Systems and methods for deep packet inspection with a virtual machine

Patent metadata

Field	Value
Publication number	US-9288159-B2
Application number	US-201313957990-A
Country	US
Kind code	B2
Filing date	Aug 2, 2013
Priority date	Aug 3, 2012
Publication date	Mar 15, 2016
Grant date	Mar 15, 2016

Abstract

System and methods are provided for performing deep packet inspection of data packets. An example system includes a packet forwarding component and a virtual machine component. The packet forwarding component is configured to receive data packets for transmission and to select one or more of the data packets based at least in part on a first set of rules for deep packet inspection. The virtual machine component is configured to perform deep packet inspection on the selected data packets according to a second set of rules to determine whether the selected data packets are allowed for transmission. The packet forwarding component is further configured to transmit the selected data packets when the selected data packets are allowed for transmission after the deep packet inspection.

First claim

What is claimed is:

1. A system for performing deep packet inspection of data packets, the system comprising at least one processor configured to:
receive a plurality of data packets to be forwarded; and
select one or more of the plurality of data packets based at least in part on a first set of rules for deep packet inspection, by inspecting a predetermined sequence of bits at a predetermined offset of each of the plurality of data packets;
perform deep packet inspection on the selected one or more data packets to determine whether the selected one or more data packets are allowed for forwarding, according to a second set of rules that are based on
(i) characters in the selected one or more data packets matching a predetermined pattern,
(ii) strings in the selected one or more data packets matching a predetermined pattern,
(iii) cardinality of a group consisting of the selected one or more data packets, wherein the cardinality represents how many packets are in the group,
(iv) behavioral and statistical analyses of the selected one or more data packets to identify a virus or analyze network traffic, and
(v) existence, from among the selected one or more data packets, a plurality of consecutive data packets that together contain a particular sequence of actions that indicates a particular application or network entity;

discard the selected one or more data packets in response to determining, based on the deep packet inspection, that the selected one or more data packets are not allowed for forwarding;
forward the selected one or more data packets in response to determining, based on the deep packet inspection, that the selected data packets are allowed for forwarding; and
wherein the receiving, the selecting, the discarding and the forwarding are performed by a packet forwarding component; and
wherein the deep packet inspection is performed by a virtual machine component.

2. The system of claim 1 , wherein the virtual machine component is configured to determine whether the selected data packets are allowed for forwarding by inspecting a particular sequence of bits of each of the selected data packets.

3. The system of claim 1 , wherein the virtual machine component is included in a deep-packet-inspection core, and wherein the packet forwarding component is included in a switch core.

4. The system of claim 3 , wherein the deep-packet-inspection core is included in a central-processing-unit core, and wherein the central-processing-unit core further includes an application processor configured to (i) receive information related to hardware events from the switch core, and (ii) output information related to configuration of the switch core.

5. The system of claim 1 , wherein the deep-packet-inspection core further includes a deep-packet-inspection control plane configured to (i) receive information related to deep-packet-inspection events from the virtual machine component, and (ii) output information related to configuration of the virtual machine component.

6. A method for performing deep packet inspection of data packets, the method comprising:
receiving a plurality of data packets to be forwarded;
selecting, based at least in part on a first set of rules, one or more of the plurality of data packets for deep packet inspection, by inspecting a predetermined sequence of bits at a predetermined offset of each of the plurality of data packets;
performing deep packet inspection on the selected one or more data packets to determine whether the selected one or more data packets are allowed for forwarding, according to a second set of rules that are based on
(i) characters in the selected one or more data packets matching a predetermined pattern,
(ii) strings in the selected one or more data packets matching a predetermined pattern,
(iii) cardinality of a group consisting of the selected one or more data packets, wherein the cardinality represents how many packets are in the group,
(iv) behavioral and statistical analyses of the selected one or more data packets to identify a virus or analyze network traffic, and
(v) existence, from among the selected one or more data packets, a plurality of consecutive data packets that together contain a particular sequence of actions that indicates a particular application or network entity;

discarding the selected one or more data packets in response to determining if the deep packet inspection determines that the selected one or more data packets are not allowed for forwarding; and
forwarding the selected one or more data packets if the deep packet inspection determines that the selected one or more data packets are allowed for forwarding.

7. The method of claim 6 , wherein performing, according to a second set of rules, deep packet inspection on the selected data packets to determine whether the selected data packets are allowed for forwarding includes:
inspecting a particular sequence of bits of each of the selected data packets.

8. The method of claim 6 , further comprising:
receiving information related to hardware events from a switch core, the switch core selecting, based at least in part on the first set of rules, one or more of the data packets for deep packet inspection; and outputting information related to configuration of the switch core.

9. The method of claim 6 , further comprising:
receiving information related to deep-packet-inspection events from a virtual machine, the virtual machine performing the deep packet inspection; and
outputting information related to configuration of the virtual machine.

10. A processing system for performing deep packet inspection of data packets, the processing system comprising:
one or more data processors configure to implement a virtual machine that is configured to
receive, from a switch core, one or more data packets to be forwarded, and
perform deep packet inspection on the one or more data packets to determine whether the one or more data packets are allowed for forwarding, according to a set of rules that are based on
(i) characters in the one or more data packets matching a predetermined pattern,
(ii) strings in the one or more data packets matching a predetermined pattern,
(iii) cardinality of a group consisting of the selected one or more data packets, wherein the cardinality represents how many packets are in the group,
(iv) behavioral and statistical analyses of the one or more data packets to identify a virus or analyze network traffic, and
(v) existence, from among the one or more data packets, a plurality of consecutive data packets that together contain a particular sequence of actions that indicates a particular application or network entity;

discard the one or more data packets in response to the virtual machine determining, based on the deep packet inspection, that the received one or more data packets are not allowed for forwarding; and
cause the received one or more data packets to be forwarded by the switch core in response to the virtual machine core determining, based on the deep packet inspection, that the one or more data packets are allowed for forwarding.

11. The processing system of claim 10 , wherein the virtual machine is configured to perform the deep packet inspection on the received data packets by inspecting a particular sequence of bits of each of the received data packets.

12. The processing system of claim 10 , wherein the switch core is configured to select, based at least in part on a second set of rules, the one or more data packets from a data stream for deep packet inspection.

13. The processing system of claim 12 , where the switch core is configured to select, based at least in part on t

Assignees

• Marvell World Trade Ltd

Inventors

• Hutt Gad
• Orr Michael
• Tausi Ronen
• Vovnoboy Vitaly

Classifications

• H04L43/12

  Network monitoring probes · CPC title

• H04L49/25 Primary

  Routing or path finding in a switch fabric · CPC title

• H04L43/028 Primary

  by filtering · CPC title