Patents by Inventor Tim Millet

Tim Millet has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Publication number: 20090238181
    Abstract: Methods and systems are provided for steering network packets. According to one embodiment a method is provided for steering incoming network packets. Each network packet processing resource of a network routing/switching device is dynamically assigned to one or more network interfaces of the network routing/switching device. Each of the network packet processing resources includes one or more processing elements and a memory. Incoming network packets received by the network interfaces are steered to an appropriate network packet processing resource based on the dynamic assignment.
    Type: Application
    Filed: June 2, 2009
    Publication date: September 24, 2009
    Applicant: FORTINET, INC.
    Inventors: Sachin Desai, Tim Millet, Zahid Hussain, Paul Kim, Louise Yeung, Ken Yeung
  • Publication number: 20090225759
    Abstract: Methods and systems are provided for applying metering and rate-limiting in a virtual router environment and supporting a hierarchy of metering/rate-limiting contexts per packet flow. According to one embodiment, multiple first level metering options and multiple second level metering options associated with a hierarchy of metering levels are provided. A virtual routing engine receives packets associated with a first packet flow and packets associated with a second packet flow. The virtual routing engine performs a first type of metering of the first level metering options on the packets associated with the first packet flow using a first metering control block (MCB) and performs a second type of metering of the second level metering options on the packets associated with the first packet flow and the packets associated with the second packet flow using a second MCB.
    Type: Application
    Filed: May 18, 2009
    Publication date: September 10, 2009
    Applicant: FORTINET, INC.
    Inventors: Zahid Hussain, Sachin Desai, Naveed Alam, Joseph Cheng, Tim Millet
  • Patent number: 7580373
    Abstract: Methods are provided for discovering nodes participating in a ring network. According to one embodiment, a ring controller receives a packet containing an arbitration token. If the arbitration token does not arrive within a preselected network timeout period, then the ring controller generates an arbitration token. If the packet contains an arbitration token, then the ring controller checks to see if it was modified by a higher priority node and if not, sets itself as the master node. For each discovery marker in the packet, the ring controller saves topology information associated with the discovery marker. The ring controller adds to the packet a first discovery marker when the packet does not contain a first discovery maker, wherein the first discovery marker includes topology information associated with the node. Finally, the ring controller sends the packet to a next node in the network.
    Type: Grant
    Filed: November 2, 2006
    Date of Patent: August 25, 2009
    Assignee: Fortinet, Inc.
    Inventor: Tim Millet
  • Patent number: 7522604
    Abstract: Methods and systems are provided for routing traffic through a virtual router-based network switch. According to one embodiment, a method for routing packets in a router includes establishing a flow data structure, which identifies a packet flow through a virtual router in the router. When a packet is received, a comparison is performed between a subset of at least one packet header associated with the packet and a subset of the flow data structure. If the subset of the packet header matches the subset of the flow data structure, then the packet can be hardware accelerated to a network interface. Otherwise, the packet may be either dropped or forwarded to a general purpose processor for processing.
    Type: Grant
    Filed: February 5, 2007
    Date of Patent: April 21, 2009
    Assignee: Fortinet, Inc.
    Inventors: Zahid Hussain, Samir Jain, Naveed Alam, Joseph Cheng, Greg Lockwood, Tim Millet
  • Publication number: 20090073977
    Abstract: Methods and systems are provided for routing traffic through a virtual router-based network switch. According to one embodiment, a flow data structure is established that identifies current packet flows associated with multiple virtual routers in the virtual router-based network device. When an incoming packet is received by the virtual router-based network device, it is then determined whether the incoming packet is associated with a current packet flow by accessing the flow data structure based on a header associated with the incoming packet. If it is determined that the incoming packet is associated with the current packet flow, then the incoming packet is hardware forwarded via a network interface of the virtual router-based network device without intervention by a processor of the virtual router-based network device, otherwise the incoming packet is forwarded to software on the processor for flow learning.
    Type: Application
    Filed: October 29, 2008
    Publication date: March 19, 2009
    Applicant: FORTINET, INC.
    Inventors: Zahid Hussain, Samir Jain, Naveed Alam, Joseph Cheng, Gregory Lockwood, Tim Millet
  • Publication number: 20080259936
    Abstract: A system and method for providing IP services. A packet is received at a line interface/network module and forwarded to a virtual routing engine The virtual routing engine determines if the packet requires processing by a virtual services engine. If the packet requires processing by the virtual services engine, the packet is routed to the virtual services engine for processing.
    Type: Application
    Filed: May 19, 2008
    Publication date: October 23, 2008
    Applicant: Fortinet, Inc.
    Inventors: Zahid Hussain, Tim Millet
  • Patent number: 7376125
    Abstract: A system and method for providing IP services. A packet is received at a line interface/network module and forwarded to a virtual routing engine The virtual routing engine determines if the packet requires processing by a virtual services engine. If the packet requires processing by the virtual services engine, the packet is routed to the virtual services engine for processing.
    Type: Grant
    Filed: June 4, 2002
    Date of Patent: May 20, 2008
    Assignee: Fortinet, Inc.
    Inventors: Zahid Hussain, Tim Millet
  • Publication number: 20070291755
    Abstract: Methods and systems are provided for hardware-accelerated packet multicasting in a virtual routing system. According to one embodiment, a multicast packet is received at an ingress system of a packet-forwarding engine (PFE). The ingress system identifies flow classification indices for the multicast packet. Then, for each instance of multicasting, the ingress system sends a single copy of the multicast packet and the flow classification indices to an egress system of the PFE. The single copy of the multicast packet is buffered in a memory accessible by the egress system. The egress system prepares the multicast packet for transmission by for each flow classification index, identifying corresponding transform control instructions based on the flow classification index, reading the single copy of the multicast packet from the memory, causing the multicast packet to be transformed in accordance with the identified transform control instructions and outputting the transformed multicast packet.
    Type: Application
    Filed: September 3, 2007
    Publication date: December 20, 2007
    Applicant: FORTINET, INC.
    Inventors: Joseph Cheng, Zahid Hussain, Tim Millet
  • Patent number: 7266120
    Abstract: A packet-forwarding engine (PFE) of a multiprocessor system uses an array of flow classification block (FCB) indices to multicast a packet. Packets are received and buffered in external memory. In one embodiment, when a multicast packet is identified, a bit is set in a packet descriptor and an FCB index is generated and sent with a null-packet to the egress processors which generate multiple descriptors with different indices for each instance of multicasting. All the descriptors may point to the same buffer in the external memory, which stores the multicast packet. A DMA engine reads from the same buffer multiple times and egress processors may access an appropriate transform control block (TCB) index so that the proper headers may be installed on the outgoing packet. The buffer may be released after the last time the packet is read by setting a particular bit of the FCB index.
    Type: Grant
    Filed: November 18, 2002
    Date of Patent: September 4, 2007
    Assignee: Fortinet, Inc.
    Inventors: Joseph Cheng, Zahid Hussain, Tim Millet
  • Publication number: 20070147368
    Abstract: Methods and systems are provided for steering network packets. According to one embodiment, a mapping associates a processing resource with a network interface module (netmod) and/or a number of line interface ports included within the netmod. In one embodiment, the mapping is configurable within the processing resource and pushed to the netmod. The netmod uses the mapping to steer network packets to the processing resource when the packets conform to the mapping. The mapping may be additionally used to identify a specific process that is to be performed against the packets once the processing resource receives the steered packets from the netmod.
    Type: Application
    Filed: March 10, 2007
    Publication date: June 28, 2007
    Applicant: FORTINET, INC.
    Inventors: Sachin Desai, Tim Millet, Zahid Hussain, Paul Kim, Louise Yeung, Ken Yeung
  • Publication number: 20070127382
    Abstract: Methods and systems are provided for routing traffic through a virtual router-based network switch. According to one embodiment, a method for routing packets in a router includes establishing a flow data structure, which identifies a packet flow through a virtual router in the router. When a packet is received, a comparison is performed between a subset of at least one packet header associated with the packet and a subset of the flow data structure. If the subset of the packet header matches the subset of the flow data structure, then the packet can be hardware accelerated to a network interface. Otherwise, the packet may be either dropped or forwarded to a general purpose processor for processing.
    Type: Application
    Filed: February 5, 2007
    Publication date: June 7, 2007
    Applicant: FORTINET, INC.
    Inventors: Zahid Hussain, Samir Jain, Naveed Alam, Joseph Cheng, Gregory Lockwood, Tim Millet
  • Publication number: 20070109968
    Abstract: Methods and systems are provided for applying metering and rate-limiting in a virtual router environment and supporting a hierarchy of metering/rate-limiting contexts per packet flow. According to one embodiment, multiple first level metering options and multiple second level metering options associated with a hierarchy of metering levels are provided. A virtual routing engine receives packets associated with a first packet flow and packets associated with a second packet flow. The virtual routing engine performs a first type of metering of the first level metering options on the packets associated with the first packet flow using a first metering control block (MCB) and performs a second type of metering of the second level metering options on the packets associated with the first packet flow and the packets associated with the second flow using a second MCB.
    Type: Application
    Filed: January 8, 2007
    Publication date: May 17, 2007
    Applicant: FORTINET, INC.
    Inventors: Zahid Hussain, Sachin Desai, Naveed Alam, Joseph Cheng, Tim Millet
  • Patent number: 7203192
    Abstract: Methods and Systems are provided for steering network packets and bridging media channels to a single processing resource. A mapping associates a processing resource with a network interface module (Netmod) or a number of line interface ports included within the Netmod. In one embodiment, the mapping is configurable within the processing resource and pushed to the Netmod. The Netmod uses the mapping to steer network packets to the processing resource when the packets conform to the mapping. Moreover, the mapping can be used to identify a specific process that is to be performed against the packets once the processing resource receives the steered packets from the Netmod.
    Type: Grant
    Filed: June 4, 2002
    Date of Patent: April 10, 2007
    Assignee: Fortinet, Inc.
    Inventors: Sachin Desai, Tim Millet, Zahid Hussain, Paul Kim, Louise Yeung, Ken Yeung
  • Publication number: 20070058648
    Abstract: A master node in a packet ring network periodically sends packet containing a discovery marker into the packet ring network. As each node in turn receives the packet, each adds its own discovery marker, which contains its topology information, to the packer, saves the topology information of others, and resends the packet to the next node in the ring. Eventually, the master node receives the packer containing a chain of discovery markers for all active nodes terminated by the master's own discovery marker, so the master node then removes its own discovery marker and resends the packer in to the ring network. Each node in turn then removes its own discovery marker. In this way, all nodes in the ring see topology information for every other active node.
    Type: Application
    Filed: November 2, 2006
    Publication date: March 15, 2007
    Applicant: FORTINET, INC.
    Inventor: Tim Millet
  • Patent number: 7181547
    Abstract: A master node in a packet ring network periodically sends a packet containing a discovery marker into the packet ring network. As each node in turn receives the packet, each adds its own discovery marker, which contains its topology information, to the packet, saves the topology information of others, and resends the packet to the next node in the ring. Eventually, the master node receives the packet containing a chain of discovery markers for all active nodes terminated by the master's own discovery marker, so the master node then removes its own discovery marker and resends the packet in to the ring network. Each node in turn then removes its own discovery marker. In this way, all nodes in the ring see topology information for every other active node.
    Type: Grant
    Filed: June 28, 2001
    Date of Patent: February 20, 2007
    Assignee: Fortinet, Inc.
    Inventor: Tim Millet
  • Patent number: 7177311
    Abstract: A method for routing packets in a router includes establishing a flow data structure identifying a packet flow through a virtual router in the router. Next, a system executing the method receives a packet, said packet having at least one packet header. The method then compares a subset of the at least one packet header to a subset of the flow data structure. If the subset of the at least one packet header matches the subset of the flow data structure, then the packet can be hardware accelerated to a network interface. Otherwise, the packet can be either dropped, or forwarded to a general purpose processor for processing.
    Type: Grant
    Filed: June 4, 2002
    Date of Patent: February 13, 2007
    Assignee: Fortinet, Inc.
    Inventors: Zahid Hussain, Samir Jain, Naveed Alam, Joseph Cheng, Gregory Lockwood, Tim Millet
  • Patent number: 7161904
    Abstract: A virtual routing platform includes a line interface a plurality of virtual routing engines (VREs) to identify packets of different packet flows and perform a hierarchy of metering including at least first and second levels of metering on the packet flows. A first level of metering may be performed on packets of a first packet flow using a first metering control block (MCB). The first level of metering may be one level of metering in a hierarchy of metering levels. A second level of metering on the packets of the first packet flow and packets of a second flow using a second MCB. The second level of metering may be another level of metering in the hierarchy. A cache-lock may be placed on the appropriate MCB prior to performing the level of metering. The first and second MCBs may be data structures stored in a shared memory of the virtual routing platform. The cache-lock may be released after performing the level of metering using the MCB.
    Type: Grant
    Filed: June 4, 2002
    Date of Patent: January 9, 2007
    Assignee: Fortinet, Inc.
    Inventors: Zahid Hussain, Sachin Desai, Naveed Alam, Joseph Cheng, Tim Millet
  • Publication number: 20060265519
    Abstract: A master node in a packet ring network periodically sends packet containing a discovery marker into the packet ring network. As each node in turn receives the packet, each adds its own discovery marker, which contains its topology information, to the packer, saves the topology information of others, and resends the packet to the next node in the ring. Eventually, the master node receives the packer containing a chain of discovery markers for all active nodes terminated by the master's own discovery marker, so the master node then removes its own discovery marker and resends the packer in to the ring network. Each node in turn then removes its own discovery marker. In this way, all nodes in the ring see topology information for every other active node.
    Type: Application
    Filed: July 29, 2006
    Publication date: November 23, 2006
    Applicant: FORTINET, INC.
    Inventor: Tim Millet
  • Publication number: 20040095934
    Abstract: A packet-forwarding engine (PFE) of a multiprocessor system uses an array of flow classification block (FCB) indices to multicast a packet. Packets are received and buffered in external memory. In one embodiment, when a multicast packet is identified, a bit is set in a packet descriptor and an FCB index is generated and sent with a null-packet to the egress processors which generate multiple descriptors with different indices for each instance of multicasting. All the descriptors may point to the same buffer in the external memory, which stores the multicast packet. A DMA engine reads from the same buffer multiple times and egress processors may access an appropriate transform control block (TCB) index so that the proper headers may be installed on the outgoing packet. The buffer may be released after the last time the packet is read by setting a particular bit of the FCB index.
    Type: Application
    Filed: November 18, 2002
    Publication date: May 20, 2004
    Applicant: CoSine Communications, Inc.
    Inventors: Joseph Cheng, Zahid Hussain, Tim Millet
  • Publication number: 20030223418
    Abstract: Methods and Systems are provided for steering network packets and bridging media channels to a single processing resource. A mapping associates a processing resource with a network interface module (Netmod) or a number of line interface ports included within the Netmod. In one embodiment, the mapping is configurable within the processing resource and pushed to the Netmod. The Netmod uses the mapping to steer network packets to the processing resource when the packets conform to the mapping. Moreover, the mapping can be used to identify a specific process that is to be performed against the packets once the processing resource receives the steered packets from the Netmod.
    Type: Application
    Filed: June 4, 2002
    Publication date: December 4, 2003
    Inventors: Sachin Desai, Tim Millet, Zahid Hussain, Paul Kim, Louise Yeung, Ken Yeung