202 can have some form of network address including a node identifier and a port number or can be a unique node identifier. Network interface 202 can be operatively coupled to a general purpose processor 206 for running the compute-intensive applications at issue.

Further, the host system 200 can include a storage interface 204, the type and form of which can be dependent on many factors or criteria. Storage interface 204 can be operatively coupled with general purpose processors 206 for controlling any storage decision or requirements for various applications of the host system 200. For example, storage of file data or block data, performance, operating system, throughput, flexibility, scalability, data mobility, reliability and the like can be controlled using storage interface 204.

The host system 200 can further include an operating system 208 for managing various computer resources and interfaces, which can include general purpose processor 206, storage interface 204, and network interface 202 so that the resources can be correctly and fairly used. Further, operating system 208 can be an interface that enables a user to interact with general purpose processor 206 of the host system 200. Further, operating system 208 of the host system 200 can run a program or group of programs designed for end users. These programs can be divided into two classes: low level software 210 and application software 212. While low level software 210 includes low-level programs that interact with computing devices at a basic level, application software 212 resides above system software and includes applications such as database programs, network security functionality and the like.

According to an embodiment, the host system 200 can further include an acceleration device 214 for hardware accelerating certain compute-intensive function, such as those involving pattern matching and/or policy searching. When the host system 200 receives an input stream of instructions, either from network interface 202 or from storage interface 204, for performing string matching and/or range comparison, acceleration device 214 can be used for providing effective hardware acceleration by performing string matching and range comparison on the received input stream using a hash based look up table so that suitable output can be provided to general purpose processor 206. In this manner, acceleration device 214 decreases latency and increases throughput of general purpose processor 206 of the host system 200. Those skilled in the art will appreciate that acceleration device can be used to perform various functionalities such as intrusion prevention pattern matching, firewall policy search pattern matching, applications' pattern matching and the like.

FIG. 2B is a block diagram 250 illustrating a network interface card (NIC) 218 including an acceleration device 214 in accordance with an embodiment of the present invention. In the context of the present example, to perform string matching and range comparison using acceleration device 214, a host system can be operatively coupled with a NIC 218. According to an embodiment, embedded processor 216 of NIC 218 can be operatively coupled to general purpose processor 206 of the host system. NIC 218 can further include network interface 202 and storage interface 204. Further, NIC 218 can include an acceleration device 214 operatively coupled with embedded processor 216. Acceleration device 214 can be configured to process an input stream of data for providing effective hardware acceleration, which may involve performing one or both of string matching and range comparison with a common set of hardware resources. Further, the host system can include operating system 208, low level software 210 and application software 212. In an embodiment, NIC 218 can be in the form of a discrete device that can be interfaced or operatively coupled with general purpose processor 206 of the host system for providing effective hardware acceleration, which involves performing string matching and/or range comparison. Further, acceleration device 214 of NIC 218 can be utilized for pattern matching by plurality of other host systems or network nodes operatively coupled with the NIC through the host system, without awareness of physical location of the NIC.

FIG. 3 illustrates examples 300 of a packet inspection rule 302, a firewall policy 304 and an SQL command 306 for which pattern matching and range comparison hardware acceleration would be helpful. The example packet inspection rule 302 pertains to inspection of packets to determine an input stream of data packets that have content type as text and/or Hypertext Markup Language (HTML). The example firewall policy 304 is defined to match all address from network 192.168.0.0/24. The example standardized query language (SQL) command 306 is defined to determine all results from ‘my table’ that have ‘ename’ as ‘shoe’ and has a ‘unit price’ between 100 and 1000. In an implementation, examples 302, 304 and 306 illustrate the type of compute-intensive pattern matching and policy searching that can be accelerated by an acceleration device described herein.

FIG. 4 is a block diagram illustrating components of an acceleration device 400 in accordance with an embodiment of the present invention. In the context of the present example, an input stream of information can be received at block 402 that pertains to a bloom filter of acceleration device 400. When the input stream pertains to a string, bloom filter 402 can facilitate determining a length of the input stream, which is further explained with reference to FIG. 5. However, when the input stream pertains to a range, the bloom filter 402 can be bypassed and the input stream can be directly provided to cascaded range or string compare block 404. Cascaded range or string compare block 404 can be used for performing range comparison and string matching to identify units of the input stream that satisfy conditions present in a hash-based lookup table, which is further explained with reference to FIGS. 6A-B. In an implementation, when input stream pertains to a string with a length less that a pre-defined threshold, the input stream can be passed through a symbol content address memory 406 to identify the units that satisfy conditions from multiple available conditions present in the hash-based look-up table.

Further, correlation block 408 can correlate the identified units based on a set of conditions defined as a rule related to any of a network policy definition, a packet inspection rule, a database operation command, a format of the input stream and the like. Output of the correlation block 408 is at least one set of correlated units, which can be passed to exact match processors 410 to perform exact string matching and exact range matching.

FIG. 5 is a block diagram illustrating implementation of a bloom filter architecture 500 in accordance with an embodiment of the present invention. According to an embodiment, bloom filter architecture 500 can include multiple bloom filters 502-1, 502-