Patent ID: 7136926

Claim:
A computer-implemented method of performing network packet filtering on packets received on a network using a set of rules, said method comprising: dividing the set of rules along N dimensions; dividing each of said N dimensions into rule ranges using said set of rules; generating a set of possible rules for each rule range in each of said N dimensions; receiving a set of one or more packets on a network; searching said rule ranges along said N dimensions in parallel to select N sets of possible rules along said N dimensions; logically combining said N sets of possible rules to generate a final set of rules; applying said final set of rules; repeating said steps of searching, logically combining, and applying for each received packet; receiving a new rule; examining the new rule to determine if the new rule specifies a new dimension; and if it is determined that the new rule specifies a new dimension, adding the new rule to the set of rules, adding the new dimension to the N dimensions, dividing said set of rules along N+1 dimensions, dividing each of said N+1 dimensions into rule ranges using said set of rules, and generating a set of possible rules for each rule range in each of said N+1 dimensions.