Packet routing with payload analysis, encapsulation and service module vectoring

• US 20070258449A1
• Filed: 05/05/2006
• Published: 11/08/2007
• Est. Priority Date: 05/05/2006
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Bennett, James
• Granted Patent: US 7,948,977 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An Internet infrastructure with network devices and end point devices containing service module manager and service modules, that supports packet analysis, encapsulation and vectoring, and interleaving applications. The network device that supports packet content analysis on arriving packet, consists of a plurality of packet switched interface circuitries, user interface circuitry, local storage comprising the service module manager software and a plurality of local service modules, and processing circuitry communicatively coupled to each of the packet switched interfaces, local storage and user interface circuit. The processing circuitry executes service module manager and thus analyzes the packet content and applies one or more selected local service module processing using the packet. The processing circuitry thus takes one or more actions on the packet. A packet switching exchange that supports packet content analysis, encapsulation and vectoring on arriving packet, consisting a plurality of interconnecting switches, a plurality of line cards, general primary processing card. A client device that supports packet content analysis on arriving packet containing a plurality of network interfaces, user interface circuitry, local storage and processing circuitry communicatively coupled to each of the network interfaces, local storage and user interface circuitry.

Claims

1. A packet switching exchange that receives a plurality of packets, each of the plurality of packets having payload content, the packet switching exchange comprising:

a plurality of switches;

a first line card, communicatively coupled to the plurality of switches, comprising a first network interface and first line card processing circuitry;

a second line card, communicatively coupled to the plurality of switches, comprising a second network interface and second line card processing circuitry;

primary processing circuitry communicatively coupled to the plurality of switches;

the first line card compares the payload content of each of the plurality of packets to a plurality of predefined trigger templates, and, in response to the comparison of a first packet of the plurality of packets with a first trigger template of the plurality of predefined trigger templates, the first line card delivers the first packet and supplemental information to the primary processing circuitry; and

the primary processing circuitry responds to the delivery by comparing a predefined supplemental template to the first packet and, based on the comparison, delivers the first packet to a first of a plurality of service modules for processing.

2. The packet switching exchange of claim 1, wherein the packet switching exchange is a router.

3. The packet switching exchange of claim 1, wherein the packet switching exchange is an access point.

4. The packet switching exchange of claim 1, wherein the supplemental information relates to the first trigger template.

5. The packet switching exchange of claim 1, wherein the first of the plurality of service modules comprising a local service module.

6. The packet switching exchange of claim 1, wherein the first of the plurality of service modules comprising a remote service module.

7. The packet switching exchange of claim 1, wherein the plurality of predefined trigger templates comprising a payload trigger template.

8. The packet switching exchange of claim 1, wherein the supplemental information comprising a request for the predefined supplemental template comparison.

9. The packet switching exchange of claim 1, wherein the supplemental information comprising an identifier associated with the first of the plurality of service modules.

10. A network node in a packet switched network that participates in a communication pathway between a first end-point device and a second end-point device, the communication pathway supporting deliver of a packet, the network node comprising:

first communication interface circuitry communicatively coupled to the first end-point device via a first portion of the communication pathway;

second communication interface circuitry communicatively coupled to the second end-point device via a second portion of the communication pathway;

processing circuitry communicatively coupled to both the first communication interface and the second communication interface;

storage, communicatively coupled to the processing circuitry, comprising a plurality of templates;

the processing circuitry compares the packet to the plurality of templates, and, based on the comparison, selectively vectors the packet out of the communication pathway for application of service functionality.

11. The network node of claim 10, wherein the vectoring of the out of the communication pathway comprising applying local service functionality.

12. The network node of claim 10, wherein the vectoring of the out of the communication pathway comprising delivering the packet to a remote server.

13. The network node of claim 10, wherein the network node comprising an access point.

14. The network node of claim 10, wherein the plurality of templates comprising a payload template.

15. The network node of claim 10, wherein the processing circuitry executes trigger logic to determine whether to vector the packet out of the communication pathway.

16. The network node of claim 10, wherein the processing circuitry both vectors the packet out of the communication pathway and delivers a copy of the packet into the communication pathway.

17. The network node of claim 10, wherein the service functionality comprising at least one of a plurality of service modules.

18. The network node of claim 17, wherein the plurality of service modules comprising a local service module.

19. The network node of claim 17, wherein the plurality of service modules comprising a remote service module.

20. A packet switching infrastructure that communicates a plurality of packets, each of the plurality of packets having payload content, the packet switching infrastructure comprising:

a packet switched pathway that communicates the plurality of packets;

a plurality of service functions;

a plurality of predefined templates;

processing circuitry that both delivers the plurality of packets along at least a portion of the packet switched pathway and compares the predefined templates with each of the plurality of packets in the packet switched pathway; and

the processing circuitry, based at least in part on the comparison, selects one of the plurality of service functions.

21. The packet switching infrastructure of claim 20, wherein the processing circuitry comprising switching node circuitry.

22. The packet switching infrastructure of claim 20, wherein the processing circuitry comprising end point device circuitry.

23. The packet switching infrastructure of claim 20, wherein the processing circuitry comprising access point circuitry.

24. The packet switching infrastructure of claim 20, wherein plurality of service functions comprising a service function at a different premises than that of the processing circuitry.

25. The packet switching infrastructure of claim 20, wherein plurality of service functions comprising a service function performed by the processing circuitry.

26. The packet switching infrastructure of claim 20, wherein plurality of service functions comprising a service function performed by remote processing circuitry.

27. The packet switching infrastructure of claim 20, wherein the plurality of predefined templates comprising at least one payload template.

28. The packet switching infrastructure of claim 20, wherein the plurality of predefined templates comprising at least one header template.

29. A method performed by a network node in a packet switched communication pathway, the packet switched communication pathway for routing a plurality of packets, the method comprising:

comparing each of the plurality of packets against a plurality of predefined templates;

at least temporarily interrupting the routing of a first of the plurality of packets in response to the comparison; and

delivery at least the first of the plurality of packets to a selected one of a plurality of remote service functions.