US 11,838,318 B2
Data plane with connection validation circuits
Shruthi Krishnan, Santa Clara, CA (US); Junggun Lee, Los Altos, CA (US); and Changhoon Kim, Palo Alto, CA (US)
Assigned to Barefoot Networks, Inc., Santa Clara, CA (US)
Filed by Barefoot Networks, Inc., Santa Clara, CA (US)
Filed on Aug. 31, 2021, as Appl. No. 17/463,346.
Application 17/463,346 is a continuation of application No. 15/986,048, filed on May 22, 2018, granted, now 11,108,812, issued on Aug. 31, 2021.
Claims priority of provisional application 62/658,296, filed on Apr. 16, 2018.
Prior Publication US 2022/0094711 A1, Mar. 24, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/00 (2013.01); H04L 9/40 (2022.01); H04L 1/1607 (2023.01); H04L 45/64 (2022.01); H04L 12/54 (2022.01)
CPC H04L 63/1458 (2013.01) [H04L 1/1657 (2013.01); H04L 45/64 (2013.01); H04L 63/1425 (2013.01); H04L 12/56 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A data-plane circuit for use in a network forwarding element, the data-plane circuit being for forwarding data messages within a network, the data-plane circuit comprising:
a plurality of ports to receive and transmit data messages; and
a plurality of programmable message processing stages, comprising hardware, to process data tuples associated with the received data messages,
a first set of message processing stages programmed to implement a connection-validation circuit to validate source internet protocol (IP) addresses of a set of received data messages, while a second set of programmable message processing stages is programmed to perform data message forwarding operations in order to forward the data messages within the network;
wherein:
the first set of programmable message processing stages are to implement connection validation operations of the connection-validation circuit based, at least in part, upon a source-IP-based whitelist;
the whitelist is for use in determining message generation and message forwarding; and
after receiving a synchronization (SYN) data message for a destination compute node from a source compute node, the connection validation operations comprise consulting the source-IP-based whitelist to determine whether the whitelist indicates that a SYN data message should be forwarded to the destination compute node or whether the whitelist indicates that a SYN-acknowledgment (ACK) data message should be generated by the connection-validation circuit.