Abstract: A system and method to perform regular expression pattern matching is provided. A data stream is fed into a plurality of character match units, or CMU's, that are organized in series. A same character of the datastream is written into each of the CMU's for matching. A failure or success of the match attempt with a stored character of a selected CMU is reported to a pattern sequencing logic. A succeeding character of the datastream is then written into each of the CMU's for another character match attempt. The plurality of CMU's and the pattern sequencing logic may be comprised with a single pattern match unit, or PMU. The PMU may be controlled by a configuration data that is loaded into the PMU. The configuration data may consist of: (a.) pattern characters and length information; (b.) repetition and anchoring control; (c.) local character class definitions; and (d.) pattern sequencing information.

Abstract: A combined hash table/bucket trie technique facilitates fast, deterministic, memory-efficient exact match look-ups on extremely large tables. A limited number of hash keys which collide on the same location can be stored in the hash table. If further keys collide on the same location, a bucket trie is formed, the colliding keys are stored in the trie, and trie traversal information is stored in the hash table. Regardless of the number of buckets in the trie, an input key need only be compared with the keys in one bucket to detect a stored key identical to the input key or conclude that no stored key is identical to the input key.

Abstract: A high-speed parallel pattern searching system is disclosed. The high-speed parallel pattern searching system allows the body of a data packet to be searched for one or more patterns such as a string or a series of strings. These string patterns can be defined by the grammar of regular expressions. In the invention, one or more patterns are loaded into one or more nanocomputers that operate in parallel. A control system then feeds a packet body into the participating nanocomputers such that each participating nanocomputer tests for a match. The various tests performed by the nanocomputers may be combined to perform complex searches. These nanocomputer searches are performed in parallel. Furthermore, several different searches may be combined together using control statements. A combination of these searches engines can be supported such that data is also looked at in parallel.

Abstract: A control system for high-speed rule processors used in a gateway system is disclosed. The gateway system employing the current invention can process packets at wire speed by using massive parallel processors, each of the processors operating concurrently and independently. Further, the processing capacities in the gateway system employing the current invention are expandable. The number of packet inspector engines may be increased and all of the engines are connected in a cascade manner. Under the control system, all of the engines operate concurrently and independently and results from each of the engines are collected sequentially through a common data bus. As such the processing speed of packets becomes relatively independent of the complexities and numbers of rules that may be applied to the packets.

Abstract: A high-speed rule processing apparatus is disclosed that may be used to implement a wide variety of rule processing tasks such as network address translation, firewall protection, quality of service, IP routing, and/or load balancing. The high-speed rule processor uses an array of compare engines that operate in parallel. Each compare engine includes memory for storing instructions and operands, an arithmetic-logic for performing comparisons, and control circuitry for interpreting the instructions and operands. The results from the array of compare engines is prioritized using a priority encoding system.