Interactive control of network devices

• US 20040001433A1
• Filed: 07/18/2001
• Published: 01/01/2004
• Est. Priority Date: 07/18/2001
• Status: Abandoned Application

• Current Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Ervin, Marcus Wayne III, Mellencamp, Rob, Gram, Charles Andrew
• Application Number:
  US09/908,503
• Publication Number:
  US 20040001433A1
• Time in Patent Office: Days
• US Class Current: 370/229
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Methods and apparatus are disclosed for establishing interfaces or “tunnels” between networking devices, so one device can control the other and vice versa. Such devices may be general purpose processors (GPP) and ethernet web switches. A first device receives data packets as they flow across a network. A second device can access packets only if they flow through the first device. The second device can only send packets to the network if they flow through the first device. In a preferred embodiment, the first device is optimized for high-speed data transfer and the second device for data inspection and flow decision making. Each tunnel carries related types of packets in one direction between “partnered” devices. Data tunnels pass network data packets. Control tunnels carry messages to control the operation of a first device by a second. Messages stop, start or otherwise direct the flow of data through the first device. A Broadcast tunnel enables several network devices to interact. The second device contains logic that receives the data packets, processes them and sends them back to the first device. The second device can processing includes data inspection. and decision making based on the packet contents. A preferred embodiment blocks viruses including blocking intentional “Denial Of Service” schemes.

Claims

1. An apparatus comprising:

a first networking means (52) for receiving a flow of data (60) from a network (20, 22), processing said data and delivering processed said data (60) to said network (20, 22);

a second networking means (54) for inspecting received said data (60) and for making decisions in respect of received said data (60);

said first networking means (52) being coupled to said second networking means (54) by a plurality of tunnels (56, 58, 70);

a flow of data (60) received by said first networking means (52) being passed to said second networking means (54) through a first one of said plurality of tunnels (56, 58, 70) and redirected to said first networking means by a second one of said plurality of tunnels (56, 58, 70);

said second networking means (54) exercising operational control of said first networking means (52) by sending messages to said first networking means (52) through a third one of said plurality of tunnels (56, 58, 70) and receiving replies from said first networking means (52) through a fourth one of said plurality of tunnels (56, 58, 70); and

said messages including instructions to start, stop and “

boot”

said first networking means and to start, stop and otherwise direct said flow of data (60) through said first networking means.

2. An apparatus as claimed in claim 1, in which an interface is provided between said first networking means (52) and said second networking means (54).

3. An apparatus as claimed in claim 1, in which said first networking means (52) includes a general purpose processor (GPP) (16).

4. An apparatus as claimed in claim 1, in which said second networking means (54) includes an Ethernet™

web switch (14).

5. An apparatus as claimed in claim 1, in which said first networking means (52) can control said second networking means (54).

6. An apparatus as claimed in claim 1, in which said first networking means (52) is optimized for high-speed data transfer.

7. An apparatus as claimed in claim 1, in which said second networking means (54) is attached to said first networking means (52), and can access packets only if they flow through said first networking means (52).

8. An apparatus as claimed in claim 1, in which said second networking means (54) can only send packets to said network (20, 22) if they flow through said first networking means (52).

9. An apparatus as claimed in claim 1, in which second networking means (54) is optimized for data inspection, and for associated data flow decision making.

10. An apparatus as claimed in claim 1, in which network processing occurs in a network switch (14).

11. An apparatus as claimed in claim 1, in which application processing occurs in a general purpose processor (16).

12. An apparatus as claimed in claim 1, in which one of said tunnels (56, 58, 70) is a Control tunnel that is used to control the operation of a first device by a second device.

13. An apparatus as claimed in claim 1, in which one of said tunnels (56, 58, 70) is a Broadcast tunnel which is connected to all network devices.

14. An apparatus as claimed in claim 1, in which one of said tunnels (56, 58, 70) is a Data tunnel which is used to pass network data a packets between network devices.

15. An apparatus as claimed in claim 1, which is used as a virus checker.

16. An apparatus as claimed in claim 1, which is used to block the illegal transfer of copyrighted files.

17. An apparatus as claimed in claim 1, which is used to block illegal file-sharing.

18. An apparatus as claimed in claim 1, which is used to block intentional denial-Of-service schemes.

19. An apparatus as claimed in claim 1, which utilizes data flow acceleration.

20. An apparatus as claimed in claim 1, in which decisions made by said first networking means (52) affect the operation of said second networking means (54).

21. An apparatus as claimed in claim 1, in which decisions made by said second networking means (54) affect the operation of said first networking means (52).