EFFICIENT CLASSIFICATION MANIPULATION AND CONTROL OF NETWORK TRANSMISSIONS BY ASSOCIATING NETWORK FLOWS WITH RULE BASED FUNCTIONS

• US 20030005144A1
• Filed: 10/28/1998
• Published: 01/02/2003
• Est. Priority Date: 10/28/1998
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: ENGEL, ROBERT, KANDLUR, DILIP DINKAR, MEHRA, ASHISH, BARZILAI, TSIPORA P.
• Granted Patent: US 6,519,636 B2
• Time in Patent Office: Days
• US Class Current: 709/235
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/21 using leaky-bucket
• CPC Class Codes: H04L 47/22 Traffic shaping
• CPC Class Codes: H04L 47/2416 Real-time traffic
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A computer connected to one or more networks through appropriate network interfaces is used to classify, manipulate, and/or control communications, e.g., packets sent and/or received over the network by one or more applications executing in the computer. Each application is connected to the network through one or more sockets to enable this communication. The computer also comprises one or more rule sets of one or more rules. A socket set of one or more of the sockets is associated with only one of the rule sets. The rules in the rule set are used to control one or more of the packets communicated by the applications communicating over the socket(s) associated with the respective rule set. Rules can be added to the rule set, deleted from the rule set, or modified in order to classify, manipulate, and/or control the communication of the packets, e.g. to control the rate at which the packets are sent or to provide certain security functions.

Claims

1. A server connected through one or more network interfaces to one or more networks, each of the networks connected to one or more clients, the server having one or more memories and one or more central processing units (CPUs) and further comprising:

one or more applications executed by one or more of the CPUs, each application using one or more sockets connected to the networks to communicate over the networks;

one or more rule sets containing one or more rules; and

one or more socket sets of one or more of the connected sockets, each of the socket sets associated with only one of the rule sets, the rule set controlling one or more ;

packets sent by the applications on each of the sockets in the associated socket set.

2. A server, as in claim 1, where the association between a rule set and a socket is based on any one or more of the following attributes of the socket:

a source address of the server, a destination address of the client, a source port of the server, a destination port of the client, a protocol type, and an application type.

3. A server, as in claim 1, where the rule set controls the timing of the sending procedure of the packets to the network or the sending of received packets to the application on any socket in the associated socket set in one or more of the following ways:

limiting the average rate of delivered packets, limiting the peak rate of delivered packets, limiting the size of the burst of packets delivered at the peak rate, and limiting the size of sent packets.

4. A server, as in claim 1, where the rule set controls the security of the packets sent on any of the sockets in the associated socket set in one or more of the following ways:

using an encryption key, using the encryption technique, how often to encrypt, packet authentication, how often to authenticate packets, method of authentication, when to prevent packet sending.

5. A server, as in claim 1, where the rule set controls all the packets sent from any socket in the associated socket set in the same way.

6. A server, as in claim 1, where the association between one or more of the socket sets and the rule set is bidirectional.

17. A server, as in claim 1, where the rule set controls the temporal spacing of successive packets to slow down the transmission.

7. A server connected through one or more network interfaces to one or more networks, each of the networks connected to one or more clients, the server having one or more memories and one or more central processing units (CPUs) and further comprising:

one or more applications executed by one or more of the CPUs, each application using one or more sockets to communicate over the network;

one or more rule sets of one or more rules, one or more of the rules containing one or more client constraints; and

one or more socket sets of one or more of the connected sockets, each of the socket sets associated with only one of the rule sets, the rule set controlling one or more packets sent by each of the sockets in the associated socket set.

8. A server, as in claim 7, where the client constraints include any one or more of the following:

a client with limited access bandwidth to the network, a client with limited bandwidth to the server, one or more other network sessions involving the client, a client with limited computational power, and a client with limited memory.

9. A server, as in claim 7, where the client constraints are communicated to the server from a client constraint determinator that executes on the client to determine the client constraints.

10. A server, as in claim 7, where the client constraints are communicated to the server from an agent computer that has a concurrent second session with the client.

11. A server, as in claim 7, where the client constraints are assumed or extrapolated based on previous observations, or communication with clients with similar constraints, or clients located close to each other.

12. A server, as in claim 7, where the client constraints are determined using human input.

13. A server, as in claim 7, where client constraint is a client bandwidth constraint and the rule set controls the packets to be sent slower because the client has concurrent audio and/or video sessions.

14. A server, as in claim 13, where the rule set controls using any one or more of the following shaping mechanisms:

limiting the average rate of sent packets, limiting the peak rate of packets, limiting the size of the burst of packets that are sent out at the peak rate, and limiting the size of the packets sent.

15. A server, as in claim 7, where the client constraints are thin client constraints.

16. A server, as in claim 15, where the thin client constraints are imposed by any one or more of the following thin clients, that are tier-zero devices:

a set-top box, a hand held device, a Palm Pilot, a Web appliance, and a Web-based application device.

18. A server, as in claim 17, where one of the applications is one of the following:

a video stream, an audio stream, a video and audio stream, and a large data stream.

20. A method, as in claim 19, where the information is modified to modified information if the rules are not satisfied, the modified information satisfying the rules.

19. A method, executed by a computer system, the computer system having one or more network connections to one or more networks, the method comprising the steps of:

verifying that there is information to be communicated between one or more applications executing on the computer system over one or more of the network connections;

verifying that the information can be communicated as determined by one or more rules in a rule set associated with the connection; and

communicating the information if the rules are satisfied.

21. A computer connected through a connection on one or more network interfaces to one or more networks, the computer comprising:

means for verifying that there is information to be communicated between one or more applications executing on the computer system over one or more of the network connections;

means for verifying that the information can be communicated as determined by one or more rules in a rule set associated with the connection; and

means for communicating the information if the rules are satisfied.