Abstract: A data processing method comprises receiving an electronically parseable document, scanning the document according to at least one predefined rule to determine if the document is suspicious, and, if the document is determined not to be suspicious, parsing the document with a first parser, and, if the document is determined to be suspicious, parsing the document with a second parser.

Abstract: The present, invention improves the hash table lookup operation by using a new processor cache architecture. A speculative processing of entries stored in the cache is combined with a delayed evaluation of cache entries. The speculative processing means that for each cache entry retrieved from main memory in a step of the hash table lookup operation it is assumed that it already contains the selected hash table entry. The delayed evaluation means that certain steps of the lookup operation are performed in parallel with others. In advantageous embodiments the invention can also be used in conjunction with a hierarchy of inclusive caches. The preferred embodiments of the invention involve a new approach for a transition rule cache of a BaRT-FSM controller.

Abstract: The invention relates to a method of optimizing a state transition function specification for a state machine engine based on a probability distribution for the state transitions. For the preferred embodiment of the invention, a B-FSM state machine engine accesses a transition rule memory using a processor cache. The invention allows improving the cache hit rate by exploiting the probability distribution. The N transition rules that comprise a hash table entry will be loaded in a burst mode from the main memory, from which the N transition rules are transferred to the processor cache. Because the comparison of the actual state and input values against each of the transition rules can immediately start after each of these rules has been received, the overall performance is improved as the transition rule that is most likely to be selected is the first to be transferred as part of the burst access.

Abstract: The invention relates to a method and system for the design and implementation of state machine engines. A first constraints checking step checks a state transition function created by a designer against constraints imposed by the implementation technology in order to detect all portions of the state transition function that are in conflict with the constraints. A subsequent conflict resolution step tries to determine one or more suggested ways to meet the conflicting constraints, by investigating how the original state transition function can be modified such that all constraints are met. A final presentation and selection step provides the designer textual and/or graphically results of the constraints check and suggested modifications. The modifications can be accepted interactively, or the state transition function can be changed manually. In the latter case, the modified state transition function will be processed starting again with the constraints checking step.

Abstract: Methods and apparatus are provided for classifying data packets in a data processing device (1) according to a plurality of context-specific sets of processing rules based on context identifiers associated with respective data packets, each context identifier corresponding to a said context-specific rule set to be used for classification of the associated packet, wherein, for each of a predetermined group of data items in each packet, each rule defines a rule range indicating a range of possible values of the corresponding data item for which that rule applies.

Abstract: Methods and apparatus are provided for classifying data packets in data processing systems. A first packet classification method determines which of a plurality of predefined processing rules applies to a data packet, where each rule is associated with a range of possible data values in each of a plurality of dimensions (X,Y) corresponding to respective data items in the packet format. For each dimension (X,Y), it is determined which of a set of predefined basic ranges contains the corresponding data value (I1, I2) from the packet, where the basic ranges correspond to respective non-overlapping value ranges between successive rule range boundaries in the dimension. For the basic range so determined for each dimension, a corresponding basic range identifier is selected from a set of predefined basic range identifiers corresponding to respective basic ranges in that dimension.

Abstract: A method and system for converting a plurality of ranges of values for a plurality of packet classification rules in a computer system is disclosed. The plurality of ranges exists in at least one dimension. The method and system include mapping each of the plurality of ranges to a plurality of nonoverlapping prefixes. The method and system also include mapping the plurality of nonoverlapping prefixes to a plurality of overlapping prefixes corresponding to the plurality of ranges. The plurality of overlapping prefixes include a plurality of shorter matching overlapping prefixes for a plurality of nonconflicting ranges.

Abstract: A method and apparatus for deep packet processing including a parsing and a searching method supported by a data structure storing the state-transition rules in the state-transition rule tables of a programmable state machine for parsing. The state-transition rule table is then compressed using the BaRT compression algorithm. Each transition rule comprises a test value, a test mask and a next state field. In a second embodiment the state-transition rule table is split into more than one state-transition rule table corresponding to disjoints state spaces, thus allowing more flexibility in the use of storage space. Finally a parsing and searching method can be implemented using the same hardware. The searching and parsing methods can be implemented alternatively or in any combination at wire-speed.

Abstract: An XML parsing system includes a pattern-matching system 1 that receives an input stream 2 of characters corresponding to the XML document to be parsed, and provides an output 3 for subsequent processing in software by a processor 4. The pattern matching system 1 includes two main components, a controller in the form of a programmable state machine 5, which is programmed with an appropriate state transition diagram 6, and a character processing unit 7 in the form of a token and character handler. The programmable state machine 5 controls the character processing unit 7 to, e.g., compare characters in the input character stream 2 with other received or stored characters. The character processing unit 7 then provides feedback to the programmable state machine controller 5, e.g., as to whether the compared characters match, so that the programmable state machine controller 5 can then parse the received document accordingly.

Abstract: A method and system for storing and searching for prefixes for rules, such as filter rules, in a computer system is disclosed. The method and system include providing a ternary content addressable memory (TCAM). The filter rules use range(s) of values in at least one dimension and correspond to prefix(es). The range(s) are described by prefix(es). Some filter rules may intersect. The method and system include providing priorities for the filter rules. The priorities include at least one different priority for the filter rules that intersect. The method and system also include storing the prefixes in the TCAM in block(s) in an order based upon the priorities of the filter rules. In another aspect, the method and system include searching the TCAM for a longest prefix match for a key and searching an additional storage for an almost exact match for the key in parallel with the TCAM.

Abstract: Methods and apparatus are provided for classifying data packets in a data processing device according to a set of processing rules, wherein, for each of a predetermined group of data items in each packet, each rule defines a rule range indicating a range of possible values of the corresponding data item for which that rule applies.

Abstract: Methods and apparatus are provided for classifying data packets in a data processing device. In one aspect, packets are classified according to a plurality of sets of processing rules. Each rule defines a plurality of rule ranges, each rule range indicating a range of possible values of a corresponding data item in the packet for which the rule applies, and rule ranges defined in different rule sets correspond to a common set of data items. Independent item searches are performed for respective data items in the packet corresponding to rule ranges defined in the rule sets. The item search for a data item comprises selecting a range identifier corresponding to the value of the data item from a predetermined set of range identifiers for that data item. This set of range identifiers indicates, for all possible values of the data item, which of the rule ranges corresponding to the data item in the rule sets a value intersects.

Abstract: The invention relates to a system in which given search keys are evaluated, segment by segment, to search through tree-structured tables for finding an output information corresponding to the longest matching prefix. For at least one of the segments, only selected bits of the search key segment are used as index for accessing an associated table where test values are stored which are to be compared to the respective search key segment. The bits to be selected are determined by an index mask, reflecting the distribution of the valid test values in the table entries (and valid search key segment values). This allows table compression for minimizing storage requirements and search time. A procedure is disclosed for generating an optimum index mask in response to the set of valid test values.

Abstract: A system for reducing the size of a database includes a memory in which the database configured in a ternary matrix array structure is stored. A processor executing at least one reduction algorithm scans the database tagging superfluous entries that are subsequently deleted. The tagging and deleting are done in such a way that the logical contents of the original database is unchanged, even though the size of the database is reduced.

Abstract: The invention is directed to methods, apparatus and systems for processing a data packet that has a destination address. In the event that in a routing table cache and in a routing table, there is no entry with a destination address prefix that is a prefix of the destination address, a default-route-prefix is determined in a default-route determination step.

Abstract: A method and system for storing and searching for prefixes for rules, such as filter rules, in a computer system is disclosed. The method and system include providing a ternary content addressable memory (TCAM). The filter rules use range(s) of values in at least one dimension and correspond to prefix(es). The range(s) are described by prefix(es). Some filter rules may intersect. The method and system include providing priorities for the filter rules. The priorities include at least one different priority for the filter rules that intersect. The method and system also include storing the prefixes in the TCAM in block(s) in an order based upon the priorities of the filter rules. In another aspect, the method and system include searching the TCAM for a longest prefix match for a key and searching an additional storage for an almost exact match for the key in parallel with the TCAM.

Abstract: A method and system for converting a plurality of ranges of values for a plurality of packet classification rules in a computer system is disclosed. The plurality of ranges exists in at least one dimension. The method and system include mapping each of the plurality of ranges to a plurality of nonoverlapping prefixes. The method and system also include mapping the plurality of nonoverlapping prefixes to a plurality of overlapping prefixes corresponding to the plurality of ranges.

Abstract: In a system for finding output information such as an output link identification, by a longest-matching prefix search in response to a search key, only a search data structure comprising search tables is provided which is derived from a basic data structure comprising detailed prefix tables. The full basic data structure need not be maintained, but auxiliary information is provided in the search tables of the search data structure to enable reconstruction of relevant portions of the basic data structure when updates have to be made. In an updating procedure, first the relevant search tables are found and then reconverted to the associated prefix tables from which they were derived. Updating is performed on the reconstructed prefix tables which are then reconverted into search tables to be inserted into the search data structure, for replacing or supplementing search tables that required updating.

Abstract: Methods and apparatus are provided for classifying data packets in data processing systems. A first packet classification method determines which of a plurality of predefined processing rules applies to a data packet, where each rule is associated with a range of possible data values in each of a plurality of dimensions (X,Y) corresponding to respective data items in the packet format. For each dimension (X,Y), it is determined which of a set of predefined basic ranges contains the corresponding data value (I1, I2) from the packet, where the basic ranges correspond to respective non-overlapping value ranges between successive rule range boundaries in the dimension. For the basic range so determined for each dimension, a corresponding basic range identifier is selected from a set of predefined basic range identifiers corresponding to respective basic ranges in that dimension.

Abstract: In a system in which data are stored in an interleaved fashion in a memory consisting of a plurality of memory banks, a method and means are provided for mapping a given address into a memory bank and an internal memory bank address. Lookup table means (LUT1; LUT2) are provided for furnishing not only a bank number but also a part (MSP) of the internal bank address, in response to selected portions (X, Y) from the given address, while the remainder (LSP) of the internal bank address is directly taken from the given address. Two implementations are disclosed in which either two lookup tales are provided, or two sections in a single lookup table, for separately generating the bank number and a part of the internal bank address. Another implementation provides two lookup tables which are accessed sequentially and which provide different intermediate outputs (m, n, p, q, r) which are selectively combined (B, C) to obtain bank number as well as part of the internal bank address.