Content service aggregation system

• US 20080114887A1
• Filed: 11/07/2007
• Published: 05/15/2008
• Est. Priority Date: 07/06/2001
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Zhou, Yuhong, Nguyen, Chau, Spurrier, Gregory, Ganesan, Elango, Lee, Yen, Panwar, Ramesh, Freed, Michael, Phillips, John, Bryers, Mark, Ramirez, Ricardo, Hathaway, Robert, Hass, David, Rashid, Abbas, Gruner, Frederick, Ramanoorthi, Sankar, Zaidi, Nazar, Vilas, Mark
• Granted Patent: US 7,765,328 B2
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A network content service apparatus includes a set of compute elements adapted to perform a set of network services; and a switching fabric coupling compute elements in said set of compute elements. The set of network services includes firewall protection, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations, Web caching, Web switching, and virtual private networking. Code operable on the compute elements enables the network services, and the compute elements are provided on blades which further include at least one input/output port.

Claims

1. A network device comprising:

a set of compute elements internal to the network device and adapted to perform a set of network services on packet data, the set of compute elements arranged in a processing pipeline to provide the set of network services;

a forwarding table stored within the network device that defines a plurality of different routes through the compute elements of the network device, the routes defining different sets of one or more of the network services and specifying an order for applying the network services;

a hardware switching fabric internal to the network device and coupling the compute elements to communicate the packet data between the compute elements; and

a flow control element to receive a data packet, to identify the data packet as being associated with a subscriber of a data center, and to identify a subset of the network services that are associated with the identified subscriber,

wherein, in response to receiving the data packet, the flow control element selects one of the routes based on the subset of network services identified as associated with the subscriber and attaches a route tag to the packet to identify the selected route,

wherein the route tag causes the data packet to be forwarded within the network device to a first one of the compute elements in the processing pipeline and causes output from one of the compute elements in the processing pipeline to be forwarded to a next compute element in the processing pipeline along the selected route through the compute elements for performing the subset of the services associated with the identified subscriber.

2. The network device of claim 1 wherein said set of network services further includes Web switching.

3. The network device of claim 1 wherein said set of network services further includes Web caching.

4. The network device of claim 1, further comprising at least one removable blade,

wherein one or more of the plurality of compute elements and switching fabric are arranged on the blade, and

wherein the one or more of the plurality of compute elements are arranged on the blade in the processing pipeline to provide the network services to the packet traffic.

5. The network device of claim 4 wherein said device includes at least two blades.

6. The network device of claim 1 further including at least one secure input/output port and at least one public input/output port.

7. The network device of claim 1 wherein each of said compute elements is optimized to perform one of said set of services.

8. The network device of claim 1 wherein each of said compute elements performs all said services in said set.

9. The network device of claim 1 wherein a first set of said plurality of compute elements comprise control elements and a second set of said plurality of compute element comprise service computation elements.

10. The network device of claim 1,

wherein said control code includes an operating system, and

wherein said control code includes an IP stack.

11. The network device of claim 1 wherein said control code includes a service provisioning architecture.

12. The network device of claim 1 wherein said control code includes content services applications.

13. The network device of claim 1, wherein the network services include at least a stateful firewall service, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations or virtual private networking.

14. A network services device, comprising:

a plurality of compute elements optimized to provide network content services on data packets coupled to the device; and

a switching fabric coupling said plurality of compute elements; and

an input/output element coupled to said switching fabric and said network,

wherein the compute elements are arranged in a processing pipeline to provide said set of network services; and

flow control means for receiving a data packet, identifying the data packet as being associated with a subscriber of a data center, identifying a set of one or more of the network services that are associated with the identified subscriber, and attaching a route tag to the data packet,

wherein the flow control element stores a forwarding table that defines a plurality of different routes through the compute elements of the network device, the routes defining different sets of one or more of the network services and specifying an order for applying the network services,

wherein, in response to receiving the data packet, the flow control element selects one of the routes based on the subset of network services identified as associated with the subscriber, and attaches the route tag to the packet to identify the selected route,

wherein the switch fabric forwards the data packet along the selected route through the processing pipeline of the compute elements to perform the one or more network services associated with the identified subscriber.

15. The network services device of claim 14 wherein said plurality of compute elements further includes:

means for performing a stateful firewall service;

means for performing Network Address Translation;

means for performing Internet Protocol forwarding;

means for performing bandwidth management;

means for performing Secure Sockets Layer operations,

means for performing virtual private networking; and

means for performing Web caching.

16. The network services device of claim 14 wherein said plurality of compute elements further includes means for performing Web switching.

17. The network services device of claim 14 wherein said plurality of compute elements is provided on a plurality of blades, each blade including a subset of said plurality of compute elements.

18. The network services device of claim 17 wherein said switching fabric includes a cross-bar switch.

19. The network services device of claim 18 wherein each said blade includes at least one cross-bar switch and at least one of said plurality of compute elements.

20. The network services device of claim 19 wherein a first of said plurality of blades includes at least a first of said compute elements comprising a control compute element and at least a second of said blades includes at least a second of said compute elements comprising a content service provision element.

21. The network services device of claim 14 further comprising code, operable on one of said compute elements, for routing packets within the network services device to said compute elements and microcode in said compute elements to perform said services.

22. The network services device of claim 21 wherein said device further includes a control compute element maintaining flow conversations amongst said plurality of compute elements.

23. A network content services device, coupled to a network and at least one secure content domain, comprising:

a plurality of compute elements;

a first input/output port coupled to said network;

a second input/output port coupled to the secure content domain;

a switching fabric coupling the input/output ports and compute elements;

code operable on the plurality of compute elements to provide network services to streams of packets received from subscribers, wherein the compute elements are arranged in a processing pipeline to operate said code; and

a flow control element to receive a data packet, to identify the data packet as being associated with a subscriber of a data center, to identify a set of one or more of the network services that are associated with the identified subscriber,

wherein the flow control element stores a forwarding table that defines a plurality of different routes through the compute elements of the network device, the routes defining different sets of one or more of the network services and specifying an order for applying the network services,

wherein, in response to receiving the data packet, the flow control element selects one of the routes based on the subset of network services identified as associated with the subscriber, and attaches a route tag to the packet to identify the selected route, and

wherein the switch fabric forwards the data packet along the selected route through the processing pipeline of the compute elements to perform the one or more network services associated with the identified subscriber.