Apparatus and method for processing of security capabilities through in-field upgrades

[0001] The present invention relates generally to computer networking security applications. More particularly, the invention provides a method and system for upgrading one or more hardware logic to one or more security logic processors coupled to a security device provided in a computing system in computer network environment. Merely by way of example, the invention has been applied to networking devices, which are distributed throughout local, wide area, and world wide area networks, any combination of these, and the like. Such networking devices include computers, servers, routers, bridges, network security appliances, firewalls, switches, any combination of these, and the like.

[0002] As the world progresses, internetworking of computers has become an important infrastructure for enterprises, communication systems, countries and the world. The data flowing between computers is increasingly more important in terms of both the content carried and the timeliness of delivery. Through technological advances in computing and networking, large databases are now in use and shared over networks by parties on opposite sides of the globe.

[0003] Data carried between computers across networks, such as the Internet, in small quantities are usually known as packets. Where an amount of data is too big to fit into a single packet (the size of which is typically defined by the characteristics of the network over which the packet will flow), a series of packets is used to carry the data from one end of the communication channel to the other. This series, or stream as it is commonly referred to, is then reassembled from the individual packets into the original data at the receiving end.

[0004] Packets are routed between computers using specially developed algorithms that allow computers and network equipment to decide along which path the packet should be sent to arrive at its final destination. These algorithms examine the packet header (typically a fixed sized portion of the packet containing information such as the source and destination address of the packet added to the payload to be transported) to make routing decisions. The algorithms need to examine the packet and make the decision very quickly to allow large numbers of packets to be sent with very small delay. As well as examining the header, the contents of the packet may be examined for information to aid in making decisions about the path and priority given to a packet; this examination of the data however adds an overhead that can limit the throughput and delay imposed by the device examining the data—typically the more data to be searched the longer the delay incurred by searching it.

[0005] Increasingly, as packets are sent from their source to their destination they are examined not just to help in routing decisions but for other purposes as well. A piece of email, which is sent across a network as a series of packets may be reassembled from the series of packets and examined to see if it is an unsolicited email message (commonly referred to as ‘spam’); this examination process often involves looking at the contents of the message, which is the payload portion of the packets involved in carrying the email. Similarly the email may be scanned to see if it contains a computer virus. Packets, or content data derived from a series of packets, may also be examined to look for copyright infringements, illegal activity such as network intrusions, spying, computer ‘hacking’ or corporate espionage, or simply to analyze usage to offer a better quality of service. By examining packets, or content data obtained from reassembling a series of packets, in a network new applications are now being offered, and it can reasonably be expected that new network applications based on the examination of packets or content data will continue to be developed.

[0006] Specialized network equipment is able to examine packet headers (with their small total size, set protocol and fixed layout) very quickly. However, to examine a packet's payload data or the content data derived from a series of packets, where content data are not always well structured, is complex and can be hard to do in the small window of time available to process each packet or content data. This problem is compounded when one must often analyze this payload or content data in context of data structures and protocols, and even further in the face of malicious obfuscation by a sophisticated attacker. Typically appliances such as email gateways, intrusion detection systems and general content protection appliances search the network data in software which, while often flexible and highly optimized, still comes nowhere near approaching the desired speeds, in terms of total throughput or delay. Appliances may also use specialized routing hardware which is strictly limited to examining headers. Furthermore, these software and hardware appliances typically impose quite severe restrictions on what data can be searched for, and the number of different patterns that can be matched simultaneously. Additionally, the software and hardware appliances often cannot uncover and detect security violations that occur in the network environment.

[0007] Specifically, the ability to detect existing and new security threats is often central to all network security systems. Detecting existing threats relies on pre-existing knowledge of the mechanism of action of a particular attack or malicious software. This knowledge usually takes the form of a signature that uniquely identifies the threat. As new threats are discovered, their signatures are distributed to existing security devices. Unfortunately, various limitations exist with these approaches.

[0008] As an example, a limitation of this approach is the inability of the security systems to detect previously unknown security threats. New attacks may often not yield to the same analysis techniques used to extract signatures from attacks in existence at the time the system was deployed. Alternatively, the signature definition format may not be sufficiently expressive to cover the new forms of security threats, requiring deployed security systems to be upgraded before these new threats can be detected. In the case of security systems based on hardware security devices, such in-field upgrades are often costly or impractical. That is, it is very difficult to upgrade conventional hardware security devices in an easy and cost effective manner. These and other limitations of the conventional approach can be found throughout the present specification and more particularly below.

[0009] What is desired is an apparatus and method that can improve detection of security. intrusions on computer networks.

[0010] According to the present invention, techniques for computer networking security applications are provided. More particularly, the invention provides a method and system for upgrading one or more hardware logic to one or more security logic processors coupled to a security device provided in a computing system in computer network environment. Merely by way of example, the invention has been applied to networking devices, which have been distributed throughout local, wide area, and world wide area networks, any combination of these, and the like. Such networking devices include computers, servers, routers, bridges, firewalls, network security appliances, any combination of these, and the like.

[0011] In a specific embodiment, the present invention provides software and hardware logic to be updated after it has been installed in its normal operating environment. The system is adapted to facilitate the upgrading of software and hardware logic in the field. The system includes a hardware logic provider, a computing system, a security device, transmission media, transmission sources, transmission destinations and security knowledge base. Computing system includes a computing system update controller, an optional first processing system and an optional second processing system. Security device includes a hardware logic update controller and one or more security logic processors.

[0012] In a specific embodiment, the present invention provides a method for upgrading one or more security applications, e.g., anti-spam, anti-virus, anti-spyware, intrusion detection/prevention. The method includes deriving a second hardware logic from a security knowledge base, e.g., database, library. The method includes operating a computing system (e.g., router, bridge, personal computer, server, network appliance, storage device, firewall) including a security device. The computing system is coupled to the one or more computer networks, e.g., local area networks, wide area networks, Internet. The security device has one or more security logic processors, which include one or more respective first hardware logic. The method transfers a field programmable gate array (“FPGA”) image representative of at least the second hardware logic through the computer network to one or more first memory devices. The method includes temporarily halting one or more of the security logic processors at a predetermined portion of the stream of information according to a specific embodiment. The method includes loading the second hardware logic onto the one or more security logic processors while the one or more security logic processors have been paused. The method resumes the operation of the one or more security logic processors.

[0013] In an alternative specific embodiment, the invention provides an alternative method for upgrading one or more security applications, e.g., anti-spam, anti-virus, anti-spyware, intrusion detection/prevention. The method includes providing a computing system (e.g., router, bridge, personal computer, server, network appliance, storage device, firewall) coupled to one or more computer networks (e.g., local area networks, wide area networks, Internet), where the computing system comprises a central processing unit that has been adapted to oversee one or more instructions associated with the computing system, a common bus coupled to the central processing unit, one or more first memory devices coupled to the common bus, a security device coupled to the common bus, one or more second memory devices coupled to the security device, and one or more security logic processors coupled to the security device. The security device is coupled to an input/output port coupled to the one or more computer networks. The security device is adapted to process a stream of information derived from the input/output port to perform a pattern matching process on one or more portions of the stream of information at about network speed. The one or more security logic processors have one or more respective first hardware logic. The method includes operating the computing system including the security device coupled to the one or more computer networks. The method includes transferring a field programmable gate array (“FPGA”) image representative of at least a second hardware logic through the computer network to the one or more first memory devices. The method includes pausing one or more of the security logic processors at a predetermined portion of the stream of information. The method loads the second hardware logic onto the one or more security logic processors while the one or more security logic processors have been paused.

[0014] In a specific embodiment, the present invention provides a system for upgrading one or more security applications. The system has one or more computer memories, where the one or more computer memories include at least one or more codes directed to operating a computing system including a security device, the computer system being coupled to the one or more computer networks (e.g., local area networks, wide area networks, Internet), the security device comprising one or more security logic processors, and the one or more security logic processors comprising one or more respective first hardware logic. The one or more computer memories also include at least one or more codes directed to transferring an FPGA image representative of at least the second hardware logic through the computer network to one or more first memory devices, where the one or more first memory devices is provided in the computing system. The one or more first memory devices also store at least one or more codes directed to pausing one or more of the security logic processors at a predetermined portion of the stream of information. The one or more computer memories also include at least one or more codes directed to loading the second hardware logic onto the one or more security logic processors while the one or more security logic processors have been paused. The one or more computer memories also include at least one or more codes directed to resuming the operation of the one or more security logic processors.

[0015] In an alternative specific embodiment, the present invention provides a system with one or more computer memories, where the one or more computer memories further include at least one or more codes directed to operating a first processing system provided in the computing system, where the first processing system comprises a first software logic. The one or more computer memories also include at least one or more codes directed to operating a second processing system provided in the computing system, where the second processing system comprises a third software logic. The one or more computer memories also include at least one or more codes directed to loading a second software logic onto the first processing system to replace at least in part the first software logic. The one or more computer memories also include at least one or more codes directed to loading a fourth software logic onto the second processing system to replace at least in part the third software logic.

[0016] In a specific embodiment, hardware logic to one or more security logic processors is derived from a collection of rules, signatures, patterns and instructions, which are in turn derivable from security knowledge base characterizing e-mail viruses, http viruses, spam e-mails, spywares, Web services attacks including those affecting Extensible Markup Language (XML) data, voice-over-IP attacks, intrusion attacks, encryption algorithms, decryption algorithms, combinations of these, and the like. In a further embodiment, hardware logic to one or more security logic processors is derived from a collection of representations of regular expressions characterizing unique properties of e-mail viruses, http viruses, spam e-mails, spywares, Web services attacks including those affecting Extensible Markup Language (XML) data, voice-over-IP attacks, and intrusion attacks. Of course, there can be other variations, modifications, and alternatives.

[0017] Numerous benefits and/or advantages can be performed using the present invention over conventional techniques. In a specific embodiment, the present invention can be implemented using conventional computer hardware and/or software. Additionally, the invention provides a method and apparatus that enables easy upgrading of security devices provided on computing applications in a remote manner. In a preferred embodiment, hardware logic can be updated remotely in an easy and cost effective manner. One or more of these benefits may be included in one or more of the embodiments described herein. These and other benefits are described throughout the present specification and more particularly below.

[0018] FIG. 1 is a simplified diagram of a system for upgrading the hardware logic in a security device according to an embodiment of the present invention;

[0019] FIG. 2A is a simplified high-level block diagram of a system for delivering security threat handling capabilities through in-field hardware upgrades according to an embodiment of the present invention.

[0020] FIG. 2B is a simplified high-level block diagram of a system for delivering security threat handling capabilities through in-field hardware upgrades according to an embodiment of the present invention.

[0021] FIG. 3A shows simplified functional blocks of the hardware logic provider, computing system update controller, hardware logic update controller and security logic processor according to an embodiment of the present invention.

[0022] FIG. 3B shows simplified functional blocks of the hardware logic provider, computing system update controller, hardware logic update controller and security logic processor according to an embodiment of the present invention.

[0023] FIG. 4 shows simplified functional blocks of the first/second hardware logic in FIGS. 3A and 3B in relation to security attributes stored in second memory devices and in accordance with an embodiment of the present invention.

[0024] FIG. 5 shows various functional blocks of the first/second hardware logic in FIGS. 3A and 3B in relation to the hardware logic update controller and in accordance with an embodiment of the present invention.

[0025] FIG. 6 is a flowchart of the steps carried out in the processing channels of FIGS. 4 and 5, in accordance with an embodiment of the present invention.

[0026] FIG. 7 is a simplified method for upgrading security applications according to an embodiment of the present invention, where the computing device includes a first processing system and a second processing system.

[0027] FIG. 8 is a simplified method for upgrading security applications according to an embodiment of the present invention, where the security logic processor processes data received from a second transmission medium and outputs data to a third transmission medium.

[0028] According to the present invention, techniques for computer networking security applications are provided. More particularly, the invention provides a method and system for upgrading one or more hardware logic to one or more security logic processors coupled to a security device provided in a computing system in computer network environment. Merely by way of example, the invention has been applied to networking devices that are distributed throughout local, wide area, and world wide area networks, any combination of these, and the like. Such networking devices include computers, servers, routers, bridges, firewalls, network security appliances, any combination of these, and the like.

[0029] In a specific embodiment, the present invention enables security hardware to be updated after it has been installed in its normal operating environment. FIG. 1 is a simplified high-level diagram of a system 100 adapted to facilitate the upgrading of hardware logic of a security device in the field. This diagram is merely an example, which should not unduly limit the scope of the claims herein. One of ordinary skill in the art would recognize other variations, modifications, and alternatives. System 100 is shown as including a hardware logic provider 140, computing system 120, security device 150, transmission sources 110, transmission destinations 130 and security knowledge base 160. In a specific embodiment, the security knowledge base can be provided on a database platform such as those manufactured by Oracle Corporation, Microsoft Corporation, and other companies. As merely an example, the security knowledge base includes collections of information on known electronic message and data viruses maintained by anti-virus application vendors, collections of information on known spam techniques maintained by anti-spam application vendors, collections of information on known spyware techniques maintained by anti-spyware application vendors, collections of information on encryption algorithms, collections of information on decryption algorithms, collections of information on known network intrusion and attack techniques maintained by network security application vendors, information and data that can be gathered using a computer connected to the Internet, information and data that can be gathered using honeypot computers connected to the Internet that are configured to collect malicious data and attacks from the network from which solutions and countermeasures can be derived and implemented using software and hardware logic, any combination of these, and the like. The security device 150 is coupled to the computing device 120. One or more input data streams are provided by transmission sources 110. In an embodiment, the one or more input data streams are provided to the computing system 120 via a coupling to a network of computers. Of course, there can be other variations, modifications, and alternatives.

[0030] In another embodiment, the one or more input data streams are provided to the security device 150 via a coupling of a network of computers. The computing system 120 comprising the security device 150 processes the one or more input data streams and provides one or more output data streams to transmission destinations 130. A first hardware logic provided in the security device 150 is used to process the one or more input data streams and output one or more output data streams. Hardware logic provider 140 derives a second hardware logic from one or more portions of security information derived from security knowledge base 160, where the hardware logic provider 140 is coupled to the security knowledge base 160 through at least a network of computers. Of course, there can be other variations, modifications, and alternatives.

[0031] Furthermore, the hardware logic provider 140 derives a second computing system logic from the second hardware logic. The computing system 120 retrieves the second computing system logic, which includes the second hardware logic, from the hardware logic provider 140. The computing system 120 derives the second hardware logic from the second computing system logic and provides it to the security device 150 in order to update the functionalities of the security device 150 by replacing at least the first hardware logic with the second hardware logic. The first and second hardware logic represents hardware architectures implementing processors for handling security threats. The second hardware logic represents an updated hardware architecture implementing one or more processors for handling security threats. In an embodiment, the security device 150 is provided at a second geographic region and the hardware logic provider 140 is provided at a first geographic region. As merely an example, the term computing system logic refers to one or more algorithms and procedures implemented using computer program codes that are designed to execute on a computing system, which is an ordinary meaning for such term. As merely an example, the term computer system logic is one or more binary executable programs or modules existing as files that can be loaded into the random access memory (RAM) of a computing system and executed to perform specific tasks, but can also be others. Additionally, the term hardware logic refers to one or more algorithms and procedures implemented using semiconductor circuitry, optical circuitry, quantum circuitry, any combination of these, and the like, which is an ordinary meaning of such term. As merely an example, the term hardware logic is one or more FPGA images that can be loaded into hardware devices and enable the hardware devices to perform specific tasks, but can also be others. Of course, there can be other variations, modifications, and alternatives.

[0032] In an embodiment, the security device 150 receives one or more first processed data streams, processes the one or more first processed data streams and produces one or more second processed data streams. In an embodiment, the security device 150 is a network security device, where the network security device is adapted to process network data packets received in the one or more first processed data streams. For example, the network security device is used to perform at least one form of anti-virus filtering, anti-spam filtering, anti-spyware filtering, network intrusion detection, network intrusion prevention, encryption, decryption, network data packet flow management, and network data packet prioritization. In another embodiment, the security device 150 is a content processing device, where the content processing device is adapted to process content data derived from at least one network data packet received in the one or more first processed data streams. For example, the content processing device is used to perform at least one form of anti-virus filtering, anti-spam filtering, anti-spyware filtering, network intrusion detection, network intrusion prevention, encryption, decryption, network data packet flow management, and network data packet prioritization, processing on Extensible Markup Language (XML) data, and processing on Voice-over-IP (VoIP) data. As merely an example, the content processor may be a Grand Prix Series Tarari Content Processor manufactured by Tarari Inc., an Octeon™ Network Services Processor manufactured by Cavium Networks, Britestream Security NIC manufactured by Britestream Networks, but can be others. Of course, there can be other variations, modifications, and alternatives. Further details of the present method and system can be found throughout the present specification and more particularly below.

[0033] FIG. 2A is a simplified high-level diagram of a system 200 comprising a first embodiment of the computing system 120 and an embodiment of the security device 150. This diagram is merely an example, which should not unduly limit the scope of the claims herein. One of ordinary skill in the art would recognize other variations, modifications, and alternatives. The first embodiment of the computing system 120 is shown as including a computing system update controller 212, a first processing system 213, and a second processing system 214. In this embodiment, the computing system update controller 212 is adapted to receive the second computing system logic from the hardware logic provider 140 via a first transmission medium 221 provided in the network of computers. Furthermore, the computing system update controller 212 extracts the second hardware logic from the received second computing system logic, and transmits the extracted second hardware logic to the security device 150 via a fourth transmission medium 374 (shown in FIG. 3A). Of course, there can be other variations, modifications, and alternatives.

[0034] In a specific embodiment, the first processing system 213 provided in the first embodiment of the computing system 120 is adapted to receive one or more input data streams from one or more transmission sources. As an example, the information in the one or more input data streams is transmitted over a second transmission medium 222. The first processing system 213 processes the one or more input data streams to produce one or more first processed data streams. In an embodiment, first processing system 213 is a mail transfer agent (MTA), such as Postfix. In another embodiment, first processing system 213 comprises a mail transfer agent (MTA), such as Postfix, as well as a software processing module that processes e-mail messages from the MTA before outputting the processed data as one or more first processed data streams. The one or more first processed data streams are then transmitted to the security device 150. Of course, there can be other variations, modifications, and alternatives.

[0035] In a specific embodiment, the second processing system 214 provided in the first embodiment of the computing system 120 is adapted to receive one or more second processed data streams from the security device 150. The second processing system 214 then processes the one or more second processed data streams to produce one or more output data streams, which are then transmitted to one or more transmission destinations 130 via a third transmission medium 223 provided in the network of computers. In an embodiment, second processing system 214 accumulates and aggregates the results from the security device 150 prior to transmitting one or more output data streams to one or more transmission destinations 130 via a third transmission medium 223. In another embodiment, second processing system 214 is a mail transfer agent (MTA), such as Postfix. In a further embodiment, second processing system 214 is composed of a mail transfer agent (MTA), such as Postfix, as well as a software processing module that processes the results from the security device 150 before sending it to Postfix. Postfix then sends the resulting e-mail messages as one or more output data streams to one or more transmission destinations 130 via a third transmission medium 223. Of course, there can be other variations, modifications, and alternatives.

[0036] The illustrative embodiment of the security device 150 shown in FIG. 2A is shown as including a hardware logic update controller 215, security logic processor 220, and second memory devices 216. The hardware logic update controller 215 is adapted to receive the second hardware logic from the computing system 120. The received second hardware logic is then used to replace at least in part the first hardware logic in the security logic processor 220. The security logic processor 220 is adapted to receive one or more first processed data streams, process the one or more first processed data streams using the first or second hardware logic, and provide one or more second processed data streams. In an embodiment, the security logic processor 220 performs scanning and filtering on the one or more first processed data streams using one or more security attributes. One or more second memory devices 216 are used to store one or more security attributes, where the one or more security attributes are used by the security logic processor 220 during the processing of one or more first processed data streams to provide one or more second processed data streams. In one illustrative example, the one or more security attributes include regular expression rules that are used to detect spam messages.

[0037] An example of two security attributes used for detecting spam in messages are:

[0038] “buy a [degree|diploma|certificate] now!”

[0039] “V[ill]agra”

[0040] The above example illustrates how regular expressions can be used to detect text such as “buy a degree now!”, “buy a diploma now!”, “buy a certificate now!”, “Viagra”, “Vlagra”, or “Vlagra”. This example should not unduly limit the scope of the claims herein. One of ordinary skill in the art would recognize other variations, modifications, and alternatives that can be used as security attributes.

[0041] In an embodiment, one or more security logic processors 220 are coupled to the security device 150. In another embodiment, one or more second memory devices 216 are coupled to the security device 150 and the one or more security logic processors 220.

[0042] In an embodiment, the one or more first processed data streams received by the security device 150 are the same as the one or more input data streams, and the one or more second processed data streams outputted by the security device 150 are the same as the one or more output data streams that are transmitted to one or more transmission destinations 130 via a third transmission medium 223. This embodiment is used in conjunction with a second embodiment of the computing system 120, as shown in FIG. 2B. This diagram is merely an example, which should not unduly limit the scope of the claims herein. One of ordinary skill in the art would recognize other variations, modifications, and alternatives. The second embodiment of the computing system 120 comprises of computing system update controller 212. In this embodiment, the one or more input data streams are transmitted to the security device 150 without first being received, processed and outputted by the first processing system 213. Also in this embodiment, the one or more second processed data streams are transmitted as one or more output data streams to one or more transmission destinations 130 via a transmission medium 223 without first being received, processed and outputted by the second processing system 214.

[0043] In another embodiment, one or more input data streams are received by the security device 150 without first being received, processed and outputted by the first processing system 213, and the one or more second processed data streams produced by the security device 150 are transmitted to a second processing system 214. In another embodiment, one or more input data streams are first received by the first processing system 213, and the one or more second processed data streams produced by the security device 150 are transmitted as one or more output data streams to one or more transmission destinations 130 via a third transmission medium 223 without first being received, processed and outputted by second processing system 214.

[0044] In an embodiment, the security knowledge base 160 comprises a first information on network security. For example, the first information includes information on network intrusion methods. In this embodiment, the hardware logic provider 140 creates a first algorithm from the information on network intrusion methods and generates a second hardware logic that implements the first algorithm that can loaded into a security logic processor 220 to improve the detection and/or prevention of network intrusions. In another embodiment, the security knowledge base 160 comprises a second information on content security. For example, the second information includes information on XML exploitation methods. In this embodiment, the hardware logic provider 140 creates a second algorithm from the information on XML exploitation techniques and generates a second hardware logic that implements the second algorithm that can be loaded into a security logic processor 220 to improve the detection and/or prevention of XML exploits.

[0045] FIG. 3A is a simplified high-level diagram of a system 300 and is shown to include an embodiment of the hardware logic provider 140, computing system update controller 212 in the context of the first embodiment of the computing system 120, hardware logic update controller 215, and security logic processor 220. This diagram is merely an example, which should not unduly limit the scope of the claims herein. One of ordinary skill in the art would recognize other variations, modifications, and alternatives. This embodiment of the hardware logic provider 140 comprises a hardware logic designer 305, hardware logic creator 310, hardware logic manager 315 and computing system logic manager 316. The hardware logic designer 305 is adapted to receive one or more portions of the information from the security knowledge base 160, extract the desired information from the one or more portions of the information to form a second hardware logic design data. In a specific embodiment, relevant information from the security knowledge base 160 is extracted by the hardware logic designer 305 to produce an effective solution that addresses a security threat. For example, the hardware logic designer 305 receives information about network intrusion exploits from the security knowledge base 160. From the received information and knowledge, the hardware logic designer 305 creates an algorithm that can detect and prevent the respective network intrusion exploits. A design is then created from the algorithm and provided to the hardware logic creator 310 as second hardware logic design data. In an embodiment, hardware logic designer 305 is an automated system, such as one based on genetic algorithms. In another embodiment, hardware logic designer 305 is a human-assisted system. An example of a solution generated by hardware logic designer 305 that addresses a security threat is a finite state machine (FSM) designed to perform fast pattern matching, such as those disclosed in U.S. patent application No. US 2005/0035784 and U.S. patent application No. US 2005/0028114.

[0046] In a specific embodiment, the solution generated by hardware logic designer 305 may also include design data for a second software logic for a first processing system 213 and a fourth software logic for a second processing system 214. The hardware logic creator 310 is coupled to the hardware logic designer 305 and is adapted to receive the second hardware logic design data and also possibly a second and fourth software logic design data, from the hardware logic designer 305. The hardware logic creator 310 then forms the second hardware logic from the second hardware logic design data and also possibly a second and fourth software logic from the second and fourth software logic design data. For example, in an embodiment, based on the design data, the hardware logic creator 310 produces a second hardware logic representated by an FPGA image suited for a security logic processor 220. An example of the FPGA image is a hardware logic representation created by a Xilinx compiler targeted at a specific Xilinx part, but can be others. In another example, the FPGA image is represented by a bitstream file that can be loaded into a corresponding Xilinx part by an appropriate bitstream loader, but can be others.

[0047] In another embodiment, based on the design data, the hardware logic creator 310 produces a second software logic that performs data normalization in software and a fourth software logic that performs extra pattern matching on the results received from the security device 150. The hardware logic manager 315 is coupled to the hardware logic creator 310 and is adapted to receive the second hardware logic as well as possibly the second and fourth software logic, provided by the hardware logic creator 310. The hardware logic manager 315 is adapted to process the second hardware logic as well as possibly the second and fourth software logic. For example, in an embodiment, the hardware logic manager 315 adds the received second hardware logic into a database of second hardware logics and also possibly adds the received second and fourth software logic into a database of software logics. Access to the database of second hardware logics and also possibly the database of software logics, is then controlled by the hardware logic manager 315. The database of second hardware logics and also possibly the database of software logics may also include the use of primary and secondary storage devices. One example of a primary storage device includes the random access memory (RAM) of a computer. One example of a secondary storage device includes the hard disk drive of a computer. In another example of an embodiment of the hardware logic manager 315, the hardware logic manager 315 stores the received second hardware logic and also possibly the received second and fourth software logic, in at least one secondary storage device.

[0048] The computing system logic manager 316 is coupled to the hardware logic manager 315 and is adapted to receive second hardware logic and also possibly second and fourth software logic from hardware logic manager 315. The computing system logic manager 316 is further adapted to form the second computing system logic that includes the second hardware logic and also possibly the second and fourth software logic. The computing system logic manager 316 then processes the second computing system logic and provides access to the second computing system logic by a computing system update controller 212 via a first transmission medium 221.

[0049] As merely an example, in an embodiment, the computing system logic manager 316 derives a second computing system logic from the received second hardware logic, where the second computing system logic is representative of a software package of data that includes the second hardware logic, where the software package of data encapsulates the second hardware logic in a format that is convenient and suited for transmission over the first transmission medium 221, where in an embodiment, the first transmission medium 221 includes the Internet. In a further embodiment, the software package of data includes a second software logic to be loaded into the first processing system 213, and a fourth software logic to be loaded into the second processing system 214. In an embodiment, computing system logic manager 316 transmits second computing system logic including second hardware logic to computing system update controller 212 on demand and only sends second computing system logic that is compatible with computing system 120, where the second hardware logic included in second computing system logic is also compatible with security logic processor 220. In another embodiment, computing system logic manager 316 transmits second computing system logic including second hardware logic to computing system update controller 212 based on an automated update schedule and only sends second computing system logic that is compatible with computing system 120, where the second hardware logic included in second computing system logic is also compatible with security logic processor 220.

[0050] In an embodiment, the first processing system 213 is adapted to transmit the one or more first processed data streams to a security device 150 via a fifth transmission medium 375. In this embodiment, the one or more security logic processors 220 provided in the security device 150 are correspondingly adapted to receive one or more first processed data streams from the first processing system 213 via a fifth transmission medium 375. In an embodiment, the second processing system 214 is adapted to receive one or more second processed data streams from a security device 150 via a sixth transmission medium 376. In this embodiment, the one or more security logic processors 220 provided in the security device 150 are correspondingly adapted to produce one or more second processed data streams that are transmitted to the second processing system 214 via a sixth transmission medium 376.

[0051] In the simplified illustrative embodiment of the invention represented by FIG. 3A, computing system update control 212 is responsible for receiving second computing system logic from hardware logic provider 140 via a first transmission medium 221. The embodiment shown in FIG. 3A illustrates the computing system update controller 212 as comprising a computing system logic download controller 355, central processing unit 366, computing system update scheduler 365, and one or more first memory devices 360. In an embodiment, the computing system logic download controller 355 is adapted to receive the second computing system logic over a first transmission medium. The received second computing system logic is then stored in one or more first memory devices 360. The computing system logic download controller 355 is further adapted to derive a second hardware logic from the second computing system logic and stores the second hardware logic in the one or more first memory devices 360. The computing system logic download controller 355 is further adapted to derive a second and fourth software logic from the second computing system logic and stores the second and fourth software logic in the one or more first memory devices 360.

[0052] The first processing system 213 includes a first software logic for processing one or more input data streams. The computing system update scheduler 365 schedules a second determined time for updating at least in part the first software logic in the first processing system 213 with a second software logic. The operation of the first processing system 213 is controllable by the computing system update scheduler 365. The method of upgrading the first processing system 213 includes temporarily halting a first execution process o f the first processing system 213, upgrading the first software logic with at least a second software logic in the first processing system 213, and initiating execution of a second execution process of the first processing system 213 where the second execution process is associated with the second software logic and the second software logic is provided for processing one or more input data streams.

[0053] Furthermore, the computing system update scheduler 365 schedules a third determined time for updating at least in part the third software logic in the second processing system 214 with a fourth software logic. The operation of the second processing system 214 is controllable by the computing system update scheduler 365. The method of upgrading the second processing system 214 includes temporarily halting a third execution process of the second processing system 214, upgrading the third software logic with at least a fourth software logic in the second processing system 214, and initiating execution of a fourth execution process of the second processing system 214 where the fourth execution process is associated with the fourth software logic and the fourth software logic is provided for processing one or more second processed data streams.

[0054] The computing system update scheduler 365 is coupled to the hardware logic update scheduler 330 provided in the hardware logic update controller 215. In an embodiment, the computing system update scheduler 365 signals to hardware logic update scheduler 330 when an upgrade is taking place so that the hardware logic update scheduler 330 can perform the necessary steps to upgrade the security logic processor 220.

[0055] In a specific embodiment, the security logic processor 220 illustratively shown in FIG. 3A represents an embodiment of the invention where the security logic processor 220 comprises a first/second hardware logic 340. The hardware logic update controller 215 illustratively shown in FIG. 3A represents an embodiment of the invention where the hardware logic update controller 215 comprises a hardware logic download controller 320 and hardware logic update scheduler 330. The hardware logic download controller 320 receives second hardware logic from computing system update controller 212 via a fourth transmission medium 374. The hardware logic download controller 320 provides the second hardware logic to hardware logic update scheduler 330, which upgrades the hardware logic provided in one or more security logic processors 220. The computing system update scheduler 365 and hardware logic update scheduler 330 operate to schedule a determined time for updating the one or more security logic processors 220 of a security device 150.

[0056] In a specific embodiment, the operation of the one or more security logic processors 220 is controllable by the hardware logic update scheduler 330. The method of upgrading the hardware logic provided in the one or more security logic processors 220 include temporarily halting an execution process associated with a first hardware logic to be upgraded within the one or more security logic processors of the security device, the first hardware logic ceasing processing of the one or more first processed data streams during the temporarily halting step of the execution process, receiving the second hardware logic over a fourth transmission medium, updating the first hardware logic at least in part with the second hardware logic within the one or more security logic processors of the security device, and initiating execution of at least the second hardware logic within the one or more security logic processors of the security device to process one or more first processed data streams.

[0057] In an embodiment, the second hardware logic is stored in one or more memories, which are provided in a database. In another embodiment, the second hardware logic is managed within the database, for example, by storing a plurality of second hardware logic in a table indexed by an identifier and keeping the entries in the table up-to-date. In another embodiment, the second hardware logic provided by the hardware logic provider 140 is compatible with one or more security logic processors 220 of a security device 150. For example the second hardware logic provided by hardware logic provider 140 is targeted for an FPGA of a particular brand and model in a particular security device. In another embodiment, the second hardware logic is processed to verify its integrity has been preserved during the transfer from the hardware logic provider 140 to the computing system update controller 212. For example, the hardware logic provider 140 derives a first digital signature from the second hardware logic. The first digital signature and second hardware logic is then packaged into a second computing system logic.

[0058] In a specific embodiment, the second computing system logic, which includes the second hardware logic and first digital signature, is then transmitted to the computing system update controller 212. The computing system update controller 212, on receiving the second computing system logic, extracts the second hardware logic and first digital signature. The computing system update controller 212 then computes a second digital signature from the received second hardware logic, and compares the first digital signature to the second digital signature to verify that the second hardware logic has not been corrupted accidentally or purposefully by an attacker. In a further embodiment, the second hardware logic and/or second computing system logic is also encrypted.

[0059] In another embodiment, the second computing system logic provided by the hardware logic provider 140 is compatible with a computing system 120. For example the second computing system logic provided by hardware logic provider 140 is targeted for a computer with a particular CPU brand and model and with a particular operating system. In another embodiment, the second computing system logic is processed to verify that its integrity has been preserved during the transfer from the hardware logic provider 140 to the computing system update controller 212. For example, the hardware logic provider 140 derives a third digital signature from at least parts of the second computing system logic. The third digital signature is then packaged into a second computing system logic. The second computing system logic, which includes the third digital signature, is then transmitted to the computing system update controller 212. The computing system update controller 212, on receiving the second computing system logic, extracts the third digital signature. The computing system update controller 212 then computes a fourth digital signature from at least parts of the received second computing system logic, and compares the third digital signature to the fourth digital signature to verify that the second computing system logic has not been corrupted accidentally or purposefully by an attacker.

[0060] In an embodiment, computing system update scheduler 365 and hardware logic update scheduler 330 only schedules an update on the security logic processor 220 if a new, compatible and properly licensed second hardware logic is available. For example, if an end-user has not obtained a license for a second hardware logic, then hardware logic update scheduler 330 will not perform an update on the security logic processor 220 using that logic data. In a further embodiment, an update is only scheduled on the completion of the processing of a well-defined block of data received in the one or more first processed data streams. For example, a well-defined block of data is a packet of network traffic. In another example, a well-defined block of data is a complete e-mail message.

[0061] The computing system update scheduler 365 and hardware logic update scheduler 330 operate to coordinate the process of updating the security logic processor 220 to maintain the data and logical integrity of the various modules in the security logic processor 220. Data integrity within the security logic processor 220 refers to the integrity of the input and output data that enters and leaves the security logic processor 220. Without coordination and scheduling of hardware logic updates, it is possible to corrupt or lose input and output data when hardware logic updates are taking place. For example, if hardware logic update takes place whilst the security logic processor 220 is in the middle of processing input data and the reading of input data has not been temporarily halted, then the input data currently being processed by the security logic processor 220 will be lost or corrupted. Furthermore, since the hardware updating process takes a finite amount of time, input data received during the upgrade will also be lost or corrupted. Logical integrity within the security logic processor 220 refers to the integrity of the internal hardware logic. Without coordination and scheduling of hardware logic updates, it may be possible to corrupt the logics within the security logic processor 220, rendering it unusable. For example, without coordination and scheduling, incompatible hardware logic components can be loaded into the security logic processor 220, resulting in unpredictable behavior and unusable functionalities.

[0062] The computing system update scheduler 365 and hardware logic update scheduler 330 operate to resume the operation of the stopped first processing system 213, second processing system 214 and one or more security logic processors 220 in the correct sequence.

[0063] In the simplified illustrative embodiment of the invention represented by FIG. 3A, computing system update controller 212 is shown in the context of the first embodiment of the computing system 120, which includes a first processing system 213 and second processing system 214. The simplified illustrative embodiment of the invention represented by FIG. 3B is similar to the simplified illustrative embodiment of the invention shown in FIG. 3A with the exception that in FIG. 3B, the computing system update controller 212 is shown in the context of the second embodiment of the computing system 120, which does not include a first processing system 213 and a second processing system 214. In FIG. 3B, the one or more input data streams are transmitted to the security logic processor 220, so in this case, the one or more first processed data streams are in fact the same as the one or more input data streams. Also in FIG. 3B, the one or more second processed data streams are transmitted to the one or more transmission destinations 130 via a third transmission medium, so in this case, the one or more second processed data streams are in fact the same as the one or more output data streams.

[0064] In an embodiment, any of the first transmission medium 221, second transmission medium 222, third transmission medium 223, fourth transmission medium 374, fifth transmission medium 375 and sixth transmission medium 376 can be an Ethernet network, the Internet, and/or a data bus internal to a computer system. Transmission mediums include the use of physical mediums, such as a network cable. Transmission mediums also include wireless mediums, such as those that use electromagnetic radiation. In an embodiment, the computing system 120 and security device 150 is the same physical device. For example, the security device 150 is built into the motherboard of the computing system 120.

[0065] In a specific embodiment, the present invention provides a method for upgrading one or more security applications, e.g., anti-spam, anti-virus, anti-spyware, intrusion detection/prevention. The method includes deriving a second hardware logic from a security knowledge base, e.g., database, library. The method includes operating a computing system (e.g., router, bridge, personal computer, server, network appliance, storage device, firewall) including a security device. The computer system is coupled to the one or more computer networks, e.g., local area networks, wide area networks, Internet. The security device has one or more security logic processors, which include one or more respective first hardware logic. The method transfers an FPGA image representative of at least the second hardware logic through the computer network to one or more first memory devices. The method includes temporarily halting one or more of the security logic processors at a predetermined portion of the stream of information according to a specific embodiment. The method includes loading the second hardware logic onto the one or more security logic processors while the one or more security logic processors have been paused. The method resumes the operation of the one or more security logic processors. In an embodiment, the one or more first memory devices comprises a fixed storage device.

[0066] In an alternative specific embodiment, the invention provides an alternative method for upgrading one or more security applications, e.g., anti-spam, anti-virus, anti-spyware, intrusion detection/prevention. The method includes providing a computing system (e.g., router, bridge, personal computer, server, network appliance, storage device, firewall) coupled to one or more computer networks (e.g., local area networks, wide area networks, Internet), where the computing system comprises a central processing unit that has been adapted to oversee one or more instructions associated with the computing system, a common bus coupled to the central processing unit, one or more first memory devices coupled to the common bus, a security device coupled to the common bus, one or more second memory devices coupled to the security device, and one or more security logic processors coupled to the security device. In an embodiment, the common bus includes a PCI bus. The security device is coupled to an input/output port coupled to the one or more computer networks. The security device is adapted to process a stream of information derived from the input/output port to perform a pattern matching process on one or more portions of the stream of information at about network speed. In an embodiment, about network speed is at least one hundred Mega bits per second. The one or more security logic processors have one or more respective first hardware logic. The method includes operating the computing system including the security device coupled to the one or more computer networks. The method includes transferring an FPGA image representative of at least a second hardware logic through the computer network to the one or more first memory devices. The method includes pausing one or more of the security logic processors at a predetermined portion of the stream of information. The method loads the second hardware logic onto the one or more security logic processors while the one or more security logic processors have been paused.

[0067] In a specific embodiment, the present invention provides a system for upgrading one or more security applications. The system has one or more computer memories, where the one or more computer memories include at least one or more codes directed to operating a computing system including a security device, the computer system being coupled to the one or more computer networks (e.g., local area networks, wide area networks, Internet), the security device comprising one or more security logic processors, and the one or more security logic processors comprising one or more respective first hardware logic. The one or more computer memories also include at least one or more codes receiving to transferring an FPGA image representative of at least the second hardware logic through the computer network to one or more first memory devices, where the one or more first memory devices is provided in the computing system. The one or more first memory devices also store at least one or more codes directed to pausing one or more of the security logic processors at a predetermined portion of the stream of information. The one or more computer memories also include at least one or more codes directed to loading the second hardware logic onto the one or more security logic processors while the one or more security logic processors have been paused. The one or more computer memories also include at least one or more codes directed to resuming the operation of the one or more security logic processors.

[0068] In an alternative specific embodiment, the present invention provides a system with one or more computer memories, where the one or more computer memories further include at least one or more codes directed to operating a first processing system provided in the computing system, where the first processing system comprises a first software logic. The one or more computer memories also include at least one or more codes directed to operating a second processing system provided in the computing system, where the second processing system comprises a third software logic. The one or more computer memories also include at least one or more codes directed to loading a second software logic onto the first processing system to replace at least in part the first software logic. The one or more computer memories also include at least one or more codes directed to loading a fourth software logic onto the second processing system to replace at least in part the third software logic.

[0069] In a specific embodiment, hardware logic to one or more security logic processors are derived from a collection of signatures, rules, patterns and instructions, which are in turn derivable from security knowledge base characterizing e-mail viruses, http viruses, spam e-mails, spywares, Web services attacks including those affecting Extensible Markup Language (XML) data, voice-over-IP attacks, and intrusion attacks, combinations of these, and the like. In a further embodiment, hardware logic to one or more security logic processors are derived from a collection of representations of regular expressions characterizing unique properties of e-mail viruses, http viruses, spam e-mails, spywares, Web services attacks including those affecting Extensible Markup Language (XML) data, voice-over-IP attacks, and intrusion attacks. Of course, there can be other variations, modifications, and alternatives.

[0070] FIG. 4 shows a block diagram of the components of an embodiment of first/second hardware logic 340 in relation to security attributes provided in one or more second memory devices 216. In accordance with this embodiment, first/second hardware logic 340 is shown as including an input channel interface 405, processing channel 1 410, processing channel 2 415, processing channel n 420, and output channel interface 425. FIG. 4 illustrates the data flow from one or more first processed data streams through to the one or more second processed data streams in terms of the components of the first/second hardware logic 340. Also shown in FIG. 4 is the data flow between the components of first/second hardware logic 340 and security attributes provided in one or more second memory devices 216. In accordance with this embodiment, input channel interface 405 receives data from one or more first processed data streams. Input channel interface 405 redirects data from the received one or more first processed data streams into at least one of the n processing channels. Input channel interface 405 also provides the raw input data that has not been processed by the processing channels 410, 415, and 420 to output channel interface 425.

[0071] In accordance with an embodiment of the first/second hardware logic 340, processing channels 410, 415, and 420 perform security processing functions in parallel. Processing channels 410, 415, and 420 obtain input data from input channel interface 405 and processes them using security attributes provided in one or more second memory devices 216. In an embodiment, each processing channel 410, 415, and 420 implement different security processing functions. In a further embodiment, a plurality of processing channels 410, 415, or 420 implement a pattern matching system based on finite state machines, such as those disclosed in U.S. patent application No. US 2005/0035784 and U.S. patent application No. US 2005/0028114. The results of pattern matching in processing channels 410, 415, and 420 are then sent to output channel interface 425. As merely examples, patterning matching processes and systems are illustrated in U.S. Provisional Application 60/654224 filed Feb. 17, 2005 (Attorney Docket Number 021741-001910) and U.S. Application Serial Nos. 10/927967 filed Aug. 26, 2004,______, and ______ (Attorney Docket Numbers 021741-001600US, 021741-001910US, and 021741-001920US), commonly assigned, and hereby incorporated by reference for all purposes.

[0072] In accordance with an embodiment of the first/second hardware logic 340, output channel interface 425 accepts raw input data from input channel interface 405 as well as pattern matching results from processing channels 410, 415, and 420. Output channel interface 425 then transmits match results along with any raw input data as one or more second processed data streams.

[0073] In an embodiment, security attributes provided in one or more second memory devices 216 are a collection of rules, signatures, patterns and instructions derivable from security knowledge base 160 characterizing e-mail viruses, http viruses, spam e-mails, spywares, XML-based attacks, voice-over-IP attacks, and intrusion attacks. In a further embodiment, security attributes provided in one or more second memory devices 216 include a collection of representations of regular expressions characterizing unique properties of e-mail viruses, http viruses, spam e-mails, spywares, XML-based attacks, voice-over-IP attacks, and intrusion attacks. The regular expressions are then used by finite state machine pattern matching systems, such as those disclosed in U.S. patent application No. US 2005/0035784 and U.S. patent application No. US 2005/0028114, for matching against the incoming input data.

[0074] FIG. 5 shows a block diagram of the components of an embodiment of first/second hardware logic 340 in relation to the hardware logic update controller 215. In this embodiment, input channel interface 405, output channel interface 425, and processing channels 410, 415, and 420, operate as shown in the illustrative embodiment represented by FIG. 4. When a hardware logic update is scheduled by hardware logic update scheduler 330, a ‘stop’ signal is sent to input channel interface 405, output channel interface 425, and processing channels 410, 415, and 420. In an embodiment, all of these components stop processing at the earliest possible time, whilst maintaining their state prior to the stop operation. In another embodiment, hardware logic update scheduler 330 only sends ‘stop’ signals to those components that require updating. Other components continue to execute if it is possible to do so. For example, if processing channel 1 410 is the only component to be updated, then it is the only component that is temporarily stopped, with data from the input channel interface 405 being redirected to the other channels. All other components continue to execute as normal. Once the execution of the relevant components of first/second hardware logic 340, are temporarily stopped, hardware logic update scheduler 330 proceeds to update the relevant hardware components.

[0075] After updating the components of first/second hardware logic 340, hardware logic update scheduler 330 sends a ‘start’ signal to all components of first/second hardware logic 340 that have previously been stopped, thus restoring the components to their states prior to the stop operation. Processing then recommences in the stopped components, and execution proceeds as normal. Since security hardware updates occur relatively infrequently and hardware updates can be conducted in a timely manner, the effect of stopping processing while the update takes place should not significantly and adversely affect the throughput performance of the content security system.

[0076] FIG. 6 is a flowchart of the processing functions implemented in an embodiment of the first/second hardware logic 340. The flowchart illustrates the distinct processing steps of receiving the one or more first processed data streams 605, pre-processing 610, feature extraction 615, filtering 620, result aggregation 625, and generation of one or more second processed data streams 630. The upgradeable hardware logic components perform the steps of pre-processing 610, feature extraction 615, filtering 620, and result aggregation 625. In an embodiment, pre-processing step 610 normalizes the input data. For example, uniform resource identifiers (URI) are normalized into a pre-determined format. In an embodiment, feature extraction step 615 extracts features from the pre-processed data. For example, the hash values of fragments of the pre-processed data are calculated and passed to the next step. In an embodiment, filtering step 620 performs pattern matching using security attributes provided in one or more second memory devices 216. Data passed to this step that matches any of the security attributes provided in one or more second memory devices 216 then raises signals that are passed to the next step along with any match information. In an embodiment, result aggregation step 625 accepts the matched patterns and accumulates a histogram of the patterns that matched. This histogram along with other match statistics is then outputted as one or more second processed data streams 630.

[0077] Security knowledge base 160 is a pool of knowledge concerning network and content security. For example, this pool can encompass the body of knowledge existing in the Internet, and public and private libraries of books, journals, conference proceedings, white papers, reports, presentations, formal and informal conversations, news articles, magazines and surveys existing in various formats, such as paper, electronic, CD, DVD, photographic and microfilm. This pool of knowledge can contain information such as known security exploits, signatures representing security exploits and methods for detecting and preventing such exploits.

[0078] The one or more transmission sources 110 contain data to be scanned by the computing system 120 comprising security device 150. Examples of transmission sources 110 include servers that send e-mail, servers that serve web-pages and computing machines that send data over a network. The one or more transmission sources 110 send data that could potentially carry information that is a security threat to computing system 120 and/or one or more transmission destinations 130. The one or more transmission destinations 130 are coupled to the one or more transmission sources 110.

[0079] A method for upgrading one or more security applications, e.g., anti-spam, anti-virus, intrusion detection/prevention in a networking environment is briefly outlined below:

[0080] 1. Derive a second hardware logic from a security knowledge base, e.g., database;

[0081] 2. Operate a computing system (e.g., router, bridge, personal computer, server, network appliance, storage device, firewall) including a security device;

[0082] 3. Transfer an FPGA image representative of at least a second hardware logic through the computer network to one or more first memory devices, which is coupled to the computing system;

[0083] 4. Temporarily halting one or more of the security logic processors at a predetermined portion of the stream of information;

[0084] 5. Load the second hardware logic onto the one or more security logic processors while the one or more security logic processors have been paused;

[0085] 6. Resume the operation of the one or more security logic processors; and

[0086] 7. Perform other steps, as desired.

[0087] As shown, the above sequence of steps provides a method for upgrading one or more security applications operating with one or more network devices coupled to a computing system in a networking environment. Depending upon the embodiment, one or more of the steps can be combined. Other steps can be added according to specific embodiments. In yet other embodiments, certain steps may be removed. Of course, there can be other variations, modifications, and alternatives. Further details of the present method can be found through out the present specification and more particularly below.

[0088] FIG. 7 is a simplified method for upgrading security applications according to an embodiment of the present invention. The steps to this method are briefly outlined below:

[0089] 1. Operate the computing system (step 705);

[0090] 2. Receive information from security knowledge base (step 710);

[0091] 3. Derive a second hardware logic and possibly second and fourth software logic from the received information (step 715);

[0092] 4. Derive a second computing system logic from the second hardware logic (step 720), where the second computing system logic may include a second software logic and a fourth software logic;

[0093] 5. Transmit the second computing system logic to computing system update controller (step 725);

[0094] 6. Halt processing in the first processing system (step 730);

[0095] 7. Halt processing in the second processing system (step 735);

[0096] 8. Load second computing system logic into computing system, where the second software logic is derived from the second computing system logic and used to replace at least in part the first software logic in the first processing system, and the fourth software logic is derived from the second computing system logic and used to replace at least in part the third software logic in the second processing system (step 740);

[0097] 9. Derive the second hardware logic from the second computing system logic (step 745);

[0098] 10. Halt processing in the security logic processor (step 750);

[0099] 11. Transmit the second hardware logic to hardware logic update controller (step 755);

[0100] 12. Load the second hardware logic into the security logic processor to replace at least in part the first hardware logic (step 760);

[0101] 13. Resume processing in the security logic processor (step 765);

[0102] 14. Resume processing in the second processing system (step 770);

[0103] 15. Resume processing in the first processing system (step 775);

[0104] 16. Operate the computing system (step 780).

[0105] As shown, the above sequence of steps provides a simplified method for upgrading security applications. Depending upon the embodiment, one or more of the steps can be combined. Other steps can be added according to specific embodiments. In yet other embodiments, certain steps may be removed. Of course, there can be other variations, modifications, and alternatives. Further details of the present method can be found through out the present specification and more particularly below.

[0106] FIG. 8 is a simplified method for upgrading security applications according to an embodiment of the present invention. The steps to this method are briefly outlined below:

[0107] 1. Operate the computing system (step 805);

[0108] 2. Receive information from security knowledge base (step 810);

[0109] 3. Derive a second hardware logic from the received information (step 815);

[0110] 4. Derive a second computing system logic from the second hardware logic (step 820);

[0111] 5. Transmit the second computing system logic to computing system update controller (step 825);

[0112] 6. Derive the second hardware logic from the second computing system logic (step 830);

[0113] 7. Halt processing in the security logic processor (step 835);

[0114] 8Transmit the second hardware logic to hardware logic update controller (step 840);

[0115] 9. Load the second hardware logic into the security logic processor to replace at least in part the first hardware logic (step 845);

[0116] 10. Resume processing in the security logic processor (step 850);

[0117] 11. Operate the computing system (step 855).

[0118] As shown, the above sequence of steps provides a simplified method for upgrading security applications. Depending upon the embodiment, one or more of the steps can be combined. Other steps can be added according to specific embodiments. In yet other embodiments, certain steps may be removed. Of course, there can be other variations, modifications, and alternatives.

[0119] Although the foregoing invention has been described in some detail for purposes of clarity and understanding, those skilled in the art will appreciate that various adaptations and modifications of the just-described preferred embodiments can be configured without departing from the scope and spirit of the invention. For example, other pattern matching technologies may be used, or different network topologies may be present. Moreover, the described data flow of this invention may be implemented within separate network systems, or in a single network system, and running either as separate applications or as a single application. Therefore, the described embodiments should not be limited to the details given herein, but should be defined by the following claims and their full scope of equivalents.