Abstract: Systems, devices, and methods for correlating security policies to received packets are provided. In one example, a network device, maintains information regarding multiple security policies within a dual bitmap based search tree including a first bitmap and a second bitmap formatted as information embedded in a node structure. A packet is received by the network. A first field of the packet is compared with a first range, corresponding to a first bit location in the first bitmap in which the first bit location in the first bitmap is associated with at least a first security policy. After determining the first field is within the first range, the network device accesses a second bit location in the second bitmap, corresponding to the first bit location. Based at least in part upon a value in the second bit location, a set of one or more security policies are applied to the packet.

Abstract: Systems, devices, and methods are discussed for classifying a number of security policies in relation to criteria for applying those security policies to yield a dual bitmap scheme representing a correlation between security policies and one or more criteria.

Abstract: Systems, devices, and methods for correlating security policies to received packets are provided. In one example, a network device, maintains information regarding multiple security policies within a dual bitmap based search tree including a first bitmap and a second bitmap formatted as information embedded in a node structure. A packet is received by the network. A first field of the packet is compared with a first range, corresponding to a first bit location in the first bitmap in which the first bit location in the first bitmap is associated with at least a first security policy. After determining the first field is within the first range, the network device accesses a second bit location in the second bitmap, corresponding to the first bit location. Based at least in part upon a value in the second bit location, a set of one or more security policies are applied to the packet.

Abstract: Systems, devices, and methods are discussed for identifying security policies applicable to a received information packet based upon a dual bitmap scheme accounting for bit position mergers and/or policies common to multiple bit positions.

Abstract: Systems, devices, and methods are discussed for classifying a number of security policies in relation to criteria for applying those security policies to yield a dual bitmap scheme representing a correlation between security policies and one or more criteria.

Abstract: Systems, devices, and methods are discussed for identifying security policies applicable to a received information packet based upon a dual bitmap scheme accounting for bit position mergers and/or policies common to multiple bit positions.

Abstract: Systems and methods for programming a network device using a domain-specific language (DSL) are provided. According to one embodiment, source code in a form of a DSL, describing a slow-path task that is to be performed by a network device, is received by a processing resource. A determination is made regarding one or more types of processors are available within the network device to implement the slow-path task. For each portion of the source code, a preferred type of processor is determined by which the portion of the source code would be most efficiently implemented. When the preferred type of processor is available within the network device, executable code is generated targeting the preferred type of processor based on the portion of the source code; otherwise, intermediate code is generated in a form of a high-level programming language, targeting a general purpose processor of the network device.

Abstract: Systems and methods for programming a network device using a domain-specific language (DSL) are provided. According to one embodiment, source code in a form of a DSL, describing a slow-path task that is to be performed by a network device, is received by a processing resource. A determination is made regarding one or more types of processors are available within the network device to implement the slow-path task. For each portion of the source code, a preferred type of processor is determined by which the portion of the source code would be most efficiently implemented. When the preferred type of processor is available within the network device, executable code is generated targeting the preferred type of processor based on the portion of the source code; otherwise, intermediate code is generated in a form of a high-level programming language, targeting a general purpose processor of the network device.

Abstract: Systems and methods for generating design verification test cases using a restricted randomization process are provided. According to one embodiment, a processor of a hardware design verification system receives a set of restrictions and defines a scenario involving the values that is to be excluded from the test case. The processor also receives pre-assigned values for one or more variables. For each variable other than the one or more variables, the processor assigns a first random value to the variable that is within a valid range for the variable. The processor then identifies a conflict between a first pair of variables, and resolves the conflict by assigning a second random value to a first variable or a second variable of the first pair of variables within their respective valid ranges.

Abstract: The present invention discloses a rule matching method including: receiving a packet; detecting feature information in content of the packet, and determining whether the detected feature information in the packet conforms to a classification characteristic of one rule group among a plurality of preset rule groups; if yes, determining a state machine corresponding to the one rule group as a first state machine; and determining whether the first state machine is stored in an on-chip memory, and if yes, using the first state machine to match the packet to obtain a matching result; and if no, when an off-chip memory stores the first state machine, loading the first state machine from the off-chip memory into the on-chip memory, and using the first state machine to match the packet to obtain a matching result. Embodiments of the present invention enable a product to achieve better performance.

Abstract: The present invention discloses a rule matching method including: receiving a packet; detecting feature information in content of the packet, and determining whether the detected feature information in the packet conforms to a classification characteristic of one rule group among a plurality of preset rule groups; if yes, determining a state machine corresponding to the one rule group as a first state machine; and determining whether the first state machine is stored in an on-chip memory, and if yes, using the first state machine to match the packet to obtain a matching result; and if no, when an off-chip memory stores the first state machine, loading the first state machine from the off-chip memory into the on-chip memory, and using the first state machine to match the packet to obtain a matching result. Embodiments of the present invention enable a product to achieve better performance.