US 12,335,154 B2
Dynamic leaf determination for tree creations for high-speed network policy search during data packet scanning
Shushan Wen, Pleasant Hill, CA (US)
Assigned to Fortinet, Inc., Sunnyvale, CA (US)
Filed by Fortinet, Inc., Sunnyvale, CA (US)
Filed on Mar. 30, 2023, as Appl. No. 18/129,038.
Application 18/129,038 is a continuation in part of application No. 17/566,855, filed on Dec. 31, 2021.
Prior Publication US 2023/0239213 A1, Jul. 27, 2023
Int. Cl. H04L 47/20 (2022.01); G06F 16/22 (2019.01); H04L 9/40 (2022.01); H04L 47/2441 (2022.01)
CPC H04L 47/20 (2013.01) [G06F 16/2246 (2019.01); H04L 47/2441 (2013.01); H04L 63/0263 (2013.01); H04L 63/20 (2013.01)] 9 Claims
OG exemplary drawing
 
1. A network processor of a network computing device on a data communication network, for dynamic leaf generation determination for generic tree policy search optimization in high-speed network processor configuration for examining data packets, the network processor comprising:
a raw policy set for the network processor and a dimension bitmap corresponding to the raw policy set;
a policy tree builder to generate a policy tree image from a set of recursive operations on the raw policy set including an on-the-fly determination of whether a specific node, corresponding to a selected dimension of the raw policy set, is a leaf based on a leaf policy count limit, wherein for the selected dimension, the specific node is associated with a policy count defining a number of policies from the raw policy set under the specific node and a range count defining a number of distinct ranges of the selected dimension, wherein the specific node is converted to the leaf if the policy count does not exceed the leaf policy count limit and the range count for the selected dimension does not exceed a product of the leaf policy count limit and a range count limit coefficient, and otherwise the specific node is converted to two or more child nodes, and wherein the leaf policy count limit is determined from a predetermined upper and lower limit and a ratio of the policy count and a sum of the policy count and the range count;
network processor hardware to configure at least one set of registers, at least one set of tables, and at least one sequence of instructions according to the policy tree image; and
a queue to receive data packets of a data packet session,
wherein the network processor applies the optimized policy tree image to the data packet session from the data communication network by the network processor.