专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20210306373A1 HARDWARE ACCELERATION DEVICE FOR DENIAL-OF-SERVICE ATTACK IDENTIFICATION AND MITIGATION 有权
公开(公告)号：US20210306373A1
公开(公告)日：2021-09-30
申请号：US16836540
申请日：2020-03-31
申请人： Fortinet, Inc.
发明人： Zhi Guo , Peixue Li , Xu Zhou
IPC分类号： H04L29/06 , H04L29/08 , H04L12/861 , H04L12/745 , H04L12/26
摘要： Systems and methods for providing an integrated or Smart NIC-based hardware accelerator for a network security device to facilitate identification and mitigation of DoS attacks is provided. According to one embodiment, a processor of a network security device receives an application layer protocol request from a client, directed to a domain hosted by various servers and protected by the network security device. The application layer protocol request is parsed to extract a domain name and a path string. The hardware acceleration sub-system updates rate-based counters based on the application layer protocol request by performing a longest prefix match on the domain name and the path string. When a rate threshold associated with the rate-based counters is exceeded, a challenge message is created and transmitted to the client, having embedded therein the application layer protocol request; otherwise the application layer protocol request is allowed to pass through the network security device.

2. 发明授权

US10212129B2 Network interface card rate limiting 有权
公开(公告)号：US10212129B2
公开(公告)日：2019-02-19
申请号：US15454887
申请日：2017-03-09
申请人： Fortinet, Inc.
发明人： Zhiwei Dai , Xu Zhou
IPC分类号： G06F13/22 , H04L29/06 , G06F13/34 , G06F13/16 , G06F13/28 , G06F9/48 , G06F15/78 , H04L12/26
摘要： Systems and methods for limiting the rate of packet transmission from a NIC to a host CPU are provided. According to one embodiment, data packets are received from a network by the NIC. The NIC is coupled to a host central processing unit (CPU) of a network security device through a bus. A status of the host CPU is monitored by the NIC. A rate limiting mode indicator is set by the NIC based on the status. When the rate limiting mode indicator indicates rate limiting is inactive, then the received data packets are delivered or made available to the host CPU for processing. When the rate limiting mode indicator indicates rate limiting is active, then rate limiting is performing by temporarily stopping or slowing the delivery or making available of the received data packets to the host CPU for processing.

3. 发明授权

US10176322B2 Operation of a dual instruction pipe virus co-processor 有权
公开(公告)号：US10176322B2
公开(公告)日：2019-01-08
申请号：US15707080
申请日：2017-09-18
申请人： Fortinet, Inc.
发明人： Xu Zhou , Lin Huang , Michael Xie
IPC分类号： G06F21/56 , G06F21/55 , H04L29/06 , G06F9/38 , G06F21/75
摘要： Circuits and methods are provided for detecting, identifying and/or removing undesired content. According to one embodiment, a method for performing content scanning of content objects is provided. A content object that is to be scanned is stored by a general purpose processor to a system memory of the general purpose processor. Content scanning parameters associated with the content object are set up by the general purpose processor. Instructions from a signature memory of a co-processor that is coupled to the general purpose processor are read by the co-processor based on the content scanning parameters. The instructions contain op-codes of a first instruction type and op-codes of a second instruction type. Those of the instructions containing op-codes of the first instruction type are assigned by the co-processor to a first instruction pipe of multiple instruction pipes of the co-processor for execution. An instruction of the assigned instructions containing op-codes of the first instruction type is executed by the first instruction pipe including accessing a portion of the content object from the system memory.

4. 发明申请

US20170318031A1 DIRECT CACHE ACCESS FOR NETWORK INPUT/OUTPUT DEVICES 审中-公开
公开(公告)号：US20170318031A1
公开(公告)日：2017-11-02
申请号：US15651274
申请日：2017-07-17
申请人： Fortinet, Inc.
发明人： Xu Zhou , Hongbin Lu
IPC分类号： H04L29/06 , H04L29/08 , G06F12/14 , G06F3/06
CPC分类号： H04L63/1408 , G06F3/0619 , G06F3/065 , G06F3/067 , G06F12/0806 , G06F12/0813 , G06F12/0817 , G06F12/145 , G06F15/167 , G06F2212/1016 , G06F2212/1052 , H04L63/0236 , H04L63/0245 , H04L63/0272 , H04L67/2842 , H04L67/2857 , H04L69/22
摘要： Methods and systems for improving efficiency of direct cache access (DCA) are provided. According to one embodiment, a set of DCA control settings are defined by a network interface controller (NIC) of a network security device for each of multiple I/O device queues. The control settings specify portions of network packets that are to be copied to a cache of the corresponding CPU. A packet is received by the NIC. The packet is parsed to identify boundaries of portions of the packet and is queued onto an I/O device queue. The packet is then transferred from the I/O device queue to a host memory of the network security device and the specified portions are concurrently copied to the cache of the corresponding CPU based on the control setting associated with the I/O device queue.

5. 发明申请

US20170255549A1 VIRTUALIZATION IN A MULTI-HOST ENVIRONMENT 审中-公开
公开(公告)号：US20170255549A1
公开(公告)日：2017-09-07
申请号：US15600402
申请日：2017-05-19
申请人： Fortinet, Inc.
发明人： Xu Zhou , Zengli Duan , Ziyu Huang
IPC分类号： G06F12/02 , G06F3/06 , G06F9/455
CPC分类号： G06F12/0238 , G06F3/061 , G06F3/0644 , G06F3/0655 , G06F3/0683 , G06F9/455 , G06F9/45558 , G06F12/0284 , G06F2009/45583
摘要： Methods and systems for implementing improved partitioning and virtualization in a multi-host environment are provided. According to one embodiment, multiple devices, including CPUs and peripherals, coupled with a system via an interconnect matrix/bus are associated with a shared memory logically partitioned into multiple domains. A first domain is associated with a first set of the devices and a second domain is associated with a second set of the devices. A single shared virtual map module (VMM), maps a memory access request to an appropriate partitioned domain of the memory to which the originating device has been assigned based on an identifier associated with the device and further based on they type of memory access. The VMM causes a memory controller to perform memory access on behalf of the device by outputting a physical address based on the identified domain and the virtual address specified by the request.

6. 发明授权

US09712544B2 Direct cache access for network input/output devices 有权
公开(公告)号：US09712544B2
公开(公告)日：2017-07-18
申请号：US15434342
申请日：2017-02-16
申请人： Fortinet, Inc.
发明人： Xu Zhou , Hongbin Lu
IPC分类号： G06F3/00 , H04L29/06 , G06F3/06 , H04L29/08 , G06F12/14
CPC分类号： H04L63/1408 , G06F3/0619 , G06F3/065 , G06F3/067 , G06F12/0806 , G06F12/0813 , G06F12/0817 , G06F12/145 , G06F15/167 , G06F2212/1016 , G06F2212/1052 , H04L63/0236 , H04L63/0245 , H04L63/0272 , H04L67/2842 , H04L67/2857 , H04L69/22
摘要： Methods and systems for improving efficiency of direct cache access (DCA) are provided. According to one embodiment, a set of DCA control settings are defined by a network interface controller (NIC) of a network security device for each of multiple I/O device queues. The control settings specify portions of network packets that are to be copied to a cache of the corresponding CPU. A packet is received by the NIC. The packet is parsed to identify boundaries of portions of the packet and is queued onto an I/O device queue. The packet is then transferred from the I/O device queue to a host memory of the network security device and the specified portions are concurrently copied to the cache of the corresponding CPU based on the control setting associated with the I/O device queue.

7. 发明申请

US20170193231A1 EFFICIENT DATA TRANSFER IN A VIRUS CO-PROCESSING SYSTEM 审中-公开
公开(公告)号：US20170193231A1
公开(公告)日：2017-07-06
申请号：US15269658
申请日：2016-09-19
申请人： Fortinet, Inc.
发明人： Xu Zhou , Lin Huang , Michael Xie
IPC分类号： G06F21/56 , G06F12/1009
CPC分类号： G06F21/568 , G06F12/1009 , G06F21/562 , G06F21/564 , G06F21/565 , G06F21/567 , G06F2212/1052 , G06F2212/152 , G06F2212/657
摘要： Circuits and methods are provided for detecting, identifying and/or removing undesired content. According to one embodiment, a processor maintains a page directory and a page table within a system memory for use in connection with translating virtual addresses to physical addresses. Content scanning of a content object is offloaded to a hardware accelerator coupled to the processor by storing content scanning parameters, including the content object and a type of the content object, to the memory using one or more virtual addresses and indicating to the hardware accelerator that the content object is available for content scanning. Responsive thereto, the hardware accelerator: (i) translates the virtual addresses to corresponding physical addresses based on one or more of the page directory and the page table; (ii) accesses scanning parameters based on the physical addresses; (iii) scans the content object for undesirable content by applying multiple signatures; and (iv) returns a result of the content scanning to the processor.

8. 发明申请

US20160352652A1 VIRTUAL MEMORY PROTOCOL SEGMENTATION OFFLOADING 审中-公开
标题翻译：虚拟内存协议分段卸载
公开(公告)号：US20160352652A1
公开(公告)日：2016-12-01
申请号：US15198936
申请日：2016-06-30
申请人： Fortinet, Inc.
发明人： Xu Zhou , David Chen , Lin Huang , Guansong Zhang
IPC分类号： H04L12/935 , H04L12/863 , G06F12/1081 , H04L29/06
CPC分类号： H04L49/3045 , G06F12/1081 , G06F13/1689 , G06F2212/657 , H04L47/62 , H04L47/621 , H04L69/166
摘要： Methods and systems for a more efficient transmission of network traffic are provided. According to one embodiment, presence of outbound payload data, distributed across a first and second payload buffer, within a user memory space of a network device that has been generated by a user process is determined by a bus/memory interface or a network interface unit. The payload data is fetched by performing direct virtual memory addressing of the user memory space including mapping virtual addresses of the payload buffers to corresponding physical addresses, including: (i) when the payload buffers are noncontiguous, then retrieving the outbound payload data with reference to multiple buffer descriptors having starting virtual addresses of the payload buffers and (ii) when they are contiguous, then retrieving the outbound payload data with reference to a single buffer descriptor. The outbound payload data is then segmented across one or more TCP packets.
摘要翻译：提供了更有效地传输网络流量的方法和系统。根据一个实施例，由用户进程生成的网络设备的用户存储器空间内的分布在第一和第二有效载荷缓冲器上的出站有效载荷数据的存在由总线/存储器接口或网络接口单元。通过执行用户存储器空间的直接虚拟存储器寻址来获取有效负载数据，包括将有效载荷缓冲器的虚拟地址映射到对应的物理地址，包括：（i）当有效载荷缓冲器不连续时，参考具有有效载荷缓冲区的起始虚拟地址的多个缓冲器描述符和（ii）当它们是连续的时，然后参考单个缓冲器描述符检索出站有效载荷数据。然后将出站有效载荷数据跨越一个或多个TCP数据包进行分段。

9. 发明授权

US09460287B2 Efficient data transfer in a virus co-processing system 有权
标题翻译：病毒协同处理系统中的高效数据传输
公开(公告)号：US09460287B2
公开(公告)日：2016-10-04
申请号：US14734488
申请日：2015-06-09
申请人： Fortinet, Inc.
发明人： Xu Zhou , Lin Huang , Michael Xie
IPC分类号： G06F11/00 , G06F21/56
CPC分类号： G06F21/568 , G06F12/1009 , G06F21/562 , G06F21/564 , G06F21/565 , G06F21/567 , G06F2212/1052 , G06F2212/152 , G06F2212/657
摘要： Circuits and methods are provided for detecting, identifying and/or removing undesired content. According to one embodiment, a processor maintains a page directory and a page table within a system memory that contain information for translating virtual addresses to physical addresses. Virus processing of a content object is offloaded to a hardware accelerator coupled to the processor by storing scanning parameters, including the content object and a type of the content object, to the memory using one or more virtual addresses and indicating to the hardware accelerator that the content object is available for processing. Responsive thereto, the hardware accelerator: (i) translates the virtual addresses to corresponding physical addresses based on the page directory and the page table; (ii) accesses the scanning parameters based on the physical addresses; (iii) scans the content object for viruses by applying multiple virus signatures; and (iv) returns a result of the scanning to the processor.
摘要翻译：电路和方法被提供用于检测，识别和/或去除不需要的内容。根据一个实施例，处理器维护页面目录和在系统存储器内的包含用于将虚拟地址转换为物理地址的信息的页表。通过使用一个或多个虚拟地址将包括内容对象和内容对象的类型的扫描参数存储到存储器中，将内容对象的病毒处理卸载到耦合到处理器的硬件加速器，并向硬件加速器指示内容对象可用于处理。响应于此，硬件加速器：（i）基于页目录和页表将虚拟地址转换为相应的物理地址; （ii）基于物理地址访问扫描参数; （iii）通过应用多个病毒签名对内容对象进行病毒扫描; 和（iv）将扫描结果返回给处理器。

10. 发明申请

US20160094519A1 DIRECT CACHE ACCESS FOR NETWORK INPUT/OUTPUT DEVICES 审中-公开
公开(公告)号：US20160094519A1
公开(公告)日：2016-03-31
申请号：US14736432
申请日：2015-06-11
申请人： Fortinet, Inc.
发明人： Xu Zhou , Hongbin Lu
IPC分类号： H04L29/06 , H04L29/08
CPC分类号： H04L63/1408 , G06F3/0619 , G06F3/065 , G06F3/067 , G06F12/0806 , G06F12/0813 , G06F12/0817 , G06F12/145 , G06F15/167 , G06F2212/1016 , G06F2212/1052 , H04L63/0236 , H04L63/0245 , H04L63/0272 , H04L67/2842 , H04L67/2857 , H04L69/22
摘要： Methods and systems for improving efficiency of direct cache access (DCA) are provided. According to one embodiment, a set of DCA control settings are defined by a network I/O device of a network security device for each of multiple I/O device queues based on network security functionality performed by corresponding CPUs of a host processor. The control settings specify portions of network packets that are to be copied to a cache of the corresponding CPU. A packet is received by the network I/O device. Information associated with the packet is queued onto an I/O device queue. The information is then transferred from the I/O device queue to a host memory of the network security device. Based on the control settings for the I/O device queue only those portions of the information corresponding to the one or more specified portions are copied to the cache of the corresponding CPU.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式