant to indicate the content search memory or PRISM memory of this invention without limitation.
  • Berry and Sethi in their paper “From Regular Expressions to Deterministic Automata” Published in Theoretical Computer Science in 1986, showed that regular expressions (REs) can be represented by NFAs such that a given state in the state machine is entered by one symbol, unlike the Thompson NFA. Further, the Berry-Sethi NFAs are c-free. A ‘V’ term RE can be represented using ‘V+1’ states NFA using Berry-Sethi like NFA realization method. The duality of Berry-Sethi method also exists where all transitions that lead the machine out of a state are dependent on the same symbol. This is shown in the paper “A Taxonomy of finite automata construction algorithms” by Bruce Watson published in 1994 in section 4.3. I show a method of creating NFA search architecture in a memory leveraging the principles of Berry-Sethi's NFA realization and the dual of their construct. The NFA search memory is programmable to realize an arbitrary regular expression using the compiler flow of this invention to convert a regular expression to that usable by PRISM. The compiler of this invention follows the principles of Berry-Sethi FSA construction to convert regular expressions into an FSAs and creates various data structures that are required for PRISM to operate as a programmable regular expressions engine.
  • This PRISM memory and the compiler for PRISM of this patent may be used for many applications like those for detecting intrusions, extrusions and confidential information disclosure (accidental or malicious or intended), regulatory compliance search using hardware for regulations like HIPAA, Sarbanes-Oxley, Graham-Leach-Bliley act, California security bills, security bills of various states and/or countries and the like, deep packet inspection, detecting spam, detecting viruses, detecting worms, detecting spyware, detecting digital rights management information, instant message inspection, URL matching, application detection, detection of malicious content, and other content, policy based access control as well as other policy processing, content based switching, load balancing, virtualization or other application layer content inspection for application level protocol analysis and processing for web applications based on HTTP, XML and the like and applying specific rules which may enable anti-spam, anti-virus, other security capabilities like anti-spyware, anti-phishing and the like capabilities. The content inspection memory may be used for detecting and enforcing digital rights management rules for the content. The content inspection memory may also be used for URL matching, string searches, genetic database searches, proteomics, bio informatics, web indexing, content based load balancing, sensitive information search like credit card numbers or social security numbers or health information or the like.
  • Classification of network traffic is another task that consumes up to half of the processing cycles available on packet processors leaving few cycles for deep packet inspection and processing at high line rates. The described content search memory can sienificantly reduce the classification overhead when deployed as companion search memory to packet processors or network processors or TOE or storage network processors or the like.
    • BRIEF DESCRIPTION OF THE DRAWINGS
  • FIG. 1 a illustrates Thompson's NFA (prior art)
  • FIG. 1 b illustrates Berry-Sethi NFA (prior art)
  • FIG. 1 c illustrates DFA (prior art)
  • FIG. 2 a illustrates a left-biased NFA and state transition table (prior art)
  • FIG. 2 b illustrates a right-biased NFA and state transition table (prior art)
  • FIG. 3 a illustrates state transition controls
  • FIG. 3 b illustrates configurable next state tables per state
  • FIG. 4 a illustrates state transition logic (STL) for a state
  • FIG. 4 b illustrates a state logic block
  • FIG. 5 a illustrates state transition logic (STL) for a state :in Left-Biased FSA
  • FIG. 5 b illustrates state transition logic (STL) for a state in Right-Biased FSA
  • FIG. 6A illustrates Right-biased Tagged FSA Rule block in PRISM
  • FIG. 6B illustrates Left-biased Tagged FSA Rule block in PRISM
  • FIG. 7 illustrates PRISM Block Diagram
  • FIG. 8 a illustrates PRISM Memory Cluster Block Diagram
  • FIG. 8 b illustrates PRISM Memory Cluster Detailed Block Diagram
  • FIG. 9 illustrates PRISM search compiler flow (full+incremental rule distribution)
  • FIG. 10 illustrates PRISM HA Compiler flow
  • FIG. 11 illustrates PRISM Row-Wise FSA Extension
  • FIG. 11A illustrates PRISM Rule Group FSA Extension.
  • FIG. 12 illustrates PRISM. Row-Wise FSA Extension Example #1
  • FIG. 13 illustrates PRISM Row-Wise FSA Extension Example # 2
  • FIG. 14 illustrates PRISM Column-Wise FSA Extension
  • FIG. 15 illustrates PRISM FSA Extension Example # 1
  • FIG. 16 a illustrates Column-Wise PRISM FSA Extension Example
  • FIG. 16 b illustrates Row-Wise and Column-Wise PRISM BA Extension Example
    •  DESCRIPTION
  • I describe a FSA extension architecture and a regular expression compiler for high performance Programmable Intelligent Search Memory for searching content with regular expressions as well as other pattern searches. The regular expressions may optionally be tagged to detect sub expression matches beside the full regular expression match. The regular expressions are converted into equivalent FSAs that may optionally be NFAs and may optionally be converted into tagged NFAs. The PRISM memory also optionally supports ternary content addressable memory functionality. So fixed string searches may optionally be programmed into the PRISM memory. PRISM memory enables a very efficient and compact realization of intelligent content search using FSA to meet the needs of current and emerging content search applications. Unlike a regular expression processor based approach, the PRISM memory can support tens of thousands to hundreds of thousands of content search rules defined as regular expressions as well as patterns of strings of characters. A compiler for compiling these regular expression rules into PRISM. compatible data structure is described in this invention to enable PRISM to perform the content inspection using the compiled rules. The PRISM memory performs simultaneous search of regular expressions and other patterns. The content search memory can perform high speed content search at line rates from 1 Gbps to 10 Gbps and higher, when the best of class server microprocessor can only perform the same tasks at well below 100 Mbps. The content search memory can be used not only to perform layer 2 through layer 4 searches that may be used for classification and security applications, it can also be used to perform deep packet inspection and layer 4 through layer 7 content analysis.
  • Following are some of the embodiments, without limitations, that can implement PRISM memory:
  • The PRISM memory may be embodied inside network interface cards of servers, workstations, client PCs, notebook computers, handheld devices, switches, routers and other networked devices. The servers may be web servers, remote access servers, file servers, departmental servers, storage servers, network attached storage servers, database servers, blade servers, clustering servers, application servers, content /media servers, VOIP servers and systems, grid computers/servers, and the like. The PRISM memory may also be used inside an I/O chipset of one of the end systems or network core systems like a switch or router or appliance or the like.
  • The PRISM memory may also be embodied on dedicated content search acceleration cards that may be used inside various systems described in this patent. Alternatively, PRISM memory may also be embodied as a content search memory inside a variety of hardware and/or integrated circuits like ASSPs, ASICs, FPGA, microprocessors, multi-core processors, network processors, TCP Offload Engines, network packet classification engines, protocol processors, regular expression processors, content search processors, mainframe computers, grid computers, servers, workstations, personal computers, laptops, handheld devices, cellular phones, wired, or wireless networked devices, switches, routers, gateways, XML accelerators, VOIP servers, Speech recognition systems, bio informatics systems, genetic and proteomics search systems, web search servers, electronic vault application networks and systems, Data Warehousing systems, Storage area network systems, content indexing appliances like web indexing, email indexing and the like, chipsets and the like or any combination thereof Alternatively, PRISM memory blocks may be embedded inside other memory technologies like DRAM, SDRAM, DDR DRAM, DDR II DRAM, RLDRAM, SRAM, RDRAM, RDRAM, QDR SRAM, DDR SRAM, CAMs, Boundary Addressable Memories, Magnetic memories, Flash or other special purpose memories or a combination thereof or future derivates of such memory technologies to enable memory based content search.
  • One preferred embodiment of the invention is in an integrated circuit memory chip that may support around 128,000 8-symbol regular expression rules in current process technologies. A second preferred embodiment of the PRISM technology is an integrated circuit memory chip that may support around 8,000 regular expression rules in current process technologies to support applications where a lower content search memory cost is required. Each process generation may provide ability to store around twice as many PRISM memory bits as the previous generation. Thus in one preferred embodiment the PRISM memory would be able to support tens of thousands of eight state FSA and can. potentially support over 100,000 FSAs. There are many variations of the PRISM memory architecture that can be created that can support more or less FSAs depending upon various factors like the number of states per FSA, the chip die area, cost, manufacturability expectations and the like which will be appreciated by a person with ordinary skill in the art.
    • DETAILED DESCRIPTION
  • describe a FSA extension architecture and a regular expression compiler for a high performance Programmable Intelligent Search Memory for searching content with regular expressions as well as other pattern searches. The regular expressions may optionally be tagged to detect sub expression matches beside the full regular expression match. The regular expressions are converted into equivalent FSAs or NFAs and optionally into tagged NFAs. The PRISM memory also optionally supports ternary content addressable memory functionality. So fixed string searches may optionally be programmed into the PRISM memory of my invention. PRISM memory of this invention enables a very efficient and compact realization of intelligent content search using FSA to meet the needs of current and emerging content search applications. Unlike a regular expression processor based approach, the PRISM memory can support tens of thousands to hundreds of thousands of content search rules defined as regular expressions as well as patterns of strings of characters. The PRISM memory performs simultaneous search of regular expressions and other patterns. The content search memory can perform high speed content search at line rates from 1 Gbps to 10 Gbps and higher using current process technologies. The description here is with respect to one preferred embodiment of this invention in an integrated circuit (IC) chip, it will be appreciated by those with ordinary skill in the art that changes in these embodiments may be made without departing from the principles and spirit of the invention. The illustrations are made to point out salient aspects of the invention and do not illustrate well understood IC design elements, components and the like implementation of the invention in integrated circuits so as not to obscure the invention.
  • Ability to perform content search has become a critical capability in the networked world. As the network line rates go up to 1 Gbps, 10 Gbps and higher, it is important to be able to perform deep packet inspection for many applications at line rate. Several security issues, like viruses, worms, confidential information leaks and the like, can be detected and prevented from causing damage if the network traffic can be inspected at high line rates. In general, content search rules can be represented using regular expressions. Regular expression rules can be represented and computed using FSAs. NFAs and DFAs are the two types of FSAs that are used for evaluation of regular expressions. For high line rate applications a composite DFA can be used, where each character of the input stream can be processed per cycle of memory access. However, this does have a limit on how fast the search can be performed dictated by the memory access speed. Another limiter of such approach is the amount of memory required to search even a modest number of regular expression rules. As discussed above, NFAs also have their limitations to achieve high performance on general purpose processors. In general, today's best of class microprocessors can only achieve less than 100 Mbps performance using NFAs or DFAs for a small number of regular expressions. Hence, there is a clear need to create targeted content search acceleration hardware to raise the performance of the search to the line rates of 1 Gbps and 10 Gbps. PRISM memory is such a high performance content search hardware that can be targeted for high line rates. The invention of this patent describes a compiler to make PRISM memory structures useful for processing content against a large number of regular expressions compiled to leverage PRISM capabilities.
  • As described earlier, regular expression can be represented using FSA like NFA or DFA. FIG. 1 a illustrates Thompson's construction for the regular expression (xy+y)*yx. Thompson's construction proceeds in a step by step manner where each step introduces two new states, so the resulting NFA has at most twice as many states as the symbols or characters and operators in the regular expression. An FSA is comprised of states, state transitions, and symbols that cause the FSA to transition from one state to another. An FSA comprises at least one start state, and at least one accept state where the start state is where the FSA evaluation begins and the accept state is a state which is reached when the FSA recognizes a string. Block 101 represent the start state of the FSA, while block 105 is an accept state. Block 102 represents state 2 and 104 represents state 3. The transition from state 2 to state 3 is triggered on the symbol x, 103 and is represented as a directed edge between the two states. Thompson's NFA comprises of ‘ε’ transitions, 116, which are transitions among states which may be taken without any input symbol.
  • FIG. 1 b illustrates Berry-Sethi NFA for the regular expression (xy+y)*yx. Berry and Sethi described an algorithm of converting regular expressions into .FSA using a technique called ‘marking’ of a regular expression. It results in an NFA which has a characteristic that all transitions into any state are from the same symbol. For example, all transitions into state 1, 107, are from symbol ‘x’. The other characteristic of the Berry-Sethi construct is that number of NFA states are the same as the number of symbols in the regular expression and one start state. In this type of construction, each occurrence of a symbol is treated as a new symbol. The construction converts the regular expression (xy+y)*yx to a marked expression (x1y2+y3)*y4x5 where each x1 leads to the same state, 107. The figure does not illustrate the markings. Once the FSA is constructed the markings are removed. The FIG. 1 b illustrates the NFA with the markings removed. As can be seen from the figure, in Berry-Sethi construction all incoming transitions into a state are all dependent on the same symbol. Similarly, a duality of Berry-Sethi construct also has been studied and documented in the literature as discussed earlier, where instead of all incoming transitions being dependent on the same symbol, all outgoing transitions from a state are dependent on the same symbol. The Berry-Sethi construct is also called a left-biased type of construct, where as its dual is called a right-biased construct.
  • Finite State Automaton can evaluate incoming symbols or characters against the regular expression language of the automaton and detect when an input string is one of the strings recognized by it. However, it is advantageous in certain conditions to know if a certain sub-expression of the regular expression is also matched. That may be enabled by tagging the NFA as described in the paper by Ville Laurikari referred earlier. Following description illustrates how the inventions of this patent enable tagged NM realization in PRISM memory. The tagging for sub-expression checking may involve further processing of the FSA to uniquely identify sub-expression matching. However for illustration purpose, if in the regular expression “(xy+y)*yx” done desires to detect if the sub-expression “xy” is in the recognized string, one can tag the state 4, 110, as a tagged state. Thus, whenever the regular expression transitions through state 4, 110, the sub-expression match or tag match may be indicated. There may also be need to detect if a specific transition leads the regular expression through a desired sub-expression. In such a case a tag start state and a tag end state may be marked. For instance, if it is desired to detect if the transition from state 0 to state 2, 117, is taken then the state 0 may be marked as a tag start state and state 2 may be marked as a tag end state. The tagged FSA implementation may then indicate the beginning of the tag transition when the FSA reaches the tag start state and then indicate the end of the tag transition when the FSA reaches the tag end state. If the FSA moves from the tag start state immediately followed by transitioning into tag end state, then the tagged FSA can indicate the match of a tagged transition. The illustrations in the description below do not illustrate this aspect of tagged NFA, though it may optionally be supported in PRISM and may be easily implemented as follows or other means for example by adding a tag start and tag end state flags (as memory bits or flip-flops) and the logic for the tag transition detection to follow the steps described above as can be appreciated by those with ordinary skill in the art. The patent of this disclosure enables detection of sub-expressions using tagging.
  • FIG. 1 c illustrates a DFA for the same regular expression (xy+y)*yx. DFA is deterministic in that only one of its states is active at a given time, and only one transition is taken dependent on the input symbol. Whereas in an NFA, multiple states can be active at the same time and transitions can be taken from one state to multiple states based on one input symbol. There are well known algorithms in the literature, like subset construction, to convert a RE or NFA to a DFA. This DFA may be realized in the PRISM Memory using the constructs described below to represent an FSA, using a left-biased realization. Thus PRISM memory of this invention may also be used to program certain DFAs where all incoming transitions to each state are with the same symbol like the DFA of this illustration.
  • FIG. 2 a illustrates a left-biased NFA and its state transition table (prior art). The illustration is a generic four state Berry-Sethi like NFA with all transitions from each node to the other shown with the appropriate symbol that the transition depends on. For example, state A, 201 has all incoming transitions dependent on symbol ‘a’ as illustrated by example transitions labeled 202 and 203. When the FSA is in State A, 201, an input symbol ‘d’, transitions the FSA to state D with the transition, 204, from state A to state D. The table in the figure illustrates the same FSA using a state transition table. The column ‘PS’, 211, is the present state of the FSA, while the row ‘sym’, 212, is a list of all the symbols that the state transitions depend on. The table 213, illustrates the next state (NS) that the FSA will transition to from the present state (PS) when an input symbol from those in the sym header row is received. In this FSA, state ‘A’ is the start state and state C is an accept state. Hence, if the FSA is in the present state ‘A’ and an input symbol ‘b’ is received, the FSA transitions to the next state ‘B’. So when the next input symbol is received, the FSA is in present state ‘B’ and is evaluated for state transition with the row corresponding to present state ‘B’.
  • FIG. 2 b illustrates a right-biased NFA and its state transition table (prior art). The illustration is a generic four state dual of Berry-Sethi NFA with all transitions from each node to the other shown with the appropriate symbol that the transition depends on. For example, state ‘A’, 205 has all outgoing transitions dependent on symbol ‘a’ as illustrated by example transitions labeled 208 and 209 where as unlike the left-biased NFA described above, each incoming transition is not on the same symbol, for example transitions labeled 206 and 207 depend on symbols ‘b’ and ‘d’ respectively. The state transition table in this figure is similar to the left biased one, except that the FSA transitions to multiple states based on the same input symbol. For example if the FSA is in the present state ‘B’ and a symbol ‘b’ is received, then the FSA transitions to all states ‘A’, ‘B’, ‘C’ and ‘D’. When an input symbol is received which points the FSA to an empty box, like 216, the FSA has received a string which it does not recognize. The FSA can then be initialized to start from the start state again to evaluate the next string and may indicate that the string is not recognized.
  • The FIG. 2 a and FIG. 2 b, illustrate generic four state NFAs where all the transitions from each state to the other are shown based on the left-biased or right-biased construct characteristics. However not all four state NFAs would need all the transitions to be present. Thus if a symbol is received which would require the FSA to transition from the present state to the next state when such transition on the received input symbol is not present, the NFA is said to not recognize the input string. At such time the NFA may be restarted in the start state to recognize the next string. In general, one can use these example four state NFAs to represent any four state RE in a left-biased (LB) or right-biased (RB) form provided there is a mechanism to enable or disable a given transition based on the resulting four states NFA for the RE.
  • FIG. 3 a illustrates state transition controls for a left-biased and right-biased NFA. The figure illustrates a left-biased NFA with a state ‘A’, 300, which has incoming transitions dependent on receiving input Symbol ‘S1’ from states ‘B’, 301, ‘C’, 302, and ‘D’, 303. However, the transitions from each of the states ‘B’, ‘C’ and ‘D’ to state ‘A’, occur only if the appropriate state dependent control is set besides receiving the input symbol ‘S1’. The state dependent control for transition from state ‘B’ to state ‘A’ is V2 while those from states ‘C’ and ‘D’ to state ‘A’ is V3 and V4 respectively. Transition to the next state ‘A’ is dependent on present state ‘A’ through the state dependent control V1. Thus transition into a state ‘A’ occurs depending on the received input symbol being ‘S1’ and if the state dependent control for the appropriate transition is set. Thus, one can represent any arbitrary four states NFA by setting or clearing the state dependent control for a specific transition. Thus, if a four states left biased NFA comprises of transition into state ‘A’, from state ‘B’ and ‘C’ but not from the states ‘A’ or ‘D’, the state dependent controls can be set as V1=0, V2=1, V3=1 and V4=0. Hence if the NFA is in state ‘D’ and a symbol ‘S1’ is received, the NFA will not transition into state ‘A’, however if the NFA is in state ‘B’ and a symbol ‘S1’ is received the NFA will transition into state ‘A’.
  • Similarly, FIG. 3 a also illustrates states and transitions for a right-biased NFA. The figure illustrates a right-biased NFA with a state ‘A’, 306, which has incoming transitions from state ‘B’, 307, state ‘C’, 308, and state ‘D’, 309, on receiving input symbols ‘S2’, ‘S3’ and ‘S4’ respectively. However, the transitions from each of the states ‘B’, ‘C’ and ‘D’ to state ‘A’, occur only if the appropriate state dependent control is set besides receiving the appropriate input symbol. The state dependent control for transition from state ‘B’ to state ‘A’ is V2 while those from states ‘C’ and ‘D’ to state ‘A’ is V3 and V4 respectively. Transition to the next state ‘A’ is dependent on present state ‘A’ through the state dependent control V1. Thus transition into a state ‘A’ occurs based on the received input symbol and if the state dependent control for the appropriate transition is set. Thus, one can represent any arbitrary four states right-biased NFA by setting or clearing the state dependent control for a specific transition. All state transition controls for a given state form a state dependent vector (SDV), which is comprised of V1, V2, V3, and V1 for the illustration in FIG. 3 a for the left-biased and the right-biased NFAs.
  • FIG. 3 b illustrates configurable next state table per state. The left-biased state table for ‘NS=A’, is shown by the table 311, whereas the right-biased state table for ‘NS=A’, is shown by the table 312. The state dependent vector for both left-biased and right-biased NFA state is the same, while the received input symbol that drive the transition are different for the left-biased vs. right-biased NFA states. Thus a state can be represented with properties like left-biased (LB), right-biased (RB), start state, accept state, SDV as well as action that may be taken if this state is reached during the evaluation of input strings to the NFA that comprises this state.
  • FIG. 4 a illustrates state transition logic (STL) for a state. The STL is used to evaluate the next state for a state. The next state computed using the STL for a state depends on the current state of the NFA, the SDV, and the received symbol or symbols for a left-biased NFA and right-biased NFA respectively. The InChar input is evaluated against symbols ‘SI through ‘Sn’ using the symbol detection logic, block 400, where ‘n’ is an integer representing the number of symbols in the RE of the NFA. The choice of ‘n’ depends on how many states are typically expected for the NFAs of the applications that may use the search memory. Thus, ‘n’ may be chosen to be 8, 16, 32 or any other integer. The simplest operation for symbol detection may be a compare of the input symbol with ‘S1’ through ‘Sn’. The output of the symbol detection logic is called the received symbol vector (RSV) comprised of individual detection signals ‘RS1’ through ‘RSn’. LB/RB# is a signal that indicates if a left-biased NFA or a right-biased NFA is defined. LB/RB# is also used as an input in evaluating state transition. The STL for a state supports creation of a left-biased as well as right-biased NFA constructs. The LB/RB# signal controls whether the STL is realizing a left-biased or a right-biased construct. The state dependent vector in the form of ‘V1’ through ‘Vn’, is also applied as input to the STL. The SDV enables creation of arbitrary ‘n’-state NFAs using STL as a basis for a state logic block illustrated in FIG. 4 b. Present states are fed into STL as a current state vector (CSV) comprised of ‘Q1’ through ‘Qn’. STL generates a signal ‘N1’ which gets updated in the state memory, block 402, on the next input clock signal. ‘N1’ is logically represented as N1=((V1 and Q1 and (LB/RB# OR RS1)) OR (V2 and Q2 and (LB/RB# OR RS2)) OR . . . (Vn and Qn and (LB/RB# OR RSn)) AND ((NOT LB/RB# OR RS1). Similar signal for another state ‘n’, would be generated with similar logic, except that the signal 401, feeding into the OR gate, 415, would be ‘RSn’, which is the output of the ‘n’-th symbol detection logic, changing the last term of the node ‘N1’ logic from ((NOT LB/RB# OR RS 1) to ((NOT LB/RB# OR RSn). The state memory, 402, can be implemented as a single bit flip-flop or a memory bit in the state logic block discussed below.
  • FIG. 4 b illustrates a state logic block (SLB). The SLB comprises the STL. 406, Init logic. 408, state memory, 410, the accept state detect logic, 411, the SDV for this state, 407, start flag, 409, accept flag, 412, tag associated with this state, 419, or action associated with this state, 413 or a combination of the foregoing. The SLB receives current state vector and the received symbol vector which are fed to STL to determine the next state. The realization of a state of an arbitrary NFA can then be done by updating the SDV for the state and selecting the symbols that the NFA detects and takes actions on. Further, each state may get marked as a start state or an accept state or tagged NFA state or a combination or neither start or accept or tagged state through the start, tag and accept flags. The init logic block, 408, receives control signals that indicate if the state needs to be initialized from the start state or cleared or disabled from updates, or loaded directly with another state value, or may detect a counter value and decide to accept a transition or not and the like. The init block also detects if the FSA has received a symbol not recognized by the language of the regular expression and then may take the FSA into a predefined initial state to start processing the stream at the next symbol and not get into a state where it stops recognizing the stream. The Init block can be used to override the STL evaluation and set the state memory to active or inactive state. The STL, 406, provides functionality as illustrated in FIG. 4 a, except that the state memory is included in the SLB as independent functional block, 410. The state memory, 410, can be implemented as a single bit flip-flop or a memory bit. When the state memory is set it indicates-that the state is active otherwise the state is inactive. The accept detect logic, 411, detects if this state has been activated and if it is an accept state of the realized NFA. If the state is an accept state, and if this state is reached during the NFA evaluation, then the associated action is provided as an output of the SLB on the A1 signal, 416, and an accept state activation indicated on M1, 417. If the FSA reaches a state which is flagged as a tagged state using the tag flag, then the match detect logic may indicate a tag match, not illustrated, which another circuit can use to determine the action to be taken for the particular tag. The action could be set up to be output from the SLB on the state activation as an accept state as well as when the state is not an accept state, like a tagged state, as required by the implementation of the NFA. This can enable the SLB to be used for tagged NFA implementation where an action or tag action can be associated with a given transition into a state.
  • If there are ‘n’ states supported per FSA rule, then each SLB needs ‘n’-bit SDV which can be stored as a n-bit memory location, 3-bits allocated to start, tag and accept flags, 1-bit for LB/RB#, m-bit action storage. Thus if n=16 and m=6, then the total storage used per SLB would be a 26-bit register equivalent which is a little less than 4 bytes per state. If tag start flag and tag end flags are supported, not illustrated, then the number of memory bits would be 28-bits. If multiple tagged expressions need to be enabled then the number of bits for tagging may be appropriately increased. When the number of states in a resulting FSA of a RE is more than ‘n’ supported by the FSA of PRISM, a mechanism is required that would allow the PRISM memory to support such rules. The patent of this application describes such a mechanism and, an architecture described below.
  • FIG. 5 a illustrates State transition logic (STL) for a state in a left-biased FSA. This figure illustrates state transition logic for a state of an FSA when the logic illustrated above for FIG. 4 a is simplified with the LB/RB# set to active and symbol detection logic for one of the states illustrated. The symbol bits are illustrated as ‘m-bit’ wide as S1m . . . S11 illustrated in block 502. The input character symbol bits are labeled as cInm . . . cIn1, 501. The symbol detection logic illustrated in FIG. 4 a, 400, is illustrated as individual bits labeled Em . . . E1, 503, and is also referred to as symbol evaluation logic in this patent. The symbol dependent vector is labeled Vn1 . . . V11, 504 which indicates the symbol dependent vector bit enabling transition into state 1 from each of the ‘n’ states that represent the CSV, Qn . . . Q1, 509, of the FSA. RS1, 505, is the result of the evaluation of the input character symbol with one symbol of the FSA, Stm . . . S11 illustrated in block 502. The logic gates, 506 and 507, are NAND gates that form the logic function to generate the next state, Q1, based on the RS1, SDV, Vn1 . . . V11, and CSV, Qn . . . Q1. States Qn . . . Q2 would be generated using similar circuit structure as the one illustrated in FIG. 5 a, except the .RSV bit, SDV and the symbol specific to the particular state will be used. For example, for the generation of state Qn the Symbol would be Snm . . . Sn1, the SDV vector would be Vnm . . . V1n, and the RSV bit would be RSn instead of RS1.
  • FIG. 5 b illustrates State transition logic (STL) for a state in a right-biased FSA. This figure illustrates state transition logic for a state when the logic illustrated above for FIG. 4 a is simplified with the LB/RB# set to inactive state and symbol detection logic for one of the states illustrated. Key differences between the right biased FSA circuit illustrated in this figure and the left-biased FSA illustrated in FIG. 5 a, is that the next state generation logic depends on all received symbol vector bits, RS1, 505, through RSn, 505 n, which are the result of the evaluation of the input character symbol with each of the ‘n’ symbols of the FSA instead of only one RSV bit, RS1, 505, illustrated in FIG. 5 a. The logic gates. 506 a and 507 b, represent the right-biased FSA logic function to generate the next state based on the RSV, RS1, 505, through RSn, 505 n, SDV, Vn1 . . . V11, and CSV, Qn . . . Q1. States Qn . . . Q2 would be generated using similar circuit structure as the one illustrated in FIG. 5 b, except the SDV and the symbol specific to the particular state will be used. For example, for the generation of state Qn the Symbol would be Snm . . . Sn, the SDV vector would be Vnn . . . V1n, and the RSV vector would be the same, RS1, 505, through RSn, 505 n.
  • PRISM memory allows various elements of the ESA blocks to be programmable such that the compiler of this invention can accept a regular expression and compile it with information for various PRISM state elements to make the general purpose programmable state machine of PRISM FSA to implement the specific regular expression rule. The compiler can compile other rules and later replace the current rule with another rule in the same PRISM FSA or may use another PRISM FSA or a combination of the like.
  • FIG. 6A illustrates Right-biased Tagged FSA Rule block in PRISM. As discussed earlier the FSA of. PRISM are optionally Tagged. For clarity, FSA rule block, PRISM FSA rule block, PRISM FSA rule memory block, rule block, rule memory block, are used interchangeable in this application. Further, NFA rule block or PRISM NFA rule block or NFA rule memory block, are also used interchangeably and mean a PRISM FSA rule block where the FSA type is an NFA in this patent. The discussion below is with respect to tagged NFA, though it is also applicable for non-tagged NFAs or other FSA types where the tagging elements, described below, are not used or not present. This figure illustrates a state block 1, 601, which comprises of some elements of the state transition logic illustrated in FIG. 5 b. The figure illustrates other state blocks, 602 and 603, that represent state blocks 2 through n, where ‘n’ is the number of states of the NFA or FSA programmed in this PRISM FSA rule block. These blocks are illustrated without details unlike state block 1. The primary difference between the blocks is that each state block generates its own RSV bit and uses only its own state bit from the CSV. For instance state block 2, generates RS2 by evaluating the received character with the symbol programmed in its symbol logic block which is similar to block 502. The state blocks are organized slightly differently than the illustration in FIG. 5 b. The logic for one state illustrated in FIG. 5 b, is illustrated to be organized in a vertical slice like, 614, where each state block holds portion of the logic necessary to form the final state. In this illustration the state Qn, 508n, is generated by processing the outputs from each state blocks'‘n’-th slice. The SDV vector bits held in each state block are for transition control from the specific state to all other states. For instance the blocks, like 504 a, hold different members of the SDV vectors compared to the blocks, like 504. Thus the SDV for each state is distributed amongst multiple state blocks unlike that illustrated in FIG. 5 b. For example state block 1, holds SDV vector bits V1n, V1(n-1) through V11 indicating state transition vector bits for transitioning out of state l to the ‘n’ states, unlike FIG. 5 b which are transposed where the state transition logic for a state holds bits Vn1, V(n-1)1 through V11 for transition into state 1. The indices VXY indicate the state dependent vector bit that enables or disables transition from state X to state Y where each X and Y may have a range from 1 through where n is the number of states of the FSA. Thus the SDV of a state indicates the controls for enabling transitions from any state to itself as illustrated in 504, which indicates SDV transition controls from states n through 1 to state 1. As can be noticed the indices of the vector bits are reversed between the FIG. 5 b and FIG. 6 a. Thus a specific state's SDV is distributed in multiple state blocks and is illustrated aligned vertically like slice 614. This figure also illustrates the initialization logic, 408, illustrated in FIG. 4 b as block 605 that affects what value gets loaded in the state memory bit, 508n, under different conditions.like initialization, startup, error state, store and load or context switch and the like. Thus SDV vectors for an FSA are written to the FSA rule block in a state transposed manner as described above. The initialization block comprises of initialization/start state vector memory bits. Thus the input into the init block, 605, is logically equivalent to the node Nth in FIG. 5 b, adjusted for the appropriate state bit. The state control block, 604, comprises of the logic gates, 507 a, which logically NANDs the partial state output, like 615, from the state blocks 1 through state block n. The state control block, 604, further comprises of the init logic blocks, like 605, and the state memory blocks, like 508 a. The FSA Rule block also comprises of tagged match detect block, 613, which may optionally comprise of tagging elements for supporting. tagged NFAs. The tagged match detect block comprises of Accept vector blocks, like 610, which comprise of accept vector memory bits and may optionally comprise of tag memory bits. The tagged match detect block further comprises of accept detect blocks, like 611, which comprise of accept state detection and may optionally comprise of tagged state or state transition detection logic. The state memory blocks, like 508, may be controlled be clock or enable or a combination signals to step the FSA amongst its states as new input characters arc evaluated. The clocked enable signals may provide more control over simple clock by enabling when the FSA should be evaluated. For instance upon finding a match, the FSA controller, 802, described below may be programmed to hold further evaluation of any symbols for this FSA until the match information is processed. The FSA rule block generates multiple output signals that can be used to indicate the progress of the FSA. The FSA rule block outputs comprise of a Rule Match, 609, which indicates when the regular expression rule programmed in the FSA rule block is matched with characters of the input stream. The Rule Match signal may be used by the local or global priority encoder and evaluation processor, blocks 815 and 713 respectively described below, to decide on next steps to be taken based on user programmed actions and/or policies. The priority encoder and evaluation processors may optionally comprise of counters that may be triggered upon specific rule matches. The counters may be used for several purposes like statistical events monitoring, match location detection in the input stream and the like. The priority encoders may also decide the highest priority winner if multiple matches are triggered and then the output may be used to find the appropriate action associated with the matched regular expression rule. The FSA rule block output may optionally comprise of Tag Match signal(s) that may be used by the priority encoders and evaluation processors to detect partial regular expression matches. The number of tag match signals per FSA rule block may depend on the number of sub-expressions that are allowed to be detected in a given NFA. The FSA rule block is organized as a series of memory locations that each hold a portion of the NFA rule evaluation information using memory circuits like the SDV memory, Symbols memory, Mask vectors (discussed below) memory, initialization or start state vector memory, accept state vector memory, optionally tag state flag or vector memory, the FSA states memory or current state vector memory and the like. The FSA rule block comprises of.FSA evaluation circuits interspersed amongst the memory blocks storing the FSA programmable information like the SDV, start state, accept state, symbols and the like. The FSA rule blocks evaluate multiple symbols against input stream for matches to step the FSA. Each symbol evaluation block, like 503, may optionally output an indication of a pattern comparison between the input character or symbol and the programmed symbol. These output signals, like 617, 614, 616, can be treated as local content addressable memory match signals. The PRISM memory may optionally support logic that enables generating merged CAM match signals from multiple FSA rule blocks organized in PRISM memory clusters, which may in turn be laid out in rows and columns of PRISM FSA rule blocks, to support larger width pattern matches. Thus the PRISM memory can be used as content addressable memory when enabled to process the CAM match signals. The PRISM memory can be optionally configured such that portions of the memory support CAM functionality while other portions may support FSA functionality or the entire PRISM memory may optionally be configured to behave like FSA memory or CAM memory. The CAM memories typically support functionality to detect 4 byte patterns, 18 byte patterns or even 144 byte patterns. PRISM memory may optionally provide configuration mechanisms to support similar large pattern evaluation by chaining multiple FSA rule blocks' CAM match signals using appropriate logic to generate composite CAM match signals for desired pattern width.
  • FIG. 6B illustrates Left-biased Tagged FSA Rule block in PRISM. As discussed earlier the FSA of PRISM are optionally Tagged. The discussion below is with respect to tagged NFA, though it is also applicable for non-tagged NFAs or other FSA types where the tagging elements, described below, are not used or not present. Left-biased FSA Rule blocks are similar in functionality as those discussed above for the Right-biased FSAs except for a few minor differences that enable the FSA rule block to behave as a Left-biased FSA. The state blocks, 601 a, 602 a, 603 a, in the left-biased NFAs receive all RSV vector bits, like 505 n, unlike a specific RSV bit per state block in the right-biased NFA. The input to NAND gates like 506 b, is. the specific RSV bit depending on the bit slice at the bit location in the state block of the NAND gate. Thus bit location ‘p’ where ‘p’ can range from 1 through ‘n’, uses RSp (Received Symbol Vector bit ‘p’) to generate the partial state block output, 615 a. By making such a change in the blocks the NFA may now function as a left-biased NFA. The rest of the blocks perform similar functions as described above for a right-biased NFA.
  • PRISM memory may comprise of left-biased NFAs, right-biased NFAs or left-biased FSA or right-biased FSA or a combination of them or may be comprised as selectable left-biased or right-biased NFAs with logic similar to FIG. 4 a. All such variations are within the scope of this invention, as may be appreciated by one with ordinary skill in the art.
  • FIG. 9 illustrates PRISM search compiler flow which is used for full and incremental rules distribution. For clarity, the PRISM search compiler is also referred to as search compiler or compiler in this patent application and the terms are used interchangeably. The search compiler of FIG. 9 allows an IT manager or user to create and compile the search and security rules of different types as illustrated by 901, 902 and 903, without limitations. Even though, the illustrated rules list primarily security type rules there may be regular expression rules for any other application that needs content search like many applications listed in this patent application. The compiler flow would optionally be provided with information about the specific nodes or networked systems or otherwise that may use PRISM and the characteristics of these nodes, like the security capability, the rules communication method, the size of the rule base supported, the performance metrics of the node, deployment location e.g. LAN or SAN or WAN or other, or the like for specific security or network related search applications. The compiler flow may optionally use this knowledge to compile node specific rules from the rule set(s) created by the IT manager or the user. The compiler comprises a rules parser, block 904, for parsing the rules to be presented to the PRISM FSA Compiler Flow, block 906, illustrated further in FIG. 10, which analyzes the rules and creates rules database that needs to be programmed into PRISM memory of the specific nodes or systems for analyzing the content. The rule parser may read the rules from files of rules or directly from the command line or a combination depending on the output of the rule engines like blocks 901, 902 and 903. The rules for a specific node are parsed to recognize the language specific tokens used to describe the rules or regular expression tokens and outputs regular expression (RE) rules, 905. The parser then presents the REs to the PRISM FSA compiler flow which processes the REs and generates NFA for RE. Optionally if tagging is supported by the specific PRISM instance, and if REs use tagging, the PRISM FSA compiler then decides whether the RE will be processed as a NFA or tagged NFA based on the PRISM memory capability. It then generates the NFA or tNFA rule in a format loadable or programmable into PRISM memory and stores the database in the compiled rules database storage, 908.
  • Rules distribution engine, block 909, then communicates the rules to specific system or systems that comprise of PRISM memory. The search rules targeted to specific systems may be distributed to a host processor or a control processor or other processor oldie system that includes PRISM memory. A software or hardware on the receiving processor may then optionally communicate the rules to the PRISM memory by communicating with the external interface, block 702, and the PRISM controller, block 703, described below to configure and/or program the PRISM memory with the FSA rules. The Rules distribution engine, 909, may optionally communicate directly with the PRISM controller, block 703, through the external interface block 702, if the external interface and PRISM controller optionally support such functionality. The rules may be distributed using a secure link or insecure link using proprietary or standard protocols as appropriate per the specific node's capability over a network.
  • FIG. 7 illustrates PRISM block diagram. As may be appreciated by one with ordinary skill in the art, that many different variations of these blocks and their configuration, organization and the like can be created from the teachings of this patent and are all covered without limitations. PRISM controller, block 703, communicates with the rules distribution engine, block 909, or with a master processor or a companion processor like a host system microprocessor or a control processor or a network processor or a switch processor or an ASIC based controller or processor or the like to receive appropriate compiled rule tables prior to starting the content inspection. It programs the received rules into the appropriate PRISM FSA rule blocks, described earlier, by working with the address decode and control logic block 704, coupled to the PRISM controller, block 703, and the PRISM memory cluster arrays, block 710. There may be multiple rules being stored in each PRISM memory cluster array's FSA rule blocks. There may optionally be multiple application specific contexts, not illustrated, supported by the PRISM memory cluster arrays. Once the rules distribution engine provides the compiled rules to the control processor and scheduler and they are setup in their respective NFA rule blocks, PRISM memory is ready to start processing the data stream to perform content inspection. The PRISM memory state configuration information is received via the external interface block, 702, which may communicate on a system bus or a network or the like with a master processor or companion processor, not illustrated. The PRISM memory of this patent may be deployed in various configurations like a look-aside configuration or flow-through configuration or an accelerator adapter configuration or may be embedded inside variety of processors or logic or ASICs or FPGA or the like as discussed earlier as well others not illustrated. In a look-aside or an accelerator adapter configuration, the PRISM memory may optionally be under control of a master processor which may be a network processor or a switch processor or a TCP/IP processor or classification processor or forwarding processor or a host processor or a microprocessor or the like depending on the system in which such a card would reside. The PRISM controller, 703, receives the configuration information under the control of such master processor that communicates with the rule engine to receive the configuration information and communicates it on to the PRISM memory. Once the configuration is done, the master processor provides packets or data files or content to the PRSIM memory for which content inspection needs to be done. The external interface, 702, used to communicated with a master processor may be standard buses like PCI, PCI-X, PCI express, Processor Direct Connect bus, RapidIO, HyperTransport or LA-1 or DDR or RDRAM or SRAM memory interface or SPI4 or Interlaken Protocol or their derivatives or the like or a proprietary bus. The bandwidth on the bus should be sufficient to keep the content search memory operating at its peak line rate to fully utilize the capability of PRISM, however a lower bandwidth bus or higher bandwidth bus may be used as well. If a lower bandwidth bus is used the total throughput may not be higher than the bus throughput. When a higher throughput bus is utilized, the external interface may need to stall the bus or drop some packets, or the like and process the content at the maximum bandwidth supported by that implementation of PRISM. The PRISM memory may preferably be a memory mapped or may optionally be an 10 mapped device in the master processor space for it to receive the content and other configuration information in a look-aside or accelerator configuration. PRISM memory optionally may be polled by the master processor or may provide a doorbell or interrupt mechanism to the master to indicate when it is done with a given packet or content or when it finds a content match to the programmed rules.
  • The PRISM controller receives incoming data for examination using regular expression rules or for examination using patterns to be matched, and may optionally store them into data buffer/memory, block 707, before presenting it to the PRISM memory cluster arrays. The PRISM memory may optionally directly stream the content to be examined to the content stream logic, block 708, which may stage the content for examination by the PRISM memory cluster arrays, block 710. The PRISM controller maintains the record of the content being processed and once the content is processed it informs the master processor. The PRISM memory cluster arrays inform the global priority encoder and evaluation processor, block 713, of the results of the search. When a. match to a rule is found the priority encoder and evaluation processor may retrieve an action associated with the rule from the global action memory, block 717, depending on programmable policies and may optionally provide this to the PRISM controller. The PRISM controller may optionally inform the master processor about the search results. The PRISM controller may execute the specific action or policy defined for the rule match. The actions may optionally comprise to stop further content evaluation, enable a certain set of rules to he examined by enabling appropriate cluster array and pass the content through that PRISM memory cluster array for further examination, or inform the master processor of the result and continue further examination or hold the match result in on-chip or off-chip memory or buffers for the master processor to request this information later or any combination thereof or the like lithe PRISM memory is configured to examine network traffic in a flow-through configuration, not illustrated, it may also be programmed to drop the offending packet or stop the specific TCP connection or the session or the like. Optionally the master processor may receive the match information and may take specific actions on the content stream.
  • The address decode and control logic, block 704, is coupled to the PRISM controller, 703, the external interface, 702, the PRISM memory cluster arrays, 710, the global priority encoder and evaluation processor, 713, the database expansion port, 718 as well as other blocks through a coupling interface, 715. The PRISM memory may support a large number of regular expressions in some preferred embodiments as discussed above, however if there are applications that need more rules, then there may optionally be a database expansion port, 718, which would enable the expansion of the rules by adding additional PRISM memory(ies) to the database expansion port. The database expansion port may provide a seamless extension of the number of rules and may use additional memory space in the host or master processor. There are multiple ways of enabling the database expansion as may be appreciated by those with ordinary skill in the art. The address decode and control logic is also coupled to optional, cluster address decode and FSA controller, block 802, and decodes addresses for the PRISM memory locations which are used to hold FSA rule block programming information as well as the FSA state information. It may perform the address decode, memory read, memory write and other PRISM memory management control functions by itself or working in conjunction with cluster address decode and FSA controller. The blocks 704 and optionally 802, may be programmed to provide configuration information for the clusters. The configuration information may optionally comprise of size of the NFAs e.g. 8-state or 16-state or the like, CAM functionality enabling, tagged NFA related configuration, context addresses if appropriate for local cluster context addressing and/or global context addresses, clusters specific configurations that may support a mixed CAM. and Regular Expression functionality at the PRISM memory level, action memory association for specific FSA rules or clusters or a combination thereof and the like. The PRISM memory cluster arrays and other blocks like global and local priority encoder and evaluation processor, blocks 713 and 815, local (not illustrated) and global action memories, block 717, and the like may get configured and programmed with information before the content inspection begins. Further, since PRISM memory supports dynamic reconfiguration of rules, its programming and configuration may be updated during the content inspection as well for example when a new security threat has been discovered and a new rule to catch that security violation needs to be programmed. The PRISM memory may provide multiple content streams to be processed through the PRISM memory cluster arrays, using context mechanism which associates each content stream with a specific context, which may optionally be assigned a specific context ID.
  • FIG. 8 a illustrates PRISM Memory cluster block diagram. There may be options to have multiple content streams and hence multiple contexts may optionally be simultaneously operated upon in different memory FSA clusters, illustrated in FIG. 8 a. For clarity, PRISM Memory cluster, memory FSA cluster, a cluster, memory cluster and memory FSA cluster are used interchangeably in this patent. A given cluster and its associated FSAs may also be able to support multiple content streams using the context information. When a new content stream starts getting processed by a FSA rule block or a cluster or the like, it may traverse through various FSAs whose states may need to be saved, if the content stream is not fully processed, when the same FSAs need to start processing another content stream. The local context memory, block 812, or global context memory, block 712, or external memory (not illustrated) coupled to external memory controller, block 1221, or a combination thereof may be used to save the state of active FSAs for a given context before the FSAs are switched to operate on a different context. Further, the new context may have its saved context restored in the specific FSAs before content from that context starts to be processed. The local context memory along with global context memory affords the benefit of very fast context switching for active contexts simultaneously across multiple clusters and FSAs without creating a context switch bottleneck. The number of contexts being store locally per cluster and those stored globally or externally is a function of the manufacturing cost and other tradeoffs which will be apparent to the one with ordinary skill in the art. Typically the amount of information that needs to be stored and retrieved per context may be limited to the NFAs or FSAs that are in the process of recognizing a specific string defined by its regular expression. In general most NFAs or FSAs may be continuously be starting to analyze the input streams from a start state if the strings being searched are not very frequent in the content being search. The FSA controller, block 802, coupled with blocks 704, and the local and global context memories and their respective memory controllers as well as the blocks 713 and 815, the local priority encoder and evaluation processor, takes the steps to perform the context switch if contexts are enabled before processing a new context.
  • The cluster address decode and FSA controller, block 802, may decode incoming addresses for configuring, reading or writing from PRISM memory locations or the like of the cluster PRISM array, block 808 which is comprised of an array of PRISM FSA rule blocks illustrated above in FIG. 6A and FIG. 6B, and also referred to as PRISM Search Engines (PSE) or programmable PRISM Search Engines or programmable search engines, block 803, in this patent, and activates memory location's word line and/or bit lines or other word lines or content lines or mask lines or the like or a combination thereof, described below to read, write and/or access the specific PRISM memory location. There may optionally be cluster specific bit line drivers and sense amplifiers, block 809, and bit line control logic, block 810, which may be used to read or write specific bits in the PRISM. cluster Memory array, block 808. These circuits are well understood by memory designers with ordinary skill in the art. The sense amplifiers and drivers may optionally be present at the global PRISM memory level illustrated in FIG. 7 depending on the tradeoffs of die area, performance, cost, power and the like which one with ordinary skill in the art can easily appreciate. The benefit of having local sense amps and drivers is potentially creating lower interconnect load for individual memory bits, which in turn can help improve the performance. Typically the block 802 may he operating during the configuration, context switching or other maintenance operations like storing and retrieving specific NFA or FSA state information, or refreshing specific PRISM FSA memory hits if appropriate and the like. Generally during content processing the block 802 may be dormant unless there is a match or an error or the like when it may start performing the necessary tasks like communicating the match, action, policy, error or the like to the PRISM controller, initiating context switching and the like. The PRISM controller, block 703, coupled with the content stream logic, block 708, content staging buffer, 709, address decode and control logic, block 704, and the cluster FSA controllers, block 802, may present the content to be examined to the PRISM FSA rule blocks. The content to be examined may be streamed by the block 708 from the data buffer or memory, 707, or from external memory, or a combination into the content staging buffer. The content staging buffer, 709, is coupled to cluster search buffer, 806, and cluster search control, 807 to align the appropriate content to the clusters for searching. The content staging buffer may hold content from the same context or multiple contexts depending on the configuration of the clusters and the like. The content is presented to the cluster PRISM array, 808, that comprises of the PRISM NFA rule blocks for examination in a sequence timed using a control signal like a clock or enable or a combination. The NFA rule blocks perform their inspection and indicate whether there is any rule match or optionally if there is any CAM pattern match or optionally any tag match and the like. The match signals are looked at by cluster level local priority encoder and evaluation processor, block 815, which may determine if there is a match and if there are multiple matches which match should be used, or all matches should be used or the like depending on the configuration. This block 815, may be coupled to global priority encoder and evaluation processor, block 713, which may perform a similar operation by examining match signals from multiple clusters. The local and global evaluation processors of these blocks may optionally generate address(es) for the winning matches) to the global action memory or external memory or a combination that may store appropriate action information that needs to be retrieved and processed to determine action(s) that need to be taken as a result of specific rule match(es). There may be optional cluster level action memory, not illustrated, for fast retrieval of action information. This cluster level action memory may act as a cache of the global and/or external memory based action storage. As described earlier the .FSA controller, block 802, coupled with local context memory, block 812, its memory controller, block 813, along with the local and global evaluation processor and priority encoders coupled to global action and context memories, may be used to store and retrieve context information from and to configure the PRISM cluster arrays with appropriate FSA states.
  • FIG. 8 b illustrates PRISM Memory cluster detailed block diagram. This figure illustrates more detail of the PRISM memory cluster block diagram illustrated in FIG. 8 a and described above. The PRISM memory clusters comprise of PRISM Search. Engines (PSE), blocks 803, which comprise of the right-biased or left-biased NFA or FSA rule blocks or a combination which may optionally be tagged as illustrated in FIG. 6A and FIG. 6B and described above. The PSEs may optionally comprise row-wise, column-wise or a combination there of or the like mechanisms described below to enable PRISM FSA extension (also referred to as PRISM Search Engine Extension or PSE Extension, in this patent) and optionally allow creation of PRISM based FSA rule groups (also referred to as Regular expression rule groups or PRISM Search Engine rule groups or PSE rule groups, in this patent). The FIG. 8 b illustrates the PSEs arranged in an array with ‘n’ rows and ‘m’ columns where ‘n’ and ‘m’ may be any integer value and may depend on design, cost, process technology, performance, power and other parameters that one with ordinary skill in the art will appreciate. One exemplary embodiment may comprise of ‘n=128’ and ‘m=8’ providing 1024 PSEs per PRISM memory cluster. The PSEs may optionally comprise of mechanisms for extending the FSAs using methods described below. The PSEs may comprise row-wise FSA extension, column-wise FSA extension or a combination thereof. The PSEs are coupled to each other and may optionally be coupled to the local priority encoder and evaluation processor, block 815, for row-wise FSA extension using one or more signals, illustrated by lines 821(1) through 821(n). The PSEs may also be coupled to each other in a column-wise manner using one or more signals represented as a group of lines, 820(21) through 820(nm), coupling PSEs to their column-wise neighbors. Such signals may be used to provide a column-wise FSA extension using mechanism and architecture described below. The PRISM cluster priority encoder and evaluation processor, block 815, may further comprise configurable controls that would allow any group of extensible FSAs to be coupled to other groups of FSAs local to the PRISM memory cluster or inter-clusters (i.e. between multiple PRISM memory clusters) or a combination thereof Cluster Address Decode and FSA Controller, block 802, provides controls, 804(1) through 804(n) like word line address and the like for each PSE and its internal memory elements like the SDV, Symbols and the like which are used to configure the PSEs with appropriate RE rules converted or compiled in to programmable ESA data structures. It may also be coupled to the cluster search controller, block 807, and sense amps and read buffers, block 819. The cluster search controller, block 807, may receive the byte values to be configured into the PSEs and may comprise the bit line drivers for the PSE memories. The sense amps and read buffers may comprise the sense amplifiers and data read buffers to read and store the information retrieved from the PSE array. Once the PRISM memory clusters are configured with the RE rules, the content to be processed may be presented to the cluster search controller. The cluster search controller, block 807, is coupled to the columns of PSEs using signals, 822(1) through 822(m), that may comprise bit lines for each of the ‘m’ columns of the PSE array. The cluster search controller may present the same content symbols or characters or bytes or the like, to each column of the array such that every FSA can process each incoming symbol and be evaluated simultaneously. However, if the PRISM cluster is configured to be used as content addressable memory, the content search controller may present the content in chunks of ‘m’ symbols or chunks of two ‘m/2’ symbols or the like to the PSE array. The PSEs provide the indication of whether a match with the programmed rules is detected or not or if a tag is matched or not or the like in a row-wise manner to the local priority encoder and the evaluation processor, block 815, using the signals, 811(1) through 811(n), that couple the PSEs in a row with the block 815. The local priority encoder and evaluation processor may receive the match signals and based on optional policy programmed, provide the winning match if multiple match signals are asserted simultaneously or may record each match or a combination. It may also provide counters to keep track of the specific location in the incoming content stream where a match or a set of matches were generated. It may further provide actions associated with specific RE or FSA rules being activated and may comprise of stopping the processing of the specific content flow or content stream or content session or the like; or generating an alert or activating a new rule group or stopping a certain rule group from further examination or a combination there of or the like. It also communicates with the global priority encoder and evaluation processor, 713, to take appropriate actions similar to those described above. The content read into the read buffers of block 819, may be coupled to the local cluster context memory, 812, or global context memory, 712, or external memory controller, 721, through the signals 817, block 815, signal 814, signals 711 and signals 715 for storage to the appropriate memory location internal to the PRISM chip or an external memory coupled to the block 721 using the external interface signals 720.
  • Each PSE of a PRISM memory cluster may be addressed using one PRISM Memory location or a set of PRISM memory locations or a combination thereof. All internal memory elements of a PSE like the each state dependent symbol memory, mask vector memory, SDV memory, or the initialization vector memory and the like may each be mapped as individual memory locations in the PRISM memory address space or may each be addressable in a PSE address space once the PSE is selected from a PRISM memory address or the like as may be appreciated by one with ordinary skill in the art. One preferred embodiment may comprise of 22 PRISM Memory address bits where in the upper 17 address bits are used to select a specific PSE in an embodiment with 128,000 PSEs and the lower 5 address bits are used to select a specific memory element of the selected PSE as described. above. Other variations of such an arrangement are within the scope and spirit of this invention as may be appreciated by one with ordinary skill in the art. The number of address bits allocated to select PSEs depends on the number of PSEs and the number of address bits allocated to select memory elements of a PSE depend on the number of memory elements in one PSE, which may in turn depend on the number of states per PSE, FSA extension mechanisms per PSE, symbol size and the like as may be appreciated by one with ordinary skill in the art. Further, a specific PSE within a cluster may be addressed or selected by PRISM memory cluster row address and a column address which would be derived from the PSE address bits. One preferred embodiment of PRISM memory with 128,000 PSEs may use 128 rows and 8 columns of PSEs per PRISM memory cluster, there by supporting 1024 PSEs per PRISM memory cluster. In such a PRISM memory embodiment, upper 7-bits of the 22-bits for PSE address may be allocated to select a specific PRISM memory cluster, and the next 10 bits of the PSE address may optionally be used to select a specific PSE in a PRISM memory cluster while the lower 5 bits may optionally be used to select a specific memory clement of the selected PSE of the selected PRISM memory cluster. The 10-bit address for selecting a specific PSE of a PRISM memory cluster, may further be allocated such that upper 7-bits of that may be used as a PSE row address selection and the remaining 3-bits of the address used as a PSE column address selection. There are multiple other ways to perform the addressing of PRISM memory as may be appreciated by one with ordinary skill in the art and all such variations are within the spirit and scope of the teachings of this invention.
  • FIG. 11 illustrates PRISM row-wise FSA extension. The figure illustrates PRISM Search Engines as FSA 1, 1101(1), FSA 2, 1101(2) through FSA M, 1101(M), which may optionally be PSEs in a row of a PRISM cluster. The PSEs are similar to those illustrated in FIG. 6A and FIG. 6B with some additional blocks described below that enable the PRISM PSEs to become extensible to support FSAs that need more states than those supported by a single PSE. The State Blocks 1 through N, 1102(1) through 1102(N) are similar to state blocks 601, 602, 603 of the left-biased or right-biased tagged NFAs or FSAs rule blocks described above. The State Control and Match detect blocks, 1105(1) through 1105(N) and 1106(1) through 1106(N), are also similar in functionality to state control, block 604, and match detect, block 613, described above for FIG. 6A and. FIG. 6B, with some minor addition to accept another term of partial state transition control feeding into the transition logic illustrated in block 507 a or 507 n or the like. The additional state transition control is based on a global state transition described below. Row-wise FSA Extension architecture in PRISM comprises of a Global State Dependent Vector (GSDV), block 1103(1) through 1103(N). It may optionally comprise of a Global Control Vector (GCV), blocks 1107(1) through 1107(N), and may optionally comprise of a Global Transition. Logic (GTL), blocks 1108(1) through 1108(N). They may optionally be coupled to the state transition logic of each FSA being extended using a Global Control Network (GCN) which may comprise of multiple circuits like those illustrated by blocks 1113, 1114, 1115, 1116, 1121, 1122, 1123, 1124, 1104(1) through 1104(N) per FSA block or the like or a combination thereof. The GSDV may optionally be an N-bit Vector, where each bit of the vector may enable a transition into the corresponding state of the FSA from a state external to the FSA. It is possible to restrict the number of Global entry points into an FSA, in which case the GSDV may be a vector with fewer than. N-bits corresponding to the states that may be entered from other FSAs using the FSA extension mechanisms described in this patent. Similarly GCV and GTL may also be N-bit vectors or vectors with fewer bits. The decision to use N-bits or less bits for these vectors may depend on the RE characteristics, application requirements, device size, implementation costs and the like as will he apparent to those with ordinary skill in the art. The GSDV and GCV vectors are memory locations and realized using memory circuits similar to other memory bit vectors like SDV, Symbols, the mask vectors and the like of this patent as may be appreciated by one with ordinary skill in the art. The specific memory bits circuits are not illustrated to avoid obscuring the invention. When a bit of GSDV is set to ‘1’ or an active state, the input to the logic gate, like 1104(1), from GSDV is set and would then enable a transition to the corresponding state if symbol associated with that state is received like RS11, and the state from another FSA that controls the extended FSA state transition is set to ‘1’ or active state. Descriptions below illustrate a few examples to clarify the GSDV controls. Thus the GSDV controls the transition into a particular state of the associated FSA from another FSA. Similarly GCV, controls a global out state transition where the transition is out of a specific state of an FSA to another FSA that is coupled to it using the FSA extension mechanisms described in this patent. When a GCV vector bit, like 1107(1) is set to an active state like ‘1’, and if the corresponding state, 1106(1) of the FSA, 1101(1) is set, then the GTL logic, 1108(1) would be activated. FIG. 11 illustrates a pre-charge and discharge circuit forming a wired-NOR logic between the GTL blocks of the FSAs coupled to form row-wise FSA extension. For example, the GTL blocks like 1108(1) of each of the coupled FSA is coupled to a precharge line like 1109, 1110, 1111, 1112 or the like, which are precharged by transistors like 1113, 1114, 1115, 1116 or the like. When any of the GTL receives its inputs like 1125(1) and 1126(1) as active, it pulls the coupled precharge line 1109 to a low value. When none of the GTL outputs pull the precharge lines like 1109, they stay at their precharged high value that has been precharged by the corresponding precharge transistor like 1113. The output of the precharged signals may optionally be buffered or inverted as illustrated by inverters like 1121, through 1124 which then drive those signals to all the FSAs coupled to the output signals, like 1117 through 1120, of the inverters with the corresponding FSA gates like, 1104(1) through 1104(N). Hence, when signal 1109 is pulled low, the output 1117 may be pulled high. Thus if the GSDV bit connected to the device, 1104(N) of an FSA is high and the received symbol is RSn1, the transition into that state is enabled. Although the figure illustrates the precharge signals, like 1109, to be coupled to inverters, like 1121, they may optionally be coupled to a multiplexer input, not illustrated, such that another input of the multiplexer may be used to control whether the value on the signals, like 1117, is from the local FSA group or from an input state external to the FSA group, not illustrated. Such a multiplexer or other logic or a combination may be used to create a rule group transition control network, where a rule group may be enabled when another event is detected by other PRISM FSAs or PRISM clusters.
  • FIG. 11A illustrates PRISM Rule Group FSA Extension. PRISM memory of this patent may optionally allow formation of a group of REs to be treated as a rule group, such that one group of REs may be enabled when another RE or RE group is evaluated to be active. This figure illustrates a mechanism to enable such rule group FSA extensions. The Rule group architecture leverages all the features of the Row-Wise FSA Extension logic described above, with a small modification,. where the inverters, 1.121 through 1124, are replaced by Rule Group Transition Logic (RGTL), block 1128, which enables the transition to a set of FSAs from other Rows of PRISM cluster or other PRISM clusters or other groups of FSAs or other groups of regular expressions. The Rule Group FSA Extension architecture further comprises of Rule Group Control Vector (RCV), 1126, which may be an N-bit vector or the same width as the width of the GTL of each FSA. When a bit of RCV is set, then the corresponding output signal in the group, 1127, is set which in turn may let the corresponding output signal, like 1117, of the RGTL block be coupled to a corresponding signal of External State Vector (ESV), line 1125 instead of the Row-wise FSA Extension precharge signal, like 1109. The ESV bits may be state output from a group of rules within the PRISM Cluster or another PRISM cluster or other groups of FSAs or other groups of regular expressions. When such a group's state that indicates a transition to another rule group is activated, the global evaluation processor, block 713, or the local evaluation processor, block 815, or a combination couple that state signal to the corresponding ESV bit which then enables the transition to the state enabled by the output of the RGTL. Optionally the PRISM local evaluation processor, block 815, or global evaluation processor, block 713, or PRISM controller, block 703, may set the appropriate ESV bits to cause the nile group to be activated. ESVs for various rule groups may be memory mapped such that by writing to such an ESV memory location a specific rule group may be activated. When a rule group transition like the one described here is enabled, the corresponding Symbol detection could optionally be ignored by setting the mask bits for that specific symbol, or the like, such that the rule group is activated once the corresponding ESV bit is asserted. Another output of the RGTL, may be ESV_out, signal 1129, which may be the outputs of this rule group that can be used to trigger transition into a state of another rule group. The ESV_out may be an N-bit or less vector as an output from RGTL which may optionally comprise an internal RCV_out vector, not illustrated, that may control which state bits are enabled on to ESV_out from this rule group. The RGTL may comprise a simple multiplexer based logic circuits, but may also comprise a mesh network connecting each precharge input or ESV input to the output or a combination there of or the like.
  • Although the description here and elsewhere within this patent may be with regards to precharge circuits, it will be appreciated by those with ordinary skill in the art, that other non-precharge circuits or logic may be used to realize the same functionality and all such variations are within the scope and spirit of the teachings of this patent.
  • FIG. 12 illustrates PRISM Row-wise FSA extension example # 1. The FSAs in FIG. 12 are assumed to be four state FSAs. Thus if a RE has more than four states, it would not fit in a single FSA or PSE. In such a case FSA extension architecture and mechanisms described in this patent will need to be used. FIG. 12 illustrates a PRISM row with four FSAs, FSA1, through FSA4, blocks 1201(1) through 1201(4), each with four states that can be used to represent a 16-state RE ‘abcdefghijkLmnop’ using the row-wise FSA extension. In this example, the RE is a simple 16-character string which is split up into four chunks of four characters each by the compiler and assigned each chunk, to one of the FSAs. The states of each FSA state bits are illustrated to represent a specific symbol or character like 1202(1) which is used to represent the state corresponding to the symbol ‘a’. This state bit is set when the received input symbol is an ‘a’. The value of the state bit is represented as the symbol in the description below for ease of explanation and would otherwise be a logical value like ‘1’ or ‘0’ or the like. The symbol ‘a’ is the start state indicated by the single circle around the symbol, 1202(1). Thus when the input content has a symbol ‘a’ the RE rule or FSA starts the evaluation of the content and enters the state ‘a’. The figure does not illustrate the SDV for each of the states and the FSAs to avoid obscuring the description of the FSA extension as may be appreciated by those with ordinary skill in the art. The SDVs, symbols and other controls of the FSA 1, block 1201(1) are set such that the state transition within the FSA progresses from a to b to c to d, if a series of input symbols received is ‘abed’. Similarly, for FSA 2, block 1201(2) through FSA 4, block 1201(4) the internal transitions are implied and not explicitly illustrated. The FSA extension is created by setting the GSDV and GCV such that the sequence of states that are enabled detect the desired RE string, ‘abcdefghijkLmnop’. The GCV vector bit 4, 1203(4) of FSA 1 is set to ‘1’ while its other bits are set to ‘0’. Thus when the FSA 1 reaches the state ‘d’, block 1202(4), the GTL bit 4, 1210, is pulled low, which indicates that the FSA 1 has reached a state that can now enable a transition to a state in another FSA. The GSDV bit 1, block 1214, of FSA 2, block 1201(2) is set to ‘1’ which enables the transition into state ‘e’, block 1218, when the received symbol is RS12 (‘e’) and the line 1204, coupled to the third input of NAND gate, 1217, through the inverter coupled to 1204 is activated. If the input string received so far is =abcde’ then the state ‘e’ of FSA 2 is activated. However, if the fifth character of the input string is not an ‘e’, the FSA 1 state ‘d’ is deactivated and thus even if the following symbol i.e. the sixth symbol is an ‘e’, the FSA 2 state ‘e’ is not activated. Assuming that the string received is ‘abcde’, then the state ‘e’ is activated. FSA 2 traverses through the states ‘fgh’ if the following three symbols received are ‘fgh’. As may be noted in this illustration, the states are not sequentially arranged, for example the state ‘h’ appears as the third state, block 1208, instead of the fourth state in FSA 2. To enable such organization of the states, the SDV of the state ‘h’ of FSA 2 is setup such that state ‘h’ is logically the fourth state that is entered after state ‘g’ is activated, where state ‘g’ is the third logical state entered from state ‘f, setup to depend on state ‘f’ in SDV of state ‘g’. Thus physical location of the symbol is not required to be in a sequential order because the state transition in PRISM depends on the current state, the received symbol and the state dependent vector. Similarly, the state ‘h’ of FSA 2 is coupled to state T of FSA 3 using GCV bit 3, 1207, GTL bit 3, 1209, and signal 1205, coupled to the GSDV bit 2, 1215, coupled to the transition input gate for the state ‘i’ of FSA 3, 1201(3). Similarly the state ‘L’ of FSA 3 is coupled to state ‘m’ of FSA 4 using the appropriate GCV and GSDV bits as illustrated. When the state ‘p’ of FSA 4 is reached, the RE is matched and the input string is recognized to be ‘abcdefghijklmnop’. The state ‘p’ is marked as the accept state by the compiler, illustrated by double circles, 1219, such that accept vector of the FSA 4 is set as ‘0100’, so that ‘p’ is the accept state. When the accept state ‘p’ is reached a match signal, like 609, of FSA 4 is asserted which is then recognized by the cluster priority encoder, block 815, and a RE match is flagged and appropriate action associated with this RE match taken or initiated.
  • FIG. 13 illustrates PRISM Row-wise FSA Extension example # 2. In this illustration, similar to that in FIG. 12, the FSAs are assumed to be four state FSAs. However the regular expression rule to be evaluated is: (abc|defghi)+jkL, which recognizes a string of characters that contain one or more occurrences of sequences ‘abc’ or ‘defghi’ followed by the sequence ‘jkL’. Note the one or more occurrences of sequence ‘abc’ followed by ‘defghi’ which is followed by ‘jKL’ once or one or more occurrence of sequence ‘defghi’ followed by ‘abc’ which is followed by ‘jKL’ may also be recognized by the regular expression. The expression (abc|defghi)+indicates that the terms ‘abc’ or ‘defghi’ may occur one or more times or may occur one after the other one or more times. The FIG. 13 illustrates how such a RE be evaluated using a Row-wise FSA extension architecture and mechanisms of this patent. In this expression, whenever the states ‘c’ or are reached, the expression can start evaluating at states ‘a’, ‘d’ or T, since they are all the follow states of the states ‘c’ and ‘i’. To enable such a transition the compiler assigns GCV vectors of FSA 1 and FSA 3 to be ‘0001’, such that when state ‘c’ is reached, signal 1302 is coupled to precharged signal 1314, or when the state T is reached. signal 1304, is coupled to precharged signal 1316, which is coupled to line 1314. These outputs are then coupled to the states ‘a’, ‘d’ and ‘j’ by the GSDV vectors for FSA 1, FSA 2 and FSA 4 where the bits, 1305, 1308 and 1312 are each set to ‘1’ enabling a transition into the states ‘a’, ‘d’ and ‘j’ from the states ‘c’ or ‘i’. The expression ‘defghi’ is compiled to occupy two FSAs, FSA2 and FSA3, which are coupled by the GCV and GSDV bits that couple the output 1315 from the state location ‘g’ of FSA 2 to input gate, 1310, which transitions into state ‘h’ when the received symbol is ‘h’ since the GSDV bit 2, block 1309, is set to ‘1’. When the FSA 4 reaches the state L, which is marked as an accept state the FSA 4 asserts the match signal like 609, which is then recognized by the cluster priority encoder, block 815, and a RE match is flagged and appropriate action associated with this RE match taken or initiated.
  • FIG. 14 illustrates PRISM Column-wise FSA extension. The figure illustrates a group of four FSAs on the left where each FSA is in one row. Each FSA is illustrated to comprise of eight states where each state and its state transition logic, match detection logic and the like is represented by a box each, like 1401(1) through 1401(8). The FSA state bits are illustrated to be aligned in columns labeled Bit 1 through Bit 8. Each state bit of an FSA is illustrated to be coupled to its neighbor using up and down control switches illustrated as lines 1403(1), 1403(2) and the like. Blocks 1404(1), 1404(2), 1405(1) and 1405(2) illustrate FSA state bits 1 and 2 of two FSAs, ESA 1 and FSA 2 illustrating the column-wise FSA extension architecture (also referred to as column-wise extension architecture in this patent) in detail and mechanism and do not illustrate all other components of PSE state like the RSV, SDV and the like. The state bits of adjoining .FSA rows are coupled to transfer their state information to the neighbor in a column-wise manner. FSA bits 1 are illustrated to transfer the state information in the down direction from block 1404(1) to block 1404(2), while the FSA bits 2 are illustrated to transfer the state information in the up direction from block 1405(2) to block 1405(1). Each FSA state bit may comprise of both up and down transfer mechanisms or they may be alternating as illustrated in this figure or there may be other pattern like skipping one state bit to transfer the states or the like and all such variations are covered by this patent as may be appreciated by one with ordinary skill in the art. The illustrated column-wise ESA extension logic enables each bit to accept an incoming state, and originate the transfer of its state to the next neighbor. The column-wise ESA extension comprises a global Fonvarding vector (FV) which comprises of bits like FV11 of block 1404(1). It may further comprise of local forwarding vector (LV) which comprises of bits like LV11. It may further comprise of circuits that allow the state bits to be merged and forwarded down or up or a combination thereof using gates like 1406, 1407 and 1408 that forms column state transition control circuit forming an AND-OR logic function between the inputs, such that if FV11 is set to ‘1’ and LV11 is set to ‘0’, then signal group forward down signal GD11 of block 1404(1) is coupled to output of gate 1408, onto the signal GD21 of block 1404(2). Similarly, if FV11 is set to a ‘0’ and LV11 is set to a ‘1’, then the state Q11 of the FSA bit 1, block 1404(1) is coupled to the signal GD2I. Further, the gate 1409, may enable the transition into the state bit 1, if UC11 is set to ‘1’ and the received symbol is RS 11 when GD11 is ‘set’. The Up Control Vector (UC), comprises of control bits like UC11 per FSA state bit, and enables that particular state bit to accept a transition into that state if the UC bit is set enabling .FSA extension from another FSA. Similarly, the logic gates 1410, 1411, 1412 and 1413, coupled to the FV, LV and UC bits FV21, LV21 and UC21 respectively enable the column-wise FSA extension into and out of state bit 1 of FSA 2. The FV and LV vectors are not required to be mutually exclusive. Hence, an FSA state bit may accept an incoming state and allow the same state to be forwarded if FV and UC bits are set to ‘1’. It is also optionally feasible to merge the state bit output of the current bit to the incoming state bit, by setting both .FV and LV vector bits to ‘1’. In such a case the forwarded output state is a ‘1’ when either the incoming state bit is a ‘1’ or the local state bit is a ‘1’ or both. The FSA bits 2, illustrate a very similar mechanism as the one described above to transfer the state in the opposite direction. The upwards FSA column-wise extension Mechanism may comprise of global Forwarding Vector-Up (UV), Local Forwarding Vector-Up (UN), Down Control Vector (DC) and may further comprise of the logic like gates 1418, 1419, 1420, 1421 forming column state transition circuit in the reverse direction as the one above and the like that enable the transfer of a local state like Q22, upwards as well as forward an incoming state, like group forward up signal GUP22, upwards, coupling to output GUP12, a well as accept an incoming state, GUP22, from a lower FSA to enable transition to its state bit by coupling through a gate like 1418 and the like. Again the LUV, UV and DC are not required to be mutually exclusive. The FV, LV, UC, UV, LUV, DC bits may each be setup as memory locations that get programmed like other control vectors for example the SDV, Symbols, mask vectors and the like. The memory circuits for these bits are not illustrated to not obscure the invention and are similar to any other memory bits of PRISM as may be appreciated by one with ordinary skill in the art.
  • FIG. 15 illustrates PRISM FSA Extension Example # 1. This figure illustrates a Column-Wise Extension on the left and it also illustrates Row-Wise and Column-Wise Extension on the right. These figures illustrate PSE comprised of 8 states per FSA. The figures illustrate how four regular expressions may be programmed in PRISM using the FSA extension architecture and mechanism of this patent. Block 1501, illustrates how a regular expression REI: (abc|defghi)+jkL may be programmed using the column-wise FSA extension. Each box like 1513 represents an FSA state bit and all the other associated circuits, similar to block 614 with circuits for FSA extensions described above added, and is labeled with the state that it represents using the states corresponding symbol like ‘a’. Block 1504, illustrates how a regular expression RE2: ‘abcdefghijkLmnop’ may be programmed using the column-wise FSA extension. The figure does not illustrate the GSDV, GCV, SDV and the like vector bits being setup to simplify the illustration and description, but are implied to be setup properly by the PRISM search compiler to enable the right transitions between multiple states. Further, the figures illustrating RE examples in this patent, local state transitions within an FSA are implied to exist and proper programming generated by the compiler but are not illustrated to not obscure the figures. The arrows in the figure, like 1508 and 1507 are used to indicate inter-FSA transitions enabled using the FSA extension mechanisms of this patent. The RE1 is programmed to include two terms ‘abc’ and ‘jkL’ of the RE1 in the FSA in Row1. However, the term ‘defghi’ is programmed using the column-wise FSA extension mechanisms described above and is distributed between FSAs in Row 1 and Row 2. For instance, the state ‘d’ is assigned to Row1 and column B3, block 1514. The local vector of this state bit is set to ‘1’. Thus when the state ‘d’ is activated the output from B3 Row1 to 133 Row 2, arrow 1508, is activated. The UC vector bit 3 for the Row 2 state hit 3 is set to a ‘1’ which enables the transition into state ‘e’, Row 2 column B3, if the received symbol is ‘e’. Thus if the input content is ‘de’, then the downward transition, arrow 1508, will be taken and the FSA in Row 2 will be in state ‘e’. However, if the second symbol is not an ‘e’, then the state ‘e’ is not activated. The states of FSA in Row 2 are programmed such that they transition from ‘e’ to ‘f’ to ‘g’ to ‘h’ when a sequence of ‘efgh’ is received after a symbol ‘d’. When FSA 2 reaches state ‘h’, the upward state forwarding mechanism between Row2 column B8 and Row1 column 88 is activated and the FSA in Row 1 will reach the state ‘i’ if the next symbol received is ‘i’. For the upward transition, the local forwarding vector-up (LUV) bit for Row 2 column 138 is set to ‘1’ and the down control vector (DC) bit for Row1 column 138 is set to ‘1’, which enable the transition from Row2 FSA state ‘h’ to Rawl FSA state ‘i’. When the state ‘c’ or ‘i’ of Row 1 is active, then the following states that the FSA may enter as per the RE1 are ‘a’, ‘d’ or ‘j’ depending on the received input symbol and so the SDV vectors for those states are set up to transition from the states ‘c’ or T. When the Row 1 FSA reaches state ‘L’, which is programmed as an accept state, the RE1 is activated and the input string recganized by this RE has been received on the input. A match signal like 609 from this FSA is activated and send to the cluster priority encoder and evaluation processor which takes appropriate action based on this regular expression match. Block 1504, illustrates a regular expression RE2: ‘abcdefghijkLmnop’ programmed using the column-wise FSA extension mechanisms of this patent. The state ‘a’ which is the start state, block 1512, is assigned to Row 4 and column B1 and other seven states are assigned in the other state bit slice columns of FSA 4. Then the state ‘h’ is coupled to state ‘i’ of Row3 column B8 using the up column-wise FSA extension similar to block 1501 described above. As may be noticed the states ‘jkLmnop’ are assigned in a reverse order in Row3, though as discussed above the state assignment order is not critical in PRISM, since the state transition controls like SDV are set properly to follow the correct transitions. Thus for the Row 3, the FSA states are programmed to transition in the order ‘ijkLmnop’, if a string corresponding to that sequence is received after ‘abcdefgh’. When the state ‘p’, 1511 is reached, the RE2 is matched and the match signal for this RE is asserted to the cluster local priority encoder and evaluation processor, block 815, which takes appropriate actions that are programmed based on activation of RE2.
  • Blocks 1502, 1505, 1503 and 1506 illustrate the programming of RE1 [(abc|defghi)+jkL], RE2 [abcdefghijkLmnop], RE3 [(xyz|defghi)+jkL] and RE4 [xyzdefghijkLmnop] respectively using the Row-wise and Column-wise FSA extension mechanisms of this patent. The block 1502, column 1, Row 1 FSA, programs the terms ‘abc’; and ‘jkL’ of REI where as the term ‘defghi’ is programmed in the column 2, Row 1 FSA. The Row-wise extension architecture and mechanisms described above and illustrated in FIG. 11 is used her except that the width of each FSA is ‘8’ states. In an exemplary 8-state FSA based FSA extension, there may be eight precharge lines like 1109, 1110 and the like which may each be activated by the corresponding state bit of the coupled FSAs which may provide a greater freedom for coupling various state terms of a large FSA. The transitions 1520 and 1519, take the FSA from one FSA to the next FSA as per the .regular expression state transitions. Local state transitions within an FSA are not illustrated as described above. Thus when the FSA reaches state ‘c’, it may enable local transitions into states ‘a’ and ‘j’ and enable an inter-FSA transition 1520 into state ‘d’. Similarly the state ‘i’ may enable a local transition within that FSA to state ‘d’ and enable an inter-FSA transition 1519 to states ‘a’ and ‘j’ of Columnl Row1 FSA. When the accept state is reached the match signal for the associated FSA is asserted and the cluster priority encoder and evaluation processor, block 815, takes the appropriate action that is programmed.
  • The compiler may assign various FSA states to appropriate state bit slices like 614 depending on the row-wise coupling architecture which may be different than that illustrated in FIG. 11 as may be appreciated by one with ordinary skill in the art and such variations are within the scope this invention. For instance instead of coupling precharge line 1109 to line 1117, another scheme could couple it to a signal like 1118, 1119 or 1120 or the like and any such variations are covered within the scope of this invention.
  • Block 1503, illustrates RE3 to be programmed using the column-wise FSA extension. The compiler may assign different terms of the RE to appropriate state bit slices of the FSAs to enable the transitions required to complete the correct RE state transitions between various terms of the RE, and may optionally do it based on the available FSA state bits and the like. For instance, in this assignment, the term ‘defghi’ is assigned to Row 3, Column1 FSA, where the state ‘d’ is assigned to B3, which aligns directly below state ‘z’ of the term ‘xyz’ assigned to Row 2, Columnl FSA. This enables the column-wise state transition between these two terms of the regular expression when state ‘z’ is reached and the RE needs to transition to state ‘d’ based on the next received input symbol. One salient point to notice, is that the state of Row 3 Column1 is aligned with the accept state ‘L’ in 38 of Row2. This would prevent a required transition from state Si' to states ‘x’ or state of the RE using column-wise transition. This is avoided by creating a duplicate state ‘i’ in FSA in Row 2 Column1, B7, which is entered from state ‘h’ in Row3 Column1. Thus the column-wise FSA extension architecture enables the state ‘i’ to be reached in FSA in Row2 B7. Both states ‘i’ in both FSAs would be active simultaneously when a symbol ‘i’ is received following a string ‘defgh’. The state ‘i’ in Row 2 is then locally enabled to cause transitions into states ‘x’ or states ‘i’ of the follow states as per the RE, where as the state ‘i’ in Row3 is enabled to cause a local transition to state ‘d’ in Row3 which is also required to be taken as per the regular expression. Thus, the PRISM compiler has freedom to align various RE terms to effect the proper transitions by duplicating the same state in multiple FSA bits and FSAs. When the accept state ‘L’ is reached the match signal for the associated FSA is asserted and the cluster priority encoder and evaluation processor, block 815, takes the appropriate action that is programmed.
  • Block 1506, illustrates RE4 to be programmed using column-wise FSA extension as well, where the freedom of assignments of various states to the compiler are illustrated using assignments between two rows of the Column 2 FSAs where multiple transitions are illustrated between various state bits distributed between the two FSAs.
  • FIG. 16 a illustrates column-wise PRISM FSA extension example. In this example, a RE: ‘(abc|defghi|Lmnopqrstuv)+jkL’ is illustrated to be programmed using column-wise FSA extension architecture. The RE spans across four rows of FSAs in one column of PRISM memory cluster array. The PRISM compiler selects to program each of the first three terms starting at B1 location of the first three rows, for example state ‘a’ is assigned to block 1601, state ‘d’ is assigned to block 1602, and the state ‘L’ is assigned to block 1603. The compiler then tries to assign all the states of the specific term within the same FSA if they fit, otherwise it uses neighboring FSAs to assign the remaining states of the term for example it splits the term ‘Lmnopqrstuv’ in Row 3 and Row 4. The compiler triplicates state ‘c’, block 1608, 1606 and 1607, to enable the required transition from state ‘c’ into its various follow states like state ‘a’, ‘d’, ‘L’ or ‘j’. Similarly state ‘i’ is also repeated three times and state ‘v’ is repeated two times, block 1614 and 1615, to enable appropriate transitions required by the R.E. The appropriate FV, LV, UV, LUV, DC and UC vector bits are set to enable the right state transitions required by the RE terms as assigned to the group, of four FSAs by the compiler. The transition 1610 and 1612, illustrate a composite transition, where both LUV and UV for state ‘i’ in Row2, B7 are set to ‘2’, enabling the state transition from state ‘v’, 1615 to state ‘j’ as well as transition from state ‘i’ to state ‘j’. However, the DC vector bit for the state ‘i’ is set to ‘0’ to prevent state ‘v’ from causing a transition into state when the inputs received are a ‘v’ followed by an ‘i’. When the accept state ‘L’, Row 1, B5 is reached the match signal for FSA in Row1 is asserted and the cluster priority encoder and evaluation processor, block 815, takes the appropriate action that is programmed.
  • FIG. 16 b illustrates Row-wise and column-wise PRISM FSA extension example. In this example, a RE: ‘(abc|defghi|Lmnopqrstuv)+jkL’ is illustrated to be programmed using column-wise and row-wise FSA extension architectures together. In this illustration the compiler uses three columns of FSAs of one row of FSAs or PSEs, blocks 803, of the PRISM memory cluster, block 808, to program various terms of the RE and uses Row 2 of column 3 for a few states of one term. The FSAs in Row1 are coupled to each other using the row-wise FSA extension mechanisms, where as the column 3 Rows 1 and Row 2 FSAs are coupled using the column-wise FSA extension architecture. The states ‘u’ is duplicated, block 1627 and 1628, and the state ‘v’ is also duplicated, block 1619 an 1623 to enable the right transitions between various states and terms of the RE. The term ‘abc’ and ‘jkL’ are assigned to FSA in Row 1 in Colunm1, where as the term ‘defghi’ is assigned to Row 1 in Column 2. and the term ‘Lmnopqrstuv’ is assigned to Column 3 FSAS in Rows 1 and Rows 2. The transition 1629, enables the FSA to go from state ‘q’ to state ‘r’ using the column-wise transition, as well as the transitions from duplicated states ‘u’, 1627 and 1628, to duplicated states ‘v’, states 1619 and 1623, respectively are also enabled using column-wise transition. The transition 1620, -enables transition from state ‘c’, state ‘v’ and state ‘i’ to states ‘d’ or state ‘L’, while the transition 1624, enables the state transition from states ‘v’ and T to states ‘a’ or T. Transitions within an FSA are not illustrated to not complicate the figure but are implied and properly programmed by the PRISM compiler. When the accept state ‘L’, Row 1, Column 1 is reached the match signal for FSA in Row 1 is asserted and the cluster priority encoder and evaluation processor, block 815, takes the appropriate action that is programmed.
  • In one exemplary embodiment, there may be column-wise FSA extension enabled between each group of four PRISM Memory cluster PSE rows, and the row-wise extension may , be enabled between each of those rows and eight columns of PSEs. Ha regular expression needs more states than the states enabled by such a large group of FSAs, such an RE may optionally be split into multiple FSAs or may optionally use rule group FSA extension architecture and mechanisms illustrated in FIG. 1 IA and described above. Thus by using the column-wise and row-wise FSA extensions of this patent any arbitrary FSA may be represented within PRISM, even when the individual PSE may support lot fewer FSA states as illustrated above.
  • FIG. 9 illustrates a PRISM search compiler flow (full and incremental rule distribution). The flow can be used for distributing search rules or security rules when the full set of rules are defined or when any updates or modifications are made to the rule set and incremental changes to the rule set need to be communicated and configured in the PRISM search memory. The search memory may be used in distributed security architecture within system nodes across a network which may be a LAN, WAN, MAN, SAN, wireless or wired LAN and the like. The rules like application layer rules, network layer rules or storage network layer rules or any other content search rules may be created using manual or automated means and provided as inputs to the search compiler flow in a predefined format. The rules may be created per each layer of a seven layer OSI networking stack or there may be other non OSI layer specific rules. The search compiler's rule parser, 904, parses the rules and converts them into regular expression format if the rules are not already in that form. Then the regular expression rules are converted into FSA rules compiled to the node capabilities of the node that has the PRISM content search memory and stored in the rules database. The rules from the rule database are retrieved and distributed by the rules distribution engine to the appropriate node(s) with the PRISM search memory. The search or security rules may be distributed to the host processor or a control processor or a host microprocessor or a network processor or a master processor or a combination thereof as appropriate depending on the node capability. The rules may be distributed using a secure link or insecure link using proprietary or standard protocols as appropriate per the specific node's capability over a network. The network may be a local area network (LAN), wide area network (WAN), internet, metro area network (MAN), wireless LAN, storage area network (SAN) or a system area network or another network type deployed or a combination thereof. The network may be Ethernet based, Internet protocol based or SONET based or other protocol based or a combination thereof.
  • FIG. 10 illustrates PRISM FSA Compiler flow. The regular expressions for the content search are presented to the PRISM FSA Compiler flow by the rules parser, block 904. PRISM compiler flow may optionally be implemented as a stand alone compiler as well and may read regular expressions for the content search rules or security rules or the like generated by an IT manager or a user or another tool or a combination or the like for compilation to PRISM. PRISM FSA compiler reads the regular expressions, block 1002, from a storage device like a disk drive or a file server or memory or the like or directly from the output of another tool or a combination and processes these regular expressions optionally in the order specified. Since PRISM processes RE rules using independent FSAs or NFAs, the REs are compiled individually, however it may be possible for the PRISM FSA compiler to process more REs for one FSA for PRISM that supports multiple REs per FSA block. The PRISM compiler flow comprises of one or more of the steps illustrated in the FIG. 10 and described below which may be performed in the illustrated order or another order to compile the rules for PRISM as may be appreciated by one with ordinary skill in the art. PRISM compiler flow checks if all the regular expressions have been processed or not, block 1003, and if any expressions are left, it goes through the path, 1004, otherwise it follows the path, 1017. When a regular expression is read by the block, 1005, it is parsed, block 1006, to understand various constructs of the regular expression. The PRISM compiler flow may at this stage indicate an error if there are any issues with the regular expression like any syntax being invalid or the like. The error flow is not illustrated in the figure but may optionally comprise of logging the regular expression with an error, informing the user or the application or the like of the error, ignore the error and move on to the next regular expression, or stop the processing altogether or the like or a combination of the foregoing. However, if no errors are discovered, the regular expressions syntax tree is constructed, block 1007, and various symbols of the regular expression are extracted, block 1008. The regular expression symbols are then marked, block 1009, to make each symbol unique as per the requirement of the Berry-Sethi's FSA construction algorithm. For example a regular expression like (a|b)*cd(a|ef)* may be marked as (a0|b1)*c2d3(a4|e5f6)* there by making each symbol of the regular expression unique. This regular expression is now linear and is processed, block 1010, to find the determinants that extract whether empty string is part of the language of the regular expression and its components. The compiler flow may extract the first states that are entered from the start state of the regular expression, block 1011. For the above example the first states are: a0, b1, and c2 which may all be entered on processing the first symbol from the start state. Then the PRISM FSA compiler flow may extract the follow states, block 1012 for each of the states or symbols of the FSA. For the example above the following may be the follow states per each state:
  • State a0: Follow states: a0, b1, and c2
  • State b1: Follow states: a0, b1, and c2
  • State c2: Follow states: d3
  • State d3: Follow states: a4 or e5
  • State a4: Follow states: a4 or e5
  • State e5L Follow states: f6
  • State f6: Follow states: a4 or e5
  • The PRISM compiler flow then creates the state transition list per state, 1013, from the follow states above which essentially form the state transition list from each state. The PRISM compiler flow then extracts terminal or accept states, 1014 of the regular expression. For the example expression above the accept states are: d3, a4, and f6. Once all the processing of the FSA states is done, the marked symbols are converted back to their unmarked form and the appropriate PRISM programmable FSA data structures generated, block 1015 for example, SDV per FSA state, state symbols, symbol mask if any, initial or first states, accept states as well as optional tag states if the regular expression is tagged, a left biased or right-biased control if PRISM implements such option, any associated action to be taken, the FSA ID that will hold this RE and the like. If the regular expression needs to use more states than those supported in a single PSE, the compiler assigns the RE to multiple FSAs and couples them together using row-wise, column-wise, or rule group FSA extensions or a combination there of or may split the RE into multiple rules to fit the specific embodiment of PRISM, its characteristics and the like. This RE in the PRISM compiled form may either be kept in memory or storage or the like and once all such REs are processed they may all be stored in a compiled rules database, block 1018. Each compiled RE may be deposited individually in the database or all rules may be deposited once they are all processed or a combination. The compiled rules database may be an actual database or a file or a storage element or the like that records the compiled rules data that may then be programmed into an appropriate PRISM device by the rules distribution engine, 909, working with the PRISM controller of the corresponding PRISM device.
  • The PRISM memory of this invention may be manufactured into hardware products in the chosen embodiment of various possible embodiments using a manufacturing process, without limitation, broadly outlined below. The PRISM memory in its chosen embodiment may be designed and verified at various levels of chip design abstractions like RTL level, circuit/schematic/gate level, layout level etc. for functionality, timing and other design and manufacturability constraints for specific target manufacturing process technology. The design would be verified at various design abstraction levels before manufacturing and may be verified in a manufactured form before being shipped. The PRISM memory design with other supporting circuitry of the chosen embodiment at the appropriate physical/layout level may be used to create mask sets to be used for manufacturing the chip in the target process technology. The mask sets are then used to build the PRISM memory based chip through the steps used for the selected process technology. The PRISM memory based chip then may go through testing/packaeing process as appropriate to assure the quality of the manufactured product.
  • Thus the inventions of this patent cover various aspects like:
  • A memory architecture comprising programmable intelligent search memory (PRISM) for content search wherein the PRISM memory provides search capability for regular expression based search and a regular expressions are compiled into a format recognized by PRISM and that follows the PRISM FSA algorithm.
  • The regular expression compiler comprises of one or more of the following steps in no specific order:
      • 1. Read mechanism to read regular expressions and a read process to do the same
      • 2. Parse mechanism to parse RE and a parse process to do the same
      • 3. Syntax tree generation mechanism to generate syntax tree and a syntax tree generation process to do the same
      • 4. RE error handling mechanism to handle RE errors and a process to handle RE errors
      • 5. RE symbol extraction mechanism to extract RE symbols and an RE symbol extraction process to do the same
      • 6. RE marking mechanism to mark RE symbols with unique integers and a RE marking process to do the same
      • 7. A FSA linearization mechanism to create a linear FSA and create its determinants to extract presence or absence of empty sting in the language defined by the RE and a process to do FSA linearization
      • 8. A mechanism to find and extract first states of the linear FSA and a process for first state identification and extraction
      • 9. A mechanism to find and extract follow states of the linearized FSA and a process for follow state identification and extraction
      • 10. A mechanism to find and extract the state transition list per state and a process for state transition list identification and extraction
      • 11. A mechanism to find and extract the accept or terminal states and a process for accept or terminal states identification and extraction
      • 12. Create PRISM programmable FSA data programmable database structure for the RE comprises one or more of SDV, state symbols, LB/RB, Accept state, Initial States or Initial vector, tag states, FSA ID, GSDV, GCV, RCV, ESV, LUV, UV, FV, DC, UC, LV or a combination of the foregoing
      • 13. A mechanism to generate the Compiled RE expressions rules data base comprising the PRISM programmable FSA data structures and a method for the compiled RE rules data base generation.
      • 14. A mechanism to provide the compiled rules data base to a rules distribution engine or other agent to program these rules in the target PRISM device and a method to do the same
      • 15. A mechanism to generate a programmable FSA rule ID for programming the linear FSA in one specific memory location of PRISM memory locations that are randomly accessible to access, store or program the programmable FSA rule memory circuits
      • 16. A mechanism to generate specific actions that need to be taken when a particular regular expression programmed in the PRISM FSA rule blocks is matched or
      • 17. a combination of the foregoing.
  • The PRISM memory comprises of FSA extension architecture and mechanisms to enable programming of regular expressions that are larger than the basic PSE FSA search states. The FSA extension architecture may optionally comprise of Row-wise FSA extension mechanisms or column-wise FSA extension mechanisms or FSA rule groups extensions or a combination thereof to support large regular expressions and optionally to support groups of regular expressions that can be used to enable execution of other groups of regular expressions when a certain event in the first rule group is activated.
  • The PRISM memory Rule group FSA extension architecture may comprise of External state vectors, and may optionally comprising of rule group control vectors. The ESVs and RCVs may optionally be addressed as memory locations that may be programmed by the PRISM controller, or an external master processor or the cluster evaluation processor or a global evaluation processor or a combination to enable transitions into and out of rule groups in. PRISM.
  • The Column-wise FSA architecture may further comprise of Forwarding vector- up or down, local forwarding vectors- up or down, up control vector, down control vector, or a combination there of
  • The row-wise FSA architecture may further comprise of global state dependent vectors, global control vectors, global state transition controls, global control network or a combination.
  • The PRISM control vectors like GSDV, GCV, FV, LV, LUV, UV, DC, UC, RCV, or the like may be implemented as memory locations accessed for from programming from the PRISM address decode and control logic or PRISM cluster address decode and FSA controller or PRISM controller or a combination there of
  • PRISM memory architecture that enables replicating states of an FSA that may enable proper FSA extensions of REs using FSA extension architecture and mechanisms described above.
  • The PRISM memory further comprises an array of search memory circuits that provide the regular expression search functions for searching content from documents, messages or packets or other data received from the network or the local host or a master processor or a network processor or TCP Offload Engine or Processor or Storage Network processor or a security processor or other processor or a combination thereof.
  • The PRISM memory further comprises of a plurality of clusters of the search memory circuits that provide regular expression search functions for a plurality of regular expressions. The search memory circuits comprise of memory elements to store symbols of finite state automata representing the regular expressions. The search memory circuits further comprise memory elements to store mask vectors (MV) that may be applied to the stored symbols. The mask vectors are coupled to the symbol memory elements and the content being searched through symbol evaluation circuits that detect whether the received content comprises of the symbols being searched. The search memory circuits further comprise of memory elements to store elements of state dependent vectors (SDV) which are used to decide the state traversal by the search memory for the finite state automata. The search memory circuits further comprise of match detect circuits that operate by coupling with the memory elements for symbols, MVs, SDVs, and the symbol evaluation circuits for multiple states of the FSAs to decide on the traversal of the states in the FSA based on the content being searched and the programmed symbols. SDVs, and MVs. The search memory circuits may further comprise tag and match detect circuits that operate to provide tagged FSA and regular expression search, wherein the tagged FSA is used to detect sub-string or partial regular expression match beside a full regular expression match.
  • The memory elements of the PRISM memory comprise of static memory cells. The memory elements are each independently addressable in a random order. The PRISM memory further comprises of circuits to couple the content search memory with other logic to provide coupling with processors that can interface to the PRISM memory integrated circuits. The PRISM memory further comprises of a controller for interfacing with the processors to receive the content to be searched. The PRISM memory may further comprise of address decode logic circuits which decode the received address to select the specific static memory cells location to be read or written. The memory elements of the search memory may each be uniquely addressed to read or write appropriate values in the memory elements. The address decoding logic and the controller generate control signals necessary to address the appropriate memory locations of the static memory cells based search memory. The control signals are coupled to the PRISM arrays as a series of word lines and bit lines that can randomly be used to access desired memory locations.
  • The memory elements of PRISM support detection of character pattern strings. The PRISM memory comprises of symbol detection circuits and may optionally comprise of mask vectors per symbol bits, that may be used to evaluate received character string-using simple XOR based compare or other logic function and create a match indication. The PRISM match signal processing circuits may logically combine multiple match signals from each symbol detection block to generate a composite match signal which would be activated only if all the symbols have a match. The composite match signal creates a match functionality like a traditional CAM chip and thus enable PRISM chip to be partially or fully configured to behave like a CAM provide a pattern matching functionality beside regular expression search.
  • While the foregoing has been with reference to particular embodiments of the invention, it will be appreciated by those with ordinary skill in the art that changes in these embodiments may be made without departing from the principles and spirit of the invention.

Claims (4)

1. A memory architecture comprising programmable intelligent search memory for content search wherein said programmable intelligent search memory performs regular expression based search and comprises of a plurality of programmable search engines to perform search using a plurality of regular expressions, said plurality of regular expressions converted into plurality of finite state automata to program in said plurality of programmable search engines.
2. An integrated circuit chip comprising programmable intelligent search memory for content search wherein, said programmable intelligent search memory performs regular expression based search and comprises of a plurality of programmable search engines to perform search using a plurality of regular expressions, said plurality of regular expressions converted into plurality of finite state automata to program in said plurality of programmable search. engines.
3. A hardware processor comprising an integrated circuit chip memory said integrated circuit chip memory comprising programmable intelligent search memory for content search, wherein said programmable intelligent search memory performs regular expression based search and comprises of a plurality of programmable search engines to perform search using a plurality of regular expressions, said plurality of regular expressions converted into plurality of finite state automata to program in said plurality of programmable search engines.
4. An integrated circuit chip of claim 2 comprising a processor, said processor comprising memory, said memory comprising said programmable intelligent search memory for content search.
US13/006,265 2006-12-08 2011-01-13 Fsa extension architecture for programmable intelligent search memory Abandoned US20110153657A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US13/006,265 US20110153657A1 (en) 2006-12-08 2011-01-13 Fsa extension architecture for programmable intelligent search memory

Applications Claiming Priority (12)

Application Number Priority Date Filing Date Title
US87388906P 2006-12-08 2006-12-08
US87363206P 2006-12-08 2006-12-08
US92888307P 2007-05-10 2007-05-10
US93060707P 2007-05-17 2007-05-17
US93333207P 2007-06-06 2007-06-06
US93331307P 2007-06-06 2007-06-06
US96159607P 2007-07-23 2007-07-23
US96305907P 2007-08-01 2007-08-01
US96517007P 2007-08-17 2007-08-17
US96526707P 2007-08-17 2007-08-17
US11/952,110 US7899976B2 (en) 2006-12-08 2007-12-06 FSA extension architecture for programmable intelligent search memory
US13/006,265 US20110153657A1 (en) 2006-12-08 2011-01-13 Fsa extension architecture for programmable intelligent search memory

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US11/952,110 Continuation US7899976B2 (en) 2006-12-08 2007-12-06 FSA extension architecture for programmable intelligent search memory

Publications (1)

Publication Number Publication Date
US20110153657A1 true US20110153657A1 (en) 2011-06-23

Family

ID=39499457

Family Applications (13)

Application Number Title Priority Date Filing Date
US11/952,117 Active 2029-03-25 US7899978B2 (en) 2006-12-08 2007-12-06 Dynamic programmable intelligent search memory
US11/952,104 Active 2028-11-04 US7831607B2 (en) 2006-12-08 2007-12-06 Interval symbol architecture for programmable intelligent search memory
US11/952,110 Active 2029-03-18 US7899976B2 (en) 2006-12-08 2007-12-06 FSA extension architecture for programmable intelligent search memory
US11/952,028 Active 2029-09-10 US8051022B2 (en) 2006-12-08 2007-12-06 Embedded programmable intelligent search memory (PRISM) that simultaneously performs regular expression based search and signature pattern based search
US11/952,043 Active 2029-12-21 US7912808B2 (en) 2006-12-08 2007-12-06 100Gbps security and search architecture using programmable intelligent search memory that uses a power down mode
US11/952,103 Active 2028-09-30 US7831606B2 (en) 2006-12-08 2007-12-06 Signature search architecture for programmable intelligent search memory
US11/952,111 Active 2029-09-24 US8055601B2 (en) 2006-12-08 2007-12-06 Compiler for compiling content search rules comprising a regular expression using a programmable intelligent search memory (PRISM) and vectors
US11/952,112 Active 2028-11-30 US7827190B2 (en) 2006-12-08 2007-12-06 Complex symbol evaluation for programmable intelligent search memory
US11/952,114 Active 2029-03-24 US7899977B2 (en) 2006-12-08 2007-12-06 Programmable intelligent search memory
US12/902,485 Abandoned US20110029550A1 (en) 2006-12-08 2010-10-12 Interval symbol architecture for programmable intelligent search memory
US12/902,500 Abandoned US20110029556A1 (en) 2006-12-08 2010-10-12 Complex symbol evaluation for programmable intelligent search memory
US13/006,265 Abandoned US20110153657A1 (en) 2006-12-08 2011-01-13 Fsa extension architecture for programmable intelligent search memory
US13/011,692 Abandoned US20110119440A1 (en) 2006-12-08 2011-01-21 Dynamic programmable intelligent search memory

Family Applications Before (11)

Application Number Title Priority Date Filing Date
US11/952,117 Active 2029-03-25 US7899978B2 (en) 2006-12-08 2007-12-06 Dynamic programmable intelligent search memory
US11/952,104 Active 2028-11-04 US7831607B2 (en) 2006-12-08 2007-12-06 Interval symbol architecture for programmable intelligent search memory
US11/952,110 Active 2029-03-18 US7899976B2 (en) 2006-12-08 2007-12-06 FSA extension architecture for programmable intelligent search memory
US11/952,028 Active 2029-09-10 US8051022B2 (en) 2006-12-08 2007-12-06 Embedded programmable intelligent search memory (PRISM) that simultaneously performs regular expression based search and signature pattern based search
US11/952,043 Active 2029-12-21 US7912808B2 (en) 2006-12-08 2007-12-06 100Gbps security and search architecture using programmable intelligent search memory that uses a power down mode
US11/952,103 Active 2028-09-30 US7831606B2 (en) 2006-12-08 2007-12-06 Signature search architecture for programmable intelligent search memory
US11/952,111 Active 2029-09-24 US8055601B2 (en) 2006-12-08 2007-12-06 Compiler for compiling content search rules comprising a regular expression using a programmable intelligent search memory (PRISM) and vectors
US11/952,112 Active 2028-11-30 US7827190B2 (en) 2006-12-08 2007-12-06 Complex symbol evaluation for programmable intelligent search memory
US11/952,114 Active 2029-03-24 US7899977B2 (en) 2006-12-08 2007-12-06 Programmable intelligent search memory
US12/902,485 Abandoned US20110029550A1 (en) 2006-12-08 2010-10-12 Interval symbol architecture for programmable intelligent search memory
US12/902,500 Abandoned US20110029556A1 (en) 2006-12-08 2010-10-12 Complex symbol evaluation for programmable intelligent search memory

Family Applications After (1)

Application Number Title Priority Date Filing Date
US13/011,692 Abandoned US20110119440A1 (en) 2006-12-08 2011-01-21 Dynamic programmable intelligent search memory

Country Status (1)

Country Link
US (13) US7899978B2 (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8200599B2 (en) 2006-12-08 2012-06-12 Pandya Ashish A 100Gbps security and search architecture using programmable intelligent search memory
US20120203755A1 (en) * 2011-02-08 2012-08-09 International Business Machines Corporation Multiple rule bank access scheme for use in a pattern matching accelerator
US20140092796A1 (en) * 2012-09-28 2014-04-03 Michael Gregory Method and System for Communicating with an Alarm System

Families Citing this family (257)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
AU2003210789A1 (en) * 2002-02-01 2003-09-02 John Fairweather A system and method for managing dataflows
US7299261B1 (en) 2003-02-20 2007-11-20 Mailfrontier, Inc. A Wholly Owned Subsidiary Of Sonicwall, Inc. Message classification using a summary
US8266215B2 (en) 2003-02-20 2012-09-11 Sonicwall, Inc. Using distinguishing properties to classify messages
US7406502B1 (en) 2003-02-20 2008-07-29 Sonicwall, Inc. Method and system for classifying a message based on canonical equivalent of acceptable items included in the message
US10572824B2 (en) 2003-05-23 2020-02-25 Ip Reservoir, Llc System and method for low latency multi-functional pipeline with correlation logic and selectively activated/deactivated pipelined data processing engines
US20070277036A1 (en) 2003-05-23 2007-11-29 Washington University, A Corporation Of The State Of Missouri Intelligent data storage and processing using fpga devices
US8548170B2 (en) 2003-12-10 2013-10-01 Mcafee, Inc. Document de-registration
US7899828B2 (en) 2003-12-10 2011-03-01 Mcafee, Inc. Tag data structure for maintaining relational data over captured objects
US7984175B2 (en) 2003-12-10 2011-07-19 Mcafee, Inc. Method and apparatus for data capture and analysis system
US8656039B2 (en) 2003-12-10 2014-02-18 Mcafee, Inc. Rule parser
US8560534B2 (en) 2004-08-23 2013-10-15 Mcafee, Inc. Database for a capture system
US7949849B2 (en) 2004-08-24 2011-05-24 Mcafee, Inc. File system for a capture system
US8010685B2 (en) * 2004-11-09 2011-08-30 Cisco Technology, Inc. Method and apparatus for content classification
US7936682B2 (en) * 2004-11-09 2011-05-03 Cisco Technology, Inc. Detecting malicious attacks using network behavior and header analysis
US7535909B2 (en) 2004-11-09 2009-05-19 Cisco Technology, Inc. Method and apparatus to process packets in a network
US7782805B1 (en) 2005-02-08 2010-08-24 Med Belhadj High speed packet interface and method
JP2008532177A (en) 2005-03-03 2008-08-14 ワシントン ユニヴァーシティー Method and apparatus for performing biological sequence similarity searches
US7907608B2 (en) 2005-08-12 2011-03-15 Mcafee, Inc. High speed packet capture
US7818326B2 (en) 2005-08-31 2010-10-19 Mcafee, Inc. System and method for word indexing in a capture system and querying thereof
US7661138B1 (en) * 2005-08-31 2010-02-09 Jupiter Networks, Inc. Finite state automaton compression
US7730011B1 (en) * 2005-10-19 2010-06-01 Mcafee, Inc. Attributes of captured objects in a capture system
US8504537B2 (en) 2006-03-24 2013-08-06 Mcafee, Inc. Signature distribution in a document registration system
US7689614B2 (en) 2006-05-22 2010-03-30 Mcafee, Inc. Query generation for a capture system
US7958227B2 (en) 2006-05-22 2011-06-07 Mcafee, Inc. Attributes of captured objects in a capture system
US7660793B2 (en) 2006-11-13 2010-02-09 Exegy Incorporated Method and system for high performance integration, processing and searching of structured and unstructured data using coprocessors
US8326819B2 (en) 2006-11-13 2012-12-04 Exegy Incorporated Method and system for high performance data metatagging and data indexing using coprocessors
US9141557B2 (en) 2006-12-08 2015-09-22 Ashish A. Pandya Dynamic random access memory (DRAM) that comprises a programmable intelligent search memory (PRISM) and a cryptography processing engine
US7899978B2 (en) * 2006-12-08 2011-03-01 Pandya Ashish A Dynamic programmable intelligent search memory
WO2008073824A1 (en) * 2006-12-08 2008-06-19 Pandya Ashish A Dynamic programmable intelligent search memory
US20110029549A1 (en) * 2006-12-08 2011-02-03 Pandya Ashish A Signature search architecture for programmable intelligent search memory
US20080186971A1 (en) * 2007-02-02 2008-08-07 Tarari, Inc. Systems and methods for processing access control lists (acls) in network switches using regular expression matching logic
US7904961B2 (en) * 2007-04-20 2011-03-08 Juniper Networks, Inc. Network attack detection using partial deterministic finite automaton pattern matching
US7743003B1 (en) 2007-05-16 2010-06-22 Google Inc. Scaling machine learning using approximate counting that uses feature hashing
WO2009024884A2 (en) * 2007-08-17 2009-02-26 Nxp B.V. System for providing fault tolerance for at least one micro controller unit
US9118811B2 (en) * 2007-08-24 2015-08-25 The Invention Science Fund I, Llc Predicted concurrent streaming program selection
US8028125B2 (en) * 2007-08-27 2011-09-27 Comtech Ef Data Corp. Content-addressable memories and state machines for performing three-byte matches and for providing error protection
US8458129B2 (en) * 2008-06-23 2013-06-04 Teradata Us, Inc. Methods and systems for real-time continuous updates
US8272056B2 (en) * 2007-10-16 2012-09-18 University Of Florida Research Foundation, Inc. Efficient intrusion detection
US8549296B2 (en) * 2007-11-28 2013-10-01 Honeywell International Inc. Simple authentication of messages
US20090157774A1 (en) * 2007-12-18 2009-06-18 International Business Machines Corporation Character pattern-based file storage tool
KR101065480B1 (en) * 2007-12-19 2011-09-19 한국전자통신연구원 Apparatus and method for updating the check node of low density parity check codes
US7979662B2 (en) * 2007-12-28 2011-07-12 Sandisk Il Ltd. Storage device with transaction indexing capability
US7913030B2 (en) * 2007-12-28 2011-03-22 Sandisk Il Ltd. Storage device with transaction logging capability
US8806629B1 (en) * 2008-01-02 2014-08-12 Cisco Technology, Inc. Automatic generation of policy-driven anti-malware signatures and mitigation of DoS (denial-of-service) attacks
US7949679B2 (en) * 2008-03-05 2011-05-24 International Business Machines Corporation Efficient storage for finite state machines
US8272051B1 (en) * 2008-03-27 2012-09-18 Trend Micro Incorporated Method and apparatus of information leakage prevention for database tables
US8214977B2 (en) * 2008-05-21 2012-07-10 Symantec Corporation Centralized scanner database with optimal definition distribution using network queries
JP5110162B2 (en) * 2008-07-01 2012-12-26 富士通株式会社 Search device and search method
US8205242B2 (en) 2008-07-10 2012-06-19 Mcafee, Inc. System and method for data mining and security policy management
US8051085B1 (en) * 2008-07-18 2011-11-01 Netlogic Microsystems, Inc. Determining regular expression match lengths
US8850578B2 (en) * 2008-08-06 2014-09-30 International Business Machines Corporation Network intrusion detection
US9253154B2 (en) 2008-08-12 2016-02-02 Mcafee, Inc. Configuration management for a capture/registration system
US9305238B2 (en) * 2008-08-29 2016-04-05 Oracle International Corporation Framework for supporting regular expression-based pattern matching in data streams
KR20100038536A (en) * 2008-10-06 2010-04-15 주식회사 이베이지마켓 System for utilization of client information in the electronic commerce and method thereof
US8423749B2 (en) * 2008-10-22 2013-04-16 International Business Machines Corporation Sequential processing in network on chip nodes by threads generating message containing payload and pointer for nanokernel to access algorithm to be executed on payload in another node
FR2938943B1 (en) * 2008-11-21 2010-11-12 Thales Sa MULTIPROCESSOR SYSTEM.
US20100138575A1 (en) 2008-12-01 2010-06-03 Micron Technology, Inc. Devices, systems, and methods to synchronize simultaneous dma parallel processing of a single data stream by multiple devices
CA2744746C (en) 2008-12-15 2019-12-24 Exegy Incorporated Method and apparatus for high-speed processing of financial market depth data
US9258217B2 (en) * 2008-12-16 2016-02-09 At&T Intellectual Property I, L.P. Systems and methods for rule-based anomaly detection on IP network flow
US20100174887A1 (en) 2009-01-07 2010-07-08 Micron Technology Inc. Buses for Pattern-Recognition Processors
US8850591B2 (en) 2009-01-13 2014-09-30 Mcafee, Inc. System and method for concept building
US8706709B2 (en) 2009-01-15 2014-04-22 Mcafee, Inc. System and method for intelligent term grouping
US9105323B2 (en) * 2009-01-23 2015-08-11 Micron Technology, Inc. Memory device power managers and methods
US20100192225A1 (en) * 2009-01-28 2010-07-29 Juniper Networks, Inc. Efficient application identification with network devices
US8473442B1 (en) 2009-02-25 2013-06-25 Mcafee, Inc. System and method for intelligent state management
US8145859B2 (en) * 2009-03-02 2012-03-27 Oracle International Corporation Method and system for spilling from a queue to a persistent store
US8135972B2 (en) 2009-03-10 2012-03-13 Cortina Systems, Inc. Data interface power consumption control
US8447722B1 (en) 2009-03-25 2013-05-21 Mcafee, Inc. System and method for data mining and security policy management
US8667121B2 (en) 2009-03-25 2014-03-04 Mcafee, Inc. System and method for managing data and policies
US8250016B2 (en) * 2009-04-17 2012-08-21 Alcatel Lucent Variable-stride stream segmentation and multi-pattern matching
US8468220B2 (en) 2009-04-21 2013-06-18 Techguard Security Llc Methods of structuring data, pre-compiled exception list engines, and network appliances
US9894093B2 (en) 2009-04-21 2018-02-13 Bandura, Llc Structuring data and pre-compiled exception list engines and internet protocol threat prevention
WO2010141182A2 (en) 2009-06-02 2010-12-09 Saffron Technology, Inc. Methods, systems and computer program products for providing a distributed associative memory base
US20100325633A1 (en) * 2009-06-19 2010-12-23 Microsoft Corporation Searching Regular Expressions With Virtualized Massively Parallel Programmable Hardware
US8289960B2 (en) * 2009-06-22 2012-10-16 Citrix Systems, Inc. Systems and methods for N-core tracing
US8387076B2 (en) 2009-07-21 2013-02-26 Oracle International Corporation Standardized database connectivity support for an event processing server
US8321450B2 (en) 2009-07-21 2012-11-27 Oracle International Corporation Standardized database connectivity support for an event processing server in an embedded context
WO2011011916A1 (en) * 2009-07-29 2011-02-03 华为技术有限公司 Regular expression matching method and system, and searching device
US8386466B2 (en) 2009-08-03 2013-02-26 Oracle International Corporation Log visualization tool for a data stream processing server
US8527458B2 (en) 2009-08-03 2013-09-03 Oracle International Corporation Logging framework for a data stream processing server
US9083740B1 (en) 2009-09-28 2015-07-14 Juniper Networks, Inc. Network traffic pattern matching using adaptive deterministic finite automata
US20110099423A1 (en) * 2009-10-27 2011-04-28 Chih-Ang Chen Unified Boot Code with Signature
US8407789B1 (en) * 2009-11-16 2013-03-26 Symantec Corporation Method and system for dynamically optimizing multiple filter/stage security systems
US9323994B2 (en) 2009-12-15 2016-04-26 Micron Technology, Inc. Multi-level hierarchical routing matrices for pattern-recognition processors
US9305057B2 (en) 2009-12-28 2016-04-05 Oracle International Corporation Extensible indexing framework using data cartridges
US8959106B2 (en) 2009-12-28 2015-02-17 Oracle International Corporation Class loading using java data cartridges
US9430494B2 (en) 2009-12-28 2016-08-30 Oracle International Corporation Spatial data cartridge for event processing systems
CN102148805B (en) * 2010-02-09 2015-04-08 华为技术有限公司 Feature matching method and device
US9110875B2 (en) * 2010-02-11 2015-08-18 International Business Machines Corporation XML post-processing hardware acceleration
US8935270B1 (en) * 2010-05-13 2015-01-13 Netlogic Microsystems, Inc. Content search system including multiple deterministic finite automaton engines having shared memory resources
US9392005B2 (en) * 2010-05-27 2016-07-12 Samsung Sds Co., Ltd. System and method for matching pattern
US8601013B2 (en) * 2010-06-10 2013-12-03 Micron Technology, Inc. Analyzing data using a hierarchical structure
US8766666B2 (en) 2010-06-10 2014-07-01 Micron Technology, Inc. Programmable device, hierarchical parallel machines, and methods for providing state information
WO2011156746A2 (en) * 2010-06-11 2011-12-15 California Institute Of Technology Systems and methods for rapid processing and storage of data
US8650146B2 (en) 2010-06-24 2014-02-11 Lsi Corporation Impulse regular expression matching
US9507880B2 (en) * 2010-06-30 2016-11-29 Oracle International Corporation Regular expression optimizer
US20120017200A1 (en) * 2010-07-16 2012-01-19 Fujitsu Limited Solving Hybrid Constraints to Validate a Security Software Module for Detecting Injection Attacks
US8724473B2 (en) 2010-07-16 2014-05-13 Ixia Locating signatures in packets
US20120017119A1 (en) * 2010-07-16 2012-01-19 Fujitsu Limited Solving Hybrid Constraints to Generate Test Cases for Validating a Software Module
US8589405B1 (en) 2010-07-16 2013-11-19 Netlogic Microsystems, Inc. Token stitcher for a content search system having pipelined engines
US8700593B1 (en) * 2010-07-16 2014-04-15 Netlogic Microsystems, Inc. Content search system having pipelined engines and a token stitcher
US8572106B1 (en) 2010-07-16 2013-10-29 Netlogic Microsystems, Inc. Memory management in a token stitcher for a content search system having pipelined engines
KR101089023B1 (en) * 2010-08-06 2011-12-01 삼성에스디에스 주식회사 Smart card, anti-virus system and scanning method using the same
US8713049B2 (en) 2010-09-17 2014-04-29 Oracle International Corporation Support for a parameterized query/view in complex event processing
US8862603B1 (en) * 2010-11-03 2014-10-14 Netlogic Microsystems, Inc. Minimizing state lists for non-deterministic finite state automatons
US8892580B2 (en) 2010-11-03 2014-11-18 Microsoft Corporation Transformation of regular expressions
US8806615B2 (en) 2010-11-04 2014-08-12 Mcafee, Inc. System and method for protecting specified data combinations
US9189280B2 (en) 2010-11-18 2015-11-17 Oracle International Corporation Tracking large numbers of moving objects in an event processing system
DE112011104633B4 (en) * 2010-12-28 2016-11-10 International Business Machines Corporation Unit for determining the starting point for a search
EP2668574B1 (en) 2011-01-25 2021-11-24 Micron Technology, INC. Utilizing special purpose elements to implement a fsm
JP5763783B2 (en) 2011-01-25 2015-08-12 マイクロン テクノロジー， インク． Method and apparatus for compiling regular expressions
JP5763784B2 (en) 2011-01-25 2015-08-12 マイクロン テクノロジー， インク． Grouping states for element usage
KR101607736B1 (en) * 2011-01-25 2016-03-30 마이크론 테크놀로지, 인크. Unrolling quantifications to control in-degree and/or out degree of automaton
US8799188B2 (en) * 2011-02-08 2014-08-05 International Business Machines Corporation Algorithm engine for use in a pattern matching accelerator
US9398033B2 (en) 2011-02-25 2016-07-19 Cavium, Inc. Regular expression processing automaton
US20120221494A1 (en) * 2011-02-25 2012-08-30 International Business Machines Corporation Regular expression pattern matching using keyword graphs
US8719404B2 (en) 2011-02-28 2014-05-06 International Business Machines Corporation Regular expression searches utilizing general purpose processors on a network interconnect
FR2973188B1 (en) * 2011-03-25 2013-04-19 Qosmos METHOD AND DEVICE FOR EXTRACTING DATA
US8990416B2 (en) 2011-05-06 2015-03-24 Oracle International Corporation Support for a new insert stream (ISTREAM) operation in complex event processing (CEP)
US9417894B1 (en) 2011-06-15 2016-08-16 Ryft Systems, Inc. Methods and apparatus for a tablet computer system incorporating a reprogrammable circuit module
US20120324143A1 (en) 2011-06-15 2012-12-20 Data Design Corporation Methods and apparatus for data access by a reprogrammable circuit module
US9858051B2 (en) * 2011-06-24 2018-01-02 Cavium, Inc. Regex compiler
US8990259B2 (en) 2011-06-24 2015-03-24 Cavium, Inc. Anchored patterns
US8688608B2 (en) * 2011-06-28 2014-04-01 International Business Machines Corporation Verifying correctness of regular expression transformations that use a post-processor
US9329975B2 (en) 2011-07-07 2016-05-03 Oracle International Corporation Continuous query language (CQL) debugger in complex event processing (CEP)
US9183244B2 (en) 2011-08-02 2015-11-10 Cavium, Inc. Rule modification in decision trees
WO2013020002A1 (en) 2011-08-02 2013-02-07 Cavium, Inc. Incremental update of rules for packet classification
US9208438B2 (en) 2011-08-02 2015-12-08 Cavium, Inc. Duplication in decision trees
US10229139B2 (en) 2011-08-02 2019-03-12 Cavium, Llc Incremental update heuristics
US8909672B2 (en) * 2011-08-17 2014-12-09 Lsi Corporation Begin anchor annotation in DFAs
US8990070B2 (en) 2011-11-18 2015-03-24 International Business Machines Corporation Computer-based construction of arbitrarily complex formal grammar expressions
US9002772B2 (en) 2011-11-18 2015-04-07 International Business Machines Corporation Scalable rule-based processing system with trigger rules and rule evaluator
US9203805B2 (en) * 2011-11-23 2015-12-01 Cavium, Inc. Reverse NFA generation and processing
US9047243B2 (en) 2011-12-14 2015-06-02 Ip Reservoir, Llc Method and apparatus for low latency data distribution
US8648621B2 (en) * 2011-12-15 2014-02-11 Micron Technology, Inc. Counter operation in a state machine lattice
US8700561B2 (en) 2011-12-27 2014-04-15 Mcafee, Inc. System and method for providing data protection workflows in a network environment
US9990393B2 (en) 2012-03-27 2018-06-05 Ip Reservoir, Llc Intelligent feed switch
US10650452B2 (en) 2012-03-27 2020-05-12 Ip Reservoir, Llc Offload processing of data packets
US10121196B2 (en) 2012-03-27 2018-11-06 Ip Reservoir, Llc Offload processing of data packets containing financial market data
US11436672B2 (en) 2012-03-27 2022-09-06 Exegy Incorporated Intelligent switch for processing financial market data
US20130275709A1 (en) 2012-04-12 2013-10-17 Micron Technology, Inc. Methods for reading data from a storage buffer including delaying activation of a column select
US9558299B2 (en) * 2012-04-30 2017-01-31 Hewlett Packard Enterprise Development Lp Submatch extraction
US8830714B2 (en) 2012-06-07 2014-09-09 International Business Machines Corporation High speed large scale dictionary matching
US8843495B2 (en) * 2012-07-12 2014-09-23 International Business Machines Corporation High-efficiency selection of runtime rules for programmable search
US9235798B2 (en) * 2012-07-18 2016-01-12 Micron Technology, Inc. Methods and systems for handling data received by a state machine engine
US9304968B2 (en) 2012-07-18 2016-04-05 Micron Technology, Inc. Methods and devices for programming a state machine engine
US9524248B2 (en) 2012-07-18 2016-12-20 Micron Technology, Inc. Memory management for a hierarchical memory system
US8904101B2 (en) * 2012-08-26 2014-12-02 Cisco Technology, Inc. Content-addressable memory lookup device supporting iterative lookup operations
US9361308B2 (en) 2012-09-28 2016-06-07 Oracle International Corporation State initialization algorithm for continuous queries over archived relations
US9563663B2 (en) 2012-09-28 2017-02-07 Oracle International Corporation Fast path evaluation of Boolean predicates
US9672239B1 (en) * 2012-10-16 2017-06-06 Marvell Israel (M.I.S.L.) Ltd. Efficient content addressable memory (CAM) architecture
US9268881B2 (en) 2012-10-19 2016-02-23 Intel Corporation Child state pre-fetch in NFAs
US9117170B2 (en) 2012-11-19 2015-08-25 Intel Corporation Complex NFA state matching method that matches input symbols against character classes (CCLs), and compares sequence CCLs in parallel
US9665664B2 (en) 2012-11-26 2017-05-30 Intel Corporation DFA-NFA hybrid
US10956422B2 (en) 2012-12-05 2021-03-23 Oracle International Corporation Integrating event processing with map-reduce
WO2014088576A1 (en) * 2012-12-06 2014-06-12 Empire Technology Development Llc Malware attack prevention using block code permutation
US9251440B2 (en) * 2012-12-18 2016-02-02 Intel Corporation Multiple step non-deterministic finite automaton matching
US9304768B2 (en) 2012-12-18 2016-04-05 Intel Corporation Cache prefetch for deterministic finite automaton instructions
US9098587B2 (en) 2013-01-15 2015-08-04 Oracle International Corporation Variable duration non-event pattern matching
US10298444B2 (en) 2013-01-15 2019-05-21 Oracle International Corporation Variable duration windows on continuous data streams
US9268570B2 (en) 2013-01-23 2016-02-23 Intel Corporation DFA compression and execution
US20140215090A1 (en) * 2013-01-31 2014-07-31 Lsi Corporation Dfa sub-scans
US9047249B2 (en) 2013-02-19 2015-06-02 Oracle International Corporation Handling faults in a continuous event processing (CEP) system
US9390135B2 (en) 2013-02-19 2016-07-12 Oracle International Corporation Executing continuous event processing (CEP) queries in parallel
US10649970B1 (en) 2013-03-14 2020-05-12 Invincea, Inc. Methods and apparatus for detection of functionality
US10083200B2 (en) * 2013-03-14 2018-09-25 Cavium, Inc. Batch incremental update
US9448965B2 (en) * 2013-03-15 2016-09-20 Micron Technology, Inc. Receiving data streams in parallel and providing a first portion of data to a first state machine engine and a second portion to a second state machine
US10229144B2 (en) 2013-03-15 2019-03-12 Cavium, Llc NSP manager
US9595003B1 (en) 2013-03-15 2017-03-14 Cavium, Inc. Compiler with mask nodes
US9195939B1 (en) 2013-03-15 2015-11-24 Cavium, Inc. Scope in decision trees
US9703574B2 (en) 2013-03-15 2017-07-11 Micron Technology, Inc. Overflow detection and correction in state machine engines
CN103188267B (en) * 2013-03-27 2015-12-09 中国科学院声学研究所 A kind of protocol analysis method based on DFA
US11263221B2 (en) 2013-05-29 2022-03-01 Microsoft Technology Licensing, Llc Search result contexts for application launch
US10430418B2 (en) 2013-05-29 2019-10-01 Microsoft Technology Licensing, Llc Context-based actions from a source application
US9418113B2 (en) 2013-05-30 2016-08-16 Oracle International Corporation Value based windows on relations in continuous data streams
US9235564B2 (en) 2013-07-19 2016-01-12 International Business Machines Corporation Offloading projection of fixed and variable length database columns
US9426166B2 (en) 2013-08-30 2016-08-23 Cavium, Inc. Method and apparatus for processing finite automata
US9426165B2 (en) 2013-08-30 2016-08-23 Cavium, Inc. Method and apparatus for compilation of finite automata
US9507563B2 (en) 2013-08-30 2016-11-29 Cavium, Inc. System and method to traverse a non-deterministic finite automata (NFA) graph generated for regular expression patterns with advanced features
US10503716B2 (en) * 2013-10-31 2019-12-10 Oracle International Corporation Systems and methods for generating bit matrices for hash functions using fast filtering
US9934279B2 (en) 2013-12-05 2018-04-03 Oracle International Corporation Pattern matching across multiple input data streams
US9419943B2 (en) 2013-12-30 2016-08-16 Cavium, Inc. Method and apparatus for processing of finite automata
US9544402B2 (en) 2013-12-31 2017-01-10 Cavium, Inc. Multi-rule approach to encoding a group of rules
US9275336B2 (en) 2013-12-31 2016-03-01 Cavium, Inc. Method and system for skipping over group(s) of rules based on skip group rule
US9667446B2 (en) 2014-01-08 2017-05-30 Cavium, Inc. Condition code approach for comparing rule and packet data that are provided in portions
US9729353B2 (en) * 2014-01-09 2017-08-08 Netronome Systems, Inc. Command-driven NFA hardware engine that encodes multiple automatons
US10362093B2 (en) * 2014-01-09 2019-07-23 Netronome Systems, Inc. NFA completion notification
US9558224B2 (en) * 2014-01-09 2017-01-31 Netronome Systems, Inc. Automaton hardware engine employing memory-efficient transition table indexing
US9465651B2 (en) * 2014-01-09 2016-10-11 Netronome Systems, Inc. Transactional memory having local CAM and NFA resources
US9417656B2 (en) * 2014-01-09 2016-08-16 Netronome Systems, Inc. NFA byte detector
US9602532B2 (en) 2014-01-31 2017-03-21 Cavium, Inc. Method and apparatus for optimizing finite automata processing
US9904630B2 (en) 2014-01-31 2018-02-27 Cavium, Inc. Finite automata processing based on a top of stack (TOS) memory
US9723014B2 (en) * 2014-03-31 2017-08-01 International Business Machines Corporation Detecting malware-related activity on a computer
US9438561B2 (en) 2014-04-14 2016-09-06 Cavium, Inc. Processing of finite automata based on a node cache
US10110558B2 (en) 2014-04-14 2018-10-23 Cavium, Inc. Processing of finite automata based on memory hierarchy
US10002326B2 (en) 2014-04-14 2018-06-19 Cavium, Inc. Compilation of finite automata based on memory hierarchy
US9940459B1 (en) * 2014-05-19 2018-04-10 Invincea, Inc. Methods and devices for detection of malware
US9244978B2 (en) 2014-06-11 2016-01-26 Oracle International Corporation Custom partitioning of a data stream
US9712645B2 (en) 2014-06-26 2017-07-18 Oracle International Corporation Embedded event processing
JP6183318B2 (en) * 2014-08-19 2017-08-23 コニカミノルタ株式会社 Portable terminal, its program, device, operation display system
US9886486B2 (en) 2014-09-24 2018-02-06 Oracle International Corporation Enriching events with dynamically typed big data for event processing
US10120907B2 (en) 2014-09-24 2018-11-06 Oracle International Corporation Scaling event processing using distributed flows and map-reduce operations
US9720827B2 (en) * 2014-11-14 2017-08-01 Intel Corporation Providing multiple memory modes for a processor including internal memory
US11366675B2 (en) 2014-12-30 2022-06-21 Micron Technology, Inc. Systems and devices for accessing a state machine
WO2016109570A1 (en) 2014-12-30 2016-07-07 Micron Technology, Inc Systems and devices for accessing a state machine
WO2016109571A1 (en) 2014-12-30 2016-07-07 Micron Technology, Inc Devices for time division multiplexing of state machine engine signals
US9253208B1 (en) * 2015-03-05 2016-02-02 AO Kaspersky Lab System and method for automated phishing detection rule evolution
EP3113440A1 (en) * 2015-07-01 2017-01-04 Orange Self-managed network security measures
US10268948B2 (en) * 2015-07-23 2019-04-23 The Boeing Company Data driven classification and troubleshooting system and method using associative memory and a machine learning algorithm to improve the accuracy and performance of the associative memory
WO2017018901A1 (en) 2015-07-24 2017-02-02 Oracle International Corporation Visually exploring and analyzing event streams
US9875045B2 (en) * 2015-07-27 2018-01-23 International Business Machines Corporation Regular expression matching with back-references using backtracking
US9690938B1 (en) 2015-08-05 2017-06-27 Invincea, Inc. Methods and apparatus for machine learning based malware detection
US10740116B2 (en) 2015-09-01 2020-08-11 International Business Machines Corporation Three-dimensional chip-based regular expression scanner
US10977309B2 (en) 2015-10-06 2021-04-13 Micron Technology, Inc. Methods and systems for creating networks
US10846103B2 (en) 2015-10-06 2020-11-24 Micron Technology, Inc. Methods and systems for representing processing resources
US10691964B2 (en) 2015-10-06 2020-06-23 Micron Technology, Inc. Methods and systems for event reporting
US10389773B2 (en) * 2015-10-20 2019-08-20 Intel Corporation Technologies for end of frame detection in streaming content
WO2017135838A1 (en) 2016-02-01 2017-08-10 Oracle International Corporation Level of detail control for geostreaming
WO2017135837A1 (en) 2016-02-01 2017-08-10 Oracle International Corporation Pattern based automated test data generation
US11527523B2 (en) 2018-12-10 2022-12-13 HangZhou HaiCun Information Technology Co., Ltd. Discrete three-dimensional processor
US10489590B2 (en) 2016-03-07 2019-11-26 Chengdu Haicun Ip Technology Llc Processor for enhancing computer security
US20180189585A1 (en) * 2016-03-07 2018-07-05 Chengdu Haicun Ip Technology Llc Storage with In-situ Anti-Malware Capabilities
US10560475B2 (en) 2016-03-07 2020-02-11 Chengdu Haicun Ip Technology Llc Processor for enhancing network security
EP3475822B1 (en) 2016-06-22 2020-07-22 Invincea, Inc. Methods and apparatus for detecting whether a string of characters represents malicious activity using machine learning
US10146555B2 (en) 2016-07-21 2018-12-04 Micron Technology, Inc. Adaptive routing to avoid non-repairable memory and logic defects on automata processor
US10972495B2 (en) 2016-08-02 2021-04-06 Invincea, Inc. Methods and apparatus for detecting and identifying malware by mapping feature data into a semantic space
US10268602B2 (en) 2016-09-29 2019-04-23 Micron Technology, Inc. System and method for individual addressing
US10019311B2 (en) 2016-09-29 2018-07-10 Micron Technology, Inc. Validation of a symbol response memory
US10929764B2 (en) 2016-10-20 2021-02-23 Micron Technology, Inc. Boolean satisfiability
US10592450B2 (en) 2016-10-20 2020-03-17 Micron Technology, Inc. Custom compute cores in integrated circuit devices
EP3560135A4 (en) 2016-12-22 2020-08-05 IP Reservoir, LLC Pipelines for hardware-accelerated machine learning
US10282436B2 (en) 2017-01-04 2019-05-07 Samsung Electronics Co., Ltd. Memory apparatus for in-place regular expression search
US11196720B2 (en) * 2017-01-09 2021-12-07 Introspective Power, Inc. Secure storage and data exchange/sharing system using one time pads
US10481881B2 (en) * 2017-06-22 2019-11-19 Archeo Futurus, Inc. Mapping a computer code to wires and gates
US9996328B1 (en) * 2017-06-22 2018-06-12 Archeo Futurus, Inc. Compiling and optimizing a computer code by minimizing a number of states in a finite machine corresponding to the computer code
TWI640872B (en) * 2017-07-07 2018-11-11 群聯電子股份有限公司 Memory control circuit unit, memory storage device and control method thereof
TW202301125A (en) 2017-07-30 2023-01-01 埃拉德 希提 Memory chip with a memory-based distributed processor architecture
US10714172B2 (en) 2017-09-21 2020-07-14 HangZhou HaiCun Information Technology Co., Ltd. Bi-sided pattern processor
US9967272B1 (en) * 2017-12-05 2018-05-08 Redberry Systems, Inc. Real-time regular expression search engine
US10033750B1 (en) * 2017-12-05 2018-07-24 Redberry Systems, Inc. Real-time regular expression search engine
US10983721B2 (en) 2018-07-13 2021-04-20 Fungible, Inc. Deterministic finite automata node construction and memory mapping for regular expression accelerator
US10635419B2 (en) * 2018-07-13 2020-04-28 Fungible, Inc. Incremental compilation of finite automata for a regular expression accelerator
US10656949B2 (en) 2018-07-13 2020-05-19 Fungible, Inc. Instruction-based non-deterministic finite state automata accelerator
US11880314B1 (en) * 2018-07-27 2024-01-23 Dialog Semiconductor B.V. Microcontroller for driving an external device
US11210337B2 (en) * 2018-10-16 2021-12-28 International Business Machines Corporation System and method for searching audio data
US11296068B2 (en) 2018-12-10 2022-04-05 HangZhou HaiCun Information Technology Co., Ltd. Discrete three-dimensional processor
US11734550B2 (en) 2018-12-10 2023-08-22 HangZhou HaiCun Information Technology Co., Ltd. Discrete three-dimensional processor
US11636154B2 (en) 2019-09-26 2023-04-25 Fungible, Inc. Data flow graph-driven analytics platform using data processing units having hardware accelerators
US11263190B2 (en) 2019-09-26 2022-03-01 Fungible, Inc. Data ingestion and storage by data processing unit having stream-processing hardware accelerators
US11636115B2 (en) 2019-09-26 2023-04-25 Fungible, Inc. Query processing using data processing units having DFA/NFA hardware accelerators
US10998047B1 (en) 2020-01-15 2021-05-04 Hewlett Packard Enterprise Development Lp Methods and systems for an analog CAM with fuzzy search
US11934964B2 (en) 2020-03-20 2024-03-19 Microsoft Technology Licensing, Llc Finite automata global counter in a data flow graph-driven analytics platform having analytics hardware accelerators
US11630729B2 (en) 2020-04-27 2023-04-18 Fungible, Inc. Reliability coding with reduced network traffic
US11615827B2 (en) 2020-10-15 2023-03-28 Hewlett Packard Enterprise Development Lp Hardware accelerator with analog-content addressable memory (a-CAM) for decision tree computation
US11561607B2 (en) 2020-10-30 2023-01-24 Hewlett Packard Enterprise Development Lp Accelerating constrained, flexible, and optimizable rule look-ups in hardware
CN112632230B (en) * 2020-12-30 2021-10-15 中国科学院空天信息创新研究院 Event joint extraction method and device based on multi-level graph network
US11954495B1 (en) * 2021-12-10 2024-04-09 Amazon Technologies, Inc. Database acceleration with coprocessor subsystem for offloading tuple filtering

Citations (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020161664A1 (en) * 2000-10-18 2002-10-31 Shaya Steven A. Intelligent performance-based product recommendation system
US20040059443A1 (en) * 2002-08-28 2004-03-25 Harshvardhan Sharangpani Method and apparatus for efficient implementation and evaluation of state machines and programmable finite state automata
US20040083387A1 (en) * 2002-10-29 2004-04-29 Dapp Michael C. Intrusion detection accelerator
US6778557B1 (en) * 1998-01-23 2004-08-17 Kabushiki Kaisha Toshiba Point-to-multipoint communication system
US20040215593A1 (en) * 2003-01-09 2004-10-28 Harshvardhan Sharangpani Programmable processor apparatus integrating dedicated search registers and dedicated state machine registers with associated execution hardware to support rapid application of rulesets to data
US20050012521A1 (en) * 2003-01-09 2005-01-20 Harshvardhan Sharangpani Methods and apparatuses for evaluation of regular expressions of arbitrary size
US20050052934A1 (en) * 2003-09-09 2005-03-10 Tran Hieu Van Unified multilevel cell memory
US6892237B1 (en) * 2000-03-28 2005-05-10 Cisco Technology, Inc. Method and apparatus for high-speed parsing of network messages
US20050108518A1 (en) * 2003-06-10 2005-05-19 Pandya Ashish A. Runtime adaptable security processor
US20050216770A1 (en) * 2003-01-24 2005-09-29 Mistletoe Technologies, Inc. Intrusion detection system
US20060085533A1 (en) * 2004-09-10 2006-04-20 Hussain Muhammad R Content search mechanism
US20060136570A1 (en) * 2003-06-10 2006-06-22 Pandya Ashish A Runtime adaptable search processor
US20060253816A1 (en) * 2004-03-12 2006-11-09 Sensory Networks, Inc. Apparatus and Method For Memory Efficient, Programmable, Pattern Matching Finite State Machine Hardware
US20070038798A1 (en) * 2004-09-10 2007-02-15 Bouchard Gregg A Selective replication of data structures
US20070061884A1 (en) * 2002-10-29 2007-03-15 Dapp Michael C Intrusion detection accelerator
US20070255894A1 (en) * 2005-02-10 2007-11-01 Hessel Richard E Vector processor
US20080046423A1 (en) * 2006-08-01 2008-02-21 Lucent Technologies Inc. Method and system for multi-character multi-pattern pattern matching
US7353332B2 (en) * 2005-10-11 2008-04-01 Integrated Device Technology, Inc. Switching circuit implementing variable string matching
US20080133517A1 (en) * 2005-07-01 2008-06-05 Harsh Kapoor Systems and methods for processing data flows
US20080140600A1 (en) * 2006-12-08 2008-06-12 Pandya Ashish A Compiler for Programmable Intelligent Search Memory
US7406470B2 (en) * 2002-06-13 2008-07-29 Intel Corporation Full regular expression search of network traffic
US20080255839A1 (en) * 2004-09-14 2008-10-16 Zentian Limited Speech Recognition Circuit and Method
US7472285B2 (en) * 2003-06-25 2008-12-30 Intel Corporation Apparatus and method for memory encryption with reduced decryption latency
US20090100055A1 (en) * 2003-11-07 2009-04-16 Qiang Wang Fast signature scan
US7660140B1 (en) * 2007-10-25 2010-02-09 Netlogic Microsystems, Inc. Content addresable memory having selectively interconnected counter circuits
US7890692B2 (en) * 2007-08-17 2011-02-15 Pandya Ashish A FSA context switch architecture for programmable intelligent search memory

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5778557A (en) * 1992-09-23 1998-07-14 Food Plant Engineering, Inc. Temperature and atmosphere control system for stored products
US20080008202A1 (en) 2002-10-31 2008-01-10 Terrell William C Router with routing processors and methods for virtualization
US7702629B2 (en) * 2005-12-02 2010-04-20 Exegy Incorporated Method and device for high performance regular expression pattern matching
US7644080B2 (en) * 2006-09-19 2010-01-05 Netlogic Microsystems, Inc. Method and apparatus for managing multiple data flows in a content search system
US7529746B2 (en) * 2006-09-19 2009-05-05 Netlogic Microsystems, Inc. Search circuit having individually selectable search engines

Patent Citations (39)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6778557B1 (en) * 1998-01-23 2004-08-17 Kabushiki Kaisha Toshiba Point-to-multipoint communication system
US6892237B1 (en) * 2000-03-28 2005-05-10 Cisco Technology, Inc. Method and apparatus for high-speed parsing of network messages
US20020161664A1 (en) * 2000-10-18 2002-10-31 Shaya Steven A. Intelligent performance-based product recommendation system
US7406470B2 (en) * 2002-06-13 2008-07-29 Intel Corporation Full regular expression search of network traffic
US20040059443A1 (en) * 2002-08-28 2004-03-25 Harshvardhan Sharangpani Method and apparatus for efficient implementation and evaluation of state machines and programmable finite state automata
US20040083387A1 (en) * 2002-10-29 2004-04-29 Dapp Michael C. Intrusion detection accelerator
US20070061884A1 (en) * 2002-10-29 2007-03-15 Dapp Michael C Intrusion detection accelerator
US20040215593A1 (en) * 2003-01-09 2004-10-28 Harshvardhan Sharangpani Programmable processor apparatus integrating dedicated search registers and dedicated state machine registers with associated execution hardware to support rapid application of rulesets to data
US20050012521A1 (en) * 2003-01-09 2005-01-20 Harshvardhan Sharangpani Methods and apparatuses for evaluation of regular expressions of arbitrary size
US7464254B2 (en) * 2003-01-09 2008-12-09 Cisco Technology, Inc. Programmable processor apparatus integrating dedicated search registers and dedicated state machine registers with associated execution hardware to support rapid application of rulesets to data
US20050216770A1 (en) * 2003-01-24 2005-09-29 Mistletoe Technologies, Inc. Intrusion detection system
US20060136570A1 (en) * 2003-06-10 2006-06-22 Pandya Ashish A Runtime adaptable search processor
US20050108518A1 (en) * 2003-06-10 2005-05-19 Pandya Ashish A. Runtime adaptable security processor
US7685254B2 (en) * 2003-06-10 2010-03-23 Pandya Ashish A Runtime adaptable search processor
US7472285B2 (en) * 2003-06-25 2008-12-30 Intel Corporation Apparatus and method for memory encryption with reduced decryption latency
US20050052934A1 (en) * 2003-09-09 2005-03-10 Tran Hieu Van Unified multilevel cell memory
US20090100055A1 (en) * 2003-11-07 2009-04-16 Qiang Wang Fast signature scan
US20060253816A1 (en) * 2004-03-12 2006-11-09 Sensory Networks, Inc. Apparatus and Method For Memory Efficient, Programmable, Pattern Matching Finite State Machine Hardware
US20060085533A1 (en) * 2004-09-10 2006-04-20 Hussain Muhammad R Content search mechanism
US20070038798A1 (en) * 2004-09-10 2007-02-15 Bouchard Gregg A Selective replication of data structures
US20080255839A1 (en) * 2004-09-14 2008-10-16 Zentian Limited Speech Recognition Circuit and Method
US20070255894A1 (en) * 2005-02-10 2007-11-01 Hessel Richard E Vector processor
US20080133517A1 (en) * 2005-07-01 2008-06-05 Harsh Kapoor Systems and methods for processing data flows
US7353332B2 (en) * 2005-10-11 2008-04-01 Integrated Device Technology, Inc. Switching circuit implementing variable string matching
US20080046423A1 (en) * 2006-08-01 2008-02-21 Lucent Technologies Inc. Method and system for multi-character multi-pattern pattern matching
US20080140911A1 (en) * 2006-12-08 2008-06-12 Pandya Ashish A FSA Extension Architecture for Programmable Intelligent Search Memory
US7899976B2 (en) * 2006-12-08 2011-03-01 Pandya Ashish A FSA extension architecture for programmable intelligent search memory
US20080140912A1 (en) * 2006-12-08 2008-06-12 Pandya Ashish A Programmable Intelligent Search Memory
US20080140661A1 (en) * 2006-12-08 2008-06-12 Pandya Ashish A Embedded Programmable Intelligent Search Memory
US7912808B2 (en) * 2006-12-08 2011-03-22 Pandya Ashish A 100Gbps security and search architecture using programmable intelligent search memory that uses a power down mode
US20080140600A1 (en) * 2006-12-08 2008-06-12 Pandya Ashish A Compiler for Programmable Intelligent Search Memory
US7827190B2 (en) * 2006-12-08 2010-11-02 Pandya Ashish A Complex symbol evaluation for programmable intelligent search memory
US7831606B2 (en) * 2006-12-08 2010-11-09 Pandya Ashish A Signature search architecture for programmable intelligent search memory
US7831607B2 (en) * 2006-12-08 2010-11-09 Pandya Ashish A Interval symbol architecture for programmable intelligent search memory
US7899978B2 (en) * 2006-12-08 2011-03-01 Pandya Ashish A Dynamic programmable intelligent search memory
US20080140991A1 (en) * 2006-12-08 2008-06-12 Pandya Ashish A Dynamic Programmable Intelligent Search Memory
US7899977B2 (en) * 2006-12-08 2011-03-01 Pandya Ashish A Programmable intelligent search memory
US7890692B2 (en) * 2007-08-17 2011-02-15 Pandya Ashish A FSA context switch architecture for programmable intelligent search memory
US7660140B1 (en) * 2007-10-25 2010-02-09 Netlogic Microsystems, Inc. Content addresable memory having selectively interconnected counter circuits

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8200599B2 (en) 2006-12-08 2012-06-12 Pandya Ashish A 100Gbps security and search architecture using programmable intelligent search memory
US9129043B2 (en) 2006-12-08 2015-09-08 Ashish A. Pandya 100GBPS security and search architecture using programmable intelligent search memory
US20120203755A1 (en) * 2011-02-08 2012-08-09 International Business Machines Corporation Multiple rule bank access scheme for use in a pattern matching accelerator
US8423533B2 (en) * 2011-02-08 2013-04-16 International Business Machines Corporation Multiple rule bank access scheme for use in a pattern matching accelerator
US20140092796A1 (en) * 2012-09-28 2014-04-03 Michael Gregory Method and System for Communicating with an Alarm System

Also Published As

Publication number Publication date
US7899976B2 (en) 2011-03-01
US20080140991A1 (en) 2008-06-12
US20110029550A1 (en) 2011-02-03
US7899978B2 (en) 2011-03-01
US7831606B2 (en) 2010-11-09
US20080140661A1 (en) 2008-06-12
US20080140917A1 (en) 2008-06-12
US7831607B2 (en) 2010-11-09
US7827190B2 (en) 2010-11-02
US8055601B2 (en) 2011-11-08
US20080140631A1 (en) 2008-06-12
US7912808B2 (en) 2011-03-22
US20080140912A1 (en) 2008-06-12
US20110119440A1 (en) 2011-05-19
US20080140600A1 (en) 2008-06-12
US20080140911A1 (en) 2008-06-12
US7899977B2 (en) 2011-03-01
US20110029556A1 (en) 2011-02-03
US20080140662A1 (en) 2008-06-12
US8051022B2 (en) 2011-11-01
US20080140632A1 (en) 2008-06-12

Similar Documents

Publication Publication Date Title
US20220237128A1 (en) Content search extension architecture for programmable intelligent search memory
US7899976B2 (en) FSA extension architecture for programmable intelligent search memory
US9129043B2 (en) 100GBPS security and search architecture using programmable intelligent search memory
US7890692B2 (en) FSA context switch architecture for programmable intelligent search memory
US20110029549A1 (en) Signature search architecture for programmable intelligent search memory
US20110113191A1 (en) Programmable intelligent search memory
Xu et al. A survey on regular expression matching for deep packet inspection: Applications, algorithms, and hardware platforms
Yu et al. Gigabit rate packet pattern-matching using TCAM
CN110546640B (en) Hierarchical pattern matching for deep packet analysis
Pao et al. A memory-based NFA regular expression match engine for signature-based intrusion detection

Legal Events

Date Code Title Description
STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION