1. A method for secure fast table lookups performed on a first one of a pair of network elements, comprising:
establishing a plurality of connections of a protocol, wherein establishing each connection includes exchanging locally selected identifiers between the first network element and a second one of the pair of network elements, wherein the following is performed for each connection establishment:
allocating connection data in memory of the first network element,
generating a local identifier that is a pointer to the allocated connection data,
applying a mathematical transformation to the generated local identifier,
including a value representing the generated local identifier and a result of the mathematical transformation of the generated local identifier in a first portion and a second portion of a connection establishment packet respectively, and
transmitting the connection establishment packet to the second network element; and
responsive to receiving a first data packet of that protocol from the second network element, performing the following:
extracting data from the first portion and the second portion of the first data packet,
applying the mathematical transformation to the data extracted from the first portion,
determining that a result of the mathematical transformation of the data extracted from the first portion matches the data extracted from the second portion of the first data packet, and
dereferencing the data extracted in the first portion to locate the allocated connection data for the first data packet.
2. The method of claim 1, wherein the value representing the generated local identifier is an obfuscated value of the generated local identifier.
3. The method of claim 1, wherein for each connection establishment, the generated local identifier is a memory address to the allocated connection data.
4. The method of claim 1, further comprising:
responsive to receiving a second data packet of that protocol from the second network element, performing the following:
extracting data from the first portion and the second portion of the second data packet,
applying the mathematical transformation to the data extracted from the first portion, and
determining that a result mathematical transformation of the data extracted from the first potion does not match the data extracted from the second portion of the second data packet, and
dropping the second data packet.
5. The method of claim 1, wherein the protocol is Layer 2 Tunneling Protocol (L2TP), wherein the first portion of each connection establishment packet and the first portion of the first data packet correspond with a session ID field, and wherein the second portion of each connection establishment packet and the second portion of the second data packet correspond with a cookie field.
6. The method of claim 1, further comprising for each connection, using a same nonce value during application of the mathematical transformation to the generated local identifier, and responsive to receiving the first data packet further using the same nonce value during application of the mathematical transformation to the data extracted from the first portion of the first data packet.
7. The method of claim 1, wherein the mathematical transformation is a one-way hash algorithm, and wherein the result of the mathematical transformation applied to the generated local identifier is a portion of a hash digest resulting from the mathematical transformation, and wherein the result of the mathematical transformation to the data extracted from the first portion is a portion of a hash digest resulting from that mathematical transformation which corresponds to the portion of the hash digest resulting from the mathematical transformation applied to the generated local identifier.
8. The method of claim 1, wherein the connection data for each connection is allocated in a portion of memory that is dedicated for connection data.
9. The method of claim 8, further comprising:
wherein the applying the mathematical transformation to the data extracted from the first portion is responsive to determining that the data extracted from the first portion is within a range of the portion of memory that is dedicated for connection data.
10. A network element to perform secure fast table lookups for protocols with bidirectional identifiers, the network element comprising:
a control plane including one or more protocol modules to establish connections, wherein each protocol module to perform the following for each connection:
allocate connection data in memory of a data plane of the network element for that connection,
select a local identifier that is a pointer to the allocated connection data that connection,
generate a validation signature based on the selected identifier, and
negotiate the selected pointer and the validation signature with one or more protocol participating peer network elements; and
a data plane coupled with the control plane, the data plane including,
a memory to store the allocated connection data of each connection,
a packet parsing engine to receive and parse data packets received from the one or more protocol participating peer network elements for the established connections, wherein each data packet received includes a local identifier and a validation signature, the packet parsing engine to extract the local identifiers and the validation signatures from the data packets,
a hash engine coupled with the packet parsing engine, the hash engine to apply a hashing algorithm to the extracted local identifiers, and
a trusted pointer validation engine coupled with the packet parsing engine and the hash engine, the trusted pointer validation engine to perform the following:
compare the extracted validation signatures with corresponding ones of the results of the application of the hashing algorithm to the extracted local identifiers, and
dereference those ones of the extracted local identifiers whose corresponding extracted validation signatures match corresponding results of the application of the hashing algorithm to that extracted local identifier.
11. The network element of claim 10, wherein the trusted pointer validation engine further is to drop those data packets whose extracted validation signatures do not match corresponding results of the application of the hashing algorithm to the extracted local identifiers.
12. The network element of claim 10, wherein one of the protocol modules is a Layer 2 Tunneling Protocol (L2TP) module, wherein the negotiate the selected pointer and validation signature includes the L2TP module to generate a L2TP connection establishment packet including the selected pointer and validation signature.
13. The network element of claim 12, wherein the L2TP module is to include the selected pointer in a session ID field of the L2TP connection establishment packet and include the validation signature in a cookie field of the L2TP connection establishment packet.
14. The network element of claim 10, wherein the control plane is to generate the validation signature for each connection further based on a nonce value, and wherein the hash engine in the data plane is further to use the nonce value when applying the hashing algorithm to the extracted local identifiers.
15. The network element of claim 10, wherein the selected local identifier for each connection is a memory address to the allocated connection data of the data plane for that connection.
16. A method for secure fast table lookups performed on a first one of a pair of network elements for protocols with bidirectional identifiers, the method comprising:
receiving a plurality of connection establishment requests each to establish a connection for a protocol with bidirectional identifiers;
performing the following for each received connection establishment request:
allocating connection data in a memory of the network element,
selecting a local identifier that is a pointer to the allocated connection data,
hashing the selected local identifier to produce a validation signature, and
generating a connection establishment packet that includes the selected local identifier in a first portion of a header of the packet and the validation signature in a second portion of the header of the packet, wherein data packets for the connection include a header including a corresponding first portion and second portion, and
transmitting the connection establishment packet to a second one of a pair of network elements;
receiving a plurality of data packets from the second network element for the established connections,
performing the following for each received data packet:
extracting data included in a first portion of a header of the data packet and data included in a second portion of the header of the data packet,
hashing the data extracted from the first portion of the header,
comparing a result of the hashing of the data extracted from the first portion of the header with the data extracted from the second portion of the header,
responsive to determining that the result of the hashing of the data extracted from the first portion of the header matches the data extracted from the second portion of the header, dereferencing the data extracted from the first portion of the header to locate the allocated connection data in the memory.
17. The method of claim 16, wherein for each received data packet, further performing the following:
responsive to determining that the result of the hashing of the data extracted from the first portion of the header does not match the data extracted from the second portion of the header, dropping that data packet.
18. The method of claim 16, wherein the validation signature is a portion of a result of the hashing of the selected local identifier.
19. The method of claim 16, wherein for each connection, the pointer is a memory address of the allocated connection data.
20. The method of claim 16, wherein the protocol is Layer 2 Tunneling Protocol (L2TP), wherein the first portion of each connection establishment packet and the first portion of the first data packet correspond with a session ID field, and wherein the second portion of each connection establishment packet and the second portion of the second data packet correspond with a cookie field.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. An embedded flash cell structure, comprising:
a substrate;
a first floating gate formed on said substrate and having an exposed side wall over the structure;
a second floating gate having an exposed side wall over the structure and spaced apart from the first floating gate;
a first pair of spacers over the respective first floating gate and the second floating gate;
a second pair of spacers at least over the respective exposed side walls of the first and second floating gates;
a source implant area in the substrate between the second pair of spacers;
a plug over the source implant area, between the first pair of spacers, and between the second pair of spacers;
first and second control gates outboard of the first pair of spacers; and
respective drain areas in the substrate formed adjacent said respective first and second control gates.
2. The structure of claim 1, wherein the first and second floating gates each have a rounded corner.
3. The structure of claim 1, including a third pair of spacers over the second pair of spacers.
4. The structure of claim 1, including a third pair of spacers over the second pair of spacers, and wherein the source area is between:
the third pair of spacers; and
the first pair of spacers.
5. The structure of claim 1, wherein the first and second floating gates are comprised of polysilicon, the first pair of spacers are comprised of tetraethoxysilane (TEOS) or high temperature oxide (HTO), the second pair of spacers are comprised of an oxidenitrideoxide sandwich (ONO), and the plug is comprised of polysilicon (poly).
6. The structure of claim 1, wherein the second pair of spacers have a total width of from about 50 to 2000 \u212b.
7. The structure of claim 1, wherein the second pair of spacers have a total width of from about 60 to 1000 \u212b.
8. The structure of claim 1, including a floating gate oxide layer underneath the first and second floating gates.
9. The structure of claim 1, including a floating gate oxide layer underneath the first and second floating gates, the floating gate oxide layer having a thickness of from about 10 to 200 \u212b.
10. A split gate flash cell, comprising:
a semiconductor substrate having a source area and a drain area;
at least one L-shaped floating gate overlying the source area, the L-shaped floating gate having at least one sidewall disposed on the side of the L-shaped floating gate proximate the source area;
a first sidewall spacer adjacent and contacting said at least one sidewall;
a second sidewall spacer adjacent and contacting said first sidewall spacer;
a control gate outboard the L-shaped floating gate; and
a conductive line electrically connected to the source area by a plug formed adjacent the second sidewall spacer.
11. The split gate flash cell of claim 10 further comprising a gate dielectric layer proximate the L-shaped floating gate.
12. The split gate flash cell of claim 10, wherein said first sidewall spacer is a composite spacer.
13. The split gate flash cell of claim 12, wherein said composite spacer comprises an oxide layer.
14. The split gate flash cell of claim 10, wherein said first sidewall spacer comprises an oxide and said second sidewall spacer comprises polysilicon.
15. The split gate flash cell of claim 14, wherein said second sidewall spacer further includes an implanted impurity.