Abstract: A digital memory structure manages a subset N of a universe U={0 . . . .M-1 } of elements e, where the universe U is represented by a complete binary tree of height m+1 with elements e of the universe U at its leaves. The digital memory structure has an array of overlapped registers reg[i], preferably where O i M/2-1, for storing internal nodes of the binary tree along respective paths from ancestors of the leaves to root. Location j of register reg[i] is arranged to store internal node k, preferably where k=(i div 2j)+2m−j−l). Any internal node of the binary tree is stored tagged, if the right and/or left subtree thereof contain(s) at least one element of subset N. The digital memory structure also has an array of pointers internal[l], preferably where 1 1 M-1, to the smallest element in the right subtree, and/or the largest element in the left subtree, of each respective ontemal node 1.

Abstract: A firewall (3), controlling network data packet traffic between internal and external networks (1,5,4), comprising filtering means, in dependence of the contents in data fields of a data packet being transmitted between said networks, selecting from a total set of rules a rule applicable to the data packet, whereby said packet is blocked or forwarded through the firewall (3). A 2-dimensional address lookup means (8) performs a 2-dimensional lookup of the source and destination addresses of the packet in a set of address prefixes, each prefix having a subset of rules of the total set of rules, in order to find a prefix associated with said source and destination addresses, and rule matching means (10), performs—based on the contents of said data fields—a rule matching in order to find the rule applicable to the data packet.

Abstract: In a method of IP routing lookup in a routing table, comprising entries of arbitrary length prefixes with associated next-hop information in a next-hop table, to determine where IP datagrams are to be forwarded, a representation of the routing table is stored, in the form of a complete prefix tree (7), defined by the prefixes of all routing table entries. Further, a representation of a bit vector (8), comprising data of a cut through the prefix tree (7) at a current depth (D), and an array of pointers, comprising indices to the next-hop table and to a next-level chunk, are stored. The bit-vector (8) is divided into bit-masks and a representation of the bit-masks is stored in a maptable. Then, an array of code words, each encoding a row index into the maptable and a pointer offset, and an array of base addresses are stored. Finally, the lookup is performed.